EBA/GL/2026/06 26 June 2026 Final Report Guidelines (revised) on common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing under Directive 2013/36/EU

2 Table of Contents Executive Summary .......................................................................................................................... 5 Background and rationale ................................................................................................................ 7 Title 1. Subject matter, scope and definitions, and implementation............................................... 24 Title 2. SREP framework ................................................................................................................... 30 2.1. Overview of the SREP framework................................................................................... 30 2.2. Scoring in the SREP ......................................................................................................... 34 2.3. Organisational arrangements......................................................................................... 36 2.4. Proportionality and supervisory engagement................................................................ 37 Title 3. Monitoring of key indicators................................................................................................ 40 Title 4. Business model analysis (BMA)............................................................................................ 42 4.1. General considerations................................................................................................... 42 4.2. Identifying the areas of focus for the BMA..................................................................... 43 4.3. Assessment of BMA robustness and identification of vulnerabilities............................ 44 4.4. Business model viability and sustainability .................................................................... 46 4.5. Summary of findings, scoring and supervisory measures .............................................. 47 Title 5. Assessing internal governance and institution-wide controls............................................. 50 5.1. General considerations................................................................................................... 50 5.2. Organisational structure, management body and its committees................................. 51 5.3. Risk culture and business conduct.................................................................................. 52 5.4. Remuneration policies and practices.............................................................................. 53 5.5. Internal control functions............................................................................................... 54 5.6. Risk management framework......................................................................................... 55 5.7. ICT systems, risk data aggregation and risk reporting.................................................... 58 5.8. ML/TF risks and prudential concerns.............................................................................. 58 5.9. Recovery planning governance....................................................................................... 59 5.10. Summary of findings, scoring and supervisory measures .............................................. 59 Title 6. Assessing risks to capital ...................................................................................................... 65 6.1. General considerations................................................................................................... 65 6.2. Assessment of credit and counterparty risk ................................................................... 67 6.3. Assessment of market risk.............................................................................................. 78 6.4. Assessment of operational risk....................................................................................... 86 6.5. Assessment of interest rate risk and credit spread risk arising from non-trading book activities ..................................................................................................................................... 102

3 Title 7. SREP capital assessment .................................................................................................... 112 7.1. General considerations................................................................................................. 112 7.2. Determining Pillar 2 requirement for risks other than the risk of excessive leverage (P2R)….. ...................................................................................................................................... 113 7.3. Pillar 2 requirements for the risk of excessive leverage (P2R-LR) ................................ 118 7.4. Reconciliation with the capital buffers and any macroprudential requirements......... 120 7.5. Determining the TSCR, TSLRR, OCR and OLRR.............................................................. 120 7.6. Meeting requirements in stressed conditions – Use of P2G and P2G-LR to address the quantitative outcomes of stress testing..................................................................................... 122 7.7. Summary of findings, scoring and supervisory measures ............................................ 125 Title 8. Assessing risks to liquidity and funding and SREP liquidity and funding assessment........ 129 8.1. General considerations................................................................................................. 129 8.2. Assessment of inherent liquidity risk............................................................................ 131 8.3. Assessment of inherent funding risk ............................................................................ 134 8.4. Assessment of liquidity and funding risk management and control framework ......... 135 8.5. Summary of findings, scoring and supervisory measures ............................................ 143 8.6. Benchmarking and setting of quantitative liquidity and funding requirements .......... 149 Title 9. Overall SREP assessment and communication................................................................... 154 9.1. General considerations................................................................................................. 154 9.2. Overall SREP assessment .............................................................................................. 154 9.3. Communication of the outcome of the SREP assessment............................................ 156 9.4. Supervisory reaction to a situation where TSCR or OCR is not met ............................. 158 9.5. Supervisory reaction to a situation where P2G is not met........................................... 158 9.6. Interaction between supervisory, early intervention measures and resolution authorities assessment .............................................................................................................. 159 9.7. Interaction between supervisory and macroprudential measures.............................. 159 9.8. Interaction between supervisory and AML/CFT measures .......................................... 160 Title 10. Application of the SREP to cross-border groups.............................................................. 161 10.1. Application of the SREP to cross-border groups........................................................... 161 10.2. SREP capital assessment and institution-specific prudential requirements................. 163 10.3. SREP liquidity assessment and institution-specific prudential requirements.............. 164 10.4. Application of other supervisory measures.................................................................. 165 Title 11. Supervisory stress testing................................................................................................. 166 11.1. Use of supervisory stress testing by competent authorities........................................ 166 11.2. Key elements of supervisory stress testing .................................................................. 167 11.3. Organisational and governance arrangements within competent authorities............ 168 Title 12. Assessing third-country branches.................................................................................... 170

4 12.1. Application of SREP to third-country branches ............................................................ 171 12.2. Summary of findings, scoring and supervisory measures ............................................ 175 Annex I – Credit risk sub-categories........................................................................................... 178 Annex II – Market risk sub-categories........................................................................................ 182 Annex III – Operational risk sub-categories ............................................................................... 188 Annex IV – IRRBB sub-categories............................................................................................... 190 Annex V – Transfer pricing risk measurement........................................................................... 191 Accompanying documents........................................................................................................... 192 5.1. Draft cost-benefit analysis/impact assessment............................................................ 192 5.2. Views of the Banking Stakeholder Group (BSG) ........................................................... 203 5.3. Feedback on the public consultation and on the opinion of the BSG .......................... 204

5 Executive Summary The EBA, pursuant to Article 107(3) of Directive 2013/36/EU (CRD), has been mandated to develop guidelines promoting common procedures and methodologies for the supervisory review and evaluation process (SREP). The SREP is the core supervisory process that consolidates findings from all supervisory activities into a comprehensive assessment of an institution. The guidelines, addressed to competent authorities, also aim to harmonise supervisory stress testing across the EU in accordance with Article 100 of Directive 2013/36/EU. Since the issuance of the previous SREP Guidelines, the regulatory framework has evolved considerably. The ‘banking package’ (Directive (EU) 2024/1619 and Regulation (EU) 2024/1623), together with other legislation such as the Digital Operational Resilience Act – DORA (Regulation (EU) 2022/2554) and the IRRBB/CSRBB package, have substantially upgraded the regulatory and supervisory landscape. At the same time, nearly ten years of the SREP implementations, dedicated peer reviews and lessons from past financial market turmoil have highlighted areas where the SREP framework can be further streamlined and improved. Against this backdrop, the update of the SREP Guidelines became necessary to integrate regulatory changes, reflect nearly a decade of supervisory experience, and ensure simplification while preserving their core objectives and structure. Therefore, the revised guidelines consolidate all relevant SREP provisions into a single, comprehensive framework, retaining the core elements while integrating new aspects such as ESG factors, operational resilience, third-country branches and clarifications on the interaction between the revised Pillar 1 and Pillar 2 capital requirements, including the output floor. They also repeal the separate ICT SREP Guidelines (EBA/GL/2017/05) as the ICT risk assessment has been integrated into the revised guidelines to ensure consistency and foster simplification. In addition, this revision enhances the proportionality, sequencing, and effectiveness of the supervisory process, taking into account institutions’ track record in addressing deficiencies. Overall, the revised guidelines aim to strengthen supervisory convergence across the EU, improve clarity, and ensure the SREP remains fit for purpose in light of both regulatory developments and supervisory experience. These guidelines also fulfil the mandates under Article 48n(6) of Directive (EU) 2024/1619 to issue guidelines on the SREP for third-country branches, and under Article 104a(7) of the same Directive to issue guidelines to operationalise the requirements where an institution becomes bound by the output floor.

6 Next steps The revised guidelines will be translated into the official EU languages and published on the EBA website. The deadline for competent authorities to report whether they comply with the guidelines will be two months after the publication of the translations. Upon application of the revised guidelines, the existing SREP Guidelines (EBA/GL/2022/03) and the Guidelines on ICT risk assessment under the SREP (EBA/GL/2017/05) will be repealed and replaced. The revised Guidelines will apply from 1 January 2027.

7 Background and rationale

1. The EBA is mandated to foster sound and effective supervision and to drive supervisory convergence across the EU arising from the requirements under the CRD and more generally from its obligations under its founding regulation. The SREP is the core supervisory process through which competent authorities form a comprehensive view on the risk profile of the institutions, as well as on their overall viability and sustainability, and it may impose adequate supervisory measures to ensure material risks are properly addressed.
2. Article 107 of the CRD mandates the EBA to draft guidelines for competent authorities, specifying the common procedures and methodologies for the SREP and for the assessment of the organisation and treatment of risks referred to in Articles 76 to 87a of the CRD, in a manner that is appropriate to the size, structure and internal organisation of institutions, and to the nature, scope, and complexity of their activities. Additionally, Article 100(2) of the CRD empowers the EBA to issue guidelines to ensure that common methodologies are used by competent authorities when conducting annual supervisory stress tests for SREP purposes.
3. Based on those mandates, the EBA’s primary objective for these guidelines is establishing consistent, efficient and effective supervisory practices and application of European Union law throughout the EU so that institutions with similar risk profiles, business models and geographic exposures are subject to broadly equivalent supervisory expectations, actions and measures, where applicable, including institution-specific prudential requirements. To achieve this objective, in addition to specifying the SREP procedures and methodologies, these guidelines also provide guidance for setting subsequent supervisory measures that competent authorities should consider.
4. The first version of the guidelines was published in 2014 (entering into force on 1 January 2016). A subsequent upgrade was published in 2018 as part of the EBA Pillar 2 Roadmap to incorporate P2G and supervisory stress test elements (and has been applied since 1 January 2019). The last update was carried out in 2021 to account for the changes brought by Directive (EU) 2019/2034 (CRD V), provisions with regards to, inter alia, the introduction of the assessment of the risk of excessive leverage (P2R-LR and P2G-LR), the revision of the methodology for the P2G determination and the cooperation with AML/CFT supervisors (and has been applicable from 1 January 2023).
5. This third review aims to align the guidelines with regulatory developments that have taken place since their latest revision. In particular, these revised guidelines take into account changes stemming from Directive (EU) 2024/1619 (CRD VI) amending Directive 2013/36/EU, Regulation (EU) 2024/1623 (CRR III) amending Regulation (EU) No 575/2013 and Regulation (EU) 2022/2554 (DORA), as well as the issuance by the EBA of other relevant guidelines and technical standards. At the same time, this review takes stock of nearly ten years of the SREP implementation, dedicated peer reviews and lessons from past financial market turmoil which have highlighted

8 areas where the SREP framework can be further streamlined and improved. It is clarified that these guidelines are addressed to the competent authorities of credit institutions and of investment firms1 , in relation to the investment firms referred to in Article 1(2) and (5) of Regulation (EU) 2019/2033, which are supervised for compliance with prudential requirements under Directive 2013/36/EU and Regulation (EU) No 575/2013. 6. In particular, a key objective of this review is to enhance the readability and use of the guidelines, while at the same time supporting a risk-focused supervisory approach. This approach is considered more suitable for the current, more mature stage of the SREP, which requires more targeted and focused guidance compared to the one originally developed in 2014. The simplification effort was carried out mainly through the following steps: a. Streamlining the text with focus on core assessment. The emphasis remains on the key areas to be assessed, while references to outdated provisions or assessments already set out in other legal acts have been removed (these are now listed in a separate document aiming to enhance transparency, support proportionality, and ensure that SREP assessments remain anchored in existing requirements rather than creating new obligations). b. Establishing a single, comprehensive set of SREP Guidelines. The previous SREP Guidelines were complemented by a separate set ICT risk assessment (ICT SREP Guidelines – EBA/GL/2017/05). In addition, the CRD VI requires the EBA to issue SREP Guidelines for third￾country branches, as well as guidelines specifying how to operationalise cases in which an institution becomes bound by the output floor. All of these elements are now integrated into this revised set: the ICT SREP Guidelines will be repealed and the ICT risk assessment provisions are integrated in Title 6 under the operational risk assessment; new guidance for third-country branches has been added as a Title 12; and the considerations on the output floor – drawing on the relevant EBA Opinion2 – have been integrated into Title 7. c. Incorporating new aspects into existing SREP elements. As further explained in the subsequent paragraphs, new cross-cutting dimensions – such operational resilience and environmental, social and governance (ESG) risk factors – have been integrated across the existing SREP elements, rather than being introduced as a separate element or independent risk categories. 7. The cyclical nature of the SREP assessment requires that the overall framework is applied at the start of a SREP cycle. Since the SREP cycle often corresponds to a calendar year, these guidelines will apply from 1 January 2027, following the consultation period and the publication of the final version. However, competent authorities are encouraged to take revised guidance into account, and where possible, to introduce its elements at an earlier stage. The general SREP framework is built around the following major components (as presented in figure 1): 1 Competent authorities supervising class 2 and class 3 investment firms that are subject to the requirements under IFD/IFR are covered by the SREP Guidelines for investment firms (EBA/GL/2022/09) and by the Commission Delegated Regulation (EU) 2023/1668 on additional own funds requirements for investment firms. 2 Opinion of the European Banking Authority on interaction between Pillar 2 requirements and the output floor (EBA/Op/2025/01).

9 Figure 1: Overview of the SREP framework 8. As illustrated in figure 1, the well-established SREP framework – in place since 2016 – has not been materially altered by this review. Experience has shown that its core elements are well embedded in the ongoing supervisory practices and provide a solid basis for supervisory dialogue. The SREP is based on information gathered through the full range of supervisory activities (e.g. on-site inspections and off-site supervisory activities). When performing their assessments, competent authorities should use available information sources as outlined in paragraph 124. In this spirit, the introduction of few new elements (through this revision) keeps the overall framework valid and up to date. Subsection ‘3.1 The general SREP framework’ provides an overview of the different elements of the framework as well as a summary of the new aspects introduced through this review. The dedicated subsection ‘3.2 Cross-cutting and more general elements’ addresses in greater detail the cross-cutting and overarching elements – such as the scoring framework, supervisory effectiveness, operational resilience, ESG risks, SREP for third-country branches, and the link with other relevant processes – and explains their underlying rationale. 3.1 The general SREP framework Categorisation of institutions and application of the principle of proportionality 9. The application of the principle of proportionality in the SREP is anchored in the categorisation of institutions, which defines the minimum level of supervisory engagement, modulating the frequency of assessments and shaping the supervisory dialogue both for individual SREP elements and for the overall SREP outcome. As proportionality lies at the core of supervisory engagement, the revised guidelines – drawing on supervisory experience in SREP

10 implementation and on the peer review on proportionality under the SREP3 – aim to foster risk￾focused supervision and a more efficient use of supervisory resources. 10.To this aim, enhanced flexibility in identifying the appropriate supervisory engagement coexists with the retention of the existing four categories of institutions defined by size, systemic importance, scale, nature, and complexity of activities. Categories 1 and 4 continue to follow the CRR definitions of ‘large institutions’ and ‘small and non-complex institutions’. Retaining the categories is essential to ensure a common understanding of materiality, consistent treatment across the EU, and effective supervisory dialogue, particularly in cross-border cases. These categories also serve as a benchmark for assessing supervisory convergence ex-post. 11.Competent authorities will continue to categorise all institutions under their remit for SREP purposes, while applying the following principles: a. Categorisation may be applied at group or individual entity level as appropriate (e.g. assigning different categories to subsidiaries and/or to the consolidated entity, where justified). b. The supervisory approach should be tailored to the risk profile of each institution and to emerging risks. This is consistent with a multi-year SREP approach where in-depth assessments of selected risks or risk factors are planned over a longer (multi-year) period. c. Despite of the assigned category, lighter reviews of SREP elements or risk areas that are deemed immaterial or not relevant in the context of the current risk profile of the institution may be undertaken where risks have been assessed as unchanged vis-a-visthe previous SREP cycles. d. Institutions may be reassigned to a lower or higher category to better reflect their risk profile and business model or supervisory needs. This refinement fosters risk-focused supervision and a more efficient use of supervisory resources. 12.As an additional element of proportionality, large institutions (under the CRR) that are not G￾SIIs may be allocated to Categories 1, 2 or 3 depending on their business model and risk profile. The revised guidelines provide for an extension of the minimum frequency for the assessment of all SREP elements from three to five years for a subset of Category 4 institutions, provided they maintain a stable low-risk profile, sound financial metrics and healthy margins, and quarterly monitoring does not raise material concerns. Competent authorities retain discretion to increase the frequency of engagement whenever warranted. Monitoring of key indicators 13.Regular monitoring of key quantitative and qualitative indicators supports the SREP by flagging changes in the institution’s financial conditions and risk profile. Such monitoring should prompt updates to the assessment of the SREP elements as new material information arises. This revision has not introduced major changes to this Title apart from integrating DORA-related 3 EBA/REP/2025/02

11 indicators in the competent authorities’ monitoring systems and ensuring appropriate review and update of monitoring indicators and tools by the competent authorities. Business model analysis (BMA) 14.Without undermining the responsibility of the institution’s management body for organising and running its business, the supervisory business model analysis should assess both the viability of the current business model and the sustainability of the strategic plans. This analysis should also help identify key vulnerabilities that may not be captured by other elements of the SREP, including those arising from ML/TF, ICT and ESG risks. 15.One of the main changes introduced by this review is that this Title now explicitly focuses on the most material areas of assessment for an institution’s business model. It also explicitly enables the use of prior supervisory assessments as a baseline where no material changes have occurred since the previous SREP cycle, provided materiality is duly assessed. The BMA now also includes reference to climate-related and other environmental risks, as well as the institution’s capacity to ensure medium- to long-term resilience to ESG risks, operational resilience, and the ability to withstand geopolitical risks. Although addressed only at high level in the guidelines, these elements are nonetheless expected to form part of an institution’s overall BMA, serving to complement the more traditional drivers and to enrich the supervisory assessment in this area. Additionally, these elements are expected to also inform the assessment of other SREP elements, such as risks to capital and risks to liquidity and funding, always with a view to ensuring complementarity and avoiding duplication. Assessment of internal governance and institution-wide controls 16.As part of the overall governance assessment, competent authorities should determine whether the internal governance framework of an institution is adequate given its risk profile, size, nature and complexity, and whether the institution sufficiently adheres to the requirements and standards of good internal governance and risk controls arrangements, including aspects such as diversity, non-discrimination and sound code of conduct. 17.As part of the risk management framework, competent authorities should review the institution’s internal capital adequacy assessment process (ICAAP) and internal liquidity adequacy assessment process (ILAAP). The assessment should focus on the soundness, effectiveness and comprehensiveness of these processes, and on the reliability of the institution’s internal estimates to support the supervisory determination of capital and liquidity adequacy. Furthermore, competent authorities should also assess the adequacy of institutions’ stress testing programmes, including scenarios and assumptions, and their outcomes. 18.The main changes introduced in this Title relate to the integration of the DORA framework and the third-party risk management framework within the institutions’ overall risk management framework, for which supervisors should evaluate compliance with DORA for the ICT services received from ICT third-party providers and with the EBA Guidelines issued pursuant to Article 74(3) of Directive 2013/36/EU for the non-ICT services received from third-party providers.

12 These changes also relate to the importance of institutions’ risk data aggregation and risk reporting capabilities through ICT systems, also reflecting BCBS principles4 where applicable. Business continuity management aspects have been grouped under Title 6.4 to better reflect the latest BCBS principles and the DORA framework. Moreover, related CRD VI changes have been reflected regarding the institutions’ statements of responsibilities and mapping of duties as well as the management body’s knowledge and skills on ESG and ICT risks. Lastly, the institution’s ability to effectively and timely remedy the deficiencies identified and/or supervisory concerns is evaluated by competent authorities, as part of the overall assessment of internal governance and institution-wide controls, in an effort to promote supervisory effectiveness. Assessment of risks to capital 19.The SREP Guidelines provide guidance for the assessment of the most common risks to capital, encompassing credit and counterparty risk, market risk, operational risk and interest rate and credit spread risk from non-trading activities (IRRBB and CSRBB), further split into risk sub￾categories. Competent authorities should focus their assessment on the material risks the institution is or might be exposed to, including any additional institution-specific risks that are not described in detail in the guidelines. The assessment should be performed in terms of the risk exposure, as well as the quality of management and controls employed to mitigate the impact of the risk. 20.The market risk section now includes an approach to ensure the capital adequacy of subsidiaries of third-country groups subject to transfer pricing arrangements envisaging the redistribution of market risk losses from other third-country group entities. Competent authorities should assess the materiality of the impact of these arrangements and set additional own fund requirements under Pillar 2 to address this risk. To support competent authorities in this assessment, the approach includes a quantitative formula to measure the risk. 21.The methodologies and internal processes for identification, measurement, monitoring and control of IRRBB are subject to the SREP as part of the risks to capital. In addition to covering IRRBB, the scope of Title 6.5 has been extended to also provide guidance for the assessment of CSRBB. The addition was made in view of the increased relevance of this risk type, in line with the EU legislative framework and the BCBS Standards. The additional provisions on CSRBB are proportionate and adapted to reflect the less mature stage of this risk compared to IRRBB while still providing meaningful guidance to competent authorities. Competent authorities should reflect the outcome of the CSRBB assessment in a combined IRRBB/CSRBB score. 22.This review provides a non-exhaustive breakdown of risks to capital into sub-categories, included in the Annex, to support a risk-based and proportionate supervisory approach. This intends to further promote consistent risk identification across jurisdictions, while remaining non-exhaustive and flexible, hence not limiting the scope of supervisory assessment. Moreover, 4 Basel Committee on Banking Supervision – Principles for effective risk data aggregation and risk reporting (January 2013)

13 the assessment of ESG elements has been integrated into the existing risks to capital and similarly, operational resilience has been incorporated into the internal governance and operational risk sections. SREP capital assessment 23.Since an institution may face risks that are not covered or not fully covered by the own funds requirements in accordance with the CRR or the capital buffers specified in the CRD, the SREP Guidelines include guidance on the determination of the quantity and composition of additional own funds requirements (P2R) determined to cover such risks, emphasising their institution￾specific nature. As a separate stack of own funds requirements, the SREP Guidelines also include guidance on the assessment of the risk of excessive leverage and on the determination of the quantity and composition of additional own funds required to cover that risk (P2R-LR). 24.Where the outcomes of the relevant stress tests suggest that an institution may not be able to meet the applicable own funds requirements under stress conditions, or is excessively sensitive to the assumed scenarios, competent authorities should take appropriate supervisory measures to ensure the institution is adequately capitalised, including the imposition of guidance on additional own funds, separately, to address the risk of excessive leverage and other risks (P2G￾LR and P2G). 25.To increase convergence and level the playing field between institutions, the SREP Guidelines specify the quality of capital competent authorities should require institutions to hold to meet their guidance on additional own funds, CET1 capital for P2G coverage, and Tier 1 for P2G-LR coverage, respectively. 26.In light of the overhaul of the Level 1 provisions under the banking package on the Pillar 1 framework to implement the revised Basel standards5 , the guidelines have been updated to reflect the interaction between Pillar 1 own funds requirements (P1R) and P2R, as well as the introduction of the output floor6 . 27.In general, as an operationalisation of the CRD requirement under Article 104a(1), the guidelines foresee that – when a relevant change in the regulatory framework for determining P1R has, or is expected to have, material impact on an institution’s capital profile – competent authorities are expected to assess this impact in terms of its interplay with the relevant P2R. The objective of this assessment is to ensure that the complementary nature of P1R and P2R components is preserved (i.e. that P2R addresses only those risks, or elements of risk, that are not covered or not sufficiently covered by P1R). Based on its outcome, this assessment may lead to a redetermination of the level or composition of the P2R, either within the annual SREP cycle or at an adjusted frequency. This assessment is intended to ensure that the P2R remains appropriately calibrated to the institution’s risk profile in the event of changes in TREA dynamics 5 BCBS Basel III: Finalising post-crisis reforms – December 2017. 6 Aimed at limiting the unwarranted variability in the own funds requirements produced by internal models relative to an institution using the standardised approaches.

14 (both upward and downward) arising from relevant changes to the P1R regulatory framework, including potential recurring material impact of the output floor. 28.More specifically when an institution becomes bound by the output floor, the guidelines set out how its interaction with P2R should be operationalised, thereby fulfilling the mandate in Article 104a(7) of the CRDVI. The provisions reflect those set out in the previously referenced EBA/Op/2025/01. Assessment of liquidity and funding risks and SREP liquidity and funding assessment 29.The SREP Guidelines provide guidance for the assessment of the risks to liquidity and funding the institution is or might be exposed to over various time horizons, as well for the related risk management controls. Competent authorities should focus their assessment on risks identified as material for the institution. 30.Competent authorities should determine whether the liquidity resources held by the institution ensure an appropriate coverage of risks to liquidity and funding, where applicable, taking adequate supervisory measures. Among such measures, competent authorities may consider imposing specific liquidity requirements to address concerns related to the institution’s liquidity and funding resources. 31.The guidance on the assessment of risks to liquidity and funding and on the liquidity adequacy assessment were merged into one Title (Title 8) in view of their strong interlinkage. The incorporation also resulted in the merger of the scores combining the liquidity and funding risk assessment scores and liquidity adequacy score into one overall liquidity and funding adequacy score. This provides for a more streamlined approach. In particular, under the proposed approach the assessment of liquidity risk already encompasses the consideration of the amount and quality of liquidity available to mitigate the risk, and there is a combined assessment of the risk management and control framework addressing both liquidity risk and funding risk. The resulting liquidity and funding adequacy score should reflect the supervisory view of the capacity of the institution’s liquidity resources to mitigate/cover the risks to liquidity and funding. Overall SREP assessment and communication 32.Having conducted the assessment of the above SREP elements, competent authorities should form a comprehensive overview of the risk profile and viability of the institution concluding with the overall SREP assessment. As part of the effort to enhance supervisory effectiveness (see next section) the revised guidelines introduce a dedicated section devoted to the communication of the SREP assessment, comprising of all the relevant information that competent authorities are expected to share, in accordance with the SREP engagement model, with institutions as a basis for an enhanced supervisory dialogue. 33.Although conceptually related to the overall SREP assessment, the consideration on any necessary supervisory measures to address concerns emerged by the SREP has been moved from this Title to the specific assessment areas (e.g. BMA, governance and institution-wide

15 controls, risks to capital and risks to liquidity and funding) to directly link them with the relevant assessment areas. This aims to enhance the relevance of supervisory measures and hence supervisory effectiveness. 3.2 Cross-cutting and more general elements Scoring framework 34.To help facilitating communication with the competent authorities and colleges of supervisors, foster comparability and a level playing field across institutions as well as to adequately prioritise supervisory resources and measures in the assessment of SREP elements, competent authorities should score from a range of ‘1’ (low risk) to ‘4’ (high risk), to reflect the supervisory view for each element-specific title of the guidelines. Scores should be assigned based on supervisory judgement, taking into account the considerations outlined in the tables at the end of each relevant section and title of these guidelines. 35.In this regard, the revised guidelines explicitly clarify that, while these considerations serve as a common baseline for assigning scores, they should not be interpreted as a mechanical checklist to be completed for each element, nor should they be seen as establishing a hierarchy of importance among the elements. Instead, they are intended to guide competent authorities in assigning scores by considering the interplay and relevance of the different elements within the specific dimension of the institution being assessed. More granular scores (such as qualifiers) can be also assigned by competent authorities for their internal purposes, provided that these are consistent with the overarching scoring framework set out in these guidelines. Competent authorities are also encouraged to use the full range of available scores to differentiate institutions and avoid undue clustering. Supervisory effectiveness 36.Past supervisory experience and recent financial market turmoil events have further underscored the need for supervisors not only to anticipate and detect, at an early stage, potential deficiencies that could threaten institutions’ financial soundness, but also to intervene promptly and decisively to ensure their timely remediation. As a way of drawing on these experiences and lessons learned, and with a view to strengthening supervisory effectiveness and establish a high-level common framework across the EU, the revised guidelines introduce targeted provisions in the following areas: a. a high-level and flexible escalation framework for supervisory measures; b. a non-exhaustive list of supervisory measures based on the specific SREP elements and sub￾elements, building on the supervisory powers set out in the CRD; c. the ability and willingness of institutions to remedy identified deficiencies or supervisory concerns in an effective and timely manner; d. communication concerning the outcome of the SREP.

16 37.The escalation framework, illustrated in figure 2, is designed to assist competent authorities in selecting the most appropriate supervisory measures in light of identified deficiencies. Within this framework, competent authorities are expected to focus on the root causes of deficiencies, reflect them in the scores assigned under these guidelines, and use such root causes as the basis for subsequent supervisory decisions and measures. While particularly relevant to the SREP, the escalation framework is conceived as an overarching structure applicable to all supervisory activities and capable of extension beyond the SREP. The framework is characterised by the following features: a. high-level: it does not prescribe binding or automatic measures to be applied to specific deficiencies. The type, scope, depth and level of detail of the measures remain at full discretion of the competent authorities, depending on the nature of the findings and on what constitute the most effective means of remediation. b. flexible: supervisory measures are not strictly sequential. Competent authorities may escalate or de-escalate measures, as appropriate, in light of the specific circumstances. Figure 2: High-level and flexible escalation framework for supervisory measures 38.Supervisory effectiveness also depends on the capacity/ability and willingness of institutions to respond adequately to supervisory measures; hence these should form part of the competent authorities’ assessment of internal governance and institution-wide controls. 39.The guidelines also reinforce transparency and communication regarding SREP outcomes. All relevant expectations for competent authorities regarding the communication related to the SREP have been now rationalised and grouped into a single Title. These expectations include, beyond the indication of material risk drivers supporting any additional own funds requirement (P2R and P2R-LR) that should be duly justified to institutions, a description of the overall outcome of the SREP, including a summary of the assessment and the overall SREP score. Furthermore, in line with the principle of risk-based supervision, where appropriate and depending on the specific remedial action required, competent authorities may disclose to institutions the SREP scores for relevant elements or sub-elements.

17 ESG 40.In line with the increased prominence of ESG risks in the financial sector – and, in particular, with the requirement under Article 98(9) of the CRD to include in the SREP an assessment of institutions’ governance and risk management processes for addressing ESG risks, as well as their exposures to such risks – the guidelines specify how competent authorities should take ESG risks into account in the SREP. 41.Since ESG risks materialise through the traditional categories of financial risks and should be managed as part of institutions’ core business strategy, governance arrangements and risk management framework, they are integrated across the existing SREP elements rather than treated as separate or stand-alone category of risk in a separate module. 42.This approach enables competent authorities to assess the prudential impact of ESG risks within the established SREP framework, including in the assessment of the business model, the assessment of internal governance and institution’s wide controls and risks to capital, liquidity and funding. At the same time, the guidelines acknowledge that competent authorities may adopt a gradual approach to the assessment of ESG risks, initially prioritising environmental factors and progressing to other sustainability factors while recognising the greater capacity to quantify climate-related risks compared to other types of environmental risks. Competent authorities should seek to progressively enhance supervisory practices as data availability, methodologies and analytical tools evolve, including with a view to advancing supervisory assessment of all types of environmental risks and gradually broadening the scope to social and governance risks. 43.Acknowledging the specific characteristics of climate-related and other environmental risks, the supervisory treatment of these risks should take into account both the high likelihood that environmental risks will increasingly materialise going forward, through different possible combinations of transition and physical risks, and the uncertainties in the timing, severity and distribution of future risks, particularly when considering long-term horizons. From this perspective, the guidelines now also refer to the integration of environmental risks into supervisory stress testing, in accordance with the Joint ESAs Guidelines on this topic7 , recognising that stress testing and scenario analysis are important tools to understand and assess institutions’ resilience to environmental risks, given their forward-looking nature and high level of uncertainty. Competent authorities may apply supervisory measures to strengthen institution’s management of ESG risks, including adjustments to prudential plans, where this could have a material impact on the institution’s stability or solvency. 7 Joint Guidelines (JC 2025 78) to ensure that consistency, long-term considerations and common standards for assessment methodologies are integrated into the stress testing of environmental, social and governance risks pursuant to Article 100(4) of Directive 2013/36/EU and Article 304c(3) of Directive 2009/138/EC.

18 Operational resilience 44.The concept of operational resilience has become prominent at the EU and international level due to the increase in cyber threats, supply chain disruptions and financial system interdependencies that can expose institutions to systemic risks. Operational resilience is an integral objective of the sound governance arrangements and effective internal control mechanisms required pursuant to Article 74 of Directive 2013/36/EU (CRD). The emphasis ensuring the continuity of critical or important functions, and in parallel maintaining financial stability, is also reflected in the DORA framework, as well as in the latest BCBS principles on operational resilience, the sound management of operational risk and third-party risk management. The ability to ensure such continuity could enable an institution, either directly or indirectly including through the use of third-party services to identify and protect itself from threats and potential failures, to respond and adapt to, as well as recover and learn from disruptive events in order to minimise their impact on the delivery of critical or important function through disruption. It is therefore necessary to introduce the concept of operational resilience within the SREP framework as its key components are already evaluated through the existing EU regulatory framework and embedded in the existing SREP framework. It is further clarified that within the EU regulatory framework, ICT risk is part of operational risk, and DORA strengthens its prudential treatment through digital operational resilience requirements; together, these contribute to the broader objective of operational resilience. 45.To this end, consistently with the treatment of other cross-cutting elements, such as ESG risks, and in line with the overarching objectives of simplification and rationalisation pursued in the revised guidelines, operational resilience is integrated within the SREP framework rather than developed as a stand-alone module. This does not aim to introduce a new framework, nor to introduce duplicative reporting or testing beyond those already established under the applicable EU regulatory framework. Rather, these Guidelines seek to ensure that operational resilience integrates and builds upon areas already covered and assessed in EU banking supervision, including internal governance and controls, operational risk management, ICT risk management, third-party risk management and business continuity management. SREP for third-country branches 46.In view of the significant and increasing presence of third-country branches in the EU, the CRD VI establishes a prudential framework setting out common requirements for third-country branches (TCBs) and facilitating the effective and comprehensive supervision of the activities of third-country groups in the EU. Under the new framework, competent authorities shall evaluate whether the governance arrangements implemented by TCBs and the capital endowment and liquidity held by them ensure a sound management and coverage of their material risks. In addition, the EBA is mandated with the development of Guidelines setting out common procedures and methodologies for this SREP for TCBs. The SREP Guidelines for TCBs are incorporated as a separate title in the SREP Guidelines (Title 12) allowing cross-references to other relevant parts of the Guidelines, while ensuring that the assessment is sufficiently tailored and proportionate to the specific nature of TCBs.

19 47.In particular, the SREP should be conducted with a level of frequency and intensity that is proportionate to the classification of TCBs as class 1 or class 2 under CRDVI Article 48a reflecting the nature, scale and complexity of the activities. Competent authorities should assess the business model, internal governance arrangements and controls, booking arrangements and the capital endowment and liquidity of the TCB (the SREP elements for TCBs). Recognising the status of the branch and its reliance on the third-country parent, competent authorities should also assess whether the TCB has sufficient independence in its governance and risk management to act in the best interests of the branch, safeguarding its safety, soundness and viability. The outcome of the assessment feeds into the overall viability score of the TCB. Unlike the overall SREP score for institutions, the scoring table for TCBs does not provide a score ‘F’ for TCBs considered as ‘failing or likely to fail’ as, while TCBs are in scope of Directive 2014/59/EU (BRRD) with some specific conditions, they cannot be subject to ‘failing or likely to fail’ under BRRD Article 32(4). Link between SREP and other supervisory processes 48.Competent authorities should reflect in the SREP assessment the available information and outcomes from other supervisory activities, including on-site inspections, approvals of internal models, authorisation approvals, outcomes of supervisory stress testing, assessment of recovery and resolution plans, market conduct and consumer protection activities, AML/CFT activities, etc. Likewise, the findings from the SREP assessment should inform other supervisory processes. 49.The revised guidelines further stress the importance for competent authorities to consider the SREP as the process integrating all outcomes of their activities during the supervisory cycle. This aims to streamline the supervisory process, allow the reallocation of resources to the most relevant risk areas and ensure that consistent feedback is given to institutions throughout the different supervisory tasks. In particular, in light of the significant efforts undertaken – and the progress achieved – in recent years in the area of recovery planning, both by institutions and competent authorities, the linkage between recovery planning outcomes and the SREP framework has been made more explicit, with the aim of fostering a stronger risk management continuum between ongoing supervision and crisis preparedness. 50.In the revised guidelines, the outcome of the recovery planning assessment – in addition to its role in the assessment of governance and institution-wide controls – also informs the assessment of capital and liquidity adequacy through the overall recovery capacity (ORC). The ORC provides an indication of an institution’s overall ability to restore its financial position following a material deterioration in its financial condition in severe stressed scenarios. 51.More specifically, the ORC has been included as one of several informative elements to be considered by competent authorities when assigning SREP scores for capital and liquidity adequacy under Title 7 and Title 8. Its inclusion is intended to provide an additional forward￾looking perspective in the supervisory assessment of institutions’ capital and liquidity profiles, particularly regarding their resilience and potential recoverability through the implementation of recovery options under stress conditions. This inclusion is intended to be applied flexibly and

20 does not imply a mechanistic or automatic correlation between the ORC scores and SREP scores for capital or liquidity adequacy. Rather, it forms part of a broader set of factors that can inform the capital and liquidity adequacy scoring process, without constraining the outcome of the supervisory assessment in this area. 52.These guidelines also identify the relevant building blocks required for an effective supervisory stress testing programme. They focus on different forms of supervisory stress testing and objectives, the respective use for SREP purposes, aspects related to the organisation, resources and communication, and possible methodologies. In particular, the supervisory stress testing section complements the assessment on capital adequacy by further clarifying and operationalising procedures for setting P2G and P2G-LR. Link between SREP and assessment of the risk of money laundering and terrorism financing 53.The revised guidelines keep unchanged the provisions on how anti-money laundering (AML) and countering the financing of terrorism (CFT)-related aspects should be factored into the SREP, while ensuring alignment with the AMLD6 package, including by reflecting risks related to the non-implementation and evasion of targeted financial sanctions (as defined in Article 2(1)(49) of Regulation (EU) 2024/1624) in relevant SREP elements. Such common guidance is important because failures by institutions to address ML/TF and targeted financial sanctions-related risks can have detrimental effects on the financial soundness of those institutions, as well as on the integrity of the internal market and financial stability. Therefore, prudential supervisors should consider, to the extent known to them, such risks from a prudential perspective throughout their work, including in the SREP, and cooperate with the authorities and bodies responsible for ensuring compliance with AML/CFT requirements. Link between the SREP and early intervention measures and resolution 54.The SREP assessment may also be used in setting triggers for early intervention measures, as provided for in Article 27 of Directive 2014/59/EU (BRRD). It also allows for the determination of an institution as ‘failing or likely to fail’, which activates the formal interaction procedure with resolution authorities pursuant to Article 32 of that Directive. To this end, these guidelines should be read together with the EBA Guidelines on triggers for use of early intervention measures8 and guidelines on the interpretation of the different circumstances when an institution shall be considered as failing or likely to fail9 . No changes have been proposed to this part in the revised guidelines. 8 EBA Guidelines on triggers for use of early intervention measures (EBA/GL/2015/03). 9 EBA Guidelines on the interpretation of the different circumstances when an institution shall be considered as failing or likely to fail under Article 32(6) of Directive 2014/59/EU (EBA/GL/2015/07).

21 Figure 3: Link between ongoing supervision, early intervention and failing or likely to fail

22 Guidelines (revised) on common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing under Directive 2013/36/EU

23 Compliance and reporting obligations Status of these guidelines

1. This document contains guidelines issued pursuant to Article 16 of Regulation (EU) No 1093/201010. In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities and financial institutions must make every effort to comply with the guidelines.
2. Guidelines set out the EBA’s view of appropriate supervisory practices within the European System of Financial Supervision, and of how Union law should be applied in a particular area. Competent authorities as defined in Article 4(2) of Regulation (EU) No 1093/2010 to whom guidelines apply should comply by incorporating them into their practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where guidelines are directed primarily at institutions. Reporting requirements
3. According to Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must notify the EBA by [dd.mm.yyyy] whether they comply or intend to comply with these guidelines, or if not, provide reasons for non-compliance. In the absence of any notification by this deadline, the EBA will consider competent authorities to be non-compliant. Notifications should be sent by submitting the form available on the EBA website with the reference ‘EBA/GL/2026/xx’. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities. Any change in the status of compliance must also be reported to the EBA.
4. Notifications will be published on the EBA website, in line with Article 16(3). 10 Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC, (OJL 331, 15.12.2010, p.12, ELI: http://data.europa.eu/eli/reg/2010/1093/oj).

24

1. Title 1. Subject matter, scope and definitions, and implementation Subject matter
2. These guidelines specify the common procedures and methodologies for the functioning of the supervisory review and evaluation process (SREP) referred to in Articles 48n, 97 and 107(1)(a) of Directive 2013/36/EU11, including those for the assessment of the organisation and treatment of risks, including money laundering and terrorist financing, referred to in Articles 76 to 87 of that Directive, and the processes and actions taken with reference to Articles 48o, 98, 100, 101, 102, 104, 104a, 104b, 104c, 105, 107(1)(b) and 117 of that Directive. These guidelines aim to provide common methodologies to be used by competent authorities when conducting supervisory stress tests in the context of their SREP referred to in Article 100(2) of Directive 2013/36/EU. In addition, these guidelines also specify in accordance with Article 104a(7) of Directive (EU) 2024/1619 on how to operationalise the requirements where an institution has become bound by the output floor.
3. These guidelines do not set methodologies for the stress tests conducted by the EBA in cooperation with other competent authorities in accordance with Article 22 of Regulation (EU) No 1093/2010; however, they do describe the range of stress tests to help set the appropriate context for the consideration of future EBA stress tests as one part of the supervisory stress tests. Scope of application
4. Competent authorities should apply these guidelines in accordance with the level of application determined in Article 110 of Directive 2013/36/EU following the requirements and waivers used pursuant to Articles 108 and 109 of Directive 2013/36/EU.
5. For parent undertakings and subsidiaries included in the consolidation, competent authorities should adjust the depth and the level of granularity of their assessments to correspond to the level of application established in the requirements of Regulation (EU) No 575/2013 specified in Part One, Title II of that Regulation, in particular recognising waivers applied pursuant to Articles 7, 10 and 15 of Regulation (EU) No 575/2013 and Article 21 of Directive 2013/36/EU. 11 Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJL 176 27.6.2013, p. 338, ELI: http://data.europa.eu/eli/dir/2013/36/oj).

25 5. Where an institution has a subsidiary in the same Member State, but no waivers specified in Part One of Regulation (EU) No 575/2013 have been granted, a proportionate approach for the assessment of capital and liquidity adequacy may be applied by focusing on the assessment of allocation of capital and liquidity across the entities and potential impediments to the transferability of capital or liquidity within the group. 6. For cross-border groups, procedural requirements should be applied in a coordinated manner within the framework of colleges of supervisors established pursuant to Article 116 or 51 of Directive 2013/36/EU. Title 10 explains the details of how these guidelines apply to cross-border groups and their entities. 7. When an institution has established a liquidity subgroup pursuant to Article 8 of Regulation (EU) No 575/2013, competent authorities should conduct their assessment of risks to liquidity and funding, and apply supervisory measures, for the entities covered by such a subgroup at the level of the liquidity subgroup. Addressees 8. These guidelines are addressed to competent authorities as defined in Article 4(2), points(i) and (viii) of Regulation (EU) No 1093/2010. Definitions 9. Unless otherwise specified, terms used and defined in Regulation (EU) No 575/201312, Directive 2013/36/EU, Directive 2014/59/EU13 or the EBA Guidelines on institutions’ stress testing14 , have the same meaning in the guidelines. In addition, for the purposes of these guidelines, the following definitions apply: ‘AML/CFT supervisor’ means a supervisory authority, as defined under Article 2(1), point (45), of Regulation (EU) 2024/1624, responsible for the supervision of institutions’ compliance with provisions of that Regulation. ‘Capital buffer requirements’ means the own funds requirements specified in Chapter 4 of Title VII of Directive 2013/36/EU. 12 Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012 (OJL 176 27.6.2013, p. 1, ELI: http://data.europa.eu/eli/reg/2013/575/oj). 13 Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012 of the European Parliament and of the Council (OJ L 173 12.6.2014, p. 190, ELI: http://data.europa.eu/eli/dir/2014/59/oj). 14 EBA Guidelines on institutions’ stress testing (EBA/GL/2018/04).

26 ‘Consolidating institution’ means an institution that is required to abide by the prudential requirements on the basis of the consolidated situation in accordance with Part 1, Title 2, Chapter 2 of Regulation (EU) No 575/2013. ‘Counterbalancing capacity’ means the institution’s ability to hold, or have access to, excess liquidity over short-term, medium-term and long-term time horizons in response to stress scenarios. ‘Funding risk’ means the risk that the institution will not have stable sources of funding in the medium and long term, resulting in the current or prospective risk that it will not be able to meet its financial obligations such as payments and collateral needs as they fall due in the medium-to￾long term, either at all or without unacceptable funding cost increases. ‘FX lending’ means lending to borrowers, regardless of the legal form of the credit facility (e.g. including deferred payments or similar financial accommodations), in currencies other than the legal tender of the country in which the borrower is domiciled. ‘FX lending risk’ means the current or prospective risk to the institution’s earnings and own funds arising from FX lending to unhedged borrowers. ‘Internal capital adequacy assessment process (ICAAP)’ means the process for the identification, measurement, management and monitoring of internal capital implemented by the institution pursuant to Article 73 of Directive 2013/36/EU. ‘Internal liquidity adequacy assessment process (ILAAP)’ means the process for the identification, measurement, management and monitoring of liquidity implemented by the institution pursuant to Article 86 of Directive 2013/36/EU. ‘Institution’s category’ means the indicator of the institution’s systemic importance assigned based on the institution’s size and complexity, and the scope of its activities. ‘Intraday liquidity’ means the funds that can be accessed during the business day to enable the institution to make payments in real time. ‘Intraday liquidity risk’ means the current or prospective risk that the institution will fail to manage its intraday liquidity needs effectively. ‘Macro-prudential requirement’ or ‘measure’ means a requirement or measure imposed by a competent or designated authority to address macroprudential or systemic risk. ‘Material currency’ means a currency in which the institution has material balance-sheet or off￾balance-sheet positions.

27 ‘Money laundering and terrorist financing (ML/TF) risk’ means the risk as defined in the EBA Risk￾Based Supervision Guidelines15 . ‘Operational resilience’ means the ability of an institution to deliver critical or important functions through disruption. ‘Overall capital requirement (OCR)’ means the sum of the total SREP capital requirement (TSCR), capital buffer requirements and macroprudential requirements, when expressed as own funds requirements. ‘Overall leverage ratio requirement (OLRR)’ means the sum of the total SREP leverage ratio requirement (TSLRR) and the G-SII leverage ratio buffer requirement in accordance with Article 92(1a) of Regulation (EU) No 575/2013. ‘Overall SREP assessment’ means the up-to-date assessment of the overall viability of an institution based on assessment of the SREP elements. ‘Overall SREP score’ means the numerical indicator of the overall risk to the viability of the institution based on the overall SREP assessment. ‘Pillar 1 own funds requirements’ or ‘P1R’ means the own funds requirements the institution is required to hold in accordance with Parts Three, Four and Seven of Regulation (EU) No 575/2013 and Chapter 2 of Regulation (EU) 2017/2402. ‘Pillar 2 guidance’ or ‘P2G’ means the level and quality of own funds the institution is expected to hold in excess of its OCR, determined in accordance with the criteria specified in these guidelines. ‘Pillar 2 guidance for the risk of excessive leverage’ or ‘P2G-LR’ means the level and quality of own funds the institution is expected to hold in excess of its OLRR, determined in accordance with the criteria specified in these guidelines. ‘Pillar 2 requirement’ or ‘P2R’ means the additional own funds requirements imposed in accordance with Article 104(1)(a) of Directive 2013/36/EU to address risks other than the risk of excessive leverage. ‘Pillar 2 requirement for the risk of excessive leverage’ or ‘P2R-LR’ means the additional own funds requirements imposed in accordance with Article 104(1)(a) of Directive 2013/36/EU to address the risk of excessive leverage. ‘Reputational risk’ means the current or prospective risk to the institution’s earnings, own funds or liquidity arising from damage to the institution’s reputation. 15 EBA Guidelines on the characteristics of a risk-based approach to anti-money laundering and terrorist financing supervision, and the steps to be taken when conducting supervision on a risk-sensitive basis under Article 48(10) of Directive (EU) 2015/849 (amending the Joint Guidelines ESAs 2016 72) (‘The Risk-Based Supervision Guidelines’) (EBA/GL/2021/16).

28 ‘Risk appetite’ means the aggregate level and types of risk the institution is willing to assume within its risk capacity, in line with its business model, to achieve its strategic objectives. ‘Risk score’ means the numerical expression summarising the supervisory assessment of an individual risk to capital, liquidity and funding representing the likelihood that a risk will have a significant prudential impact on the institution (e.g. potential loss) after considering risk management and controls and before consideration of the institution’s ability to mitigate the risk through available capital or liquidity resources. ‘Risks to capital’ means distinct risks that, should they materialise, will have a significant prudential impact on the institution’s own funds over the next 12 months. These include but are not limited to risks covered by Articles 79 to 87 of Directive 2013/36/EU. ‘Risks to liquidity and funding’ means distinct risks that, should they materialise, will have a significant prudential impact on the institution’s liquidity over different time horizons. ‘SREP element’ means one of the following: business model analysis, assessment of internal governance and institution-wide risk controls, assessment of risks to capital, SREP capital assessment, or SREP liquidity and funding assessment. ‘Supervisory benchmarks’ means risk-specific quantitative tools or methodologies developed by the competent authority to provide an estimation of the own funds required to cover risks or elements of risks not covered by Regulation (EU) No 575/2013. ‘Survival period’ means the period during which the institution can continue operating under stressed conditions and still meet its payments obligations. ‘Total risk exposure amount (TREA)’ means total risk exposure amount as defined in Article 92 of Regulation (EU) No 575/2013. ‘Total SREP capital requirement (TSCR)’ means the sum of own funds requirements as specified in Article 92(1), points (a) to (c), of Regulation (EU) No 575/2013 and additional own funds requirements determined in accordance with the criteria specified in these guidelines to address risks other than the risk of excessive leverage. ‘Total SREP leverage ratio requirement (TSLRR)’ means the sum of own funds requirements as specified in Article 92(1), point (d), of Regulation (EU) No 575/2013 and additional own funds requirements determined in accordance with the criteria specified in these guidelines to address the risk of excessive leverage. ‘Unhedged borrowers’ means retail and SME borrowers without a natural or financial hedge that are exposed to a currency mismatch between the loan currency and the hedge currency; natural hedges include, in particular, cases where borrowers receive income in a foreign currency (e.g. remittances/export receipts), while financial hedges normally presume that there is a contract with a financial institution.

29 ‘Viability score’ means the numerical expression summarising the supervisory assessment of a SREP element and representing an indication of the risk to the institution’s viability stemming from the SREP element assessed. Date of application 10.These guidelines apply from 1 January 2027. Paragraphs 102, 103, 239, 462, 463 and 470(f) apply from 01 January 2027, except for taking into account the risks of non‑implementation and evasion of targeted financial sanctions, which applies from 10 July 2027. Title 12 applies from 11 January 2027. Repeal 11.The EBA Guidelines on common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing of 18 March 2022 (EBA/GL/2022/03) and the EBA Guidelines on ICT risk assessment under the SREP (EBA/GL/2017/05) are repealed with effect from 1 January 2027. The references to the Guidelines repealed shall be construed as reference to these guidelines.

30 2. Title 2. SREP framework 2.1. Overview of the SREP framework 12.Competent authorities should have a comprehensive SREP framework covering the following components, which should be assessed on a regular basis, having regard to the list of legal acts published separately on the EBA website against which compliance of institution should be evaluated. The SREP engagement model in section 2.4 sets out how this framework can be calibrated across diverse institutions in application of the proportionality principle. These components are: a. categorisation of the institution as specified in section 2.1.1; b. monitoring of key indicators as specified in Title 3; c. business model analysis (BMA) as specified in Title 4; d. assessment of internal governance and institution-wide controls as specified in Title 5; e. assessment of risks to capital as specified in Title 6; f. assessment of the adequacy of the institution’s own funds as specified in Title 7; g. assessment of risks to liquidity and funding and SREP liquidity and funding assessment as specified in Title 8; h. overall SREP assessment (including the application of supervisory measures - and early intervention measures, where necessary) and communication as specified in Title 9 and section 2.1.2 respectively. 13.Competent authorities should consider the SREP an ongoing process that integrates the outcome of all the supervisory activities and all available sources of information into a comprehensive supervisory overview of an institution. The SREP should include consideration of the following: a. the outcome of previous SREP assessments, business model analysis and ongoing off-site supervision; b. institution’s financial reporting, strategic plan(s), regulatory reporting (common reporting – COREP, financial reporting – FINREP, and credit register, where available) and internal reporting (e.g. management information, capital and liquidity reporting, internal risk reports); c. institution’s ICAAP/ILAAP and recovery planning arrangements; d. on-site inspections; e. internal model assessments; f. targeted deep-dive analysis; g. horizontal thematic reviews;

31 h. stress testing analysis; i. third-party reports (e.g. audit reports, reports by equity/credit analysts); j. other relevant sectoral or macroeconomic studies/surveys. 2.1.1. Categorisation of institutions 14.Competent authorities should categorise all institutions under their supervisory remit into four different categories based on the size, systemic importance, nature, scale and complexity of the activities of the institutions concerned and considering Article 97(4) of Directive 2013/36/EU. The categorisation should reflect the assessment of systemic risk posed by institutions to the financial system. 15.Within a group of entities, if competent authorities determine that the relevance of different entities within the group, based on the elements listed in paragraph 17, varies, they may apply categorisation at the individual level to reflect these differences (e.g. assigning different categories to various group subsidiaries and/or consolidated entity). 16.Competent authorities should review the categorisation of their institutions periodically, and following events that may affect the business models’ riskiness, or major corporate operations such as a large divestment, a merger or acquisition, an important strategic action. 17.To ensure a minimum level of comparability, competent authorities should refer to the categories below as a starting point: ► Category 1 – All institutions defined as ‘large institutions’ in Article 4(1), point 146 of Regulation (EU) 575/2013. Competent authorities may classify ‘large institutions’ as Category 2 or Category 3 institutions for proportionality reasons provided they are not G￾SIIs. The reclassification of ‘large institutions’ that are not G-SIIs should be performed in accordance with the qualitative criteria of Category 2 and Category 3 below, considering the institution’s size, systemic importance, nature, scale and complexity of the activities. ► Category 2 – (i) Medium to large institutions other than those included in Category 1 which are not ‘small and non-complex institutions’ as defined in Article 4(1), point 145, of Regulation (EU) 575/2013 and operate in several business lines, including non-banking activities, or have sizeable cross-border activities, and offer credit and financial products to retail and corporate customers; (ii) non-systemically important specialised institutions with significant market shares in their lines of business or payment systems, or trading platforms/markets for financial instruments; (iii) institutions considered important, due to their size, activities, or business model (e.g. central institutions of an IPS, CCPs, CSDs, central cooperative banks or central savings banks), for the economy (e.g. in terms of total assets over gross domestic product – TA/GDP) or for the banking sector in a particular Member State. ► Category 3 – (i) Small to medium institutions other than those included in Categories 1 and 2, which are not ‘small and non-complex institutions’ as defined in Article 4(1), point 145, of Regulation (EU) 575/2013 and operate in a limited number of business lines, or have

32 non-significant cross-border activities, offering predominantly credit products to retail, corporate and institutional customers with a limited offering of financial products; (ii) specialised institutions with less-significant market shares in their lines of business or payment systems, or financial exchanges. ► Category 4 – All institutions defined as ‘small and non-complex institutions’ in Article 4(1), point 145 of Regulation (EU) 575/2013 and all other small non-complex institutions that do not fall into Categories 1 to 3 (e.g. with a limited scope of activities and non-significant market shares in their lines of business). 2.1.2. Continuous assessment of risks, escalation framework and supervisory measures 18.Competent authorities should continuously assess the risks to which the institution is or might be exposed through their supervisory activities in accordance with the SREP engagement model set out in section 2.4. 19.Competent authorities should ensure that the findings of their assessments are clearly documented, with a focus on the root causes of the identified deficiencies. These findings should be reflected in the SREP scores assigned in accordance with these guidelines and should inform subsequent supervisory measures that competent authorities may apply as specified in Articles 102, 104 and 105 of Directive 2013/36/EU and national law, and, when applicable, early intervention measures as specified in Article 27 of Directive 2014/59/EU, or any combination of the above. 20. As part of their ongoing supervisory activities, competent authorities should undertake appropriate and timely follow-up activities to ensure that an institution has effectively addressed the identified deficiencies. In this regard, competent authorities should establish a high-level escalation framework for supervisory measures, supporting the selection of the most appropriate measures (both quantitative and qualitative) to address the identified deficiencies. This is without prejudice to the supervisory powers provided under the applicable legal framework and the competent authorities’ discretion to determine the most appropriate measures based on the specific circumstances and deficiencies. 21.The framework referred to in the previous paragraph should consider the following actions, which are not to be intended to be strictly sequential and may be escalated or de-escalated as appropriate: a. engaging in an enhanced supervisory dialogue with the institution, such as holding a meeting with the management body or requiring a self-assessment from the institution; b. communicating corrective actions expected from the institution (non-binding measures), such as supervisory expectations or recommendations; c. requiring specific corrective action(s) from the institution (binding measures), such as setting qualitative measures the institution needs to comply with and/or setting/increasing Pillar 2 requirement or liquidity requirements;

33 d. enforcing supervisory measures to remedy the deficiencies identified, such as administrative penalties, remedial measures or fines. 22.When selecting supervisory measures, competent authorities should identify the full escalation path, taking into account the information available, the nature, size and complexity of the institution and the need to ensure timely remediation of identified deficiencies. The selection should be guided by the following considerations, as applicable: a. the intended outcome that the measures aim to achieve and, where feasible, the expected timelines for the institution to address the deficiencies; b. the severity of the deficiencies and the potential prudential impact of not addressing the issue (i.e. whether it is necessary to address the issue with a specific measure) and whether the deficiencies have already been addressed/covered by other measures; c. the demonstrated ability or intention of the institution to remediate to the deficiencies; d. whether other measures would achieve the same objective with less of an administrative and financial impact on the institution; e. the possibility that risks and vulnerabilities identified may be correlated or self-reinforcing, or both, meriting an increase in the rigorousness of supervisory measures; f. any other factors deemed relevant by the competent authorities. 23.Without prejudice to the discretion of the competent authorities in selecting the most appropriate measures, all available quantitative and qualitative measures should be used in a way that allows to best address the risk level and/or deficiencies. This should take into account the nature of the risk (quantitative and/or qualitative), the escalation process, and the fact that quantitative measures should be applied to address deficiencies in internal governance, including internal control arrangements, and other issues, where other supervisory measures have not been effective or are considered insufficient to address the identified deficiencies within an appropriate timeframe16 . 24.The provisions of this title are without prejudice to the possibility of competent authorities taking supervisory measures directly linked to the outcomes of any supervisory activities (e.g. on-site examinations or assessments of the suitability of members of the management body and key functions) where the outcomes of such activities necessitate immediate application of supervisory measures to address material deficiencies. 2.1.3. Dialogue with institutions 25.Competent authorities should engage in dialogue with institutions as they perform their supervisory activities. 16 In accordance with Article 104a(1)(b) of Directive 2013/36 of the European Union and of the Council on access to the activity of credit institutions and the prudential supervision of credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJL 176 27.6.2013, p. 338, ELI: http://data.europa.eu/eli/dir/2013/36/2026-01-11).

34 26.Competent authorities should communicate the outcomes of the SREP assessment to the institution in accordance with Title 9 and inform the institution of any action required to comply with supervisory measures applied on the basis of those findings. 2.2. Scoring in the SREP 27.Competent authorities should apply a consistent scoring system to help facilitate communication between competent authorities and colleges of supervisors, foster comparability and a level playing field across institutions, and prioritise supervisory resources and measures in the assessment of the SREP elements. They should summarise the outcomes of their assessments by assigning risk scores, SREP element scores and an overall SREP score. 28.When assigning risk scores, SREP elements scores and the overall SREP score, competent authorities should refer to the considerations outlined in the tables at the end of each relevant section and title of these guidelines, alongside the application of supervisory judgment. While these considerations serve as a baseline for assigning scores, they should not be interpreted as a mechanical checklist to be completed for each element, nor should they be seen as establishing a hierarchy of importance among the elements. Instead, they are intended to guide competent authorities in assigning scores by considering the interplay and relevance of the different elements within the specific dimension of the institution being assessed. 29.The risk scores aim to capture the likelihood that the risks to capital, liquidity and funding will have a significant impact on the institution. The SREP element scores and the overall SREP score indicate the magnitude of risks to the institution’s viability; in particular the overall SREP score should reflect the supervisory view of the overall viability of the institution as specified in Title 9. Figure 1. Overview of the scoring framework 30.The scores are: 1 (low risk), 2 (medium-low risk), 3 (medium-high risk), and 4 (high risk – this represents the worst possible assessment). An additional score of ‘F’ is available only for the

35 overall SREP score, as explained in paragraph 38. Competent authorities may introduce more granular scoring for their internal purposes, such as planning of resources, provided the overall scoring framework set out in these guidelines is respected. 31.Competent authorities should review the scores upon completion of the SREP assessments with the minimum frequency set out in the SREP engagement model in section 2.4. The scores should also be reviewed without undue delay on the basis of material new findings or developments. 2.2.1. Risk scores 32.Risk scores are assigned to summarise risks to capital (as specified in Title 6). These scores represent the likelihood that a risk will have a significant prudential impact on the institution (e.g. potential loss), after considering the quality of risk controls to mitigate this impact (i.e. residual risk), but before consideration of the institution’s ability to mitigate the risk through available capital or liquidity resources. 33.Competent authorities should determine the risk score through an assessment of an institution’s inherent risk level, while duly considering the adequacy of the institution’s risk management and controls framework. In particular, an adequate risk management and controls framework may mitigate the prudential impact of a specific risk, while a weak framework may amplify the prudential impact. The assessment of inherent risk and the adequacy of management and controls should be made with reference to the considerations specified in table 6 for credit and counterparty risk, in table 8 for market risk, in table 10 for operational risk, in table 12 for interest rate and credit spread risk in the banking book (IRRBB and CSRBB), in table 17 for liquidity and funding. 34.When assessing risks to capital, competent authorities should also consider relevant sub￾categories (e.g. concentration risk or country risk as part of the credit and counterparty risk assessment, as set out in Title 6). Depending on the materiality of any of these subcategories to a particular institution, competent authorities may decide to assess and score them individually. 35.Competent authorities may use different methods to apply the risk scores, they could score ‘risk’ and ‘risk management and controls’ separately (resulting in an intermediate and final score) or score them together. Competent authorities may also aggregate all the risks to capital into an aggregate score. 2.2.2. SREP element scores and overall SREP score 36.At the end of the overall SREP assessment, competent authorities should form a comprehensive overview of the risk profile and viability of the institution based on the four SREP elements: a. business model and strategy as specified in Title 4; b. internal governance and institution-wide controls as specified in Title 5; c. capital adequacy, as specified in Title 7; d. liquidity and funding adequacy, as specified in Title 8.

36 37.Capital adequacy and liquidity and funding adequacy represent the supervisory view of the capacity of the institution’s capital and liquidity resources to mitigate/cover risks to capital and liquidity and funding, as set out in Titles 6 and 8, and/or other elements for which additional own funds have been determined as set out in Title 7. 38.The final score is an overall SREP score. This incorporates the four SREP element scores above and supervisory judgement. Competent authorities should ensure that the overall SREP score provides an indication of the institution’s overall viability, including whether the institution is ‘failing or likely to fail’ within the meaning of Article 32 of Directive 2014/59/EU, and having regard to the EBA Guidelines on ‘failing or likely to fail’17. When the outcome of the overall SREP assessment suggests that an institution can be considered to be ‘failing or likely to fail’, competent authorities should apply a score of ‘F’ and follow the process of engaging with resolution authorities as specified in Article 32 of Directive 2014/59/EU. 39.Competent authorities should ensure that the SREP element scores and the overall SREP score: a. reflect the likelihood that supervisory measures are needed to address concerns; b. are considered among the triggers for the decision on whether to apply early intervention measures in accordance with the EBA Guidelines on triggers for use of early intervention measures18; c. inform the prioritisation and planning of supervisory resources and the setting of priorities in the supervisory examination programme (SEP). 2.3. Organisational arrangements 40.Competent authorities should ensure that their organisational arrangements for conducting SREP include at least the following: a. a description of the roles and responsibilities of their supervisory staff with respect to performing the SREP, as well as the relevant reporting lines, in both normal and emergency situations; b. procedures for documenting and recording findings and supervisory judgements; c. arrangements for the approval of the findings and scores, as well as escalation procedures where there are dissenting views within the competent authority, in both normal and emergency situations; d. arrangements for organising dialogue with the institution following the model of minimum engagement as stipulated in section 2.4 to assess individual SREP elements; e. arrangements for engaging in consultations with an institution and for communicating the outcomes of the SREP to the institution, reflecting the interaction within colleges of 17 EBA Guidelines on the interpretation of the different circumstances when an institution shall be considered as failing or likely to fail under Article 32(6) of Directive 2014/59/EU (EBA/GL/2015/07). 18 EBA Guidelines on triggers for use of early intervention measures (EBA/GL/2015/03).

37 supervisors for cross-border groups and their entities, in accordance with Commission Implementing Regulation (EU) No 710/201419; f. internal checks and balances to support effective decision-making, consistency of outcomes and accountability. 41.When defining arrangements for dialogue with institutions, competent authorities should consider the potential implications of providing the scores to the institutions in terms of their disclosure obligations pursuant to the requirements of Regulation (EU) No 596/201420 and Directives 2014/57/EU21 and 2004/109/EC22 . 2.4. Proportionality and supervisory engagement 42.Competent authorities should adjust the scope, frequency, granularity and intensity of supervisory engagement with an institution in accordance with its category and taking into account the principle of proportionality. When planning SREP activities, competent authorities should refer to the minimum SREP engagement model outlined in table 1. The model maps the intensity of the supervisory engagement to the institution’s category. The model should not be interpreted as an obstacle to allocate resources on identified supervisory priorities. Competent authorities may therefore, regardless of the categorisation of the institution, set the focus and granularity of their assessment to reflect the risk profile of the institution, the materiality of the different risks, trends and emerging risks identified through the monitoring of key indicators as outlined in Title 3, stress testing as outlined in Title 11 or the outcome of previous SREP assessments. 43.Under this model, competent authorities should form a view on all the SREP elements (business model analysis, governance/internal controls, risks to capital, and risks to liquidity and funding) in accordance with the minimum frequency set out in table 1, while remaining able to make a yearly meaningful and comprehensive assessment of an institution’s viability (summary of the overall SREP assessment). 44.This view should be based on information gathered through the full range of supervisory activities listed in paragraph 13. In particular, information from previous years may also serve as 19 Commission Implementing Regulation (EU) No 710/2014 of 23 June 2014 laying down implementing technical standards with regard to conditions of application of the joint decision process for institution-specific prudential requirements according to Directive 2013/36/EU of the European Parliament and of the Council (OJL 188, 27.6.2014, p. 19, ELI: http://data.europa.eu/eli/reg_impl/2014/710/oj). 20 Regulation (EU) No 596/2014 of the European Parliament and of the Council of 16 April 2014 on market abuse (market-abuse regulation) and repealing Directive 2003/6/EC of the European Parliament and of the Council and Commission Directives 2003/124/EC, 2003/125/EC and 2004/72/EC (OJL 173, 12.6.2014, p. 1). 21 Directive 2014/57/EU of the European Parliament and of the Council of 16 April 2014 on criminal sanctions for market abuse (market-abuse directive) (OJL 173, 12.6.2014, p.179, ELI: http://data.europa.eu/eli/reg/2014/596/oj). 22 Directive 2004/109/EC of the European Parliament and of the Council of 15 December 2004 on the harmonisation of transparency requirements in relation to information about issuers whose securities are admitted to trading on a regulated market and amending Directive 2001/34/EC (OJL 390, 31.12.2004, p.38, ELI: http://data.europa.eu/eli/dir/2004/109/oj).

38 a baseline for the assessment and summary of the overall SREP assessment, provided that the competent authority has determined - while also taking into account the quarterly monitoring of the indicators - that the institution’s risk profile has not materially changed. 45.Competent authorities should engage with the institutions’ management body and senior management23 based on the minimum frequency indicated in table 1. Regardless of the category of the institution, competent authorities should intensify their engagement to follow up on findings from previous SREP assessments, or to monitor institutions with higher/rapidly changing risk profiles or with a poor overall SREP score reflecting severe supervisory concerns. 46.Where institutions are part of cross-border groups, competent authorities should discuss how they plan to perform their SREP assessment within the framework of colleges of supervisors to identify concerns at an early stage and adjust and coordinate the approach among the authorities as specified in Title 10. Table 1. Application of SREP to different categories of institutions Category Monitoring of key indicators Evaluation of all SREP elements (at least)* Summary of the overall SREP assessment Minimum level of engagement/dialogue with institution’s management body and senior management 1 Quarterly Annual Annual Continuous/ongoing 2 Quarterly Every 2 years Annual Continuous/ongoing 3 Quarterly Every 3 years Annual Risk-based at least every 3 years 4 Quarterly Every 3 years, extensible to 5 years** Annual Risk-based at least every 3 years *With the focus and granularity of the review tailored to reflect the risk profile of the institution, materiality of the different risks, and trends and emerging risks identified through supervisory activities. This can be based on previous assessments if nothing has materially changed in accordance with the available information (e.g. monitoring of indicators and reporting), regardless of the categorisation of the institution. **The minimum frequency for assessing all SREP elements can be extended from 3 to 5 years for category 4 institutions provided that: (i) they have a stable low-risk profile, stable financial metrics and healthy margins; and (ii) the quarterly monitoring of KRIs does not give rise to concerns. 47.Where competent authorities determine that institutions have similar risk profiles or may be exposed to similar emerging risks, they may conduct thematic SREP assessments on multiple institutions as a single assessment (e.g. a BMA may be conducted on all small mortgage lenders, given that it is likely to identify the same business viability issues for all these institutions). Competent authorities may also use tailored methodologies for the application of the SREP for institutions with similar risk profiles, such as similar business models or geographical location of exposures in accordance with Article 97(4a) of Directive 2013/36/EU. 23 As defined in Article 3(9) of Directive 2013/36 of the European Union and of the Council on access to the activity of credit institutions and the prudential supervision of credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJL 176 27.6.2013, p. 338, ELI: http://data.europa.eu/eli/dir/2013/36/2026-01- 11).

39 48.For institutions covered by the supervisory examination programme required by Article 99 of Directive 2013/36/EU, competent authorities should ensure that the level of engagement and application of the SREP is determined by that programme. 49.When planning supervisory activities, competent authorities should coordinate activities internally to ensure a coherent assessment and with other parties directly or indirectly involved in the assessment, in particular when input is required from them.

40 3. Title 3. Monitoring of key indicators 50.Competent authorities should regularly monitor key financial and non-financial indicators to observe changes in the financial and operational conditions, and risk profiles of institutions. Where monitoring reveals a material change in the risk profile of an institution, or any anomalies in the indicators, competent authorities should investigate the causes and, where relevant, review the assessment of the relevant SREP element, including the risk score as relevant, to capture the new information. Competent authorities should regularly review and, where necessary, update their monitoring indicators and tools to ensure these remain relevant and effective. 51.Consistent with the SREP engagement model in section 2.4, competent authorities should monitor key financial and non-financial indicators at least quarterly for all institutions and establish more frequent monitoring to reflect the specific features of an institution or emerging risks and trends, subject to data availability (e.g. market data). 52.Competent authorities should set up monitoring systems to identify patterns, material changes and anomalies in the behaviour of the indicators (or combinations of indicators), for instance by setting out alerts based on materiality thresholds. Competent authorities should set escalation procedures to deal with anomalies. Identification of material changes or anomalies in indicators, especially in cases where changes are outliers to the peer-group performance, should be considered by competent authorities as a prompt for further investigation. 53.Competent authorities should tailor the monitoring systems, and the escalation procedures in case of anomalies, to reflect the institution’s size, complexity, business model and risk profile, focussing on the geographies, sectors and markets where the institution operates. 54.The monitoring systems should as a minimum be based on information and data reported to the competent authorities and may include the EBA dashboards or indicators. Monitoring systems should include at least the following institution-specific indicators: a. indicators related to the institution’s business model analysis (see Title 4), internal governance and controls (see Title 5), risks to capital (see Title 6) and risks to liquidity and funding (see Title 8); indicators for risk of excessive leverage (see Title 7) and indicators deduced from the application of Regulation (EU) 2022/2554; b. all the ratios derived from the application of Regulation (EU) 575/2013 and from the national law implementing Directive 2013/36/EU for calculating the minimum prudential requirements (e.g. Core Tier 1 - CET1, liquidity coverage ratio - LCR, net stable funding ratio

• NSFR, Leverage ratio); c. the minimum requirements for own funds and eligible liabilities (MREL) as specified by Directive 2014/59/EU;

41 d. relevant market-based indicators (e.g. equity price, credit default swap - CDS spreads, bond spreads); e. where applicable24, and particularly in case of idiosyncratic or systemic events, recovery indicators used in the institution’s own recovery plans; f. where available, indicators based on quantitative or qualitative information from reporting provided to competent authorities that may point to ML/TF risk. 55.Competent authorities should accompany institution-specific indicators with relevant macroeconomic indicators, where available, in the geographies, sectors and markets where the institution operates. They should also consider relevant independent market research and analysis, including threat landscape reports, where these are available, as an informative source of alternative points of view. 24 If not waived in the context of simplified obligations as determined in article 4 of Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012, of the European Parliament and of the Council (OJL L 173, 12.6.2014, p. 190, ELI: http://data.europa.eu/eli/dir/2014/59/oj).

42 4. Title 4. Business model analysis (BMA) 4.1. General considerations 56.This title specifies criteria for the assessment of the business model and strategy of the institution. The purpose of this assessment by competent authorities is to achieve a comprehensive understanding – both in current and forward-looking perspectives – of the institution’s operations, identify significant existing or potential vulnerabilities which are most likely to have a material impact on the institution, and assess the overall soundness of its business model and strategy. Following this assessment, competent authorities should determine: a. the viability of the institution’s current business model, measured by its ability to generate acceptable returns over the next 12 months; b. the sustainability of the institution’s strategy, based on its ability to generate acceptable returns over a forward-looking period of at least three years, as derived from its strategic plans and financial projections. 57.Competent authorities should use the outcome of the BMA to support the assessment of all other elements of the SREP. Competent authorities may assess specific aspects of the BMA, in particular the quantitative assessment of the business model, as part of the assessment of other SREP elements (e.g. understanding the funding structure can be part of the risks to liquidity assessment). 58.Competent authorities should take into account environmental, social and governance (ESG) risks, giving priority to environmental transition and physical risks, when performing the BMA, with a view to assessing the strategic and prudential implications of these risks for the business model of the institution in the short, medium and long term. 59.Competent authorities should also use the business model analysis to assess prudential implications of ML/TF risks, linked to the business model of the institution. In this respect, competent authorities should use the input received from AML/CFT supervisors to complement their findings from ongoing supervision and evaluate whether they give rise to prudential concerns related to ML/TF risk. Where the assessment indicates the business model of the institution gives rise to prudential concerns related to ML/TF risk, competent authorities should share the outcome of the prudential assessment of the business model with the AML/CFT supervisor25 . 25 In accordance with the EBA AML/CFT Cooperation Guidelines (EBA/GL/2021/15).

43 60.To conduct the BMA, competent authorities should use at least the following sources of quantitative and qualitative information: a. institution’s strategic plan(s) with current-year and forward-looking forecasts, and underlying economic assumptions; b. financial reporting (e.g. profit and loss - P&L, balance-sheet disclosures); c. regulatory reporting (COREP, FINREP and credit register, where available); d. internal reporting (management information, including – where available – contribution to the profitability by business lines, capital planning, liquidity reporting, operational resilience, internal risk reports); e. recovery plans; f. resolution plans, including the work and outcome of resolvability assessment provided by the resolution authority in accordance with Article 14 of Directive 2014/59/EU; g. institution’s plan to address ESG risks, to be prepared in accordance with Article 76(2) of Directive 2013/36/EU; h. third-party reports (e.g. audit reports, reports by equity/credit analysts); i. other relevant macroprudential or financial stabilities studies/surveys (e.g. from the International Monetary Fund - IMF, macroprudential authorities and institutions, European institutions). 4.2. Identifying the areas of focus for the BMA Assessment areas 61.In accordance with the engagement model set out in Title 2, competent authorities should focus their analysis on the most material assessment areas for the business model of the institution. The scope and depth of the BMA may be differentiated depending on the number and nature of supervisory reviews already performed on that institution. This assessment should in any case allow competent authorities to form a view on the overall institution’s business model viability and sustainability. 62.Competent authorities should form a view on the materiality of the changes to the institution’s business model compared to prior supervisory review, in order to decide the scope and depth of their assessment and the extent to which the prior supervisory assessment can be used as a baseline for the new one. In forming such a view, competent authorities should, in particular, consider whether there have been relevant changes in the following areas of the institution: a. the previously communicated and assessed strategic plan; b. the structure and composition of the balance sheet, including changes in sources of profit and their concentration, asset growth, changes in the liabilities structure, or shift in the relevant financial and risk indicators, and consider the results of the indicator monitoring outlined in Title 3;

44 c. governance and operations, including acquisitions, mergers or divestments of other entities, the opening or exit of business lines or geographic markets as well changes to IT infrastructure. Identification of most important business lines 63.Competent authorities should carry out a materiality assessment of the institution’s business lines to determine the key areas for the BMA to focus on. When performing this assessment, competent authorities should take into account: a. the relevance of the business lines in terms of generating profits/losses, including the geographies, subsidiaries/branches and product lines that are most material based on their contribution to the overall revenues/costs in the P&L, risk (e.g. based on TREA or other measures of risk) and/or organisational/statutory priorities (e.g. specific obligations for public sector banks to offer specific products); b. previous supervisory findings, including those arising from onsite inspections – where these findings can provide indicators on business lines requiring further investigation –, as well as findings and observations from internal or external audit reports – whether the internal audit function has identified specific issues regarding the sustainability or viability of certain business lines; c. outcomes of thematic supervisory reviews – whether a sector-wide analysis has revealed common underlying issues that prompt additional institution-specific analysis; d. importance to strategic plans – whether there are business lines that the institution wishes to grow substantially or decrease; e. peer comparisons – whether a business line has performed atypically (been an outlier) compared to peers, where such information is available to competent authorities. To identify relevant peers for the BMA, competent authorities should consider the rival product/business lines targeting the same source of profits/customers, the regulatory regimes and geopolitical risks of location of operations as well as other factors appropriate to the sector in which the institution operate. 4.3. Assessment of BMA robustness and identification of vulnerabilities 64.Competent authorities should perform an analysis of quantitative features of the institution’s current business model to assess its ability to generate acceptable profits in the short, medium and long term, given the institution’s risk appetite and its funding and capital structures. Areas for analysis by competent authorities should include: a. drivers of profitability, including trends, by assessing the underlying elements of the institution’s earning capacity, after exception items and one-offs, breakdown of income streams, breakdown of costs and costs allocation, impairment provisions and key ratios (e.g. net interest margin, cost/income, loan impairment, and cost of risk). This assessment may be complemented by the analysis of the relevant risk-adjusted profitability metrics (e.g. Return

45 On Allocated Capital – ROAC, or the Risk-Adjusted Return on Capital Return - RAROC), where these are available and deemed reliable; b. the balance sheet, including trends, by assessing the asset and liability mix, funding structure, change in the TREA and own funds, and key ratios (e.g. return on equity/assets, Core Tier 1, funding gap), as well as concentrations in the P&L and balance sheet related to customers, sectors and geographies; c. risk appetite and tolerance levels, by assessing the formal limits put in place by the institution by risk type and its adherence to them to understand the risks that the institution is willing to take to drive its financial performance and to ensure operational resilience. This should also cover the impact tolerance for ICT disruptions. 65.Competent authorities should perform an analysis of qualitative features of the institution’s current business model to understand its success drivers and key dependencies. Areas for analysis by competent authorities should include: a. the business environment, by assessing the forward-looking environment in which the institution operates based on its main or material geographic and business exposures. As part of this assessment, competent authorities should develop an understanding of the key macroeconomic variables, market trends, the competitive landscape and other relevant developments (such as regulatory and legal changes); b. key internal and external dependencies, by assessing main exogenous and endogenous factors that may influence the success of the business model, considering associated governance and internal control arrangements; c. franchise and areas of competitive advantage, by assessing the reputation of the institution and the strength of relationships with customers, suppliers and partners, as well as whether there are areas in which the institution has a competitive advantage over its peers; d. ICT support, by assessing the level and adequacy of alignment between the ICT and the business in terms of strategy, objectives, activities, resources and functions, and by considering whether any ICT-related concerns could impact the institution’s business strategy and objectives. 66.Competent authorities should complement the analysis by carrying out a forward-looking analysis (both quantitative and qualitative) of the institution’s financial projections and strategic plan to understand the underlying assumptions and dependencies, plausibility and riskiness of its business strategy. Areas for analysis by competent authorities should include: a. overall strategy and success drivers, by assessing the main quantitative and qualitative management objectives and the gap between the envisaged business model – post execution – and the current model; b. projected financial performance, by assessing the plausibility and consistency of the assumptions made by the institution that drive its strategy and forecasts; c. execution capabilities, by assessing management’s track record on delivering previous strategies and forecasts, as well as the overall ability of the institution to make use of

46 competitive advantages and success drivers in carrying out its business and to generate returns in an effective way. As part of this assessment, competent authorities should consider: i. the adequacy of the cost allocation framework - in terms of adequacy to reflect the profitability of business lines/units; ii. the fund transfer pricing framework – in terms of adequate determination of the net income component for each business line/unit, product and customer; iii. the loan pricing framework – in terms of adequate governance of the loan pricing process, pricing methodology, appropriate consideration of all the loan pricing components, and ex post profitability monitoring and reporting of product pricing decisions; iv. the revenue sharing framework between institutions established in the Union that are part of third-country groups and other entities of that group established outside the Union and not consolidated by the EU parent undertaking – in terms of fair sharing of P&L between entities or business lines taking part in the life cycle of transactions, and of the adequate governance. 67.In the analysis, competent authorities should consider any indications that the business model and activities give rise to increased ML/TF risks, including crypto-asset activities or deposit￾taking or establishment or use of legal entities in high-risk third countries, as identified in accordance with Article 9 of Directive (EU) 2015/849. Where present, these indications should be complemented by quantitative analysis, as appropriate, focusing in particular on the materiality of the revenues and the income from operations run in such high-risk third countries, the concentrations of exposures to customers for which the institution apply enhanced customer due diligence as set out in Chapter II, Section 3 of Directive 2015/849. Competent authorities should exchange information with the AML/CFT supervisor on these indications as laid out in paragraph 5963. 4.4. Business model viability and sustainability 68.Competent authorities should assess the resilience of the institution’s business model to external shocks and its adaptability to structural changes in terms of its capacity to absorb them and adapt to exogenous factors that could threaten business and strategic objectives. Areas for analysis by competent authorities should include: a. climate-related and other environmental risks, by assessing their impact on the institution’s current and future business environment and business strategy, the institution’s exposure to material transition and physical risks, as well as the development and implementation of a plan to monitor and address the financial risks stemming from ESG factors - including those arising from the process of transition towards regulatory objectives, in particular climate￾related objectives applicable in the jurisdiction(s) where the institution operates; b. digitalisation, by assessing the use and adoption level of new technologies and impact on the institution’s business strategy and business plan, execution capabilities and cost control, as well as revenue generation;

47 c. operational resilience, by reviewing the institution’s operational resilience approach and its consideration to the business strategy by the management body; d. geopolitical risks, by assessing the source of geopolitical uncertainties and its inclusion in the business strategy, as well as their financial impact on the institution’s current and future profitability, while also taking into account the institution’s capacity to withstand such uncertainties, for instance by means of its geographical and business profile diversification; e. crypto-asset activities, if applicable, by assessing the institution’s provision of crypto-asset services and any other activities related to crypto-assets. 69.Based on the performed analysis, competent authorities should form, or update, their view on the following elements: a. key vulnerabilities to which the institution’s business model and strategy expose it or may expose it, such as excessive concentrations or risk-taking, poor strategic steering of profitability and execution capabilities; b. viability of the institution’s current business model, as defined in paragraph 56, given its quantitative performance, risk appetite, funding structure, key success drivers and dependencies and business environment; c. sustainability of the institution’s strategy, as defined in paragraph 56, based on the plausibility of its strategic plan and financial forecasts, and given the supervisory assessment of the projected financial performance, overall strategy, level of operational resilience and the execution capabilities. Competent authorities should also consider the institution’s capacity to ensure its medium- to long-term resilience to environmental risks by taking into account long-term horizons of at least ten years, including by reviewing the environmental business model resilience analyses conducted by the institution in compliance with the EBA Guidelines on environmental scenario analysis26; 4.5. Summary of findings, scoring and supervisory measures 70.Based on the assessment of the viability and sustainability, and of any potential risks and vulnerabilities to the institution, competent authorities should form a view on the institution’s business model. This view should be reflected in a summary of findings, accompanied by a viability score based on the considerations specified in table 2. Table 2. Supervisory considerations for assigning a business model score Score Supervisory view Considerations 1 The business model and strategy pose a low level of risk to the viability of the institution. • The institution has a strong competitive position in its chosen markets and a strategy likely to reinforce this. • The institution generates strong and stable returns which are commensurate to the risk it takes on, given its risk appetite and funding structure and that are not driven by excessive risk-taking, or reliance on an unrealistic strategy. 26 EBA/GL/2025/04

48 Score Supervisory view Considerations • There are no material asset concentrations or unsustainable concentrated sources of income. • The institution has financial forecasts drawn up based on plausible assumptions about the future business environment. • The institution addresses strategic implications of material ESG risks, in particular environmental transition and physical risks, for its business model in the short, medium and long term through a robust transition planning process. • Strategic plans are appropriate given the current business model and management execution capabilities. 2 The business model and strategy pose a medium-low level of risk to the viability of the institution. • The institution faces competitive pressure on its products/services in one or more key markets. There is some doubt about its strategy to address the situation. • The institution generates average returns compared to peers and/or historic performance which are broadly commensurate to the risk it takes on, given its risk appetite and funding structure. • There are some asset concentrations or concentrated sources of income. • The institution has financial forecasts drawn up based on optimistic assumptions about the future business environment. • The institution broadly addresses strategic implications of material ESG risks, in particular environmental transition and physical risks, for its business model through an overall reasonable yet not fully robust transition planning process. • Strategic plans are reasonable given the current business model and management execution capabilities, but not without risk. 3 The business model and strategy pose a medium-high level of risk to the viability of the institution. • The institution has a weak competitive position for its products/services in its chosen markets and may have few business lines with good prospects. The institution’s market share may be declining significantly. There are doubts about its strategy to address the situation. • The institution generates returns that are often weak or unstable or not commensurate to the risk it takes given its risk appetite or funding structure and that raise supervisory concerns. • There are material asset concentrations or concentrated sources of income. • The institution has financial forecasts drawn up based on overly optimistic assumptions about the future business environment. • The institution addresses strategic implications of material ESG risks, in particular environmental transition and physical risks, for its business model only partially. Its transition planning process shows some weaknesses and/or deficiencies. • Strategic plans may not be plausible given the current business model and management execution capabilities. 4 The business model and strategy pose a high level of risk to the viability of the institution • The institution has a very poor competitive position for its products/services in its chosen markets and participates in business lines with very weak prospects. Strategic plans are very unlikely to address the situation. • The institution generates very weak and highly unstable returns or relies on an unacceptable risk appetite or funding structure to generate appropriate returns.

49 Score Supervisory view Considerations • The institution has extreme asset concentrations or unsustainable concentrated sources of income. • The institution has financial forecasts drawn up based on very unrealistic assumptions about the future business environment. • The institution is exposed to material ESG risks, in particular environmental transition and physical risks, and does not address strategic implications for its business model. Its transition planning process is inconsistent with the broader business strategy. Its transition planning process shows severe weaknesses and/or deficiencies. • Strategic plans are not plausible given the current business model and management execution capabilities. 71.The table below presents a non-exhaustive list of supervisory measures that competent authorities may take in case of identified deficiencies in the institution’s business model. Competent authorities should decide on the type of the supervisory measure based on its effectiveness to the specific identified deficiency. Competent authorities may apply additional supervisory measures (including quantitative measures in accordance with Article 104(1)(a) of the Directive 2013/36/EU) or a combination of them if these are deemed more appropriate to address the identified deficiencies. Table 3. Potential and non-exhaustive list of supervisory measures stemming from the BMA Potential supervisory measures for competent authorities in accordance with Article 104(1)(b), (d), (e), (f), (m), (n) of Directive 2013/36/EU – Competent authorities may require the institution to: A. adjust the financial plan assumed in the strategy, if it is not supported by internal capital planning or credible assumptions; B. make changes to organisational structures, reinforcement of risk management and control functions and arrangements to support the implementation of the business model or strategy; C. make changes to and reinforcement of IT systems to support the implementation of the business model or strategy; D. make changes to the business model or strategy; E. reduce the risk inherent in the products they originate/distribute, including requiring changes to the risks inherent in certain product offerings; and/or requiring improvements to the governance and control arrangements for product development and maintenance; D. reduce the risk inherent in its systems, including requiring improvements to the systems, or increasing the level of investment or speeding-up the implementation of new systems; and/or requiring improvements to the governance and control arrangements for system development and maintenance; G. reduce the risk inherent in their activities, including outsourced activities and requiring changes to or reduction of certain activities with a view to reducing their inherent risk; and/or requiring improvements to governance and control arrangements and oversight of outsourced activities; H. reduce ESG risks, in particular environmental risks, through adjustments to its business strategy, for which a reinforcement of the targets, measures, and actions included in the institution’s plan to be prepared in accordance with Article 76(2) of Directive 2013/36/EU could be requested.

50 5. Title 5. Assessing internal governance and institution-wide controls 5.1. General considerations 73.When assessing the internal governance and institution-wide controls, competent authorities should evaluate inter alia the compliance of the institution with the legal acts published separately on the EBA website as referred to in paragraph 12. 74.Competent authorities should assess the adequacy of the institution’s internal governance arrangements, taking into account the nature, scale and complexity of the risks inherent in the business model and the institution’s activities. Competent authorities should identify the extent to which the institution complies with the applicable legal and regulatory requirements regarding sound internal governance arrangements, including those listed in the previous paragraph, and identify any deficiencies. Competent authorities should assess whether material risks are posed due to poor internal governance arrangements and their potential effect on the risk profile, operational resilience and sustainability of the institution. For these purposes, the following areas should be assessed, in accordance with the proportionality principle and supervisory engagement outlined in Title 2: a. organisational structure, management body and its committees; b. risk culture and business conduct; c. remuneration policies and practices; d. internal control functions; e. risk management framework; f. ICT systems, risk data aggregation and risk reporting; g. ML/TF risks and prudential concerns; h. recovery planning governance. 75.Competent authorities should take into account ESG risks, giving priority to environmental transition and physical risks, when assessing the areas covered by points (a) to (f) of the previous paragraph. 76.The assessment of internal governance should inform the specific assessment of risk management and controls as specified in Titles 6 and 8, as well as the assessment of ICAAP and ILAAP in the SREP capital assessment (Title 7) and the SREP liquidity and funding assessment (Title 8). Likewise, a risk-by-risk analysis of ICAAP calculations/capital estimates reviewed under Title 7, and any deficiencies identified through that analysis, should inform the assessment of the overall ICAAP framework assessed under this Title.

51 77.As part of the overall assessment of internal governance and institution-wide controls, competent authorities should evaluate the institution’s ability to effectively and timely remedy the deficiencies identified and/or supervisory concerns expressed by competent authorities. In conducting this evaluation, competent authorities should consider whether the institution’s track record demonstrates its ability and intention to address supervisory concerns and/or identified deficiencies in an effective and timely manner, and whether this has been already taken into account in the assessment of other SREP areas. For this purpose, competent authorities should leverage the assessment of the following elements: a. the role of management body in (i) assessing the effectiveness of the institution’s governance arrangements, in particular relating to the remediation actions, and (ii) taking appropriate measures to address supervisory concerns and/or deficiencies (effective reaction to supervisory concerns); b. the risk culture within the institution; c. the adequacy and timeliness of information provided and exchanged with the competent authority; d. the quality of internal reporting on remediation actions to the management body, senior management and internal control functions; e. the role of internal control functions in reviewing the adequacy and effectiveness of the remediation actions undertaken. 78.When conducting the assessment of internal governance and institution-wide controls at subsidiary level, in addition to the elements listed in this title, competent authorities should assess whether group-wide policies and procedures are implemented consistently at subsidiary level, and whether group entities have taken appropriate measuresto ensure that their activities are compliant with all applicable laws and regulations. 5.2. Organisational structure, management body and its committees 79.In assessing the institution’s organisational structure, management body and committees, competent authorities should assess institution’s compliance with Articles 74, 88, and 91 of Directive 2013/36/EU, the EBA Guidelines on internal governance27 and the Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders28 . In the context of assessing the institution’s organisational and operational structure of the institution, and where applicable that of the group, competent authorities should consider inter alia whether: a. it is appropriately and clearly established, with well-defined, transparent and consistent lines of responsibility, including for the management body and its committees; b. it is suitable for the size and the complexity of the business and operations; 27 EBA/GL/2021/05 28 EBA/GL/2021/06

52 c. it is transparent to stakeholders, including staff and shareholders. 80. In the context of assessing the institution’s management body, competent authorities should consider inter alia whether: a. the management body knows and understands the institution’s legal, organisational and operational structure (‘know your structure’) and its risks, including appropriate oversight; b. where applicable, the management body of the consolidating institution understands both the organisation of the group and the roles of its different entities, and the links and relationships among them; c. the management body collectively has an appropriate understanding of the institution’s business model and activities, and remains up to date on sufficient knowledge and skills regarding relevant risks, including ICT risks, ESG risks and other emerging risks, through regular training; d. the institution has a policy to promote diversity and inclusion within the management body and regularly assesses these, including gender balance, and whether the composition, functioning and succession planning of the management board support effective decision￾making and reflect the institution’s diversity and inclusion objectives; e. the members of the management body interact effectively, including between its management and supervisory functions; f. each member of the management body acts with independence of mind, maintaining a sufficient time commitment and is appropriately informed of the institution’s risk situation; g. the management body in its supervisory function has established, where applicable, risk, audit, nomination and remuneration committees, and whether these committees fulfil their tasks as prescribed by the applicable legal and regulatory framework. 81.When reviewing the composition and functioning of the institution’s management body and its committees, competent authorities should also consider any relevant findings from the suitability assessments on the institution’s members of the management body and key function holders, performed by the institution, or where relevant by the competent authorities. Competent authorities should review the outcome of the institution’s process of identifying key function holders and evaluate the level of individual accountability by taking into account the individual statements regarding the roles and duties of all members of the management body in its management function, senior management, and key function holders, along with the mapping of duties, including details of the reporting lines, lines of responsibility, and the persons who are part of the governance arrangements of the institution, and their duties. 5.3. Risk culture and business conduct 82.In assessing the institution’s risk culture and business conduct, competent authorities should assess institution’s compliance with the EBA Guidelines on internal governance. In this context, competent authorities should consider inter alia whether:

53 a. the institution has consistent corporate values and a sound risk culture, which (i) are supported by effective and robust policies and procedures, communication and training to all staff, including a code of conduct and an appropriate framework for managing conflicts of interests and reporting mechanisms to foster responsible, ethical behaviour and to monitor and manage related party exposures, and (ii) promote an environment of open communication and effective challenge; b. the management body, senior management and key function holders are committed to promoting a strong risk and corporate culture and responsible business conduct; c. a strong level of risk awareness is demonstrated across the institution; d. the institution integrates risk awareness into its decision-making processes, including appropriate risk ownership. 83.Competent authorities should assess whether the institution has an appropriate framework in place to identify, document and manage related party transactions, including an approval process, exposure limits, arm’s length terms, monitoring and reporting mechanisms. Competent authorities should also evaluate the level of oversight by the management body. 5.4. Remuneration policies and practices 84.In assessing the institution’s remuneration policies and practices, competent authorities should assess institution’s compliance with Articles 74, 92, 94 of Directive 2013/36/EU, Delegated Regulation (EU) 2021/923 and the EBA Guidelines on sound remuneration policies29 . In this context, competent authorities should consider inter alia whether: a. the institution has implemented appropriate and gender-neutral remuneration policies and practices for all staff, approved, regularly reviewed and overseen by the management body, and whether these policies adhere to the applicable legal and regulatory requirements; b. the internal control functions are involved in the design of the remuneration policies and verify their proper review, monitoring and update; c. the remuneration policies and practices promote sound and effective risk management, including by taking into consideration the institution’s risk appetite in terms of ESG risks, and are consistent with the institution’s business and risk strategies, risk culture and corporate values, the long-term interests of the institution and conflicts of interest measures, and do not provide incentives for excessive risk-taking; d. the institution has correctly identified all its staff whose activities have a material impact on its risk profile in accordance with the applicable legal and regulatory requirements; e. the ratio of variable and fixed remuneration is appropriate, and the variable remuneration component does not exceed 100% of the fixed remuneration component (or 200% with shareholders’ approval) for the identified staff; f. the institution has made a proper allocation of the fixed and variable components, with no use of vehicles or practices to circumvent remuneration requirements; 29 EBA/GL/2021/04

54 g. variable remuneration is based on performance (considering both financial and non-financial criteria) and whether the institution adheres to related legal and regulatory requirements on deferral and retention periods, pay-out in instruments, and clawback and malus clauses. 5.5. Internal control functions 85.In assessing the institution’s internal control functions, competent authorities should assess institution’s compliance with the EBA Guidelines on Internal Governance and the relevant provisions of the Regulation (EU) 2022/2554 (DORA) 30 . In this context, competent authorities should consider inter alia whether: a. the institution has an appropriate internal control framework covering all areas, consistent with the ‘three lines of defence’ model, including well-functioning, effective and independent risk management, compliance and internal audit functions; b. the heads of internal control functions (i) are established at an adequate hierarchical level that provides them with the appropriate authority and stature needed to fulfil their responsibilities, (ii) have direct access and can report directly to the management body in its supervisory function, and (iii) have all the resources necessary to perform their tasks; c. the institution has adequate written internal control policies effectively implemented and a clear allocation of responsibilities for the implementation of the framework, segregation of duties, sound administrative and accounting procedures and robust reporting arrangements. 86.Competent authorities should assess whether the risk management function covers the whole institution, having a holistic view of all risks, is actively involved at an early stage in elaborating the institution’s risk strategy and monitors its effective implementation. Competent authorities should also determine whether the risk management function provides the management body with complete, updated and relevant risk-related information to enable setting the institution’s risk appetite level and related risk limits. Competent authorities should also consider the risk management function’s assessment of the robustness and sustainability of the risk strategy and appetite as well as its involvement in the evaluation of the impact of material changes or exceptional transactions on the institution’s and group’s (where applicable) overall risk. 87.Competent authorities should assess whether the compliance function effectively assesses and mitigates compliance risks arising from non-compliance with applicable legal and regulatory requirements, contractual obligations or internal rules and codes of conduct, including rules on ethics, and ensures that all material risk management decisions adequately take into account these risks. 88.Competent authorities should assess whether the internal audit function independently reviews and provides objective assurance, in accordance with the audit plan and detailed work 30 DORA - Regulation (EU) No 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU)No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p.1, ELI: http://data.europa.eu/eli/reg/2022/2554/oj).

55 programme, on the appropriateness and effectiveness of the institution’s policies, procedures and internal controls and on the compliance of all the institution’s activities, including activities provided by third-party service providers, with legal and regulatory requirements. Where applicable, competent authorities should assess whether the group-wide internal audit function is independent, has a group-wide risk-based audit plan, has appropriate resources and stature and has a direct reporting line to the management body of the consolidating institution. 5.6. Risk management framework 89.In assessing the institution’s risk management framework, competent authorities should assess institution’s compliance with the EBA Guidelines on Internal Governance, the DORA and other EBA Guidelines issued pursuant to Article 74(3) of Directive 2013/36/EU on internal governance arrangements, processes and mechanisms. In this context, competent authorities should consider inter alia whether: a. the institution has established an appropriate risk management framework and risk management processes, encompassing an appropriate and implemented risk strategy, risk appetite, including a third-party risk management policy, ICAAP and ILAAP frameworks and stress testing capabilities and results; b. where applicable, the group-wide risk management framework covers all material risks regardless of whether the risk arises from entities not subject to consolidation and establishes a comprehensive view on all risks the institution is or might be exposed to; c. the management body has the ultimate responsibility for the risk strategy, risk appetite and risk management framework and provides appropriate direction and oversight; d. the institution, and where applicable the consolidating institution, has documented and implemented an appropriate risk strategy and risk appetite, which cover all the institution’s material risks, contain risk limits and tolerances, and reflect the institution’s financial resources; e. the risk management framework establishes adequate procedures for risk identification, measurement, mitigation and monitoring and the extent to which it is embedded in, and how it influences, the overall strategy of the institution; f. the decision-making processes are clear, transparent and adequately documented, and take into account the appropriate risk considerations, and whether policies and amendments to policies are communicated in a proper and timely manner; g. there are appropriate and consistent links between the business strategy, risk strategy, digital operational resilience strategy, risk appetite and risk management framework, and the capital and liquidity management frameworks, as well as the institution’s plan to address ESG risks in accordance with Article 76(2) of Directive 2013/36/EU. 90.Competent authorities should assess whether the institution has in place a well-documented new product approval policy, approved by the management body, that addresses the development of new markets, products and services, and significant changes to existing ones, including exceptional transactions. Competent authorities should also consider whether the risk

56 management and compliance functions are appropriately involved in the assessment and approval of new products or significant changes to existing ones, with approvals linked to the adequacy of the respective controls. ICAAP and ILAAP frameworks 91.In assessing the institution’s ICAAP and ILAAP frameworks, competent authorities should assess institution’s compliance with the EBA Guidelines on ICAAP and ILAAP information31. The assessment of the institution’s ICAAP and ILAAP frameworks should encompass periodic review of the ICAAP and ILAAP and determine their soundness, effectiveness and comprehensiveness. In this regard, competent authorities should: a. assess how ICAAP and ILAAP are integrated into the institution’s overall risk management and strategic management practices, including capital and liquidity planning, as well as the extent of their forward-looking nature; b. consider the appropriateness of the ICAAP and ILAAP to assess and maintain an adequate level of internal capital and liquidity to cover the institution’s risks and to take sound business decisions (e.g. in relation to allocating capital under the business plan), including under stressed conditions; c. assess whether the ICAAP and ILAAP are embedded into the decision-making and management processes at all levels in the institution (e.g. limit setting, performance measurement); d. verify whether the ICAAP and ILAAP frameworks are subject to regular oversight by the management body, including the approval of these frameworks and their outcomes; e. assess whether the ICAAP and ILAAP are consistently and proportionately implemented in all the institution’s business lines and legal entities and cover all material risks to which the institution is or might be exposed to; f. assess compliance with related legal and regulatory requirements and also consider whether institution’s ICAAP identifies emerging risks and/or low-probability, high-impact risks, including ICT risks, environmental risks and geopolitical uncertainties; g. assess whether any deviations from the institution’s standard ICAAP or ILAAP for one or more of its legal entities or business lines are justified. 92.These assessments should contribute to the determination of P2R and to the assessment of capital adequacy as outlined in Title 7, as well as to the evaluation of liquidity and funding adequacy as outlined in Title 8. Assessment of institution’s stress testing 93.In assessing the institution’s stress testing, competent authorities should assess institution’s compliance with the EBA Guidelines on stress testing32 and the EBA Guidelines on environmental 31 EBA Guidelines on ICAAP and ILAAP information collected for SREP purposes (EBA/GL/2016/10). 32 EBA Guidelines on stress testing (EBA/GL/2018/04).

57 scenario analysis for the integration of environmental risks. This assessment encompasses the review of the institution’s stress testing programme, taking into account the size and internal organisation, and the nature, scale and complexity of the activities of the institution. 94.Competent authorities should perform a qualitative assessment of the institution’s stress testing programme, as well as a quantitative assessment of the results of stress tests. Competent authorities should consider the outcomes of qualitative and quantitative assessments together with the results of supervisory stress tests (see Title 11) for the purposes of assessing capital and liquidity adequacy and determining the appropriate supervisory response to the deficiencies identified. If the stress testing review identifies deficiencies in the institution’s governance and institution-wide controls, these should be considered by competent authorities in the assessment of these areas. Furthermore, the results of an institution’s stress tests can be used for the assessment of the institution’s capital planning, and in the quantification of liquidity requirements for the assessment of liquidity adequacy. 95.Competent authorities should assess the extent to which stress testing is embedded in the institution’s risk management framework, including how stress testing is considered in the processes of setting up the institution’s risk appetite and limits. Furthermore, competent authorities should assess the involvement of institution’s senior management and management body in the stress testing programme, including the related internal reporting, and the degree of integration of stress testing and its outcomes into the decision-making processes. 96.When assessing the stress testing programme, the results of stress tests and proposed management actions, competent authorities should consider both idiosyncratic and system￾wide perspectives. Competent authorities should consider the feasibility of management actions in stress situations, including whether the timelines for the implementation of the actions are realistic and consider the idiosyncrasies of the institution. For the review of stress testing programmes of cross-border groups, competent authorities should take into account potential barriers to the transferability of capital and liquidity within groups and the functioning of any intra-group financial support arrangements, which may arise in stressed conditions. 97.Competent authorities should assess the results of stress tests33 and whether the institution is able to maintain the applicable TSCR, at all times, in an adverse scenario and if it has identified a set of management actions to address any potential breaches of the TSCR. Competent authorities should also consider the impact of stress tests on the institution’s leverage ratio, as well as its eligible liabilities held for the purposes of minimum requirements for eligible liabilities (MREL) as referred to in Directive 2014/59/EU. 98.In the assessment of stress test results, competent authorities should also consider all known future regulatory changes affecting the institution within the scope and the time horizon of the stress test exercise. 33 For the purposes of this paragraph, stress tests do not extend to reverse stress tests.

58 5.7. ICT systems, risk data aggregation and risk reporting 99. Competent authorities should assess whether the institution’s ICT systems are reliable, resilient and adequate to measure, assess and report on the size, composition and quality of exposures across all the institution’s risk types, products and counterparties and fully support risk data aggregation capabilities at normal times and times of stress. 100. Competent authorities should verify whether the institution develops and maintains appropriate risk data aggregation and risk reporting capabilities commensurate with its risk profile and systemic importance. When reviewing the institution’s risk data aggregation and risk reporting capabilities, competent authorities should take into account the BCBS 239 principles for effective risk data aggregation and risk reporting34 for supervised institutions that fall under the scope of those principles. In particular, competent authorities should assess whether the institution is able to generate accurate, consistent, complete and reliable risk data and reporting for the entire institution, capturing all material risks, and appropriately reflecting the institution’s risk profile and capital and liquidity needs, and whether these can be aggregated and made available in a timely and flexible manner to the management body and senior management. Where applicable, competent authorities should assess whether the institution has established an effective group-wide management information and reporting system applicable to all business units and legal entities, and this information is available to the management body of the institution’s parent undertaking on a timely basis. 101. Competent authorities should determine whether the management body of the institution approves the institution’s risk data aggregation and risk reporting framework and oversees its effective implementation, including deployment of adequate resources to support these efforts. Competent authorities should also assess whether the institution’s risk data aggregation capabilities and risk reporting practices are independently validated in accordance with the institution’s internal control framework. 5.8. ML/TF risks and prudential concerns 102. When analysing the internal governance framework and institution-wide controls, competent authorities should also take into account the assessments received from AML/CFT supervisors and evaluate whether these give rise to prudential concerns. Conversely, where the competent authority’s assessment indicates the shortcomings in an institution’s internal controls and governance framework and institution-wide controls give rise to prudential concerns related to ML/TF risk and risks of non-implementation and evasion of targeted financial sanctions, competent authorities should share the outcome of that assessment with AML/CFT supervisors. 103. Competent authorities should assess whether the institution’s overall internal governance and risk management framework includes also the management of the ML/TF risks and the risks of non-implementation and evasion of targeted financial sanctions. 34 Basel Committee on Banking Supervision Principles for effective risk data aggregation and risk reporting (BCBS 239).

59 104. Competent authorities should assess from a prudential perspective whether the roles and responsibilities of the management body with regard to the AML/CFT framework are being complied with. Competent authorities should take into account any supplementary information received from the AML/CFT supervisors following their assessment in line with the EBA Guidelines on policies and procedures in relation to compliance management and the role and responsibilities of the AML/CFT Compliance Officer35 . 5.9. Recovery planning governance 105. To assess internal governance and institution-wide controls, competent authorities should consider findings and deficiencies identified in the assessment of the recovery planning governance framework conducted in accordance with Articles 6 and 8 of Directive 2014/59/EU. 106. Similarly, findings identified from the assessment of the SREP elements, including internal governance and institution-wide control arrangements, should inform the assessment of institution’s recovery plans. 5.10. Summary of findings, scoring and supervisory measures 107. Following the above assessment, competent authorities should form a view on the adequacy of the institution’s internal governance arrangements and institution-wide controls. This view should be reflected in a summary of findings, accompanied by a viability score based on the considerations specified in table 4. Table 4. Supervisory considerations for assigning a score for internal governance and institution-wide controls Score Supervisory view Considerations 1 Deficiencies in internal governance and institution-wide control arrangements pose a low level of risk to the viability of the institution. • The institution has a robust and transparent organisational structure with clear responsibilities and separation of risk-taking from risk management and control functions. • The composition and functioning of the management body are appropriate. • The time commitment of the management body members is appropriate and they comply with the limitation on the number of directorships, where relevant. • There is a sound risk culture and business conduct, including management of conflicts of interest and whistleblowing processes. • The institution has adopted a diversity policy that fosters a diverse management body composition and complies with the targets set. • The remuneration policy is in line with the institution’s risk strategy and long-term interests. 35 EBA/GL/2022/05

60 Score Supervisory view Considerations • The risk management framework and risk management processes, including the ICAAP, ILAAP, NPAP, stress testing framework, capital planning and liquidity planning, are appropriate. • The internal control framework and internal controls are appropriate. • The risk management, compliance and internal audit functions are independent, operate effectively, have sufficient resources, and the internal audit function operates in accordance with established international standards and requirements. • ICT systems, risk data aggregation and risk reporting are appropriate. • The integration of ESG risks into the internal governance and risk management framework is appropriate. • The recovery planning governance framework is appropriate. • The institution addresses swiftly identified deficiencies and/or concerns expressed by competent authorities and effectively remediates them within a short timeframe providing satisfactory outcomes. Additionally, the institution proactively reports and informs the competent authorities throughout this process. 2 Deficiencies in internal governance and institution-wide control arrangements pose a medium-low level of risk to the viability of the institution. • The institution has a largely robust and transparent organisational structure with clear responsibilities and separation of risk￾taking from risk management and control functions. • The composition and functioning of the management body are largely appropriate. • The time commitment of the management body members is largely appropriate, and, where relevant, they comply with the limitation on the number of directorships. • There is a largely sound risk culture and business conduct, including management of conflicts of interest and whistleblowing processes. • The institution has adopted a diversity policy that fosters a diverse management body composition, and largely complies with the targets set or has implemented appropriate measures to achieve the targets set in the policy. • The remuneration policy is largely in line with the institution’s risk strategy and long-term interests.

61 Score Supervisory view Considerations • The risk management framework and risk management processes, including the ICAAP, ILAAP, NPAP, stress testing framework, capital planning and liquidity planning, are largely appropriate. • The internal control framework and internal controls are largely appropriate. • The risk management, compliance and internal audit functions are independent and their operations are largely effective. • ICT systems, risk data aggregation and risk reporting are largely appropriate. • The integration of ESG risks into the internal governance and risk management framework is largely appropriate. • The recovery planning governance framework is largely appropriate. • The institution is able to adequately address most of the deficiencies identified and/or concerns expressed by competent authorities, within an acceptable timeframe and – where applicable – complies with the reporting requirements set by the competent authorities in relation to these deficiencies. 3 Deficiencies in internal governance and institution-wide control arrangements pose a medium-high level of risk to the viability of the institution. • The institution’s organisational structure and responsibilities are not fully transparent and risk-taking is not fully separated from risk management and control functions. • There are doubts about the appropriateness of the composition and functioning of the management body. • There are doubts about the appropriate time commitment of the management body member and where relevant they do not comply with the limitation on the number of directorships. • There are doubts about the appropriateness of the risk culture and business conduct, including management of conflicts of interest and/or whistleblowing processes. • The institution has not adopted a diversity policy and has not implemented measures to achieve an appropriate level of diversity within the management body. • There are concerns that the remuneration policy may not be aligned with the institution’s risk strategy and long-term interests. • There are doubts about the appropriateness of the risk management framework and risk management processes, including the ICAAP,

62 Score Supervisory view Considerations ILAAP, NPAP, stress testing framework, capital planning and/or liquidity planning. • There are doubts about the appropriateness of the internal control framework and internal controls. • There are doubts about the independence and effective operation of the risk management, compliance and internal audit functions. • There are doubts about the appropriateness of ICT systems, risk data aggregation and risk reporting. • There are doubts about the appropriateness of the integration of ESG risks into the internal governance and risk management framework. • The recovery planning governance framework was assessed as potentially having material deficiencies and/or having material impediments to its effective implementation and supervisory concerns have not been fully addressed. • The institution faces significant challenges or demonstrates limited intention to adequately address the deficiencies identified and/or concerns expressed by competent authorities, in terms of the quality of the remediation actions and/or the timeframe for their implementation, which might indicate the need for escalation. The institution also has challenges in reporting on its remediation status to competent authorities. 4 Deficiencies in internal governance and institution-wide control arrangements pose a high level of risk to the viability of the institution. • The institution’s organisational structure and responsibilities are not transparent and risk￾taking is not separated from risk management and control functions. • The composition and functioning of the management body are inappropriate. • The time commitment of the management body members is insufficient, and, where relevant, they do not comply with the limitation on the number of directorships. • The risk culture and business conduct, including management of conflicts of interest and/or whistleblowing processes are inappropriate. • The institution has not adopted a diversity policy, the management body is not diverse and the institution has not implemented measures to aim for an appropriate level of diversity.

63 Score Supervisory view Considerations • The remuneration policy is not aligned with the institution’s risk strategy and long-term interests. • The risk management framework and the risk management processes, including the ICAAP, ILAAP, NPAP, stress testing framework, capital planning and/or liquidity planning, are inappropriate. • The risk management, compliance and/or internal audit functions are not independent, not operating effectively and/or the internal audit function is not operating in accordance with established international standards and requirements. • The internal control framework and internal controls are inappropriate. • The ICT systems, risk data aggregation and risk reporting are inappropriate. • The integration of ESG risks into the internal governance and risk management framework is inappropriate. • The recovery planning governance framework was assessed as having material deficiencies and/or having material impediments to its effective implementation and supervisory concerns have not been fully addressed. • The institution is unable or does not intend to adequately address deficiencies identified and/or concerns expressed by competent authorities and lacks the capability to remedy them within an acceptable timeframe, following escalation from competent authorities. The institution also has severe challenges in reporting on its remediation status to competent authorities. 108. The table below presents a non-exhaustive list of supervisory measures that competent authorities may take in case of identified deficiencies in institution’s internal governance and institution-wide controls. Competent authorities should decide on the type of supervisory measure based on its effectiveness towards the specific identified deficiency. Competent authorities may apply additional supervisory measures or a combination of these with the ones listed in the table below, if these are deemed more appropriate to address the identified deficiencies. For breaches of DORA, competent authorities should consider the applicable corrective and remedial measures provided in Article 50 of DORA.

64 Table 5. Potential and non-exhaustive list of supervisory measures stemming from the assessment of institution’s internal governance and institution-wide controls Potential supervisory measures for competent authorities in accordance with Article 104(1) points (b), (d), (e), (f), (g), (j), (l, (m), and (n) of Directive 2013/36/EU and Article 50 of Regulation (EU) 2022/2554 – Competent authorities may require the institution to: A. enhance and have a more active involvement of the management body or its committees; B. develop and implement corrective action plans to address deficiencies; C. strengthen internal controls; D. improve the internal governance framework; E. enhance reporting mechanisms and oversight; F. limit variable remuneration; G. implement compliance management systems; H. have additional or more frequent reporting requirements; I. reinforce specific arrangements, processes, mechanisms and strategies; J. reperform stress tests using modified assumptions; K. enhance governance and risk management arrangements applied to ESG risks, in particular environmental risks.

65 6. Title 6. Assessing risks to capital 6.1. General considerations 109. Competent authorities should assess and score the risks to capital that have been identified as material for the institution. 110. The purpose of this title is to provide common methodologies to be considered for assessing individual risks and risk management and controls. It is not intended to be exhaustive and gives leeway to competent authorities to take into account other additional criteria that may be deemed relevant based on their experience and the specific features of the institution. 111. This title provides competent authorities with guidance for the assessment and scoring of the following risks to capital: a. credit and counterparty risk; b. market risk; c. operational risk; d. interest rate risk from non-trading activities (IRRBB). 112. The title also identifies a set of subcategories within each risk category above, which need to be taken into account when risks to capital are assessed. Depending on the materiality of any these subcategories to a particular institution, they can be assessed and scored individually. Annexes I-IV present non-exhaustive lists of sub-categories for credit risk, market risk, operational risk and IRRBB that competent authorities should consider, when relevant. 113. The decision on materiality depends on the supervisory judgement. However, for FX lending risk, in light of the ESRB Recommendation on lending in foreign currencies36, materiality should be determined taking into account the following threshold: loans denominated in foreign currency to unhedged borrowers constitute at least 10% of an institution’s total loan book (total loans to non-financial corporations and households), where such a total loan book constitutes at least 25% of the institution’s total assets. 114. Competent authorities should also assess other risks that are identified as material to a specific institution but are not listed above (e.g. pension risk, strategic and business risk, step-in risk, intra- and inter-risk concentration). The following may assist with the identification process: a. drivers of TREA; b. risks identified in the institution’s ICAAP; 36 Recommendation of the European Systemic Risk Board of 21 September 2011 on lending in foreign currencies (ESRB/2011/1) (OJC 342, 22.11.2011, p.1).

66 c. risks arising from the institution’s business model (including those identified by other institutions operating a similar business model); d. information stemming from the monitoring of key indicators; e. findings and observations from internal or external audit reports; f. recommendations and guidelines issued by the EBA, as well as warnings and recommendations issued by macroprudential authorities or the ESRB. 115. The above elements should also be taken into account by competent authorities when they are planning the intensity of their supervisory activity in relation to the assessment of a specific risk. 116. For credit, market and operational risk, competent authorities should evaluate inter alia the compliance of the institution with the legal acts published separately on the EBA website as referred to in paragraph 12. However, these guidelines extend the scope of the assessment beyond those minimum requirements to allow competent authorities to form a comprehensive view on risks to capital. 117. When evaluating risks to capital, competent authorities should also consider the potential impact of funding cost risk following the methodology included in Title 8 and may decide on the necessity of measures to mitigate this risk. 118. In their implementation of the methodologies specified in this title, competent authorities should identify relevant quantitative indicators and other metrics, which could also be used to monitor key indicators, as specified in Title 3, and should also consider, when appropriate, institutions’ internal risk measures. 119. For each material risk, competent authorities should assess and reflect in the risk score: a. inherent risk (risk exposures); b. the quality and effectiveness of risk management and controls. 120. This assessment flow is represented in figure 2 below. Figure 2. Assessment workflow for risks to capital

67 121. When performing their assessments, competent authorities should use available information sources, including regulatory reporting, the institution’s internal metrics and reports (e.g. internal audit report, risk management reports, information from the ICAAP), on-site inspection reports and external reports (e.g. the institution’s communications to investors, rating agencies). Competent authorities should resort to ad-hoc reporting where it is strictly necessary and proportionate to carry out their supervisory tasks, and where the information is not duplicative or otherwise available, in accordance with the second subparagraph of Article 104(2) of the CRD. While the assessment is intended to be institution-specific, comparison with peers should be considered to identify potential exposure to risks to capital. For such purposes, peers should be defined on a risk-by-risk basis and might differ from those identified for BMA or other analyses. 122. In the assessment of risks to capital, competent authorities should also evaluate the accuracy and prudency of the calculation of minimum own fund requirements to identify situations where minimum own funds calculations may underestimate the actual level of risk. This assessment would inform the determination of the P2R as provided in section 7.2.3. 123. The outcome of the assessment of each material risk should be reflected in a summary of findings that provides an explanation of the main risk drivers, and a risk score, as specified in the following sections. 6.2. Assessment of credit and counterparty risk 6.2.1. General considerations 124. When assessing the credit risk management framework, competent authorities should evaluate the compliance of the institution with the legal acts published separately on the EBA website as referred to in paragraph 12. 125. Competent authorities should assess credit risk arising from all non-trading book exposures (including off balance sheet items). They should also assess the counterparty credit risk and the settlement risk that could fall under both non-trading and trading books. In order to perform such assessment, competent authorities should consider all the components that determine potential credit losses, and in particular: a. the probability of a credit event (i.e. default), or correlated credit events, that mainly concerns the borrowers and their ability to repay relevant obligations; b. the size of exposures subject to credit risk; c. the recovery rate of the credit exposures in the event of borrowers defaulting. 126. Competent authorities should take into account the possibility that these components may deteriorate over time and worsen compared to expected outcomes. 127. Competent authorities should assess the impact of ESG risks on the inherent credit risk as well as the adequacy of the credit risk controls related to ESG risks, giving priority to environmental

68 risks. In particular, competent authorities should consider environmental transition and physical risks when carrying out the assessment of credit concentration risk and real estate risk, as well as when assessing credit risk in specific portfolios or exposure classes considered as materially exposed to environmental risks. 128. In addition, competent authorities should also pay attention to consideration given to ML/TF risks within the context of the credit-granting process, including whether the institution has systems and controls in place to ensure funds used to repay loans are from legitimate sources. 6.2.2. Assessment of inherent credit risk Identification of material sources of credit risk 129. Competent authorities should assess credit risk from both a current and forward-looking perspective, integrating the analysis of the current portfolio’s credit risk with the assessment of the institution’s credit risk strategy, risk appetite and risk limits (potentially as part of the wider assessment of strategy carried out as part of the BMA). Competent authorities should also consider how the expected, as well as the stressed, macro-economic developments could affect those elements. 130. To assess the inherent credit risk of an institution, competent authorities should first identify its credit risk exposure. To achieve this and ensure consistent identification of the sources of credit risk the institution is or might be exposed to, they should consider the following sources of information: a. regulatory reporting templates, such as COREP and FINREP, taking into account the relevant regulatory exposure classes based on the institution’s approach to own funds requirements (i.e., standardised or IRB); b. insights gained from the assessment of other SREP elements (such as the BMA) and from prior supervisory activities; c. comparisons of the institution’s position with its peers, where available. In particular, for institutions using the internal ratings-based approach, competent authorities should consider the result of the supervisory benchmarking exercise carried in accordance with Article 78 of Directive 2013/36/EU. 131. Competent authorities should focus their assessment primarily on the most significant identified sources of credit risk, evaluating their materiality for the institution from a prudential perspective. To conduct this assessment, they should consider the following elements: a. the credit risk strategy and appetite and relevant limits; b. the amount of exposure value for the considered portfolio, compared to the total exposure value of credit exposures, including its growth over time; c. the amount of own funds requirement for credit risk for the considered portfolio compared to the total own funds requirement, including its growth over time;

69 d. where relevant, the internal capital allocated for credit risk for the considered portfolio by the institution compared to the total internal capital; e. the composition and quality of the institution’s on- and off-balance sheet credit-related items in the performing (including forborne exposure) and non-performing portfolio, including the level and change over time of impairments and write-offs and of the default rates of the credit portfolio. 132. Competent authorities should assess the materiality of the risk in relation to the current portfolio, as well as with an historical and forward-looking perspective (previous change in these figures and forecasts, where available). 133. As additional source of information for the materiality assessment, competent authorities should – where available and appropriate – consider the internal credit risk parameters used by the institution. This includes assessing their adequacy in accurately quantifying credit risk exposures across different portfolios, with particular attention to evidence from the yearly report produced by the validation function of the institution, and more specifically on backtesting outcomes – that is, comparing estimated parameters with observed outcomes as conducted by the institution. Competent authorities should place emphasis on portfolios where the estimated parameters have underestimated the observed outcomes. 134. Competent authorities should also consider the results of stress tests performed by the institution to identify any previously unidentified sources of credit risk, such as those emerging from changes in credit quality, credit concentrations, collateral value and credit exposure during a stressed period. 135. Based on the materiality assessment performed in the previous paragraphs, as well as the size and complexity of the institution’s credit risk and credit portfolio, competent authorities should choose the relevant level of details for the assessment. Nature, size and composition of the institution’s credit portfolio (on- and off-balance sheet credit-related items) 136. Competent authorities should assess the nature of the credit exposures (i.e. the types of borrowers and exposures) and analyse the composition of the institution’s credit portfolio. In performing this assessment, competent authorities should also consider how the nature of credit risk exposure can affect the size of exposure (e.g. credit lines/undrawn commitments drawn down by borrowers, foreign currency denomination), taking into consideration the institution’s legal capacity to unilaterally cancel undrawn amounts of committed credit facilities.

70 137. To assess the nature of credit risk, competent authorities should consider at least the following subcategories of credit risk by carrying out a more detailed assessment of those subcategories which are considered most relevant for the institution37: a. credit concentration risk; b. counterparty credit risk and settlement and delivery risk; c. country risk; d. credit risk from securitisations; e. FX lending risk; f. real estate risk; g. equity risk in the banking book; h. dilution risk; i. model risk for regulatory approved models. 138. Where specialised lending exposures are deemed material, competent authorities should assess such exposures separately from other lending activities, given that the risk of such exposures lies in the profitability of the asset or project financed (e.g. commercial real estate, energy plant, shipping, commodities) rather than the borrower (which is generally a special purpose vehicle). In conducting this assessment, competent authorities should consider: a. the profitability of the projects and the conservativeness of the assumptions underlying the business plans (including the credit risk of the main customers); b. the impact of changes in regulation, especially for subsidised sectors, on future cash flows; c. the impact of changing market demand, where relevant, and the existence of a market for the potential future sale of the object financed; d. the existence of a syndicate or of other lenders sharing the credit risk; e. any form of guarantee pledged by the sponsors; f. the potential increase in concentration risk that these activities may entail. Portfolio credit quality 139. When assessing portfolio credit quality, competent authorities should pay particular attention to the adequacy of the classification of credit exposures and assess the impact of potential misclassification, with the subsequent delay in the provisioning and recognition of losses by the institution. 140. Competent authorities should carry out an analysis to distinguish between performing, non￾performing and forborne exposure categories, considering both the number of obligors and the relevant amounts/volumes. Competent authorities should assess the overall credit quality at portfolio level and the different quality grades within each of the above categories to 37 Please refer to Annex I for a non-exhaustive breakdown of credit risk sub-categories and further details on their assessment.

71 determine the institution’s overall credit risk. As part of this assessment, competent authorities should analyse default and migration risk by exposure classes, taking into account trends in the credit quality over time, and they should consider whether the actual portfolio credit quality is consistent with the stated risk appetite and establish reasons for any deviations. 141. This should result in an overall assessment on the end-to-end credit cycle of the institution, from origination through the monitoring and management of each exposure categories. In conducting these analysis, competent authorities should employ peer comparison and use benchmark portfolios (i.e. portfolios of borrowers common to groups of institutions) where appropriate and possible. This analysis should be carried out taking into account: a. asset quality indicators, historical trends and grow rates by types of borrowers, sectors and product, borrowers’ credit grade distribution, historical migration rates across credit grades, delinquency and default rates for different time horizons; b. the non-performing rates and coverage per portfolio, sector, geography and changes over time, also taking into account the relevant inflows/outflows from each relevant portfolio, the distribution of the exposures across classes of non-performing exposures (i.e. past-due, doubtful), the level and change over time of impairments and write-offs for each relevant driver, historical recovery rates and the duration of the recovery process, foreclosed assets and changes over time, as well as the time since exposures were classified as non￾performing. 142. Competent authorities should assess whether the level of loan loss provisions and credit valuation adjustments are appropriate for the quality of the exposures and, where relevant, for the level of collateral, assessing in particular whether the level of loan loss provisions is consistent with the level of risk in different portfolios, over time and compared with the institution’s relevant peers as well as relevant macro-economic developments and whether the credit valuation adjustments to derivatives’ market values reflect the creditworthiness of relevant counterparties. Where deemed necessary, competent authorities should use on-site inspections or other appropriate supervisory actions to assess whether or not the level of loan loss provisioning and risk coverage is adequate, by assessing a sample of loans, for example. When conducting such assessment, competent authorities should also consider any findings raised by internal and external auditors, where available. 143. When evaluating the inherent credit risk of an institution, competent authorities should also take into account the results of stress tests performed by the institution to identify any previously unidentified sources of credit risk, such as those emerging from changes in credit quality, credit concentrations, collateral value and credit exposure during a stressed period. Level and quality of the credit risk mitigation framework 144. Competent authorities should consider the level and quality of guarantees (including credit derivatives) and of available collateral that would mitigate credit losses where credit events

72 occur, including those not accepted as eligible credit risk mitigation techniques for own funds calculations. In performing such assessment, competent authorities should consider: a. the coverage provided by collateral and guarantees by portfolio, borrower type, rating, sector, and other relevant aspects; b. collateral values, for performing and non-performing exposures; c. historical recovery ratios by type and amount of collateral and guarantees. 145. Competent authorities should also assess the materiality of the residual risk (as referred to in Article 80 of Directive 2013/36/EU) and in particular the adequacy and enforceability of collateral agreements and of guarantees, the timing and the ability to realise collateral and execute guarantees under the national legal framework, the liquidity and volatility in asset values for collateral and the recoverable value of collateral under any credit enforcement actions. Competent authorities should also assess the concentration of guarantors and collateral, as well as the correlation with borrowers’ creditworthiness (i.e. wrong-way risk) and the potential impact in terms of the effectiveness of protection. ESG factors 146. When assessing the impact of ESG risks and environmental risks in particular on the inherent credit risk, competent authorities should aim at taking into account the specific characteristics of these risks such as their forward-looking nature and distinct impacts over various time horizons, recognising the uncertainties associated with long-term projections while developing their capacity to factor in these characteristics into their assessment. 6.2.3. Assessment of credit risk management and control framework 147. To achieve a comprehensive understanding of the institution’s credit risk profile, competent authorities should review the institution’s credit risk management and control framework and its adequacy with respect to the inherent credit risk exposures. For this assessment, competent authorities should also rely on the outcome coming from the assessment of other SREP elements (such as the BMA and governance areas). For institutions subject to the application of the NPE (reduction) strategies and the associated governance and operational guidance, competent authorities should also assess whether institutions meet specific requirements set out in the relevant EBA guidelines for such strategies and their operationalisation, including with respect to meeting the consumer protection obligations. Credit risk strategy and appetite 148. Competent authorities should assess whether the institution has a sound, clearly formulated and documented credit risk appetite, strategy and limits approved by the management body. For this assessment, among other factors, competent authorities should take into account the role of the management body in setting, approving and reviewing the credit risk strategy and appetite, the proper implementation of this strategy by the senior management as well as its

73 appropriateness for the institution given its business model, overall risk appetite, current and prospective market environment and financial condition. Organisational and internal control framework 149. Competent authorities should assess whether the institution has an appropriate organisational framework and governance arrangements to enable effective credit risk taking, management, measurement and control, with sufficient (both qualitative and quantitative) human and technical resources to carry out the required tasks. They should in particular assess whether the institution’s management body and senior management understand the assumptions underlying the credit measurement system. For this assessment, competent authorities should take into account the adequacy of the lines of responsibility, as well as staffs’ skills and experience to perform their tasks, for taking on, measuring, monitoring and reporting credit risk, including management of NPEs, and in particular NPE workout, and finally the existence of a clear separation between risk-takers and risk managers. 150. Competent authorities should assess whether the institution has appropriate policies and procedures for the credit granting, identification, measurement, reporting and control of credit risk and whether these are consistent with the institution’s credit risk strategy and cover all the main businesses and processes. This includes the assessment of whether these policies are clearly formalised, communicated and applied consistently across the institution and the banking group it belongs to. For this assessment, competent authorities should take into account whether the management body approves these policies and discusses and reviews them regularly, in line with risk strategies as well as whether senior management is responsible for drawing up and implementing the policies and procedures, as defined by the management body. 151. Competent authorities should assess whether the institution has an appropriate framework for identifying, understanding, measuring, monitoring and reporting credit risk, in line with the institution’s size and complexity. In this regard, competent authorities should consider whether the institution has adequate data infrastructure and whether analytical techniques are appropriate to enable the institution to adequately manage their credit risk, and to fulfil supervisory reporting requirements, and to detect, measure and regularly monitor the credit risk inherent in all on- and off-balance-sheet activities (where relevant at group level). 152. Competent authorities should assess whether the institution’s management body and senior management understand the assumptions underlying the credit measurement system and whether they are aware of the degree of relevant model risk. They should assess whether the institution has undertaken stress testing to understand the impact of adverse events on its credit risk exposures and on the adequacy of its credit risk provisioning, by considering the stress test frequency, relevant risk factors identified, assumptions underlying the stress scenario; and the internal use of stress testing outcomes for capital planning and credit risk strategies.

74 153. Competent authorities should assess whether the institution has defined and implemented continuous and effective monitoring of credit risk exposures (including credit concentration) throughout the institution, amongst others, by means of specific indicators and relevant triggers to provide effective early warning alerts. Competent authorities should assess whether the institution has implemented regular reporting of credit risk exposures, including the outcome of stress testing, to the management body, senior management and the relevant credit risk managers. 154. Competent authorities should assess whether the institution has a strong and comprehensive internal control framework and sound safeguards to mitigate its credit risk in line with its credit risk strategy and appetite. For this assessment, competent authorities should in particular pay attention to the adequate scope covered by the institution’s control functions (including all consolidated entities, geographical locations and credit activities), to the existence of operating limits and other practices aimed at keeping credit risk exposures within levels acceptable to the institution in accordance with its risk appetite and limits. For this purpose, competent authorities should pay particular attention to whether institution has appropriate internal controls and practices to ensure that breaches of (or exceptions to) policies, procedures and limits are reported in a timely manner to the appropriate level of management for action, including checks to identify, assess and manage ML/TF risks to which the institution is exposed as a result of the credit granting activities. 155. In conducting this assessment, competent authorities should consider whether the limit system is adequate for the institution’s complexity and its capacity to measure and manage credit risk. This includes assessing whether the limits established are absolute or whether breaches thereof may occur. In the latter case, the institution’s policies should clearly describe the period of time during which and the specific circumstances under which such breaches of limits are possible. Furthermore, competent authorities should assess the adequacy of the procedures in place to keep credit managers informed about their limits, as well as whether such limits are subject to regular review and updates (e.g. to remain aligned with changes in strategy). 156. Competent authorities should also assess the functionality of the internal audit function in terms of adequacy, scope and frequency of internal audits on the credit risk management framework. These audits should capture the review of the main elements of credit risk management, measurement and controls framework across the institution and the adherence to relevant external regulations of the internal policies and procedures and any deviations from either. 157. For institutions adopting an internal rating-based approach to determining minimum own funds requirements for credit risk, competent authorities should also assess whether the internal validation process is sound and effective in challenging model assumptions and identifying any potential shortcomings with respect to the credit risk management system. This assessment should be based – where available – on the information stemming from already performed supervisory activities on internal models (such as onsite inspections) and

75 taking into account the supervisory practices detailed in the EBA Supervisory handbook for the validation of internal ratings-based systems38 . 6.2.4. Summary of findings, scoring and supervisory measures 158. Following the above assessment, competent authorities should form a view on the institution’s credit and counterparty risk. This view should be reflected in a summary of findings, accompanied by a risk score based on the considerations specified in table 6. Where, based on the materiality of certain risk sub-categories, the competent authority decides to assess and score them individually, the guidance provided in this table should be applied, as far as possible, by analogy. Table 6. Supervisory considerations for assigning a credit and counterparty risk score Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls 1 There is a low risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls. • The nature and composition of credit risk exposure imply non￾material risk/very low risk. • Exposure to complex products and transactions is not material/very low. • The level of credit concentration risk is not material/very low. • The level of forborne and non￾performing exposures is not material/very low. • The credit risk posed by performing exposures is not material/very low. • The impact of ESG risks, in particular environmental transition and physical risks, on credit risk is not material/very low. • The level of coverage of provisions and of credit valuation adjustments are adequate and reliable to a very high level of certainty. • The level of coverage and quality of guarantees and collateral are very high. • Risk management and controls are adequate with respect to the requirements set out in the relevant EBA Guidelines. • There is consistency between the institution’s credit-risk policy and strategy and its overall strategy and risk appetite. • The organisational framework for credit risk is robust with clear responsibilities and separation of tasks between risk takers and management and control functions. • Credit-risk measurement, monitoring and reporting systems are appropriate. • Internal limits and the control framework for credit risk are sound. • Limits allowing the credit risk to be mitigated or limited are in line with the institution’s credit risk management strategy and risk appetite. • ESG risks, in particular environmental transition and physical risks, are properly integrated into the credit risk management and controls. 2 There is a medium￾low risk of significant prudential impact on the institution considering the • The nature and composition of credit risk exposure imply low to medium risk. • Exposure to complex products and transactions is low to medium. 38 EBA/REP/2023/29.

76 Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls level of inherent risk and the management and controls. • The level of credit concentration risk is low to medium. • The level of forborne and non￾performing exposures is low to medium. • The credit risk posed by performing exposures is low to medium. • The impact of ESG risks, in particular environmental transition and physical risks, on credit risk is low to medium. • The level of coverage of provisions and of credit valuation adjustments are adequate and reliable to a high level of certainty. • The level of coverage and quality of guarantees and collateral are high. 3 There is a medium￾high risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls. • The nature and composition of credit risk exposure imply medium to high risk. • Exposure to complex products and transactions is medium to high. • The level of credit concentration risk is medium to high. • The level of forborne and non￾performing exposures is medium to high. • The credit risk posed by performing exposures is medium to high and subject to further deterioration under stressed conditions. • The impact of ESG risks, in particular environmental transition and physical risks, on credit risk is medium to high. • The level of coverage of provisions and of credit valuation adjustments is medium. • The level of coverage and quality of guarantees and collateral are medium. • Risk management and controls are not compliant with respect to the requirements set out in the relevant EBA Guidelines. • There is a lack of consistency between the institution’s credit-risk policy and strategy and its overall strategy and risk appetite. • The organisational framework for credit risk is not sufficiently robust; there is no clear separation of tasks between risk takers or management and control functions. • Credit-risk measurement, monitoring and reporting systems are not appropriate. • Internal limits and the control framework for credit risk are not sufficiently sound. • Limits allowing the credit risk to be mitigated or limited are not in line with the institution’s credit risk management strategy and risk appetite. • ESG risks, in particular environmental transition and

77 Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls 4 There is a high risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls. • The nature and composition of credit risk exposure imply high risk. • Exposure to complex products and transactions is high. • The level of credit concentration risk is high. • The level of forborne and non￾performing exposures is high. • The credit risk posed by performing exposures is high. • The impact of ESG risks, in particular environmental transition and physical risks, on credit risk is high. • The level of coverage of provisions and of credit valuation adjustments is low. • The level of coverage and quality of guarantees and collateral are low. physical risks, are insufficiently integrated into the credit risk management and controls. 159. The table below presents a non-exhaustive list of supervisory measures that competent authorities may take in case of identified deficiencies in the institution’s credit and counterpart risk management framework. Competent authorities should decide on the type of the measure based on its effectiveness to the specific identified deficiency. Competent authorities may apply additional supervisory measures (including quantitative measures in accordance with Article 104(1)(a) of the Directive 2013/36/EU) or a combination of them if these are deemed more appropriate to address the identified deficiencies. Table 7. Potential and non-exhaustive supervisory measures for credit and counterparty risk Potential supervisory measures for competent authorities in accordance with Article 104(1)(b), (d), (e), (f), (j), (l), (m), (n) of Directive 2013/36/EU – Competent authorities may require the institution to: A. involve the management body or its committees more actively in relevant credit decisions; B. improve credit risk measurement systems; C. improve controls on credit processes, including credit granting, monitoring and recovery; D. enhance collateral management, evaluation and monitoring; E. enhance the quality and frequency of reporting on credit risk to the management body and senior management; F. apply a specific provisioning policy, and – where permitted by accounting rules and regulations – require it to increase provisions; G. adjust internal risk parameters and/or risk weights used to calculate risk exposure amounts for specific products, sectors or types of obligors; H. apply higher haircuts to the value of collateral; I. reduce large exposures or other sources of credit concentration risk; J. tighten credit-granting criteria for all or some product or obligor categories; K. reduce its exposure to, or acquire protection for, specific types of facilities (e.g. mortgages, export finance, commercial real estate, securitisations), obligor categories, sectors, countries, etc.; L. implement an appropriate strategy to reduce the amount or share of nonperforming exposure;

78 Potential supervisory measures for competent authorities in accordance with Article 104(1)(b), (d), (e), (f), (j), (l), (m), (n) of Directive 2013/36/EU – Competent authorities may require the institution to: M. enhance the credit risk management related to ESG risks, in particular environmental risks, potentially based on one or several actions listed above. 6.3. Assessment of market risk 6.3.1. General considerations 160. When assessing the market risk management framework, competent authorities should evaluate inter alia the compliance of the institution with the legal acts published separately on the EBA website as referred to in paragraph 12. 161. In these guidelines, references to ‘market risk’ will encompass all the following risks, which should be assessed by competent authorities: a. the market risk arising from all on- and off-balance-sheet positions which are subject to losses arising from movements in market prices, i.e. risks in trading book positions as well as the foreign-exchange and commodity risk in the non-trading book; b. the risk of losses arising from changing CVA amounts in response to changes in counterparty credit spreads and/or market prices, impacting the fair value of derivative transactions and, if applicable, of security financing transactions (SFTs); c. the risk linked to the valuation of fair-valued instruments in the sense of Article 105 of Regulation (EU) 575/2013. 162. Competent authorities may perform a less granular analysis for institutions which meet the conditions of the small trading book as set out in Article 94 of Regulation (EU) 575/2013. For institutions with immaterial exposures, the assessment should focus on the adequacy of the risk management and governance structure and the quality and effectiveness of systems and controls. 163. Competent authorities should take into account the impact of ESG risks on the inherent market risk as well as the adequacy of the market risk management framework and controls related to ESG risks, giving priority to environmental risks. 6.3.2. Assessment of inherent market risk 164. Through the assessment of inherent market risk competent authorities should determine the main drivers of the institution’s risk exposures and evaluate the risk of significant prudential impact on the institution. To develop such an understanding, competent authorities should first identify the market risks to which the institution is or may be exposed and focus their attention on the subcategories and drivers deemed the most material for the institution. 165. To support this analysis, competent authorities should consider, as a minimum, the products, activities and business lines of the institution. They should compare the own funds requirements for market and CVA risk and the additional valuation adjustment deducted from

79 the institution own funds, against the total own funds requirements. Where relevant they should compare the internal capital allocated to those risks by the institution against the total internal capital. They may also consider the relative weight of market risk positions in terms of total assets, the relative weight of net gains on market risk positions to total operating income and the historical changes in these figures and forecasts. Also, the strategy of the institution as regards market activities and the related risk appetite should be taken into account. When considering market activities, competent authorities should refer to the risks mentioned in paragraph 161 which may encompass the trading and non-trading book. Nature and composition of the institution’s risk activities 166. The first step in assessing the nature of the inherent market risk of an institution is to identify its market risk exposures consistently and comprehensively. Competent authorities should use available regulatory reporting templates, such as COREP and FINREP, internal reporting, insights gained from the assessment of other SREP elements (such as the BMA) or prior supervisory activities, and comparisons with the institution’s peers, where available. 167. Competent authorities should base their assessment primarily on the most significant identified sources of risk, evaluating their materiality for the institution from a prudential perspective. To assess the nature of market risk, competent authorities should consider at least the following subcategories39: a. interest rate risk (trading book); b. credit spread for non-securitisation, credit spread for securitisation (trading book); c. equity risk (trading book); d. migration risk (for business subject to a default risk charge) 40; e. default risk (for business subject to a default risk charge); f. foreign exchange risk, including translation risk (both in the trading and banking book); g. commodities risk (trading and banking book); h. CVA risk (trading and banking book); i. valuation risk (fair-valued instruments in the trading and non-trading books). 168. Competent authorities should also consider: a. the complexity of financial products (e.g. products valued using mark–to-model techniques, products bearing non-delta risks and basis risks). Competent authority may assess this by using as an indicator the add-on resulting from residual risks as per Article 325u of Regulation 575/2013/EU; b. the liquidity of the institution’s exposure. The competent authority can do so by assessing whether the institution is exposed to subcategories with high liquidity horizons in accordance with table 2 of Article 325bd of Regulation 575/2013/EU; 39 Please refer to Annex II for a non-exhaustive breakdown of market risk sub-categories. 40 Migration risk is treated as part of credit spread risk under the Fundamental Review of the Trading Book.

80 c. the concentration of market risk towards specific names, sectors, economies, risk-classes; d. the employment of specific market operations the risk of which may not be fully represented by the market risk own funds requirements (e.g. high-frequency trading). 169. When appropriate, competent authorities should also consider the internal risk measures of institutions. These could include the internal VaR or expected shortfall not used in the calculations of own funds requirements or sensitivities of the market risk to different risk factors and potential losses. 170. Competent authorities should also assess the institution’s ability to form a comprehensive view on the degree of market concentration risk to which it is exposed, either from exposures to a single risk factor or from exposures to multiple risk factors that are correlated, thereby paying specific attention to concentrations in complex and illiquid products. They should review the firm’s own assessment of concentrations and illiquid positions. Competent authorities should require institutions to reduce exposure towards a given CCP in case of excessive concentration risk, or to realign exposures across their clearing accounts in accordance with Article 7(a) of Regulation 648/2012. 171. When determining whether P2R should be imposed for the market risk to which the institution is exposed, in line with paragraph 300, competent authorities should consider whether the Pillar 1 methodology adequately captures the risk, taking into account that: a. institutions employing the alternative standardised approach are required under Pillar 1 to calculate an add-on (residual risk add-on) for the risks inherent in complex financial products that are not sufficiently captured in the sensitivity-based method and the default risk charge; b. institutions employing the internal model approach or the alternative internal model approach are required to capture all material risks in those internal models; c. the risk-weights provided in the alternative standardised approach, the expected shortfall measures referred to in Article 325bb of Regulation 575/2013/EU and the stress scenario risk measures referred to in Article 325bk of Regulation 575/2013/EU in the alternative internal model approach are designed to cater for the positions’ liquidity in line with liquidity horizon referred to in table 2 of Article 325bd of Regulation 575/2013/EU. 172. Competent authorities should identify and analyse in relation to market risk positions and the corresponding governance arrangements, any transfer pricing arrangements between institutions established in the Union that are part of a third-country group and other entities of that group established outside of the Union and not consolidated by the EU parent undertaking. The analysis should include: a. a quantitative component to identify the materiality of the transfer pricing arrangements relative to the trading book total P&L and the own funds of the institution;

81 b. a qualitative component to assess if the effect of these arrangements is transparent to the institution’s management board and appropriately reflected in the risk management governance; c. a qualitative component to assess how the transfer pricing arrangement affects the business decisions of the institution, including how the dynamics of the transfer pricing arrangement potentially affect the decisions of front-office desks, and the potential conflicts of interest that the arrangement may create. 173. Competent authorities should identify the materiality of the transfer pricing in the context of trading book items by focusing on the transfer pricing arrangements that meet the following conditions: a. they involve at least one entity of the group that is established outside of the Union and for which the highest level of consolidation is outside the Union; b. they are based on a transaction profit method (TPM) – or any similar practice that would be economically equivalent – in accordance with which the profits and losses relating to positions owned by several entities are re-distributed across those entities on the basis of the marginal contribution ‘m’ of each entity towards key-metrics set out in the pricing arrangement. 174. For institutions under paragraph 1733, point (a), where the profits and losses, re-allocated as a result of transfer pricing arrangements based on transaction profit methods, are material (e.g. account for more than 5% of the P&L generated by the institution) and this risk is not covered or fully covered by P1R, competent authorities should: a. consider this risk for the determination of P2R; b. consider the results of the components listed in paragraph 1722, such as the materiality of the transfer pricing arrangements, in relation to the market risk capital requirements of the portfolio whose profits and losses are used to determine the amount to be transferred to the institution as well as potential weaknesses in the related governance arrangements; c. determine P2R that sufficiently cover the market risks not captured under P1R which are generated under the transfer pricing arrangement. To that end, competent authorities may use the calculation method as laid down in Annex V or an alternative methodology that provides accurate measurement of the risk not covered in P1R and identifies the consequent P2R, considering as a reference the methodology in Annex V. Profitability analysis and stress testing 175. Competent authorities should analyse the historic profitability, including volatility of profits, of market activities to gain a better understanding of the institution’s risk profile for market risk. This analysis could be performed at portfolio level as well as being broken down by business line, asset class or desk depending on the materiality and complexity of the institution’s exposures (as emerging from the BMA or other supervisory insight).

82 176. Competent authorities should distinguish between trading and non-trading revenues (such as commissions, clients’ fees, etc.) on one hand and realised and unrealised profits/losses on the other hand. 177. For those asset classes and/or exposures generating significant profits or losses, competent authorities should assess profitability in comparison to the level of risk assumed by the institution (e.g. VaR/net gains on financial assets and liabilities held for trading) to identify and analyse possible inconsistencies. Where possible, competent authorities should compare the institution’s figures to its historical performance and its peers. 178. Competent authorities should assess whether an institution has implemented adequate stress tests that complement its risk measurement system. For this purpose, they should take into account the following elements: a. stress test frequency; b. whether relevant risk drivers are identified (e.g. illiquidity/gapping of prices, concentrated positions, one-way markets); c. assumptions underlying the stress scenario; d. internal use of stress testing outcomes for capital planning and market risk strategies. 6.3.3. Assessment of the market risk management and control framework 179. To achieve an adequate understanding of the management of market risk, commensurate to the institution’s risk profile, competent authorities should review the institution’s risk management and control framework and its adequacy with respect to inherent risk exposures. For this assessment, the competent authority should use the paragraphs set out in this section, while also leveraging on: a. the outcome of the assessment of other SREP elements (such as the BMA and governance areas); b. the outcome of the assessment referred to in Article 325c of Regulation 575/2013/EU for institutions using the alternative standardised approach, and the outcome of the assessment performed in accordance with Delegated Regulation (EU) 2024/1085, especially in relation to the requirements referred to in Articles 104b, 325bi, and 325bj of Regulation 575/2013/EU. 180. Competent authorities should also assess the policies and procedures of institutions to allocate the positions to the trading book and to the banking book, as described by Title 1 of Chapter 3 of Regulation 575/2013/EU. Market risk strategy and risk appetite 181. Competent authorities should assess whether institutions have sound, clearly formulated and documented risk appetite, strategy and limits approved by their management body. For this assessment, among other factors, competent authorities should take into account the role of

83 the management body in setting, approving and reviewing the risk strategy and appetite, the proper implementation of this strategy by the management body as well as its appropriateness for the institution given its business model, overall risk appetite, current and perspective market environment and financial condition. Organisational and internal control framework 182. Competent authorities should assess whether the institution has an appropriate organisation framework for identifying, understanding, measuring, monitoring and controlling market risk, with sufficient (both qualitative and quantitative) human and technical resources to carry out the required tasks. For this assessment, competent authorities should take into account the adequacy of the lines of responsibility for taking, monitoring, reporting and controlling market risk, their coverage of the entire institution, the existence of a clear separation between the front office and back office and between the risk-taking and the control functions, and the skills and expertise of staff involved. 183. Competent authorities should assess whether the institution has clearly defined policies and procedures for the identification, management, measurement and control of market risk and whether these are sound and consistent with the institution’s risk strategy and cover all the main businesses and processes. This includes the assessment of whether these policies and procedures are clearly formalised, communicated and applied consistently across the institution. 184. In particular, the assessment should cover the positions to be included/excluded from the trading book for regulatory purposes, the policies on internal hedges and the procedures for new market activities and/or products. 185. Competent authorities should assess whether the institution has an appropriate framework for identifying, understanding and measuring market risk, in line with the institution’s size and complexity, and that this framework is compliant with relevant minimum requirements in accordance with the applicable legal and regulatory framework. 186. Competent authorities should assess whether institutions have in place an adequate monitoring and reporting framework for market risks that ensures there will be prompt action at the appropriate level of the institution’s senior management or management body in case of breaches. The monitoring system should include specific indicators and relevant triggers to provide effective early warning alerts and should inform the management body and senior management about current exposures and measures compared to policy limits. 187. Competent authorities should assess whether the institution has a strong and comprehensive limit systems and control framework with sound safeguards to mitigate its risks in line with its risk strategy and appetite. For this assessment, competent authorities should pay particular attention to the adequate scope covered by the institution’s control functions (including all consolidated entities, geographical locations and market activities), to the existence of operating limits (including individual limits at desk or business-unit level which should be daily

84 monitored) and other practices aimed at keeping market risk exposures within levels acceptable to the institution in accordance with its risk appetite and limits. 188. Competent authorities should also assess whether the internal validation process is sound and effective in challenging model assumptions and identifying any potential shortcomings with respect to the market risk management system. For institutions adopting an internal approach to determining minimum own funds requirements for market risk, this assessment should be based – where available – on the information stemming from already performed supervisory activities on internal models (such as on-site inspections). 189. Competent authorities should also assess the functionality of the internal audit function in terms of adequacy, scope and frequency of internal audits on the market risk management framework. This should comprise the review of the main elements of risk management, measurement and controls framework across the institution and the adherence to relevant external regulations of the internal policies and procedures and any deviations from either. 6.3.4. Summary of findings, scoring and supervisory measures 190. Following the above assessment, competent authorities should form a view on the institution’s market risk. This view should be reflected in a summary of findings, accompanied by a risk score based on the considerations specified in table 8. Where, based on the materiality of certain risk sub-categories, the competent authority decides to assess and score them individually, the guidance provided in this table should be applied, as far as possible, by analogy. Table 8. Supervisory considerations for assigning a market risk score Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls 1 There is a low risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls. • The nature and composition of market risk exposures imply not material/very low risk. • The institution’s exposures to market risk are non￾complex. • The level of market risk concentration is not material/very low. • The institution’s market risk exposures generate non-volatile returns. • There is consistency between the institution’s market risk policy and strategy and its overall strategy and risk appetite. • The organisational framework for market risk is robust, with clear responsibilities and a clear separation of tasks between risk-takers and management and control functions. • Market risk measurement, monitoring and reporting systems are appropriate. • Internal limits and the control framework for market risk are sound and in line with the institution’s risk 2 There is a medium-low risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls. • The nature and composition of market risk exposures imply low to medium risk. • The complexity of the institution’s market risk

85 Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls exposures is low to medium. • The level of market risk concentration is low to medium. • The institution’s market risk exposures generate returns that have a low to medium degree of volatility. management strategy and risk appetite. 3 There is a medium-high risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls. • The nature and composition of market risk exposures imply medium to high risk. • The complexity of the institution’s market risk exposures is medium to high. • The level of market risk concentration is medium to high. • The institution’s exposures to market risk generate returns that have a medium to high degree of volatility. • There is not full consistency between the institution’s market risk policy and strategy and its overall strategy and risk profile. • The organisational framework for market risk does not sufficiently separate responsibilities and tasks between risktakers and management and control functions. • Market risk measurement, monitoring and reporting systems are not undertaken with sufficient accuracy and frequency. • Internal limits and the control framework for market risk are not in line with the institution’s risk management strategy or risk appetite. 4 There is a high risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls. • The nature and composition of market risk exposures imply high risk. • The complexity of the institution’s market risk exposures is high. • The level of market risk concentration is high. • The institution’s exposures to market risk generate returns that have a high degree of volatility. 191. The table below presents a non-exhaustive list of supervisory measures that competent authorities may take in case of identified deficiencies in the institution’s market risk management framework. Competent authorities should decide on the type of the measure based on its effectiveness to the specific identified deficiency. Competent authorities may apply other supervisory measures (including quantitative measures in accordance with Article 104(1)(a) of the Directive 2013/36/EU) or a combination of them if these are deemed more appropriate to address the identified deficiencies.

86 Table 9. Potential and non-exhaustive supervisory measures for market risk Potential supervisory measures for competent authorities in accordance with Article 104(1)(b), (d), (e), (f), (j), (l) (m), (n) of Directive 2013/36/EU – Competent authorities may require the institution to: A. enhance the quality and frequency of the market risk reporting to the institution’s management body and senior management; B. enhance the performance of the institution’s internal approaches, or of its back-testing or stress testing capacity; C. perform more frequent and in-depth internal audits of market activity; D. restrict investment in certain products when the institution’s policies and procedures do not ensure that the risk from those products will be adequately covered and controlled; E. divest financial products when the valuation processes of the institution do not produce conservative valuations that comply with the standards of Regulation (EU) No 575/2013; F. reduce the level of inherent market risk (e.g. through hedging or sale of assets or increase of derivatives settled through central counterparties (CCPs)) when significant shortcomings have been found in the institution’s measurement or control systems; G. present a plan to reduce its exposures to distressed assets and/or illiquid positions gradually. 6.4. Assessment of operational risk 6.4.1. General considerations 192. When assessing the operational risk management framework, competent authorities should evaluate inter alia the compliance of the institution with the legal acts published separately on the EBA website as referred to in paragraph 12. 193. Competent authorities should assess operational risk throughout all the business lines and operations of the institution, taking into account findings from the assessment of internal governance arrangements and institution-wide controls as specified in Title 5. In conducting this assessment, competent authorities should determine how operational risk may materialise, also considering the loss data set of the institution and potential impacts from other related risks (e.g. boundary credit-related and market-related operational risk). 194. Competent authorities should assess the materiality of operational risk arising from third-party service providers, including concentration (at entity and where relevant at group level) on one or more services provided by a single third-party service provider (directly or indirectly through subcontracting chains) or a limited number of third-party providers supporting institution’s critical or important functions, and whether these could affect the institution’s operational resilience, performance and risk management. When carrying out this assessment, competent authorities should take into account the extent to which the same third-party service providers are relied upon by other institutions, where such information is available to them. 195. When assessing operational risk, competent authorities should assess ICT risk, pursuant to DORA, and its potential impact on the institution’s critical or important functions, including any potential financial, reputational, regulatory and strategic impact to the institution. 196. Competent authorities should assess whether the institution has an adequate operational resilience approach to be able to withstand, adapt to and recover from disruptions when they

87 materialise and whether this has been adequately and consistently aligned with the existing risk management framework, business continuity plans and third-party management. 197. When assessing operational risk, competent authorities should assess, if applicable, whether the institution’s policies and procedures identify, evaluate and manage appropriately the operational risks arising from crypto-assets activities and their supporting technology. 198. Competent authorities should assess reputational risk jointly with operational risk as it is inherently linked to operational risk events. However, the outcome of reputational risk assessment should not be reflected in the scoring of operational risk but, where relevant, should be considered as part of the BMA and/or the liquidity risk assessment, as its main effects can deteriorate investors’, depositors’ or interbank-market participants’ confidence to the institution. 199. Competent authorities should assess the impact of ESG risks on the inherent operational and reputational risks as well as the adequacy of the operational risk and reputational risk controls related to ESG risks, giving priority to environmental physical and transition risks. In particular, competent authorities should consider environmental risks and greenwashing risks when carrying out the assessment of legal risk and reputational risk. 6.4.2. Assessment of inherent operational risk 200. Competent authorities should develop a thorough understanding of the institution’s inherent operational risk exposures and evaluate the significance of the prudential impact of this risk for the institution as well as the impact on its ability to deliver critical or important functions through disruption. 201. To support this assessment, competent authorities should consider the own funds requirement for operational risk compared to the total own funds requirement, and where relevant the internal capital allocated for operational risk by the institution compared to the total internal capital. Moreover, competent authorities should leverage the knowledge gained from the assessment of other SREP elements (in particular from Title 4 and Title 5), from the comparison with peers, from any other supervisory activities including the input from the AML/CFT supervisors and market surveillance authorities and from other relevant information sources. 202. Competent authorities should consider at minimum key operational risk factors, potential disruptive scenarios, and where relevant, analyse them by business line, legal entity, geography, and event type category (subject to data availability) and benchmark the institution’s position against its peers. These factors should at least cover the institution’s main strategy for operational risk and operational risk appetite, business environment (including geographical presence, ICT operations, and distribution channels), recent significant corporate events (such as mergers, acquisitions, disposals and restructuring), ICT systems and other ICT￾related aspects as per section 6.4.2.3, process changes, third-party arrangements, regulatory

88 compliance issues, business ambitions and incentive schemes and other key operational risk drivers. Nature and significance of operational risk exposures 203. Competent authorities should determine the nature of operational risk exposures by analysing exposures to the main sources and drivers of operational risk to form a forward-looking view on prospective operational risk. For this analysis, competent authorities: a. may consider the operating model, business lines, products, processes and geographies relevant to the institution, assessment of dependencies and operational risk exposures to primary risk drivers (e.g. processes, people, systems and external factors) and interactions of risk drivers, leveraging the institution’s self-risk assessment, peer analysis, data and public and/or consortium databases, if available and relevant; b. should consider both the frequency and the severity of the events to which the institution is exposed and distinguish those causing high-severity losses and those occurring with high frequencies. Based on this distinction, competent authorities should assess the trends of operational risk losses and their concentration; and c. should leverage scenario analyses and consider planned business operations and prospective operational risk analyses performed by the institution, where available, taking into account any corrective measures and mitigation actions already implemented and effective. 204. Following the identification and analysis of the major sources and drivers of operational risk, competent authorities should focus on those with the most material potential impact to the institution. 205. A primary source of information competent authorities should consider it is the institution’s loss and event data set as it can provide valuable insights on the evolution of the institution’s operational risk profile. Competent authorities should periodically assess the comprehensiveness, accuracy and quality of the loss data. Another source of information should be the institution’s records of all ICT-related incidents and significant cyber threats (as per Article 17(2) of DORA) and the identified sources of ICT risk (as per Article 8(2) of DORA). Assessment of operational risk sub-categories 206. Competent authorities should focus the assessment of operational risk sub-categories to those which are considered material to the institution. Competent authorities should also apply their expert judgement to identify significant sub-categories, based on all available internal and external information sources. In conducting the assessment, competent authorities should always pay attention to the following aspects of operational risk41: 41 Please refer to Annex III for a non-exhaustive breakdown of operational risk sub-categories.

89 a. legal risk; b. model risk; c. ICT risk. 6.4.2.1. Legal risk 207. Competent authorities should consider the following when assessing the relevance and significance of the institution’s exposures to legal risk: a. mis-selling of products or services; b. conflicts of interest in conducting business; c. manipulation of benchmark interest rates, foreign exchange rates or any other financial instruments or indices; d. barriers to switching financial products during their lifetime and/or to switching financial service providers; e. automatic renewals of products or exit penalties; and/or f. customer complaints processing; g. violation of national and international rules and regulations (tax rules, internal fraud or internal theft, anti-money laundering rules, anti-terrorism rules and economic sanctions); h. ESG-related, in particular environment-related and greenwashing-related, litigation exposures. 208. Competent authorities should consider whether the institution may occur any expenses, fines, penalties or punitive damages from legal proceedings and the number and content of complaints. The outcomes of the Title 4 assessment should be also leveraged, along with scrutinising the incentive policies, to obtain high-level insights into sources of potential misconduct. In this context, competent authorities should also consider whether the institution has in place adequate and effective systems and processes to implement and comply with restrictive measures (e.g. sanctions), including assessing institution’s compliance with the EBA Guidelines on internal policies, procedures and controls42 . 209. However, the competent authority should apply a forward-looking approach, also considering the possible impact of regulatory developments and the activity of relevant authorities in respect of consumer protection and the supply of financial services in general. 6.4.2.2. Model risk 210. Under the operational risk, competent authorities should assess model risk, with specific regard to internal non-regulatory models (e.g. AI models, product pricing, setting and monitoring risk limits, ICAAP/ILAAP models, recovery options). 42 EBA Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures (EBA/GL/2024/14)

90 211. For the assessment of model risk, competent authorities should consider: a. to what extent and for which purposes the institution uses models to make decisions and the business significance of such decisions. Competent authorities should determine the business/activity for which the institution makes significant use of models and assess the potential impact of model risk through, amongst others, sensitivity and scenario analyses or stress testing; and b. the soundness of control mechanisms (in terms of methods, frequency, follow-up, etc.), including a model approval process, regular reviews performed and the institution’s level of awareness of model deficiencies or market and business developments. 212. When models are used for decision-making purposes (e.g. product pricing, AI models, evaluation of financial instruments, client profiling), competent authorities should assess whether there is a sound internal validation process and/or model-review process to identify and mitigate model risk (other than regulatory models). 213. When conducting the model risk assessment, competent authorities should consider the assessment of other risks to capital and risks to liquidity and funding, in particular with respect to the adequacy of methodologies used for measuring risk, pricing and evaluating assets and/or liabilities. The results of such an assessment should inform the findings on operational risk. 6.4.2.3. ICT risk - Assessment of inherent ICT risk Identification of material ICT risks 214. In line with DORA, competent authorities should review the institution’s identification, classification and documentation of all ICT supported business functions, roles and responsibilities, the information assets43 and ICT assets44 supporting those functions, and their roles and dependencies in relation to ICT risk. This review should assist competent authorities to develop a thorough understanding of the institution’s inherent ICT risk exposures (ICT risk profile), identify its material inherent ICT risk and form an opinion on its prudential impact. For this purpose, competent authorities should consider at least the following, where relevant and applicable: a. report on the review of ICT risk management framework (as per Article 6(5) of DORA); b. sources of ICT risk, in particular the risk exposure to and from other financial entities, identified by the institution under Article 8(2) of DORA; c. major ICT-related incidents reported (as per Article 19(1) of DORA), including the trend of aggregated annual costs and losses caused by major ICT-related incidents (as per Article 11(10) of DORA); 43 Article 3(6) of Regulation (EU) 2022/2554 44 Article 3(7) of Regulation (EU) 2022/2554

91 d. outcomes of the tests envisaged in the digital operational resilience testing programme (as per Article 24 of DORA)), including summary of the threat-led penetration testing (TLPT) findings and related remediation plans (as per Article 26(6) of DORA); e. register of information (as per Article 28(3) of DORA), including degree of concentration on ICT third-party service providers, including ICT intra-group providers, per type of ICT services and/or ICT systems; f. recommendations and opinions from the Lead Overseers (as per Article 40(3) and Article 42(7) of DORA) and related responses, reports and information from critical ICT third-party service providers (as per Article 35(1)(c), Article 42(1) and Article 48(2) of DORA); g. level of complexity of ICT systems and results of ICT risk assessment on legacy ICT systems (as per Article 8(7) of DORA); h. risk assessment on major changes (as per Article 8(3) of DORA); i. level of adoption and integration of innovative ICT solutions; j. locations, namely the regions or countries, of data centres and sensitive designated areas, including where contractual ICT services are provided by ICT third-party service providers, also covering data processing and storage location; k. any related material deficiencies or weaknesses identified under Title 5; l. ICT risk and controls self-assessments (if provided in the ICAAP information); m. ICT risk-related management information submitted to the institution’s management body; n. ICT-related internal and external audit findings; o. external threat environment, including threat and vulnerability intelligence. Review of ICT systems and ICT services 215. Competent authorities should review the institution’s relevant documentation, methodology and processes, and form an opinion on whether the institution has appropriately identified the ICT systems and ICT services that support critical or important functions. For this purpose, competent authorities should consider: a. ICT systems supporting critical or important functions as well as the critical information assets and ICT assets identified by the institution (as per Article 8 of DORA); b. key processes dependent on ICT third-party service providers, including interconnections with ICT third-party service providers that support critical or important functions, identified by the institution (as per Article 8.5 of DORA). Identification and mapping of material ICT risks to ICT systems and ICT services that support critical or importance functions 216.Following the review of the institution’s dependency on information assets and ICT assets, ICT risk profile, ICT systems and ICT services, competent authorities should form an opinion on the material ICT risks that can have a significant prudential impact on the institution’s ICT systems

92 and services that support critical or important functions and a significant impact on its ability to operate under disruption. For this purpose, competent authorities should consider: a. financial loss, including potential customer compensation, legal and remediation costs, contractual damages, costs and lost revenue; b. potential for business disruption, considering (but not limited to) the criticality of the services affected, including institution’s transactions and operations (including third-party dependencies), the number of clients and/or financial counterparts and/or branches and employees potentially affected; c. potential data losses; d. potential reputational impact; e. potential regulatory impact, including the potential for public censure, fines or even variation of permissions; f. potential strategic impact on the institution; g. potential geographical spread. 217. Competent authorities should then map the identified material ICT risk into the ICT risk categories set out in Annex III. Institutions are expected to maintain their own categorisation rather than using the one set out in the Annex. 6.4.3. Assessment of operational risk management and control framework 218. Competent authorities should assess the framework and arrangements the institution has in place to manage and control operational risk taking into account the outcome of the analysis of the overall risk management and internal control framework addressed in Title 5, as this will influence the institution’s operational risk exposures. Regarding ML/TF risk, the competent authority should take into account the assessment provided by the AML/CFT supervisor. Operational risk strategy and appetite 219. Competent authorities should assess whether the institution has a sound, clearly formulated and documented operational risk strategy and appetite level approved by the management body, which outlines the nature, types and levels of operational risk the institution is willing to assume. For this assessment, among other factors, competent authorities should take into account the role of the management body in setting, approving, implementing and reviewing the operational risk strategy and appetite (including ICT risk appetite and digital operational resilience strategy), the strategy’s sufficient coverage and appropriateness with respect to the nature and materiality of the institution’s operational risk profile. Organisational and internal control framework 220. Competent authorities should assess the institution’s compliance with Article 323 of the Regulation (EU) No 575/2013. In this assessment, competent authorities should evaluate the soundness and effectiveness of the organisational framework and governance arrangements

93 to enable effective operational risk management, measurement and control, with sufficient human and technical resources to carry out the required tasks. Competent authorities should take into account whether clear lines of responsibility are in place for the identification, evaluation, mitigation, monitoring and reporting of operational risk as well as adherence to the three lines of defence model. 221. Competent authorities should assess whether the institution has a strong control framework and sound safeguards to mitigate its operational risk, including appropriate policies and procedures, covering also residual risk, and whether these are consistent with the institution’s operational risk management appetite and strategy and cover all the key operations and processes. This includes, amongst others, the assessment of whether these policies and procedures are clearly formalised, communicated and applied consistently across the institution. 222. Competent authorities should also assess the functionality of the internal audit function in terms of adequacy, scope and frequency of internal audits on the operational risk management framework. Business continuity, response and recovery 223. Competent authorities should assess the institution’s compliance with the (i) EBA Guidelines on Internal Governance in relation to the overall business continuity management and with the (ii) DORA in relation to the ICT business continuity policy and ICT response and recovery plans. In this regard, competent authorities should determine whether ICT business continuity policy and ICT response and recovery plans form an integral part of the institution’s overall business continuity policy and response and recovery plan. 224. Competent authorities should assess whether the institution has established effective business continuity management with tested business continuity, response and recovery plans covering at least its critical or important functions, including those contracted to third-party providers, and whether these consider a range of severe but plausible scenarios to which the institution may be vulnerable. Competent authorities should also assess whether the institution’s business continuity policy enables appropriate response and recovery measures to any type of incident. 225. Competent authorities should determine whether the institution’s business continuity management includes: a. Business Impact Analysis (BIA); b. appropriate recovery strategies incorporating key internal and external dependencies and clearly defined recovery priorities and resilience levels; c. comprehensive and flexible plans to deal with plausible disruptive scenarios, which are established based on the BIA and in coordination with internal and external stakeholders; d. plans that establish contingency strategies and response and recovery procedures;

94 e. effective testing of the design and operational effectiveness of the plans; f. BCM awareness and training programmes; g. communications plans for informing management and all relevant stakeholders, and crisis￾management documentation, measures and a crisis management function where applicable (as per Article 11(7) of DORA). 226. Competent authorities should assess whether the institution’s business continuity, response and recovery plans: a. establish roles and responsibilities, including clear guidance on potential succession, and set out the internal decision-making process along with definition of activation triggers; b. are reviewed to ensure contingency strategies remain consistent with current operations, risks and threats, resilience levels, and recovery objectives and priorities; c. prioritise business continuity actions using risk-based approach; d. are tested regularly to ensure that recovery objectives and timeframes can be met; and e. are inclusive of the testing of services provided by third-party service providers, where applicable; 227. Competent authorities should also assess whether testing results are documented and reported to the management body. Assessment of ICT risk management framework 228. Competent authorities should assess the institution’s compliance with the DORA and the EBA Guidelines on Internal Governance in relation to the internal governance and organisation of the management of ICT risk. Competent authorities should form a view on whether the institution’s management body is held overall accountable for managing ICT risk and appropriately defines, approves and oversees the implementation of all ICT-related arrangements. Competent authorities should consider whether the members of the management body possess sufficient knowledge and skills to understand and assess ICT risk and its impact on the institution’s operations. 229. Competent authorities should assess how the roles and responsibilities for all ICT-related functions and the established governance arrangements are embedded and integrated in the institution’s internal control and governance framework to manage ICT risk. For this purpose, competent authorities should consider whether the institution has effectively assigned the responsibility for managing and overseeing ICT risk to an independent control function that has direct access and can report directly to the management body in its supervisory function, and assess whether the institution demonstrates: a. clear communication, allocation and integration of roles and responsibilities in all ICT￾related functions, including ICT supported business functions, and processes;

95 b. sufficient and appropriate budget to fulfil digital operational resilience in terms of all types of resources, including relevant awareness programmes, training, and ICT skills for all staff (as per Article 5(2)(g) of DORA); c. adequate follow-up and response by the management body on critical ICT audit findings and findings reported under Article 13(5) of DORA. 230. Competent authorities should develop a thorough understanding of the institution’s ICT risk management framework and assess whether the institution has in place sufficient and appropriate strategies, policies, procedures, ICT protocols and tools, including tolerance levels, to address effectively, efficiently and comprehensively the material ICT risk in line with DORA. For this purpose, competent authorities should consider, where applicable: a. appropriateness and effectiveness of institution’s ICT risk management policies45, processes and procedures, covering inter alia ICT third-party management, ICT-related incident detection and response, ICT assess management, encryption and cryptography, ICT operations security, network security, access control, and whether these have been approved by the management body and communicated to all relevant stakeholders (as per Article 14 of DORA); b. appropriateness of institution’s risk tolerance level of ICT risk and the impact tolerance for ICT disruptions (as per Article 6(8)(b) of DORA); c. appropriateness and implementation of the institution’s digital operational resilience strategy, including its alignment with the business strategy; d. consistency of the strategy on ICT third-party risk, including the ICT multi-vendor strategy, where available, with the overall business strategy and ICT risk management framework; e. residual risk from the institution’s identified risks in respect to contractual arrangements on the use of ICT services supporting critical or important functions; f. residual risk from the institution’s identified risks on ICT projects impacting critical or important functions reported to the management body, and also on ICT systems acquisitions, development and maintenance and ICT changes; g. soundness and comprehensiveness of digital operational resilience testing programme; h. trend and magnitude of major ICT-related incidents and findings reported to the management body as per Article 17(3)(e) and Article 13(5) of DORA; i. ICT risk controls specific for the identified material ICT risk; j. timely reporting of ICT risk management aspects to the management body and senior management; k. internal audit coverage and findings. 45 In accordance with DORA, these should include at least the information security policy, backup policies, ICT asset management policy, encryption and cryptographic controls policy, cryptographic key management policy, ICT project management policy, acquisition, development, and maintenance of ICT systems policy, human resources policy, physical and environmental security policy, ICT-related incident management policy, policy on the use of ICT services supporting critical or important functions provided by ICT third-party service providers.

96 231. When assessing ICT risk management, competent authorities should pay particular attention to ICT third-party risk management, including the institution’s concentration level to ICT third￾party service providers. For this purpose, competent authorities should ensure close cooperation with the Lead Overseers of critical ICT third-party providers (CTPPs), in accordance with the ESAs’ Joint Guidelines46, in case the institution under assessment receives ICT services from a CTPP. Competent authorities should also review the effectiveness of the dedicated role established by the institution, or the designated member of senior management, on the monitoring of ICT third-party arrangements. 232. Competent authorities should consider whether the internal audit function is effective and possesses sufficient knowledge, skills and expertise to audit institution’s ICT risk management framework, by reviewing whether: a. the ICT risk management framework is audited with the required quality, focus and frequency, and is commensurate to the ICT risk profile of the institution; b. the audit plan includes audits on the material ICT risks identified by the institution, including independent reviews of ICT response and recovery plans; c. critical ICT audit findings are timely verified and remediated, including reporting to the management body; d. ICT audit findings, including agreed actions, are formally followed up and progress reports periodically reviewed by the senior management and/or the audit committee. 6.4.4. Assessment of reputational risk 233. Competent authorities should assess the reputational risk to which the institution is exposed by leveraging the understanding gained from Title 4 to Title 6.2. Such an assessment should also focus on the overall reputational risk framework, ensuring the ability of the institution to effectively manage any reputation events. For this assessment, competent authorities should avoid double counting aspects already considered under the assessment of legal risk (section 6.4.2.1). 234. When assessing the relevance of reputational risk, competent authorities should consider the size of the institution as well as the nature, scale and complexity of their services, activities and operations (for example, listed equities or debts or participation in interbank markets). 235. Competent authorities should consider both internal and external factors or events that might give rise to reputational concerns, excluding events that result in legal proceedings. For Category 1 and Category 2 institutions, competent authorities should consider all the following indicators in their assessment: a. negative media/social media coverage and consumer-association initiatives that could deteriorate the public perception and reputation of the institution; 46 ESAs’ Joint Guidelines on the oversight cooperation and information exchange between the ESAs and the competent authorities under Regulation (EU) 2022/2554 (JC/2024/36).

97 b. the number of and changes in customer complaints or sudden loss of customers or investors; c. negative events relating to the institution’s peers that the public could associate with the whole financial sector or a group of institutions; d. the reputation of individuals involved in the management of the institution or with qualifying shareholdings; e. involvement or operation in sectors or jurisdictions highly exposed to ML/TF or with individuals associated with high risk from an ML/TF perspective; f. involvement or operation in sectors or jurisdictions and/or with counterparties highly exposed to material issues or public controversies related to ESG factors, including but not necessarily limited to environmental factors; g. the reputational impact of ICT-related incidents as recorded by the institution in accordance to the Commission Delegated Regulation (EU) 2024/177247; h. other ‘market’ indicators, if available (e.g. rating downgrades or changes in the share price throughout the year). 236. Competent authorities should assess the significance of the institution’s reputational risk exposure and its interconnectedness with the other risks by leveraging the relevant risk assessments (including from other supervisory authorities) to identify any possible secondary effects in either direction. 237. In the context of the operational risk analysis, competent authorities should take into account the relevance and significance of the institution’s exposures to ML/TF risk from a prudential perspective under the scope of operational risk. In this respect, competent authorities should use the relevant input received from AML/CFT supervisors to supplement their findings from ongoing supervision and evaluate whether they give rise to prudential concerns related to ML/TF risk. 238. Competent authorities should bear in mind that any institution can be exposed to ML/TF risk regardless of the institution’s size or financial soundness. Therefore, sufficient attention should also be paid to institutions that are perceived to be financially sound and may have a good reputation given that these institutions might be specifically targeted for ML/TF purposes. Attention should also be paid to institutions that are very successful in attracting new customers/expanding market share – especially by using non-traditional distribution channels

• since this could be related to weak customer due diligence controls at the onboarding phase.

239. Competent authorities should share relevant information on operational risk issues identified that can give rise to ML/TF risks, risks of non-implementation and evasion of targeted financial 47 Commission Delegated Regulation (EU) 2024/1772 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria for the classification of ICT-related incidents and cyber threats, setting out materiality thresholds and specifying the details of reports of major incidents, C/2024/1519 (OJL, 2024/1772, 25.6.2024, ELI: http://data.europa.eu/eli/reg_del/2024/1772/oj).

98 sanctions and concerns such as deficiencies in the institutions’ ICT system or internal control framework with AML/CFT supervisors. 240. Competent authorities should assess whether the institution has implemented adequate arrangements, strategies, processes and mechanisms to manage reputational risk. In particular, competent authorities should take into account whether: a. the institution has formalised policies and processes in place for the identification, management and monitoring of this risk, including a robust code of conduct, and whether these policies and processes are proportionate to its size and its relevance in the system; b. the institution addresses this risk in a precautionary manner, including putting in place appropriate metrics and monitoring tools, coverage of potential reputation issues in contingency plans, conducting relevant training and awareness sessions and leveraging lessons learned; c. the institution conducts stress testing or scenario analysis to assess any secondary effects of reputational risk (e.g. liquidity and funding costs, securitisation transactions, access to correspondent banking service); d. the institution acts to protect its brand through tools to monitor media/social media, protocols to address misinformation and adverse publicity as well as prompt communication campaigns; e. the institution considers the potential impact of its strategy and business plans, and more generally of its behaviour, on its reputation. 6.4.5. Operational resilience 241. Competent authorities should form a holistic view on the ability of the institution to deliver critical or important functions through disruption (level of operational resilience), an outcome that benefits from the effective management of operational risk, taking into account the institution’s size, business model and overall risk profile. For this purpose, competent authorities should leverage on their existing assessments on operational risk management, business continuity, change management capabilities, third-party services and the ICT upon which the institution relies to holistically evaluate whether these elements collectively support the institution’s operational resilience. Competent authorities should also consider whether the institution implements its risk management framework, business continuity plans, third￾party management (already assessed in the context of DORA and EBA Guidelines issued pursuant to Article 74(3) of Directive 2013/36/EU on internal governance arrangements, processes and mechanisms) and recovery and resolution frameworks in a consistent and coordinated manner. Moreover, competent authorities should consider whether the institution has sufficiently mapped the internal and external interconnections and interdependencies that are needed to deliver its critical or important functions. 242. Competent authorities should consider the attention given by the management body and senior management on the institution’s ability to respond to and recover from disruptions

99 under the assumption that failures will occur. For this purpose, competent authorities should consider whether: a. the management body takes an active role in establishing a broad understanding of the operational resilience approach across the institution and in monitoring the effectiveness of the institution’s operational resilience approach; b. timely reporting on the institution’s ongoing operational resilience is provided in support of the management body’s oversight, particularly when major identified deficiencies could affect the delivery of the institution’s critical or important functions. 6.4.6. Summary of findings, scoring and supervisory measures 243. Following the above assessment, competent authorities should form a view on the institution’s operational risk. This view should be reflected in a summary of findings, accompanied by a risk score based on the considerations specified in table 10. Where, based on the materiality of certain risk sub-categories, the competent authority decides to assess and score them individually, the guidance provided in this table should be applied, as far as possible, by analogy. Table 10. Supervisory considerations for assigning an operational risk score Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls 1 There is a low risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls. • Operational risk exposures are limited to a few high￾frequency/low-severity impact categories. • The significance of the exposure to operational risk is not material/very low, as shown by scenario analysis and compared with the losses of peers. • The level of gross losses (before recoveries and including losses on credit portfolio caused by operational risk) experienced by the institution in recent years has been not material/very low or has decreased from a higher level. • No significant ICT risk exposures, simple/resilient/agile ICT architecture and no material/very low ICT risks. • The level of concentration risk towards third-party service providers is low, with simple subcontracting chains. • There is consistency between the institution’s operational risk policy and strategy and its overall strategy and risk appetite. • The organisational framework for operational risk is robust with clear responsibilities and a clear separation of tasks between risk-takers and management and control functions. • Operational risk framework includes all relevant risks. • Operational risk measurement, monitoring and reporting systems are appropriate. • The control framework for operational risk is sound. • ICT risk management and controls are adequate with respect to the requirements set out in DORA. • Third-party risk management framework is sound and effective, along with

100 Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls • The threat intensity that could result into major operational disruption (including ICT￾related incidents) of critical or important functions is low. appropriate contractual arrangements. • Effective and sound business continuity management, including tested business continuity, response and recovery plans. 2 There is a medium-low risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls. • Operational risk exposures are mainly in high-frequency/low￾severity impact categories. • The significance of the exposure to operational risk is low to medium, as shown by scenario analysis and compared with the losses of peers. • The level of gross losses experienced by the institution in recent years has been low to medium, or is expected to increase from a lower historic level or decrease from a higher historic level. • Low ICT risk exposures, moderately complex/partially constrained ICT architecture and low/medium ICT risks. • The level of concentration risk towards third-party service providers is medium, with moderate subcontracting chains. • The threat intensity that could result into major operational disruption (including ICT￾related incidents) of critical or important functions is medium. 3 There is a medium-high risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls. • Operational risk exposures extend to some low￾frequency/high-severity impact categories. • The significance of the exposure to operational risk is medium to high, as shown by scenario analysis and compared with the losses of peers. • The level of gross losses experienced by the institution in recent years has been medium to high, or is expected to increase from a lower historic level or decrease from a higher historic level. • The consistency between the institution’s operational risk policy and strategy and its overall strategy and risk appetite is not sufficiently developed or even inadequate. • The organisational framework for operational risk is not sufficiently robust. • Operational risk framework does not include all relevant risks. • Operational risk measurement, monitoring and reporting systems are inappropriate.

101 Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls • Indications of possible significant ICT risk exposures, complex/rigid/fragmented ICT architecture and medium/high ICT risks. • The level of concentration risk towards third-party service providers is high, with moderate to long/complex subcontracting chains. • The threat intensity that could result into major operational disruption (including ICT￾related incidents) of critical or important functions is high. • The control framework for operational risk is tenuous. • ICT risk management and controls are not compliant with respect to the requirements set out in DORA. • Third-party risk management framework is incomplete/weak, along with inadequate contractual arrangements. • Inadequate business continuity management, including unreliable/ineffective/incomple te business continuity, response and recovery plans. 4 There is a high risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls. • Operational risk exposures extend to all main categories. • The significance of the exposure to operational risk is high and increasing, as shown by scenario analysis and compared with the losses of peers. • The level of gross losses experienced by the institution over the last few years has been high, or risk has significantly increased. • Multiple indications of significant ICT risk exposures, highly complex/fragile ICT architecture and high ICT risks. • The level of concentration risk towards third-party service providers is very high/severe, with long/complex subcontracting chains. • The threat intensity that could result into major operational disruption (including ICT￾related incidents) of critical or important functions is very high/severe. 244. The table below presents a non-exhaustive list of supervisory measures that competent authorities may take in case of identified deficiencies in the institution’s operational risk management framework and operational resilience (taking into account the close interconnection of operational resilience and operational risk management). Competent authorities should decide on the type of the measure based on its effectiveness to the specific identified deficiency. Competent authorities may apply additional supervisory measures

102 (including quantitative measures in accordance with Article 104(1)(a) of the Directive 2013/36/EU) or a combination of these with the ones listed in the table below, if these are deemed more appropriate to address the identified deficiencies. For breaches of DORA, the competent authorities should consider the applicable corrective and remedial measures provided in Article 50 of DORA. Table 11. Potential and non-exhaustive list of supervisory measures stemming from the assessment of operational risk and operational resilience Potential supervisory measures for competent authorities in accordance with Article 104(1), points (b), (d), (e), (f), (j), (l), (m), and (n) of Directive 2013/36/EU and Article 50 of Regulation (EU) 2022/2554 – Competent authorities may require the institution to: A. involve the management body or its committees more actively in operational risk management decisions; B. improve operational risk measurement systems; C. strengthen controls on operational processes, including identification, monitoring, response and recovery; D. improve the operational governance framework; E. enhance operational risk reporting to the management body and senior management; F. develop and implement corrective action plans to address deficiencies; G. limit certain third-party arrangements, in particular for critical or important functions; H. enhance stress testing and scenario analysis of operational risk; I. implement stronger operational measures; J. enhance business continuity, response and recovery plans; K. enhance operational risk management related to ESG risks, in particular environmental risks, potentially based on one or several actions listed above. 6.5. Assessment of interest rate risk and credit spread risk arising from non-trading book activities 6.5.1. General considerations 245. When assessing the inherent interest rate risk arising from interest rate-sensitive positions from non-trading on and off-balance sheet activities (commonly referred to as interest rate risk in the non-trading book, or IRRBB) and credit spread risk arising from positions in the non￾trading book (commonly referred to as CSRBB) and the adequacy of the internal control framework, competent authorities should evaluate inter alia the compliance of the institution with the legal acts published separately on the EBA website as referred to in paragraph 12. 246. Competent authorities should assess IRRBB, including hedges for these positions, irrespective of their recognition and measurement, and irrespective of the recognition and measurement of losses and gains, for accounting purposes. 247. Competent authorities should consider the relevance and materiality of at least the following subcategories48 when assessing IRRBB: gap risk, basis risk and option risk. 248. Assessment of IRRBB should be differentiated from assessment of CSRBB that competent authorities should also conduct in accordance with section 6.5.3. In particular, competent 48 Please refer to Annex IV for a non-exhaustive breakdown of IRRBB sub-categories.

103 authorities should take into account whether institutions’ internal systems adequately assess and monitor the risk from CSRBB from an economic value and net interest income (including market value changes) perspective and appropriately define CSRBB and determine its scope49 . 249. Based on the overall assessment of the inherent risk of IRRBB and the risk management and controls for IRRBB and CSRBB, competent authorities should form a view on the IRRBB and CSRBB resulting in a combined score using the criteria laid out in table 12. The outcome of the assessment of each individual risk should be reflected in a summary of findings and an explanation of the main risk drivers. 6.5.2. IRRBB 6.5.2.1. Assessment of inherent IRRBB 250. Through the assessment of the inherent level of IRRBB, competent authorities should determine the main drivers of the institution’s IRRBB exposure and evaluate the potential prudential impact of this risk on the institution. Preliminary assessment 251. To determine the scope of the IRRBB assessment, competent authorities should first identify the sources of IRRBB to which the institution is or might be exposed and if there have been any significant changes. To do so, competent authorities should leverage the knowledge gained from ICAAP and ILAAP information collected for SREP purposes, from reporting established on IRRBB, from the assessment of other SREP elements, from the comparison of the institution’s position with those of its peers and from any other supervisory activities. As part of this, competent authorities should consider the institution’s governance of interest rate risk, including its main IRRBB strategy and its risk appetite in relation to IRRBB, and the level of internal capital the institution has allocated to IRRBB. Nature and composition of the institution’s interest rate risk profile 252. Competent authorities should form a clear view on how changes in interest rates can have an adverse impact on an institution’s net interest income (and, where relevant, its earnings) and economic value (the present value of expected cash flows) to gain both a short-term and a longer-term view on the possible threat to capital adequacy. 253. For this purpose, competent authorities should analyse and form a clear view on the structure and features of the institution’s assets, liabilities, and off-balance-sheet exposures, including their sensitivities to changes in interest rates, maturities and repricing dates, and the proportion of products and positions with uncertain maturities (e.g. with embedded options or prepayment features) and any associated behavioural assumptions. 49 Also considering the guidance in EBA/2022/14.

104 254. In addition, competent authorities should review the institution’s hedging strategy and the extent to which a natural hedge may apply (considering also the robustness of modelling of repricing maturities for items with an undefined maturity), the amount of derivatives used for hedging purposes and whether the derivatives may mitigate sensitivity in EVE, NII or other metrics used by the institution internally. 255. Competent authorities should also pay attention to any concentrations (e.g. in the loan or bond portfolios) in terms of repricing maturity or in products with automatic or behavioural optionality, non-performing exposures, and the nature of IRRBB embedded in fair value instruments, including less liquid instruments such as level 3 assets and liabilities. 256. When analysing the impact on the institution’s earnings, competent authorities should be aware of how much the institution’s returns depend on interest rate-sensitive positions, and they should determine how different changes in interest rates would affect the institution’s net interest income, as well as determining the effects of changes in the market value of instruments – depending on accounting treatment – either shown in the profit and loss (P&L) account or directly in equity (e.g. via other comprehensive income). 257. When analysing the impact on the institution’s economic value and earnings, competent authorities should first consider the results of the supervisory outlier tests stipulated in Article 98(5) of Directive 2013/36/EU and further specified in Delegated Regulation (EU) 2024/856, to get an initial benchmark against which to compare how interest rate changes would affect the institution. For this assessment, competent authorities should pay particular attention to the sensitivity of cash flows to repricing, in terms of both their timing and amount and to changes in the underlying key assumptions (particularly for customer accounts without specific repricing dates, customer accounts with embedded customer optionality and/or equity capital). 258. Where the institution is identified as an outlier by the supervisory outlier test on net interest income, competent authorities should consider analysing additional dimensions to complement the assessment, when deemed appropriate (e.g. given the institution’s the business model). Additional dimensions to consider may include market value changes of fair value instruments, the evaluation of the worst NII projections versus current realised NII and versus administrative expenses/overhead cost and net commissions/fees for capturing embedded losses/gains due to observed changes in the interest rates and in the market conditions. 259. Competent authorities should pay attention to the sensitivity of cash flows to changes in the valuation of fair value instruments in the non-trading book, including interest rate derivatives used for the hedging of non-trading book instruments (e.g. impact of mark-to- market changes in fair value instruments on P&L, hedge account effectiveness).

105 260. In addition to using the supervisory outlier test stipulated in Article 98(5) of Directive 2013/36/EU and further specified in Delegated Regulation (EU) 2024/856, competent authorities may require institutions to take into account other interest rate shock scenarios. 261. In their quantitative assessment, competent authorities should also consider the results of the institution’s internal or standardised methodologies for measuring IRRBB, among which competent authorities should also assess, for those institutions operating in different currencies, the impact for the economic value and earnings measures coming from different currencies and, where an internal methodology is applied, the approaches that the institutions use for the aggregation across these currencies. Through the analysis of these methodologies, competent authorities should gain a deeper understanding of the main risk factors underlying the institution’s IRRBB profile. 262. When analysing the results of both the impact of the supervisory outlier tests, and the institution’s internal or standardised methodologies, competent authorities should consider ‘point in time’ figures as well as historical trends. These rates should be compared to peers and considered in the context of the global market situation. Shock Scenarios and stress testing 263. Competent authorities should assess and take into account the results of the interest rate shock scenarios for ongoing management as well as the IRRBB stress tests performed by the institution as part of its ongoing internal management process. In this context, competent authorities should be aware of the main sources of the institution’s IRRBB and in particular of the effect of changes in behavioural assumptions such as on NMD. 264. If, when the outcome of the institution’s shock scenarios and stress tests is reviewed, particular accumulations of repricing/maturity at different points on the curve are revealed or suspected, competent authorities may need to carry out additional analyses. 6.5.2.2 Assessment of IRRBB management and control framework 265. To achieve a comprehensive understanding of the institution’s interest rate risk profile in the non-trading book, competent authorities should review the governance and framework underlying its interest rate exposures. IRRBB strategy and appetite 266. Competent authorities should assess whether the institution has a sound, clearly formulated and documented IRRBB strategy and appetite, approved by the management body. For this assessment, among other factors, competent authorities should take into account the role of the management body in setting, approving and reviewing the IRRBB strategy and appetite, the proper implementation of this strategy by senior management as well as its appropriateness for the institution given its business model, its market environment and role in the financial system, and capital adequacy.

106 Organisational and internal control framework 267. Competent authorities should assess whether the institution has an appropriate organisational framework and clearly assigned responsibilities for IRRBB management, measurement, monitoring and control functions with sufficient human and technical resources. For this assessment, competent authorities should take into account the adequacy of the lines of responsibility for the overall management of IRRBB, and for taking, monitoring, controlling and reporting IRRBB, including the independence of the IRRBB control area. 268. Competent authorities should assess whether the institution has clearly defined policies and procedures for the management of IRRBB that are consistent with its IRRBB strategy and appetite, approved and reviewed regularly by the management body. The policies should be clearly formalised and communicated and applied consistently across the institution, as well as across banking groups. Competent authorities should verify that policies define the procedures for new product development, major hedging or risk management initiatives, ensuring that these are subject to adequate procedures and controls before they are undertaken and the institution has undertaken an analysis of their possible impact in its overall risk profile. 269. Competent authorities should assess whether the institution has an appropriate framework for identifying, evaluating, managing and mitigating IRRBB, in line with the level, complexity and riskiness of non-trading book positions and the institution’s size and complexity. The assessment should encompass internal models, such as those related to customer behaviour (e.g. models of deposit stability and loan early repayment). In this assessment competent authorities should evaluate whether the risk managers and the institution’s senior management understand the assumptions underlying the measurement systems and they are aware of the degree of model risk that prevails in the institution’s risk measurement techniques. 270. In addition, they should consider whether the information systems and measurement techniques enable management to measure the inherent IRRBB in all its material on- and off￾balance- sheet exposures (where relevant at group level), including internal hedges, in concentrations in maturities and counterparties, in the non-trading book portfolio. The IRRBB framework should be subject to regular reviews and evaluations of the effectiveness of the framework. Competent authorities should compare internal reviews and evaluations with information from COREP. 271. Competent authorities should assess the institution’s approach to modelling the behaviour of non-maturity deposits (NMDs), including whether this takes account of relevant risk factors impacting NMD repricing behaviour. Competent authorities should use appropriate analytical tools for this assessment, taking into account the institution’s business model. Approaches that may be relevant include evaluation of how the institution segments NMDs using risk factors related to the customer, institution or market profile and benchmarking with peers that have a similar risk profile. In addition, competent authorities should consider how the

107 institution balances historical data with forward looking approaches and expert judgment, and review the impact on NII and EVE if behavioural assumptions were adjusted. 272. Competent authorities should consider whether the institution’s internal measurement systems (IMS) take into account all material forms of interest rate risk to which the institution is exposed (e.g. gap risk, basis risk and option risk). The IMS should be properly calibrated, independently validated, back-tested and reviewed at an appropriate frequency. Competent authorities should take into account whether the IMS is supported by documentation considering the nature, scale and complexity of the IRRBB inherent in the business model and the institution’s activities. 273. Competent authorities should assess whether the institution has an appropriate monitoring and internal reporting framework for IRRBB that ensures there is prompt action at the appropriate level of the institution’s senior management or management body, where necessary. The monitoring system should include specific indicators and relevant triggers to provide effective early warning alerts (e.g. for breaches of IRRBB limits). Competent authorities should take into account whether the management and control area reports the results of the monitoring regularly to the management body and senior management, with an appropriate frequency depending on the scale, complexity and level of IRRBB exposures. 274. Competent authorities should assess whether the institution has a strong and comprehensive control framework and sound safeguards to mitigate its exposures to IRRBB in line with its risk management strategy and risk appetite, including an appropriate limit system on both IRRBB measures. The internal control function should include all consolidated entities, all geographical locations and all financial activities. Competent authorities should assess the functionality of the internal audit function, including whether its reviews are conducted sufficiently frequently and cover the main elements of the IRRBB framework. 6.5.3. CSRBB 6.5.3.1. Assessment of inherent CSRBB 275. Through the assessment of the inherent level of CSRBB, competent authorities should understand the main drivers of the institution’s CSRBB exposure and evaluate the potential prudential impact of this risk on the institution. 276. To determine the scope of the CSRBB assessment, competent authorities should first identify the sources of CSRBB to which the institution is or might be exposed and if there have been any significant changes. As part of this, competent authorities should have regard to the institution’s governance of credit spread risk, including its CSRBB strategy and its risk appetite in relation to CSRBB, and the treatment of CSRBB within the ICAAP context. 277. Competent authorities should form a clear view on how changes in credit spreads can have an adverse impact on an institution’s net interest income (and, where relevant, its earnings) and economic value to gain both a short-term and a longer-term view on the possible threat to

108 capital adequacy. For this purpose, competent authorities should consider the approach applied by the institution to form this clear view on the structure and features of the institution’s assets, liabilities, and off-balance-sheet exposures, and how these are driving the level and direction of CSRBB. 278. When analysing the impact on the institution’s earnings, competent authorities should consider the impact of credit spread-sensitive positions on the institution’s return, the impact of the changes in credit spreads on the institution’s net interest income, and the effects of changes in the market value of instruments – depending on account treatment – either shown in the profit and loss (P&L) account or directly in equity (e.g. via other comprehensive income). 279. Competent authorities should consider the results of the institution’s methodologies for measuring CSRBB, where appropriate. Through the analysis of these methodologies, competent authorities should gain a deeper understanding of the main risk factors underlying the institution’s CSRBB profile. 6.5.3.2. Assessment of CSRBB management and control framework 280. To achieve a comprehensive understanding of the institution’s credit spread risk profile in the non-trading book, competent authorities should review the governance and framework underlying its interest rate exposures. 281. The review of the institution’s governance of CSRBB should include the following elements: a. the institution’s CSRBB strategy and appetite; b. the institution’s organisational framework and allocation of responsibilities with respect to CSRBB management, measurement, monitoring and control functions; c. the institution’s policies and procedures for the management of CSRBB. 282. For the assessment of these areas, competent authorities should refer to section 6.5.2.2 on the assessment of the IRRBB management and control framework, with the principles contained also applicable to the assessment of CSRBB management. 283. When analysing the perimeter of assets and liabilities covered by the CSRBB assessment, also as considered within the institution’s methodologies, competent authorities should assess whether any potential exclusion of instruments from the relevant perimeter is only made in the absence of sensitivity to credit spread risk and is appropriately documented and justified, as required in paragraph 124 of the EBA Guidelines on IRRBB and CSRBB50. Factors to take into account include: a. whether the institution includes all assets and liabilities accounted at fair value; 50Guidelines issued on the basis of Article 84 (6) of Directive 2013/36/EU specifying criteria for the identification, evaluation, management and mitigation of the risks arising from potential changes in interest rates and of the assessment and monitoring of credit spread risk, of institutions’ non-trading book activities (EBA/GL/2022/14).

109 b. whether the institution includes all assets and liabilities whose credit spread risk can be inferred from a direct/indirect or even modelled market price, whatever their accounting treatment; c. the potential relevance of credit spreads in the institution’s pricing practice for different assets/liabilities (for example through explicit references to observed market prices or more indirect relevance); d. differences, if any, that the institution applies between the perimeter for EVE and NII in the measurement of CSRBB (e.g. due to the NII time horizon or other reasons). 284. To analyse the institution’s measurement of CSRBB, competent authorities should consider, where appropriate, to review which shock scenarios the institution is considering, and, how and why the shocks may be different between balance sheet items. 285. Competent authorities should check the exclusion of idiosyncratic spread in the institution’s measurement of CSRBB or its inclusion only for proportionality reasons and regardless of the SREP categorisation of the institution, as long as it is ensured that the measures will yield more conservative results. 286. Competent authorities should assess whether the institution has an appropriate framework for identifying, evaluating, managing and mitigating CSRBB, in line with the level, complexity and riskiness of non-trading book positions and the institution’s size and complexity. They should consider whether the information systems and measurement techniques enable management to measure the inherent CSRBB in all its material on- and off-balance- sheet exposures (where relevant at group level) in the non-trading book portfolio. The CSRBB framework should be subject to regular reviews and evaluations of its effectiveness. In this context, competent authorities should assess whether significant measurement assumptions are reviewed at least annually and more frequently during rapidly changing market conditions. 287. Competent authorities should consider whether the institution’s internal measurement systems (IMS) take into account all sources of CSRBB which are relevant for the institution’s business model. The IMS should be properly calibrated, independently validated, back-tested and reviewed at an appropriate frequency. Competent authorities should take into account whether the IMS is supported by documentation considering the nature, scale and complexity of the CSRBB inherent in the business model and the institution’s activities. 288. Competent authorities should assess whether the institution has an appropriate monitoring and internal reporting framework for CSRBB that ensures there is prompt action at the appropriate level of the institution’s senior management or management body, where necessary. Competent authorities should take into account whether the management and control area reports the results of the monitoring regularly to the management body and senior management, with an appropriate frequency depending on the scale, complexity and level of CSRBB exposures.

110 289. Competent authorities should assess whether the institution has a strong and comprehensive control framework and sound safeguards to mitigate significant exposures to CSRBB in line with its risk management strategy and risk appetite. The internal control function should include all consolidated entities, all geographical locations and all financial activities. Competent authorities should assess the functionality of the internal audit function, including whether its reviews are conducted sufficiently frequently and cover the main elements of the CRSBB framework. 6.5.4. Summary of findings, scoring and supervisory measures 290. Following the above assessments, competent authorities should form a view on the institution’s IRRBB and CSRBB. This view should be reflected in a summary of findings, accompanied by a score based on the considerations specified in table 12. If, based on the materiality of certain risk subcategories, the competent authority decides to assess and score them individually, the guidance provided in this table should be applied, as far as possible, by analogy. Table 12. Supervisory considerations for assigning an IRRBB and CSRBB score Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls 1 There is a low risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls. For IRRBB: • The sensitivity of the economic value to changes in interest rates is not material/very low. • The sensitivity of earnings to changes in interest rates is not material/very low. • The sensitivity of the economic value and earnings to changes in the underlying assumptions (e.g. in the case of products with embedded customer optionality) are not material/very low. For IRRBB and CSRBB: • There is consistency between the institutions risk policy and strategy for interest rate- and credit spread risk and its overall strategy and risk appetite. • The organisational framework for interest rate and credit spread risk is robust with clear responsibilities and a clear separation of tasks between risk￾takers and management and control functions. • Interest rate and credit spread risk measurement, monitoring and reporting systems are appropriate. • There are clearly defined internal policy limits together with their associated risk mitigation measures, and the control framework for interest rate and credit spread risk (if material) that are sound and are in line with the institution’s risk strategy and risk appetite. 2 There is a medium-low risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls. For IRRBB: • The sensitivity of the economic value to changes in interest rates is low to medium. • The sensitivity of earnings to changes in interest rates is low to medium. • The sensitivity of the economic value and earnings to changes in the underlying assumptions (e.g. in the case of products with embedded customer optionality) is low to medium. . 3 There is a medium-high risk of significant prudential For IRRBB: • The sensitivity of the economic value to changes in interest rates is medium to high. • There is inconsistency between the institution’s risk policy and strategy for interest rate- and

111 Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls impact on the institution considering the level of inherent risk and the management and controls. • The sensitivity of earnings to changes in interest rates is medium to high. • The sensitivity of the economic value and earnings to changes in the underlying assumptions (e.g. in the case of products with embedded customer optionality) is medium to high. credit spread risk and its overall strategy and risk appetite. • The organisational framework for interest rate and credit spread risk does not sufficiently separate responsibilities and tasks between risk-takers and management and control functions. • Interest rate and credit spread risk measurement, monitoring and reporting systems are not undertaken with sufficient accuracy and frequency. • Internal policy limits, risk mitigation measures and/or the control framework for interest rate and credit spread risk (if material) are not aligned among themselves or not in line with the institution’s risk strategy and risk appetite. 4 There is a high risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls. For IRRBB: • The sensitivity of the economic value to changes in interest rates is high. • The sensitivity of earnings to changes in interest rates is high. • The sensitivity of the economic value and earnings to changes in the underlying assumptions (e.g. in the case of products with embedded customer optionality is high.) 291. The table below presents a non-exhaustive list of supervisory measures that competent authorities may take in case of identified deficiencies in the institution’s IRRBB and CSRBB management framework. Competent authorities should decide on the type of the measure based on its effectiveness to the specific identified deficiency. Competent authorities may apply additional supervisory measures (including quantitative measures in accordance with Article 104(1)(a) of the Directive 2013/36/EU) or a combination of them if these are deemed more appropriate to address the identified deficiencies. Table 13. Potential and non-exhaustive supervisory measures for IRRBB and CSRBB Potential supervisory measures for competent authorities in accordance with Article 104(1), points (b), (d), (e), (f), (j), and (l) and Article 84(3) of Directive 2013/36/EU – Competent authorities may require the institution to: A. enhance their stress testing capacity; B. enhance the reporting of IRRBB management information to the management body and senior management; C. apply variations to internal limits to reduce the risk inherent in activities, products and systems; D. provide additional or more frequent reporting of the institutions’ IRRBB positions; E. use the standardised methodology for IRRBB; F. specify modelling and parametric assumptions, other than those identified by the EBA RTS (in accordance with the last paragraph of Article 98(5) of Directive 2013/36/EU.

112 7. Title 7. SREP capital assessment 7.1. General considerations 292. Competent authorities should determine through the SREP capital assessment whether the own funds held by the institution provide sound coverage of risks to capital to which the institution is or might be exposed, if such risks are assessed as material to the institution. 293. Competent authorities should do this by determining and setting the quantity (amount) and quality (composition) of additional own funds the institution is required to hold to cover institution-specific risks and elements of risks that are not covered or not sufficiently covered by P1R, and, where necessary, own funds requirements to address deficiencies in models, controls, governance or other deficiencies, as well as risk arising from the institution’s business model (P2R for risks other than risk of excessive leverage and P2R-LR for risk of excessive leverage). 294. When a material impact on institution’s capital profile is or may be expected due to relevant changes to the regulatory framework for determining P1R (e.g. increase or decrease in TREA) or to its implementation for the specific institution (such as the output floor), competent authorities should assess such impact in terms of its interaction with the P2R. Such assessment may lead to a redetermination (either upward or downward) of the level or composition of the P2R to ensure that the institution’s overall own funds requirements are in line with Article 104a(1) of Directive 2013/36/EU, in particular that P2R cover risks or elements of risks that are not covered or not sufficiently covered by the P1R. To perform such an assessment, competent authorities may increase the frequency of the SREP assessment as set out in the SREP engagement model in section 2.4 or of specific elements thereof. 295. To address potential capital inadequacies, including in stressed conditions, competent authorities should take appropriate supervisory measures, including, where relevant, establishing and communicating P2G and P2G-LR which is the quantity (amount) and quality (composition) of own funds that the institution is expected to hold over and above its OCR or its OLRR. 296. When setting the P2R and, where relevant, P2G, competent authorities should: a. take into account any supervisory measures they have applied or are planning to apply to an institution; b. clearly justify all elements of additional own funds requirements for P2R and P2R-LR as well as for P2G and P2G-LR; c. apply P2R and P2R-LR as well as P2G and P2G-LR in a consistent manner to ensure broad consistency of prudential outcomes across institutions.

113 297. Competent authorities should assess the adequacy of the institution’s own funds and the impact of economic stress thereon, as well as risks posed by excessive leverage, as a key determinant of the institution’s viability. This determination should be summarised in a score taking into account the considerations specified at the end of this Title. 7.2. Determining Pillar 2 requirement for risks other than the risk of excessive leverage (P2R) 298. Competent authorities should determine P2R for risks other than the risk of excessive leverage, where they identify any of the situations listed in Article 104a(1) of Directive 2013/36/EU for an institution, including in particular: a. the risk of unexpected losses, and of expected losses insufficiently covered by provisions, over a 12-month period (except where Regulation (EU) No 575/2013 specifies own funds requirements over a different period), which individual institutions are facing due to their activities, including those reflecting the impact of certain economic and market developments; b. model deficiencies for internal approaches for the calculation of own funds requirements (‘regulatory model deficiencies’) as assessed in the context of Article 101 of Directive 2013/36/EU, excluding those already covered by the fact that an institution has become bound by the output floor in accordance with Article 92 of Regulation 575/2013; c. deficiencies in internal governance, including internal control arrangements and other deficiencies, as well as risk arising from the institution’s business model, identified following the risk assessment outlined in Titles 4 to 6, where other supervisory measures have not been effective or are considered insufficient to address the identified deficiencies. 7.2.1. Determining additional own funds to cover unexpected losses 299. When setting P2R for the risk of unexpected losses pursuant to point (a) of the following paragraph, competent authorities should consider each type of risk that may jeopardise the institution’s capital position. Competent authorities should set P2R to cover the risk of unexpected losses by determining the capital considered adequate to cover the type of risk and deducting the relevant part of P1R. 300. Competent authorities should determine on a risk-by-risk basis, the amounts of capital considered adequate, by identifying, assessing and quantifying the risks to which the institution is exposed, taking into account its full risk profile. The determination of the amounts of capital considered adequate should include: a. institution-specific risks or elements of risks that are not covered by the P1R; b. institution-specific risks or elements of such risks that are not sufficiently covered by the P1R. 301. Competent authorities should ensure that the amount of capital considered adequate to cover each risk identified in accordance with Articles 79 to 85 and 87a of Directive 2013/36/EU is not

114 lower than the relevant part of the applicable P1R covering that risk. In exceptional cases where it is overly burdensome, especially for small institutions, to meaningfully disentangle the amount of capital considered adequate on a risk-by-risk basis, competent authorities should comply with the first sentence of this paragraph on a best-effort basis, using the ICAAP calculations, supervisory judgement and other sources of information. 302. When identifying, assessing and quantifying risks to which the institution is exposed, competent authorities should rely on the following sources of information: a. the ICAAP and the outcomes of its assessment by the competent authority, including the ICAAP calculations where deemed reliable or partially reliable in accordance with paragraphs 3066 to 308; b. supervisory reporting; c. the outcome of supervisory assessment, including any relevant previous supervisory activities, and benchmarking, as well as other relevant inputs, including those arising from interaction and dialogue with the institution. 303. The ICAAP and outcomes of its assessment should be taken into account by competent authorities as one of the key inputs for the identification and assessment of risks relevant for the institution. The determination of the amount of capital considered adequate and P2R on a risk-by-risk basis should take into account the ICAAP calculations if deemed reliable or partially reliable, as well as the outcomes of supervisory benchmarking and other relevant inputs as appropriate, including the supervisory judgement. 304. For the purposes of Article 98(1), point (f) of Directive 2013/36/EU and the determination of P2R, competent authorities should assess and consider diversification effects arising from geographical, sectoral or any other relevant drivers within each material risk category (intra￾risk diversification). For each of the risks to capital covered by Regulation (EU) No 575/2013, such diversification effects should not reduce the minimum own funds requirements calculated in accordance with Article 92 of Regulation (EU) No 575/2013. 305. However, diversification between risks in different categories, including those covered by Regulation (EU) No 575/2013 (inter-risk diversification) should not be considered as part of the determination of P2R. ICAAP calculations 306. Competent authorities should assess the reliability of the ICAAP calculations by assessing whether they are: a. granular: the calculations/methodologies should allow calculations to be broken down by risk type, rather than presenting a single (economic capital) calculation covering all risks; b. credible: the calculations/methodologies used should demonstrably cover the risk they are looking to address (e.g. the credit concentration risk calculation should use appropriate sector breakdowns that reflect actual correlations and portfolio compositions) and should

115 be sufficiently robust, stable, risk sensitive and conservative to adequately quantify losses associated with the risks. Such calculations/methodologies should be consistent with the institutions’ strategic processes, including the institutions’ risk appetite; c. understandable: the underlying drivers and key assumptions of the calculations/methodologies should be clearly specified. A ‘black box’ calculation should not be acceptable. Competent authorities should ensure that the institution provides an explanation of the key assumptions used, including at least time horizon, confidence levels, correlation assumptions, key parameters, the most fallible areas of the models used, and how these are accounted for and corrected in the final ICAAP calculation; d. comparable: the calculations/methodologies should clearly mention the main assumptions in terms of the overall level of conservatism, the holding periods/risk horizons and confidence levels (or equivalent measurement) in order to allow the adjustment that may be requested or enacted by competent authorities in order to facilitate comparability with peers and supervisory benchmarking. 307. Competent authorities should further assess the reliability of the ICAAP calculations by comparing them against the outcome of the supervisory benchmarks for the same risks, and other relevant inputs. 308. An ICAAP calculation should be considered partially reliable where, despite not meeting all the criteria of paragraph 3066, the calculation still seems highly credible, though this should be on an exceptional basis and accompanied by steps to improve deficiencies identified in the ICAAP calculation. Supervisory benchmarks and other relevant inputs 309. Competent authorities should develop and apply risk-specific supervisory benchmarks as a means to challenge ICAAP calculations for those material risks, or elements of such risks, that are not covered or not sufficiently covered by Regulation (EU) No 575/2013, or to further support the determination of risk-by-risk P2R, especially where ICAAP calculations for those material risks, or elements of such risks, are deemed unreliable or are unavailable. 310. The supervisory benchmarks should be developed to provide a prudent, consistent (i.e. as applicable, calibrated to equivalent holding periods/risk horizons and confidence levels as required by Regulation (EU) No 575/2013), transparent and comparable measure with which to calculate and compare across institutions the capital considered adequate for a given risk. 311. When applying supervisory benchmarks, competent authorities should consider the business model of institutions and, to the extent appropriate, complement these with the application of supervisory judgement to account for business-model-specific and institution-specific considerations. 312. Competent authorities should use other relevant inputs to support the determination of risk￾by-risk P2R. Other relevant inputs may include the outcomes of risk assessments (following

116 the criteria specified in Title 6), peer-group comparisons, including report(s) and benchmarks issued by the EBA. 313.Other relevant inputs should prompt the competent authority to reassess the appropriateness/reliability of an ICAAP/supervisory benchmarks for a specific risk, and/or make adjustments to the outcome, where they prompt doubts about its accuracy. 314. To ensure consistency in determining P2R, competent authorities should use the same peer groups established to analyse risks to capital as specified in Title 6. 315. When competent authorities take supervisory benchmarks as well as other relevant inputs into consideration for the determination of P2R, as part of the dialogue with the institution, they should explain the rationale and general underlying principles behind the inputs used. 7.2.2. Determining own funds or other measures to cover regulatory model deficiencies not covered by the fact that an institution has become bound by the output floor 316. If, during the ongoing review of internal approaches for the calculation of own funds requirements, competent authorities identify model deficiencies that could lead to underestimation of the P1R, they should set P2R only where this is determined to be more appropriate than other supervisory measures. Competent authorities should only set P2R to cover these deficiencies: a. where it is not possible to address them under P1R through other supervisory measures, such as requiring institutions to adjust their models or apply an appropriate margin of conservatism to their estimates; b. by taking into account whether the institution has become bound by the output floor in accordance with Article 92 of Regulation (EU) No 575/2013 and, if this is the case, proceed as explained in the next paragraph. Such P2R should only be set as an interim measure while the deficiencies are addressed. 317. When an institution becomes bound by the output floor as set out in Article 92(3) of Regulation (EU) No 575/2013, competent authorities should: a. ensure the nominal amount of P2R does not automatically increase as a result of the institution becoming bound by the output floor (‘temporary cap’), in accordance with Article 104a(6) point (a) of Directive 2013/36/EU. To this end, the applicable percentage of the P2R previously communicated to the institution by the competent authority following the last SREP cycle will be applied to the institution’s unfloored TREA (U-TREA), as set out in Article 92(4) of Regulation (EU) No 575/2013. This approach will remain in place until the performance of the review described in point b; b. without delay, and no later than the end date of the next SREP, review the P2R imposed on the institution in accordance with Article 104(1), point (a) of Directive 2013/36/EU. As part of this review, competent authorities should:

117 i. remove any part of the P2R that may be covering regulatory model deficiencies for the calculation of own funds requirements that is already covered by the output floor, in order to eliminate any potential double-counting effects; ii. consider whether there are arithmetic effects (i.e. where the P2R nominal amount increase is not due to an increase in risk but results from the P2R being expressed as a percentage of TREA) on the nominal amount of P2R arising from the automatic increase in the TREA due to the fact that the institution has become bound by the output floor, and remove them as appropriate; c. communicate to the institutions the applicable own funds requirements following the review in point (b), emphasising, in particular, any findings related to double counting elements. Competent authorities may also require institutions to disclose, as part of their Pillar 3 reporting, the impact of either the temporary cap or the review of double counting – whichever is applicable at the reference date – on the reported P2R. 318. For the purpose of the previous paragraph, competent authorities should encourage institutions to inform them at an early stage when they foresee (based on estimates) they may become bound by the output floor. This is to facilitate as far as possible, the review of double counting elements described in the previous paragraph. 319. Competent authorities should perform the review described in paragraph 317 at the time an institution first becomes bound by the output floor. Following the conclusion of this review, the temporary cap on P2R does not apply, and the P2R communicated by competent authorities applies to floored TREA. Competent authorities should have regard to the fact that as long as an institution is bound by the output floor, no additional own funds requirements shall be imposed that would double-count the risks that are already fully covered by the fact that the institution is bound by the output floor, in accordance with Article 104a(8) of Directive 2013/36/EU, and in line with paragraph 2944. 7.2.3. Determining own funds or other measures to cover other deficiencies 320. Competent authorities should set P2R to cover deficiencies – identified following the risk assessment outlined in Titles 4 to 6 – where other supervisory measures have not been effective or are considered insufficient to address the identified deficiencies. Competent authorities should only set such P2R as an interim measure while the deficiencies are addressed. 321. Competent authorities should only set P2R to cover funding risk – identified following the risk assessment outlined in Title 8 – where this is determined to be more appropriate than other supervisory measures. 322. Where an institution repeatedly fails to establish or maintain an adequate level of own funds to cover the P2G, competent authorities should set P2R to cover that additional risk not later than 2 years after the breach of guidance. Competent authorities may postpone that decision

118 where they allow institutions to operate below the level of guidance due to economic or market conditions or institution-specific circumstances, in line with paragraphs 4522 and 453. 7.2.4. Determining the composition of Pillar 2 requirements 323. Where necessary, and having regard to the institution’s specific circumstances, competent authorities may decide to require the institution to cover P2R with a higher quality of capital than that referred to in Article 104a(4) of Directive 2013/36/EU51. This decision should be clearly justified, highlighting the specific circumstances that led to it. In their justifications competent authorities should refer to elements such as: a. the specific nature of the institution, its shareholding structure and, where relevant, the group structure, potentially affecting the possibility to raise capital; b. the specific nature of risks faced by the institution, potentially leading to a particularly rapid depletion of CET1 capital. 7.3. Pillar 2 requirements for the risk of excessive leverage (P2R-LR) 324. Where, as a result of the risk of excessive leverage assessment, in accordance with Article 104a (3) and (4), of Directive 2013/36/EU, competent authorities determine P2R-LR to address this risk, they should add this requirement to the own funds requirement based on the leverage ratio as set out in Article 92(1), point (d), of Regulation (EU) No 575/2013 and not to the P1R based on the TREA as set out in Article 92(1), points (a) to (c). Competent authorities should consider the leverage ratio requirement and P2R-LR as a separate stack from the TREA-based requirements and P2R for all other types of risk (i.e. available own funds can simultaneously be used to meet requirements in the TREA-based stack and in the leverage ratio-based stack of own funds requirements). 7.3.1. Assessment of risk of excessive leverage 325. In line with the concept of the leverage ratio (and its stack of requirements) as a backstop to the TREA-based own funds requirements, in the assessment of the risk of excessive leverage, competent authorities should focus on potential material vulnerabilities not covered or not sufficiently covered by the own funds requirements as set out in Article 92(1), point (d), of Regulation (EU) 575/2013 that may require corrective measures to the business activities of the institution, that were not envisaged in its business plan. 326. In assessing the risk of excessive leverage, competent authorities should consider all of the following aspects and adapt the depth of the assessment of each aspect in accordance with its relevance to the institution: 51 At least 56.25% CET1 and at least 75% Tier 1.

119 a. The elements of risk of excessive leverage that are considered not covered or not sufficiently covered by the leverage ratio own funds requirement set out in Article 92(1), point (d), of Regulation (EU) No 575/2013, as a result of, in particular: i. regulatory arbitrage/optimisation of the leverage ratio by exchanging exposures counted in the leverage ratio for economically similar exposures that may be less counted in the leverage ratio exposure calculation; ii. regulatory arbitrage/optimisation by minimising the leverage ratio exposure in the form of temporary reductions in transaction volumes in key financial markets (particularly in the money market, in certain activities such as SFTs, but also in the derivative market) around reference dates, resulting in the reporting and public disclosure of elevated leverage ratios (‘window-dressing activities’); iii. specific features of the business model, business activities or other bank idiosyncrasies that either increase or decrease the extent to which the institution is exposed to the risk of excessive leverage, but are not covered or not sufficiently covered in the calculation of the leverage ratio. Competent authorities should consider, where applicable, high exposures to written options on equity or short positions via credit derivatives that may have an elevated exposure to peak losses, as these positions are not fully captured in the leverage ratio exposure (in contrast to, for example, written credit derivatives), and concentrations in certain off-balance sheet items where the idiosyncrasies inherent to the business activities of the institution may lead to increased volatility in drawdowns; b. the elements of risk of excessive leverage that are explicitly excluded from or not explicitly addressed by the leverage ratio own funds requirement, including due to the exclusions listed in Article 429a of Regulation (EU) No 575/2013, particularly where there are concerns about the assessment of continued compliance with the conditions for these exclusions and where the reliance on a single exclusion is highly significant for the institution and the amount excluded is unduly volatile; c. the changes in the institution’s leverage ratio and its components, including the foreseeable impact of current and future expected losses on the leverage ratio, taking into account the business model of the institution. 7.3.2. Determination of P2R-LR 327. Competent authorities should determine the P2R-LR as the difference between the capital considered adequate to cover the risk of excessive leverage and the leverage ratio own funds requirements as set out in Article 92(1), point (d), of Regulation (EU) No 575/2013. This amount cannot be negative. 328. When setting P2R-LR, competent authorities should consider in particular: a) elements of risk of excessive leverage that are considered not covered or not sufficiently covered by the leverage ratio own funds requirement set out in Article 92(1), point (d), of Regulation (EU) No 575/2013, particularly where the assessment of the aspects described in paragraphs 3255 and 326 indicate a high vulnerability when compared to the leverage ratio exposure;

120 b) elements of risk of excessive leverage that are explicitly excluded from or not explicitly addressed by the leverage ratio own funds requirement, including due to the exclusions listed in Article 429a(1), of Regulation (EU) No 575/2013, assessed in accordance with paragraph 3263, point b. Competent authorities should set P2R-LR only in those cases where particularly extensive use of a certain exclusion results in a level of leverage ratio that does not appropriately reflect the risk faced by the institution. 329. Competent authorities should identify, assess and quantify the risk of excessive leverage using the sources of information and methods set out in paragraphs 302 and 303, to the extent that they are relevant for this risk. 7.3.3. Composition of P2R-LR 330. Competent authorities should add the P2R-LR to the minimum leverage ratio Tier 1 requirement. In order to meet this additional requirement, institutions should also be able to use any Tier 1 capital. 331. Where necessary, and having regard to the institutions’ specific circumstances, competent authorities may decide to require institutions to cover P2R-LR with a higher quality of capital than that specified in the previous paragraph. This decision should be clearly justified, highlighting the specific circumstances that led to it, taking into account the individual risk situation of the institution and considering situations where materialisation of the risk of excessive leverage may require a higher quality of capital to cover potential losses. 7.4. Reconciliation with the capital buffers and any macroprudential requirements 332. In determining Pillar 2 requirements (or other capital measures), competent authorities should reconcile the Pillar 2 requirements with any existing capital buffer requirements by addressing the same risks or elements of risks. Competent authorities should not set Pillar 2 requirements or other capital measures (including P2G) where the same risk is already covered by specific capital buffer requirements. Any Pillar 2 requirements or other capital measures should be institution-specific and should not cover macroprudential or systemic risks. 7.5. Determining the TSCR, TSLRR, OCR and OLRR 333. Competent authorities should determine and express the TSCR in terms of CET1 Capital, Tier 1 Capital and Total Own Funds in accordance with table 14 below:

121 Table 14. Determination of TSCR in terms of CET1, T1 and total own funds TSCR

(a) + (b) Component (a) Component (b) In terms of CET1 Capital Own funds requirement under Article 92(1)(a), of Regulation (EU) No 575/2013 P2R required to be held in CET1 capital in accordance with Section 7.2 In terms of Tier 1 Capital Own funds requirement under Article 92(1)(b), of Regulation (EU) No 575/2013 P2R required to be to be held in Tier 1 capital in accordance with Section 7.2 In terms of Total Own Funds Own funds requirement under Article 92(1)(c), of Regulation (EU) No 575/2013 Total P2R set in accordance with Section 7.2 334. Competent authorities should determine the TSLRR (in terms of Tier 1 capital) as the sum of: a. the leverage ratio own funds requirement pursuant to Article 92(1), point (d), of Regulation (EU) No 575/2013; b. the additional own funds required to address the risk of excessive leverage (determined in accordance with the criteria specified in section 7.3). 335. Where competent authorities require institutions to cover P2R-LR with a higher quality of capital in line with paragraph 331, they should determine the TSLRR (in terms of CET1) as the part of the additional own funds referred to in point b of the previous paragraph, that is required by the competent authority to be held in the form of CET1 capital. 336. Where considering the possibility of requiring a higher quality of capital, competent authorities should aim to avoid overlaps with other existing requirements within the relevant TREA-based or leverage ratio-based stack of requirements and with MREL. 337. Competent authorities should determine the OCR as the sum of: a. TSCR; b. combined capital buffer requirements. 338. Competent authorities should determine the OLRR as the sum of: a. TSLRR; b. G-SII leverage ratio buffer requirement in accordance with Article 92(1a), of Regulation (EU) No 575/2013. 339. Competent authorities should not consider items and instruments other than those eligible for the determination of own funds (as defined in Part Two of Regulation (EU) No 575/2013) in the assessment/calculation of the TSCR, TSLRR, OCR or OLRR.

122 7.6. Meeting requirements in stressed conditions – Use of P2G and P2G-LR to address the quantitative outcomes of stress testing 340. Competent authorities should determine by means of stress testing the adequacy of the institution’s own funds (quantity and composition) in stressed conditions and whether supervisory measures, including P2G, P2G-LR, revised capital planning and other measures are necessary to address potential inadequacies. To assess capital adequacy in stressed conditions, competent authorities should consider: a. the use of the qualitative outcomes (e.g. deficiencies identified in risk management and control) of institutions’ stress tests and supervisory stress testing; b. the use of the quantitative outcomes of institutions’ stress tests, if the ICAAP is deemed reliable, and of supervisory stress tests, pursuant to Article 100 of Directive 2013/36/EU as specified in Title 11, and including, for example: i. prescribing specific ‘anchor’ scenarios/assumptions to be implemented by institutions; ii. conducting system-wide stress tests using consistent methodologies and scenarios run either by institutions or by supervisors. 341. Competent authorities should assess as appropriate the quantitative outcomes of stress tests with regard to the adequacy and quality of the institution’s own funds and determine whether the quantity and quality of own funds are sufficient to cover applicable capital requirements, and in particular: a. OCR including its combined buffer requirements under the baseline scenario over a forward-looking time horizon of at least two years; b. TSCR under the adverse scenarios over a forward-looking time horizon of at least two years. 342. Competent authorities should determine P2G and P2G-LR, and, where the determination leads to a positive value, they should set P2G or P2G-LR to address supervisory concerns about the sensitivity of the institution to the adverse scenarios used in the supervisory stress tests. P2G should not be used to cover risks or elements of risks already covered by the P2R in accordance with section 7.2. Similarly, P2G-LR should not be used to cover those aspects of risk of excessive leverage already covered by P2R-LR in accordance with section 7.3. 343. The level of P2G should protect against the potential breach of TSCR in an adverse scenario. Similarly, the level of P2G-LR should protect against the breach of TSLRR in an adverse scenario. Where the quantitative outcomes of the supervisory stress tests suggest that the institution is not expected to breach its TSCR under the adverse stress test scenario, competent authorities may decide not to set P2G. Similarly, competent authorities may decide not to set P2G-LR where TSLRR is not expected to be breached under the adverse stress test scenario. 344. Competent authorities should determine and set P2G and P2G-LR based on the outcomes of the adverse scenario of the relevant supervisory stress tests, including the EU-wide stress tests

123 performed by the EBA or any other relevant supervisory stress tests performed on a system￾wide basis over a forward-looking horizon of at least two years. 345.On the basis of establishing a proportionate approach for non-Category 1 institutions and subsidiaries of cross-border groups, for setting and updating P2G and P2G-LR competent authorities may consider the outcomes of simplified forms of supervisory stress tests (e.g. through the use of supervisory-prescribed ‘anchor’ scenarios, sensitivity analysis, top-down stress tests conducted by designated authorities, and portfolio level impacts from consolidated level stress tests), past supervisory stress tests or institutions’ stress tests in accordance with paragraph 340. The simplified forms of supervisory stress tests may be carried out on an individual basis rather than as part of the system-wide exercise. 346. Competent authorities should determine and set P2G and P2G-LR in accordance with the minimum engagement model specified in section 2.4. In particular, the minimum frequency with which P2G and P2G-LR are determined and set should be the frequency of the capital adequacy assessment under the SREP minimum-engagement model. 347. Notwithstanding the previous paragraph, competent authorities: a. should assess whether the existing P2G and P2G-LR is still appropriate whenever the results of new supervisory stress tests are available, and revise them if necessary; b. may determine P2G and P2G-LR only every second year instead of annually, including for SREP Category 1 institutions. However, in the year that follows the year of determining P2G, competent authorities should assess whether P2G and P2G-LR are still relevant or need to be updated, on the basis of all relevant information, including outcomes of past supervisory stress tests, together with additional sensitivity analysis (i.e. simplified forms of supervisory stress testing). 348. When calibrating the P2G, competent authorities should ensure that it is set at a level appropriate to cover at least the anticipated maximum stress impact, which should be calculated based on the changes in the CET1 ratio (i.e. considering both movements in CET1 capital and TREA) in the worst year of stress, and taking into account the level of applicable capital requirements. The maximum stress impact for the purpose of setting the P2G should be understood as the difference between the lowest CET1 ratio in the adverse scenario over the stress test horizon and the actual CET1 ratio at the starting point. 349. When calibrating the P2G-LR, the maximum stress impact should be calculated based on the changes in the Tier 1 capital in the worst year of stress, and taking into account the applicable leverage ratio capital requirements. The maximum stress impact for the purpose of setting the P2G-LR should be understood as the difference between the lowest leverage ratio in the adverse scenario over the stress test horizon and the actual leverage ratio at the starting point. 350. Competent authorities should obtain the P2G starting point specific for each institution by offsetting elements that already cover risks reflected in the maximum stress impact. In particular, competent authorities should offset the relevant measures, in particular capital

124 conservation buffer, in accordance with paragraph 354. In addition, when setting the P2G and P2G-LR starting points, competent authorities may consider, where relevant, other adjustments to the maximum stress impact related to the static balance sheet assumption or the different time horizon between the stress test exercise and the time of the starting point. 351. Where setting the P2G and P2G-LR, competent authorities should ensure an adequate link between their respective starting points as well as their final values. For this purpose, they may decide to use a bucketing approach to classify institutions in accordance with P2G and P2G-LR starting points, based on the relevant supervisory stress tests set out in paragraph 344 or based on other approaches set out in paragraph 345. Consequently, competent authorities may assign a fixed range of P2G or P2G-LR levels to each bucket and set the final P2G and P2G￾LR within the range of the assigned bucket or, exceptionally, outside the range of the relevant bucket, based on the institution-specific considerations. Competent authorities should aim to avoid cliff effects between buckets, for instance by allowing partial overlap between the P2G or P2G-LR levels for adjacent buckets, and they should ensure that the resulting final P2G and P2G-LR are institution-specific. 352. When determining the final P2G and P2G-LR, competent authorities should consider, where relevant and available, the following factors: a. the year when the maximum stress impact occurs in relation to the starting point and time horizon of the scenarios used in the stress tests; b. the outcome of a reliable institution stress test, taking into account the specific scenario definitions and assumptions, in particular where they are deemed more relevant for the business model and risk profile of the institution or where the internal scenarios are more severe than the supervisory scenarios; c. changes occurring after the cut-off date of the stress test exercise with a material impact on the institution’s risk profile or capital position (e.g. sale of non-performing loans). These changes may include interim changes of the risk profile including structural changes in the institution’s activity or balance sheet; d. relevant management mitigating actions of the institution that are deemed credible and highly certain following their supervisory assessment; e. information about supervisory views on the relevance of supervisory stress testing to the institution’s strategy, financial plans and business model; f. reduced certainty on the actual sensitivity of the institution to adverse scenarios; g. any potential overlaps with the P2R or P2R-LR; h. the institution’s overall recovery capacity as specified in the EBA Guidelines on overall recovery capacity in recovery planning52; i. the quality (composition) of the institution’s available own funds, including the worst year of stress; 52 EBA Guidelines on overall recovery capacity in recovery planning (EBA/GL/2023/06) - Section II. Assessment of ORC – ‘adjusted ORC’.

125 j. whether or not the institution is under restructuring or resolution. 353. For the purpose of determining P2G, competent authorities should also consider the extent to which stress scenarios cover all the material risks contributing to the P2R in TSCR. Competent authorities should, in particular, have regard to the fact that macroeconomic downturn scenarios may not entirely capture some risks – for example pension risk or some elements of credit concentration risk (e.g. single name concentration) – that may amplify potential losses under the tested adverse scenarios. 354. In addition, competent authorities should consider the extent to which the existing combined buffer requirements and other applicable measures already cover risks revealed by stress testing. In this regard, competent authorities: a. should offset P2G against the capital conservation buffer (CCB), as P2G and the CCB overlap in nature; b. should in exceptional cases offset P2G on a case-by-case basis against the countercyclical capital buffer (CCyB) – while no overlap is in principle expected between them – based on the consideration of underlying risks covered by the buffer and factored into the design of the scenarios used for the stress tests, after liaising with the macroprudential authority; c. should not offset P2G against the systemic risk buffers (G-SII/O-SII buffers and the systemic risk buffer), as those are intended to cover the risks an institution poses to the financial system; d. should not offset P2G-LR against the G-SII leverage ratio buffer requirement specified in Article 92(1a) of Regulation (EU) No 575/2013; e. may review the P2G communicated to that institution to ensure that its calibration remains appropriate where an institution becomes bound by the output floor, in accordance with Article 104b(4a) of Directive 2013/36/EU. 355. Where competent authorities determine P2G, they should add this guidance on top of the OCR. Where competent authorities determine P2G-LR, they should add this guidance on top of OLRR. Competent authorities should consider OCR and OLRR as two separate stacks of requirements. Consequently, the available own funds can simultaneously be used to meet P2G and P2G-LR. 7.7. Summary of findings, scoring and supervisory measures 356. Following the above assessment, competent authorities should form a view on whether existing own funds resources provide sound coverage of the risks to which the institution is or might be exposed. This view should be reflected in a summary of findings, accompanied by a viability score based on the considerations specified in table 15. 357. In setting the score for capital adequacy, where applicable, competent authorities should consider the score of the overall recovery capacity with regard to capital (weak, adequate with potential room for improvement, orsatisfactory) as specified in paragraphs 41 to 43 of the EBA

126 Guidelines on Overall Recovery Capacity in Recovery Planning53. The consideration of the overall recovery capacity score in the context of capital adequacy is especially relevant in case of a ‘weak’ overall recovery capacity score for capital. Table 15. Supervisory considerations for assigning a score to capital adequacy Score Supervisory view Considerations 1 The quantity and composition of own funds held pose a low level of risk to the viability of the institution. • The institution is able to comfortably meet its P2G and P2G LR. • The institution holds a level of own funds comfortably above its OCR and OLRR, and is expected to do so in the future. • Stress testing does not reveal any discernible risk regarding the impact of a severe but plausible economic downturn on own funds or leverage. • The free flow of capital between entities in the group, where relevant, is not impeded, or all entities are well capitalised above supervisory requirements. • The institution has a plausible and credible capital plan that has the potential to be effective if required. • The overall recovery capacity of the institution with regard to capital, resulting from the supervisory assessment, is ‘satisfactory’. • There is no material/a very low risk of excessive leverage. 2 The quantity and composition of own funds held pose a medium-low level of risk to the viability of the institution. • The institution has difficulty meeting its P2G or P2G LR. Management mitigating actions to address this are assessed as credible. • The institution is near to breaching some of its capital buffers but is still clearly above its TSCR and TSLRR. • Stress testing reveals a low level of risk regarding the impact of a severe but plausible economic downturn on own funds or leverage, but management actions to address this seem credible. • The free flow of capital between entities in the group, where relevant, is or could be marginally impeded. • The institution has a plausible and credible capital plan that, although not without risk, has the potential to be effective if required. • The overall recovery capacity of the institution with regard to capital, resulting from the supervisory assessment, is ‘satisfactory’ or ‘adequate with room for improvement’. • There is a low level of risk of excessive leverage. 3 The quantity and composition of own funds held pose a medium-high level of risk to the viability of the institution. • The institution does not meet its P2G or P2G LR. There are concerns about the credibility of management mitigating actions to address this. 53 EBA/GL/2023/06

127 Score Supervisory view Considerations • The institution is using some of its capital buffers. There is potential for the institution to breach its TSCR or TSLRR if the situation deteriorates. • Stress testing reveals a medium level of risk regarding the impact of a severe but plausible economic downturn on own funds or leverage. Management actions may not credibly address this. • The free flow of capital between entities in the group, where relevant, is impeded. • The institution has a capital plan that is unlikely to be effective. • The overall recovery capacity of the institution with regard to capital, resulting from the supervisory assessment, is ‘adequate with room for improvement’ or ‘weak’. • There is a medium level of risk of excessive leverage. 4 The quantity and composition of own funds held pose a high level of risk to the viability of the institution. • The institution does not meet its P2G or P2G LR (or deliberately has not established P2G or P2G LR) and will not be able to do so in the foreseeable future. Management mitigating actions to address this are assessed as not credible. • The institution is near to breaching its TSCR or TSLRR. • Stress testing reveals that TSCR or TSLRR would be breached near the beginning of a severe but plausible economic downturn. Management actions will not credibly address this. • The free flow of capital between entities in the group, where relevant, is impeded. • The institution has no capital plan, or one that is manifestly inadequate. • The overall recovery capacity of the institution with regard to capital, resulting from the supervisory assessment, is ‘weak’ • There is a high level of risk of excessive leverage. 358. The table below provides a non-exhaustive list of supervisory measures that competent authorities may take in case of identified deficiencies in the institution’s capital adequacy, including in stress conditions. Competent authorities should decide on the type of supervisory measure based on its effectiveness to the specific identified deficiency. Competent authorities may apply additional supervisory measures or a combination of them if these are deemed more appropriate to address the identified deficiencies.

128 Table 16. Potential and non-exhaustive supervisory measures for capital adequacy Potential supervisory measures for competent authorities in accordance with Article 104(1), points (a), (c) (h), (i), and (j), of Directive 2013/36/EU – Competent authorities may require the institution to: A. hold additional own funds requirements by setting TSCR and determining P2G, where relevant B. submit a credible capital plan that addresses the risk of not meeting its applicable capital requirements, in case the quantitative outcomes of the stress tests indicate that, under the given stress scenarios, an institution will not be able to meet the requirements, and set a deadline for its implementation; C. make changes to capital plans as appropriate, including to the proposed management actions, or take additional mitigating actions that would become relevant given the scenarios and current macroeconomic conditions; D. limit variable remuneration as a percentage of net revenues where it is inconsistent with the maintenance of a sound capital base; E. restrict or limit its business or operations or divest activities that pose excessive risks to its soundness; E. reduce the risk inherent in certain activities, products and systems of institutions, including activities provided by third-parties; F. use net profits to strengthen own funds; G. restrict or prohibit distributions or interest payments to shareholders, members or holders of Additional Tier 1 instruments where such a prohibition does not constitute an event of default; H. impose additional or more frequent reporting requirements, including reporting on own funds and leverage. 359. When competent authorities assess the credibility of the capital plan or the revised capital plan, in line with points B. and C. of table 16, they should consider the following criteria: a. it covers the entire assumed stress testing time horizon; b. it puts forward a set of credible mitigating and management actions, such as restricting dividend payments, etc.; c. the institution is willing and able to take such actions in order to address the breaches of the applicable capital requirements in the system-wide stress tests; d. whether the mitigating and management actions are subject to any legal or reputational constraints, for instance due to contrary or conflicting former public announcements (e.g. on dividend policies, business plans and risk appetite); e. the probability that mitigating and management action would enable the institution to fully meet its applicable capital requirements within an appropriate timeframe; f. the proposed actions are broadly in line with macroeconomic considerations and with known future regulatory changes affecting an institution within the scope and timeline of the assumed adverse scenarios; g. the range of recovery options and their analysis as set out in the institution’s recovery plan. 360. Competent authorities should expect institutions to implement the revised capital plan, including further changes made based on the results of the supervisory assessment of and dialogue with the institution.

129 8. Title 8. Assessing risks to liquidity and funding and SREP liquidity and funding assessment 8.1. General considerations 361. Competent authorities should assess the institution’s material liquidity and funding risks and whether the institution’s liquidity and funding provides appropriate coverage of the risks assessed. The purpose of this title is to provide methodologies to be considered when assessing individual risks, and risk management and controls. It is not intended to be exhaustive, and gives leeway to competent authorities to take into account other additional criteria that may be deemed relevant based on their experience and the specific features of the institution in their assessment of the institution’s liquidity and funding. 362. When assessing the inherent liquidity and funding risk, and the adequacy of the liquidity and funding risk internal control framework, competent authorities should evaluate inter alia the institution’s overall compliance with the legal acts published separately on the EBA website as referred to in paragraph 12. 363. The methodology comprises six main components: a. assessment of inherent liquidity risk (section 8.2); b. assessment of inherent funding risk (section 8.3); c. assessment of liquidity and funding risk management and control framework (section 8.4); d. summary of findings and scoring for liquidity and funding adequacy (section 8.5); e. determination of potential SREP liquidity and funding risk measures (section 8.6); f. benchmarking and setting of quantitative liquidity and funding requirements (section 8.7). 364. The assessment flow is documented graphically in figure 3.

130 Figure 3. Elements of the assessment of risks to liquidity and funding 365. In the assessment of risks to liquidity and funding, competent authorities should review, among others, the institution’s liquidity coverage ratio (LCR), as specified in the Commission Delegated Regulation (EU) 2015/6144 and the net stable funding ratio (NSFR), as established in Title IV of Part Six of the Regulation (EU) No 575/2013, and the institution’s ILAAP. They should also consider the recommendations, guidelines and guidance included in LCR and NSFR implementation reports issued by the EBA, as well as warnings and recommendations issued by macroprudential authorities or the ESRB. However, these guidelines extend the scope of the assessment beyond those minimum requirements, aiming to allow competent authorities to form a comprehensive view of the risks. 366. Competent authorities should ensure the assessment pays attention to how the institution’s business model impacts its liquidity and funding risk profile, taking into account the outcome of the business model analysis conducted under Title 4. In doing so, they should pay attention to how the institution’s business model has changed over time and whether this has resulted in any increased risks. Competent authorities should monitor key quantitative indicators to capture trends and inform this analysis. 367. To assist with the quantitative assessment of the institution’s liquidity and funding risks and adequacy, competent authorities should refer to the additional guidance available in section 8.7 on benchmarking and setting quantitative liquidity and funding requirements. 368. Competent authorities shall also evaluate any information with a potential impact on liquidity and funding position (e.g. from AML/CFT competent authorities). 369. In reviewing the quality of the institution’s organisational and risk management arrangements for managing liquidity and funding risk, competent authorities should ensure that those covers all of its material legal entities, branches and subsidiaries.

131 370. Competent authorities should take into account the impact of ESG risks on the inherent liquidity and funding risks as well as the adequacy of the liquidity and funding risk management and control framework related to ESG risks, giving priority to environmental risks. 371. The outcome of the assessment of each individual risk should be reflected in a summary of findings and an explanation of the main risk drivers and a score, as explained in the following sections. 8.2. Assessment of inherent liquidity risk 372. Competent authorities should assess the institution’s short- and medium-term liquidity risk over an appropriate set of time horizons, including intraday periods, to ensure that the institution maintains adequate levels of liquidity buffers, under both normal and stressed conditions. This assessment includes the following elements: a. evaluation of liquidity needs in the short and medium term; b. evaluation of intraday liquidity risk; c. evaluation of liquidity buffer and counterbalancing capacity; d. supervisory liquidity stress testing. 373. For the assessment of liquidity needs, buffers and counterbalancing capacity under normal conditions, competent authorities should support the analysis with evidence from the reporting templates for additional monitoring metrics as specified in the ITS on supervisory reporting. When assessing liquidity needs in stressed conditions, competent authorities should also consider actions the institutions may take to preserve its reputation/franchise. This should consider reputational effects on large wholesale and retail counterparties including those potentially triggered via social or other channels. Competent authorities may perform less granular intraday liquidity risk evaluation and liquidity stress testing, where this is justified by lower materiality of these sources of risk, especially for Category 3 and Category 4 institutions, and taking into account the results of the ILAAP. Evaluation of liquidity needs in the short and medium term 374. Competent authorities should assess the institution’s liquidity needs in the short and medium term under both normal and stressed conditions. They should take into account the effect on the institution’s stressed liquidity needs before 30 days, between for example 30 days and 3 months, and after for example three to twelve months of severe but plausible stresses covering idiosyncratic, market-wide and combined shocks. Competent authorities should also analyse the size, location and currency of the liquidity needs and the separate impacts of shocks in its different material currencies to reflect currency convertibility risk and the risk of possible disruptions in the access to foreign exchange markets (including idiosyncrasies such as, for example, the loss of access to a correspondent banking account denominated in a foreign currency).

132 375. Competent authorities should support the assessment of short-term liquidity risk by analysing the LCR, as specified in Commission Delegated Regulation (EU) 2015/61, including whether the LCR is correctly measured and reported and adequately identifies the institution’s coverage of liquidity needs. Competent authorities should also assess whether institutions are periodically testing their ability to report the LCR on a daily basis in order to make sure that institutions will be able to deliver reliable data in accordance with Article 414 of Regulation (EU) 575/2013 when needed. 376. In evaluating the impact of shocks on the institution’s liquidity needs, competent authorities should take into account all material sources of liquidity risk for the institution, in particular: a. the possibility that any applicable EU regulatory requirement would not adequately identify the institution’s liquidity needs in the event of the type of stress scenario used for the requirement, including where maturities are shorter than 30 days; b. risks arising in respect of wholesale counterparties regarding on-balance-sheet items and funding concentrations. Competent authorities should have regard to the volatility of funding provided by counterparties that all belong to the most material sectors serviced and potential contagion risks. In this respect, particular attention should be paid to funding gathered through new business lines and distribution channels, as well as from clients running activities bearing an increased level of risk (crypto-asset issuers and services providers); c. risks arising in respect of contingent cash flows/off-balance-sheet items (for example, credit lines, margin calls) and activities (for example, liquidity support for unconsolidated special￾purpose vehicles beyond contractual obligations; d. inflows and outflows on a gross basis, as well as a net basis; where there are very large inflows and outflows, competent authorities should pay specific attention to the risk to the institution when inflows are not received when expected, even when the net outflow risk is limited; e. risks arising in respect of retail counterparties including funding concentrations. For this purpose, competent authorities should make use of the methodology on the classification of retail deposits into different risk buckets, pursuant to Articles 24 and 25 of Commission Delegated Regulation (EU) 2015/61; f. the risk that excessive risks in the medium- to long-term funding profile will adversely affect the behaviour of counterparties relevant to the short-term liquidity position; g. risk arising in the context of fiduciary deposits54 . 377. Competent authorities should ensure that their assessment of the institution’s short-term liquidity needs considers the impact of digitalisation (including for example instant payments) and potential for the spread of information on social media to increase the speed of withdrawals in a stressed scenario. 54 The best practices are available in the EBA report: Monitoring of liquidity coverage ratio implementation in the EU – Second report (EBA/REP/2021/07).

133 Evaluation of intraday liquidity risk 378. Competent authorities should assess the institution’s exposure to intraday liquidity risk for a selected time horizon. This assessment should include, as a minimum, an evaluation of intraday liquidity available or accessible under normal conditions as well as under financial or operational stress (e.g. IT failures, legal constraints on the transfer of funds, suspension/termination of access to correspondent banking services and/or clearing services for currencies, commodities or instruments significant for the institution). This should particularly consider how in times of stress, an institution´s increased intraday collateral needs may limit its ability to use a liquidity buffer to cover stressed outflows when needed. 379. For those jurisdictions where reporting on intraday risk is not yet available, competent authorities may rely on the institution’s own analysis of intraday liquidity risk. Evaluation of liquidity buffer and counterbalancing capacity 380. Competent authorities should assess the adequacy of the institution’s liquidity buffer and counterbalancing capacity regarding the characteristics of the assets considered under different stress scenarios within a month as well as over different time horizons, potentially up to one year, including overnight. The assessment should include consideration of the classification and quality of liquid assets (as specified in the Commission Delegated Regulation (EU) 2015/61), their compliance with general and operational requirements for high-quality liquid assets, and whether the liquidity buffer and counterbalancing capacity are in line with the institution’s risk appetite. 381. Competent authorities should consider factors that might reduce the institution’s ability to monetise its liquid assets in a timely manner during a stress period including such as high concentrations with individual counterparties or type of assets, assets in the buffer that are encumbered or borrowed, and the denomination of liquid assets in a different currency to the institution’s liquidity needs. Competent authorities should also consider the likely value of committed liquidity facilities that may be included in the counterbalancing capacity. 382. Competent authorities should review (where applicable) the appropriateness of the institution’s assumptions concerning its ability to access repo markets and central bank funding in a stressed period, including regarding the suitability and availability of assets to serve as collateral. They should take into account whether the institution tests its market access by selling or repo-ing on a periodic basis. Equally they should review the institutions’ assumptions regarding time to liquidity under stress. Supervisory liquidity stress testing 383. Competent authorities should run their own liquidity stress tests to independently assess short- and medium-term liquidity risks. Stress scenarios should be anchored to the 30-day LCR stress assumptions, but competent authorities may extend the scope of their assessment by exploring risks within 30 days as well as beyond 30 days, and altering LCR assumptions to

134 reflect risks not adequately covered in the LCR. This should include a supervisory stress test combining institution-specific and market-wide stress. 8.3. Assessment of inherent funding risk 384. Competent authorities should assess the institution’s funding risk and whether the medium￾and long-term assets and off-balance-sheet items are adequately met with a range of stable funding instruments under both normal and stressed conditions. This assessment includes the following elements: a. evaluation of the institution’s funding profile; b. evaluation of risks to the stability of the funding profile; c. evaluation of actual market access; d. evaluation of expected change in funding risks based on the institution’s funding plan. Evaluation of the institution’s funding profile 385. Competent authorities should assess the appropriateness of the institution’s funding profile, including both medium- and long-term contractual and behavioural mismatches, in relation to its business model, strategy and risk appetite. They should take into account whether the institution’s medium- and long-term assets and off-balance-sheet items are adequately met with a range of stable funding instruments, pursuant to Article 413 of Regulation (EU) No 575/2013. Competent authorities should support this assessment by analysing the NSFR as specified in Title IV of Part Six of Regulation (EU) No 575/2013 and assess whether this has been correctly reported. 386. Competent authorities should consider the impact on the institution’s funding profile of any (local) regulatory and contractual factors affecting the behavioural characteristics of funding providers (e.g. regulations regarding clearing, bail-in, deposit guarantee schemes, as they may influence the behaviour of funding providers). 387. Competent authorities should assess whether potential shortcomings arising from the institution’s funding profile, such as maturity mismatches breaching acceptable boundaries, excessive concentrations of funding sources, excessive levels of asset encumbrance, or inappropriate or unstable funding of long-term assets could lead to an unacceptable increase in the cost of funding and a loss of funding access for the institution. In particular, assumptions regarding the stickiness of funding attracted via channels that rely on fintech or are less traditional for example online deposit platforms – need to be closely assessed when planning or designing stress scenarios. Evaluation of risks to the stability of the funding profile 388. Competent authorities should consider factors that may reduce the stability of the funding profile in relation to the type and characteristics of assets, off-balance-sheet items and liabilities. They should take into account the structural maturity mismatch between assets and

135 liabilities (including the impact of any currency mismatches), appropriate structural funding metrics (e.g. loan/deposit ratio, customer funding gap and behaviourally adjusted maturity ladder), and funding characteristics that could indicate increased ML/TF risks and concerns from a prudential perspective. Competent authorities should also consider impact of losses on the stability of funding; knowing that funding providers may be sensitive to much lower losses than those that would endanger capital ratios. 389. Competent authorities should assess risks to the sustainability of the funding profile arising from concentrations in funding sources (particularly in the type of funding instruments used, specific funding markets, single or connected counterparties). For example, they should consider the characteristics of the most material sectors serviced by the institution and how this impacts the institution’s funding risk profile, paying particular attention to exposures to cyclical or volatile sectors. 390. Competent authorities should also assess the risk that asset encumbrance may have an adverse effect on the market’s appetite for the unsecured debt of the institution (in the context of the specific characteristics of the market(s) in which the institution operates and the institution’s business model). Evaluation of actual market access 391. Competent authorities should be aware of the institution’s actual market access and current and future threats to this market access including disruptions in the access to foreign exchange markets (including idiosyncratic). For the assessment, they should take into account the degree to which the institution makes high demands on particular markets or counterparties (including central banks) relative to those markets’/counterparties’ capacity, any significant or unexpected changes in the issuance of debt, the risk that news about the institution may negatively influence the market (perception/confidence) and therefore market access, and signs that short-term liquidity risks may reduce the access the institution has to its major funding markets. Evaluation of expected change in funding risks based on the institution’s funding plan 392. Competent authorities should assess the expected change in funding risks based on the institution’s funding plan and form a view on the feasibility of the plan (such as backtesting, considering alternative scenarios). 8.4. Assessment of liquidity and funding risk management and control framework 393. To achieve a comprehensive understanding of the institution’s liquidity and funding risk profile and their interconnectedness, competent authorities should also review the governance and risk management framework underlying its liquidity and funding risk. To this end, competent authorities should assess:

136 a. the liquidity risk and funding strategy and liquidity and funding risk appetite; b. the organisational framework, policies and procedures; c. risk identification, measurement, management, monitoring and reporting; d. the institution’s liquidity/funding-specific stress testing; e. the internal control framework for liquidity risk and funding risk management; f. the institution’s liquidity contingency plans and recovery plans; g. the institution’s funding plans. Liquidity and funding risk strategy and risk appetite 394. Competent authorities should assess whether the institution has a sound, clearly formulated, documented and communicated liquidity/funding risk strategy and appetite, approved by the management body. For this assessment, among other factors, competent authorities should take into account the role of the management body in setting, approving and reviewing the liquidity/funding risk strategy and appetite (including its major underlying assumptions), the proper implementation of this strategy by the management body as well as its appropriateness for the institution given its business model, overall risk tolerance, role in the financial system, financial condition and funding capacity. Organisational framework, policies and procedures 395. Competent authorities should assess whether the institution has an appropriate organisational framework and governance arrangements for liquidity and funding risk management, including a robust ILAAP framework in line with paragraph 911 of Title 5 of these Guidelines. Further, they should assess whether the institution has implemented appropriate measurement and control functions, with sufficient human and technical resources to develop and implement these functions and to carry out the required monitoring tasks. The liquidity risk control and monitoring of systems and processes should be controlled by an independent function. 396. Competent authorities should assess whether the institution has appropriate policies and procedures for the management of liquidity and funding risk and whether these are consistent with the institution’s liquidity risk appetite. This includes assessment of whether the policies and procedures are properly defined, formalised and effectively communicated throughout the institution. The management body should approve and regularly review the policies and procedures, and these should be implemented by senior management. 397. Competent authorities should assess the adequacy of the institution’s approach to maintaining market access in its significant funding markets, including any testing of market access that has been undertaken, the institution’s approach to maintaining an ongoing presence in the markets (for specific small institutions or specialised business models, testing of access to markets may not be relevant), the institution’s approach to developing strong relationships

137 with funding providers, and any evidence that the institution would continue to have ongoing market access in times of stress. Risk identification, measurement, management, monitoring and reporting 398. Competent authorities should assess whether the institution has an appropriate framework and IT systems for identifying and measuring liquidity and funding risk, in line with the institution’s size, complexity, risk appetite and risk-taking capacity. They should take the following factors into account: a. whether the institution has implemented appropriate methods for projecting its cash flows over an appropriate set of time horizons, assuming business-as-usual and stress situations, and comprehensively across material risk drivers; b. whether the institution uses appropriate key assumptions and methodologies, which are regularly reviewed, recognising interaction between different risks (credit, market, IRRBB etc.) arising from both on- and off-balance sheet items; c. whether the institution understands its ability to access financial instruments wherever they are held, having regard to any legal, regulatory and operating restrictions on their use, including, for example, the inaccessibility of assets due to encumbrance during different time horizons. 399. Competent authorities should assess whether institutions have an appropriate reporting framework for liquidity and funding risk that has been agreed by the senior management. They should take into account the quality of information systems and internal information flows used to generate reporting and whether the reporting is understandable for the target audience, accurate and usable (e.g. timely, not overly complex, within the correct scope). The reporting should be provided regularly to appropriate recipients (such as the management body, senior management or an asset-liability committee). 400. Competent authorities should assess the adequacy of the process of measuring intraday liquidity risk, especially for those institutions that participate in payment, settlement and clearing systems. They should take into account whether the institution adequately monitors and controls cash flows and liquid resources available to meet intraday requirements and forecasts when cash flows will occur during the day, and whether the institution carries out adequate specific stress testing for intraday operations, also considering business developments (e.g. possibility for instant payments). 401. Competent authorities should assess whether the institution has an adequate set of liquidity and funding indicators. They should take into account: a. whether the indicators adequately reflect the institution’s liquidity risk profile including the degree of diversification of assets in the liquidity buffer and the consistency between the currency denomination of their liquid assets and the distribution by currency of their liquidity outflows;

138 b. whether the indicators adequately cover key liquidity risk aspects related to potential cliff risks such as the concentration of outflows maturities (considering also any potential early withdrawal of liabilities) and central bank support programmes; c. whether the indicators permit identification of the institution’s structural funding vulnerabilities, including any concentrations in particular markets, currencies, counterparties, and maturities; d. whether the indicators provide an insight into the ‘stickiness’ of the institutions’ funding (independent of what is assumed in the LCR or NSFR), including the breakdown into homogenous categories in accordance with their risk properties, and the proportion of deposits outside the scope of a guarantee/insurance scheme. 402. Institutions should be able to demonstrate that the indicators are adequately documented, periodically revised, used as inputs to define the risk appetite of the institution, part of management reporting and used for setting operating limits. Institution’s liquidity- and funding-specific stress testing 403. Competent authorities should assess whether an institution has implemented adequate liquidity-specific stress testing, in accordance with the EBA Guidelines on institutions’ stress testing55: a. to understand the impact of adverse events on its risk exposure and to be able to assess the adequacy of its liquid assets, counterbalancing capacity and funding structure; b. to cover risks that may crystallise during different types of stress scenarios and/or to address risks posed by control, governance or other deficiencies. 404. Competent authorities should take into account whether the framework permits the institution to: a. determine the institution’s survival horizon given its existing liquidity buffer and stable sources of funding, and taking into account the institution’s risk appetite, during a severe but plausible liquidity stress period; b. analyse the impact of stress scenarios on its consolidated group-wide liquidity position and on the liquidity position of individual entities and business lines; c. understand where risks could arise, regardless of its organisational structure and the degree of centralised liquidity risk management. 405. Competent authorities should ensure that the institution provides the modelled impact of different types of stress scenarios (as explained in the EBA Guidelines on institutions’ stress testing), as well as a number of sensitivity tests (on the basis of proportionality). The stress scenarios and shocks simulated in them should not only be based on the past, but also make 55 EBA/GL/2018/04

139 use of hypothetical stress scenarios based on expert judgement. Competent authorities should analyse whether the following scenarios are considered as a minimum: a. short-term and prolonged; b. institution-specific and market-wide (occurring simultaneously in a variety of markets); c. a combination of (a) and (b). 406. An important aspect that competent authorities should consider when assessing the institution’s stress testing framework is the modelling of the impact of the hypothetical stress scenario(s) on the institution’s cash flows and on its counterbalancing capacity and survival horizon, and whether the modelling reflects the different impacts that economic stress may have on both an institution’s assets and its in- and outflows. 407. Competent authorities should also assess whether the institution takes a conservative approach to setting stress testing assumptions. Depending on the type and severity of the scenario, competent authorities should consider, as relevant, the appropriateness of a number of assumptions, in particular: a. the run-off of retail funding; b. the reduction of secured and unsecured wholesale funding; c. the correlation between funding markets and diversification across different markets; d. additional contingent off-balance sheet exposures; e. funding tenors (e.g. where the funding provider has call options); f. the impact of any deterioration of the institution’s credit rating; g. FX convertibility and access to foreign exchange markets and correspondent banking accounts; h. the ability to transfer liquidity across entities, sectors and countries; i. estimates of future balance-sheet growth; j. due to reputational risks, an implicit requirement for the institution to roll over assets and to extend or maintain other forms of liquidity support. 408. Competent authorities should assess whether the management framework of the institution’s liquidity-specific stress testing is appropriate and whether it is properly integrated into the overall risk management strategy. They should take into account: a. whether the extent and frequency of stress tests are appropriate to the nature and complexity of the institution, its liquidity risk exposures and its relative importance in the financial system; b. whether the outcomes of stress testing are integrated into the institution’s strategic planning process for liquidity and funding and used to increase the effectiveness of liquidity management in the event of a crisis, including in the institution’s liquidity contingency and recovery plan;

140 c. whether the institution has an adequate process for identifying suitable risk factors for conducting stress tests, having regard to all material vulnerabilities that can undermine the liquidity position of the particular institution; d. whether assumptions and scenarios are reviewed and updated sufficiently frequently; e. where the liquidity management of a group is being assessed, whether the institution pays adequate attention to any potential obstacles to the transfer of liquidity within the group. Liquidity and funding risk internal control framework 409. Competent authorities should assess whether the institution has a strong and comprehensive internal limit and control framework, and sound safeguards to mitigate its liquidity and funding risk in line with its risk appetite and to ensure the availability of a diversified funding structure. They should take into account whether the limit and control framework is adequate for the institution’s complexity, size and business model and reflects the different material drivers of liquidity risk and the outcomes of liquidity stress tests. 410. Competent authorities should consider whether the institution has limits to ensure consistency between the currency denomination of their liquid assets and the distribution by currency of their net liquidity outflows in accordance with Article 8(6) of Commission Delegated Regulation (EU) 2015/61. 411. Competent authorities should assess whether the limits are approved and regularly reviewed by the competent bodies of the institution and communicated to all relevant business lines. This process, along with how the institution monitors compliance with limits and the escalation process for breaches, should be clearly documented in its procedures. 412. Competent authorities should assess whether the institution has implemented an adequate transfer pricing system as part of the liquidity risk control framework, which incorporates all relevant liquidity costs, benefits and risks. Competent authorities should take into account whether the transfer pricing mechanism allows management to give appropriate incentives for managing liquidity risk, and whether the system and its calibration are reviewed and updated appropriately given the size and complexity of the institution. In addition, competent authorities should assess whether the institution’s policy on incorporating the funds transfer pricing (FTP) methodology into the internal pricing framework is used for assessing and deciding on transactions with customers (this includes both sides of the balance sheet, e.g. granting loans and taking deposits). 413. Competent authorities should assess whether the institution has adequate controls regarding the liquid-assets buffer, including concentration limits and appropriate ongoing monitoring of the adequacy of the buffer and for changes in market conditions that could affect the institution’s ability to liquidate its assets quickly.

141 Liquidity contingency plans 414. Competent authorities should assess whether the institution’s liquidity contingency plan (LCP) adequately specifies the policies, procedures and action plans for responding to severe potential disruptions to the institution’s ability to meet its liquidity needs and fund itself. They should take into account the content and scope of contingency funding measures included in the LCP, and in particular factors such as: a. whether the LCP adequately explains governance arrangements for its activation and maintenance; b. whether the LCP appropriately reflects the institution’s liquidity- and funding-specific and wider risk profile; c. whether the institution has a framework of liquidity early warning indicators, including among others those established as liquidity indicators in the EBA GL on recovery plan indicators that are likely to be effective in enabling the institution to identify deteriorating market circumstances in a timely manner and to quickly determine what actions need to be taken; d. whether the LCP describes clearly that the LCR liquidity buffer is designed to be used in case of stress, even if that leads to LCR values below 100%, including that it is part of the expected management of liquidity risk under stress that subsequent communications to senior management take place if established lower LCR values are reached. The LCP should clearly reflect and describe how liquidity risk should be managed under stress to steer towards targeted LCR levels as closely as possible; e. whether the LCP clearly articulates all material (potential) funding sources, including the estimated amounts available for the different sources of liquidity and the estimated time needed to obtain funds from them; f. whether the measures are in line with the institution’s overall risk strategy and liquidity risk appetite; g. the appropriateness of the assumptions regarding the role of central bank funding in the institution’s LCP. Examples of factors competent authorities may consider could include the institution’s views on: I. the current and future availability of potential alternative funding sources connected to central bank lending programmes; II. the types of lending facilities, the acceptable collateral and the operational procedures for accessing central bank funds; III. the circumstances under which central bank funding would be needed, the amount required and the period for which such a use of central bank funding would probably be required. 415. Competent authorities should assess whether the actions described in the LCP are feasible in relation to the stress scenarios in which they are meant to be taken. They should take into account factors such as:

142 a. the level of consistency and interaction between the institution’s liquidity-related stress tests, its LCP, its liquidity early warning indicators and, where applicable, its liquidity related recovery plan; b. whether the actions defined in the LCP appear likely to enable the institution to react adequately to a range of possible scenarios of severe liquidity stress, including institution￾specific and market-wide stress, as well as the potential interaction between them; and whether the actions defined in the LCP are prudently quantified in terms of liquidity￾generating capacity under stressed conditions and the time required to execute them, taking into account operational requirements such as pledging collateral at a central bank. 416. Competent authorities should assess the appropriateness of the institution’s governance framework with respect to its LCP. They should take into account factors such as: a. the appropriateness of escalation and privatisation procedures detailing when and how each of the actions can and should be activated; b. whether the institution has adequate policies and procedures with respect to communication within the institution and with external parties; c. the degree of consistency between the LCP56 and the institution’s business continuity plans. Funding plans 417. Competent authorities should assess whether the funding plan is feasible and appropriate in relation to the nature, scale and complexity of the institution, its current and projected activities and its liquidity and funding profile. They should take into account factors such as: a. whether the funding plan addresses alternative scenarios. Competent authorities should pay particular attention to the robustness of the plan for supporting the projected business activities under adverse scenarios; b. the expected change in the institution’s funding profile arising from the execution of the funding plan and whether this is suitable given the institution’s activities and business model; c. whether the funding plan supports any required or desired improvements in the institution’s funding profile; d. their own view on the (changes in) market activity planned by institutions in their jurisdiction on an aggregated level, and what that means for the feasibility of individual funding plans; and e. whether the funding plan is: I. integrated with the overall strategic plan of the institution; II. consistent with its business model; III. consistent with its liquidity risk appetite; 56 In case the LCP is fully integrated into the recovery plan, this will be incorporated into the liquidity ORC score. In case the LCP is not incorporated into the recovery plan and the two documents are separate, the LCP needs to be analysed separately.

143 418. In addition, competent authorities may consider: a. whether the institution adequately analyses and is aware of the appropriateness and adequacy of the funding plan given the institution’s current liquidity and funding positions and their projected development. As part of this, competent authorities may consider whether the institution’s senior management can explain why the funding plan is feasible and where its weaknesses lie; b. the institution’s policy for determining what funding dimensions and what markets are significant to the institution (and whether it is adequate); c. the time horizon envisaged by the institution for migration to a different funding profile, if required or desired, bearing in mind that there may be risks involved if migration towards the end state is either too fast or too slow;a d. whether the funding plan contains different strategies and clear management procedures for timely implementation of strategy changes. 419. Competent authorities should assess whether the institution’s funding plan is appropriately implemented. As a minimum, they should take into account: a. whether the funding plan is properly documented and communicated to all the relevant staff; b. whether the funding plan is embedded in the day-to-day operations of the institution, especially in the funding decision-making process. 420. In addition, competent authorities may take into account whether the institution is able to reconcile the funding plan with the data provided to competent authorities in the funding plan template. 421. Competent authorities should consider the quality of the institution’s processes for monitoring the execution of the funding plan and its ability to react to deviations in a timely manner. For this assessment, competent authorities should take into account factors such as: a. the quality of the updates to (senior) management regarding the current status of the execution of the funding plan; b. whether the funding plan envisages alternative fall-back measures to be implemented if there are changes in the market conditions; and c. the policy and practice of the institution regarding the regular review, back-testing, and updating of the funding plan when the actual funding raised significantly differs from the funding plan. 8.5. Summary of findings, scoring and supervisory measures 422. Following the above assessment, competent authorities should form a view on the institution’s liquidity and funding risks and the capacity of the institutions’ liquidity resources to cover/mitigate these. This view should be reflected in a summary of findings, accompanied by a liquidity and funding adequacy score based on the considerations specified in table 17. The

144 liquidity and funding adequacy score should reflect the view of competent authorities on whether the existing liquidity resources provide appropriate coverage of the liquidity and funding risks. Competent authorities may consider the use of intermediate scores for liquidity and funding risk where deemed relevant. 423. In setting the liquidity and funding adequacy score, competent authorities should, where applicable, consider the score of the liquidity overall recovery capacity in recovery planning (weak, adequate with potential room for improvement, satisfactory) as specified in paragraphs 41-43 of the EBA Guidelines on overall recovery capacity in recovery planning57. The consideration of the overall recovery capacity score in the context of liquidity adequacy is especially relevant in case of a ‘weak’ overall recovery capacity score for liquidity. Table 17. Supervisory considerations for assigning a liquidity and funding adequacy score Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls 1 There is a low risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls. • There is non-material/very low risk arising from mismatches (e.g. between maturities, currencies). • The size and composition of the liquidity buffer is adequate and appropriate. • The level of other drivers of liquidity risk (e.g. reputational risk, inability to transfer intra-group liquidity) is not material/very low. • The institution’s counterbalancing capacity and liquidity buffers are comfortably above supervisory quantitative requirements and are expected to remain so in the future. • The free flow of liquidity between entities in the group, where relevant, is not impeded, or all entities have a counterbalancing capacity and liquidity buffers above supervisory requirements. • There is non-material/very low risk from the institution’s funding profile or its sustainability. • The risk posed by the stability of funding is not material. • Other drivers of funding risk (e.g. reputational risk, access to funding markets) are not material/very low. • The composition and stability of longer-term funding (>1 year) pose non-material/very low risk in relation to the activities and business model of the institution. • There is consistency between the institution’s liquidity/funding risk policy and strategy and its overall strategy and risk appetite. • The organisational framework for liquidity and funding risk is robust with clear responsibilities and a clear separation of tasks between risk-takers and management and control functions. • Liquidity and funding risk measurement, monitoring and reporting systems are appropriate. • Internal limits and the control framework for liquidity risk are sound and are in line with the institution’s risk management strategy and risk appetite. • The institution has a plausible and credible liquidity contingency plan that has the potential to be effective if required. 57 EBA/GL/2023/06

145 Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls • The overall recovery capacity of the institution with regard to liquidity resulting from the supervisory assessment, is ‘satisfactory’. 2 There is a medium-low risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls. • Mismatches (e.g. between maturities, currencies) entail low to medium risk. • The risk posed by the size and composition of the liquidity buffer is low to medium. • The level of other drivers of liquidity risk (e.g. reputational risk, inability to transfer intra-group liquidity) is low to medium. • The institution’s counterbalancing capacity and liquidity buffers are above supervisory quantitative requirements, but there is a risk that they will not remain so in the future. • The free flow of liquidity between entities in the group, where relevant, is or could be marginally impeded. • The risk posed by the institution’s funding profile and its sustainability is low to medium. • The risk posed by the stability of funding is low to medium. • Other drivers of funding risk (e.g. reputational risk, access to funding markets) are low to medium. • The composition and stability of longer-term funding (>1 year) pose a low level of risk in relation to the activities and business model of the institution. • The overall recovery capacity of the institution with regard to liquidity, resulting from the supervisory assessment, is ‘satisfactory’ or ‘adequate with room for improvement’. 3 There is a medium-high risk of significant prudential impact on the institution considering the level of • Mismatches (e.g. between maturities, currencies) entail medium to high risk. • The risk posed by the size and composition of the liquidity buffer is medium to high. • The level of other drivers of liquidity risk (e.g. reputational risk, • There is not full consistency between the institution’s liquidity and funding risk policy and strategy and its overall strategy and risk appetite. • The organisational framework for liquidity and funding risk does not sufficiently separate

146 Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls inherent risk and the management and controls. inability to transfer intra-group liquidity) is medium to high. • The institution’s counterbalancing capacity and liquidity buffers are deteriorating and/or are below supervisory quantitative requirements, and there are concerns about the institution’s ability to restore compliance with these requirements in a timely manner. • The free flow of liquidity between entities in the group, where relevant, is impeded. • The risk posed by the institution’s funding profile and its sustainability is medium to high. • The risk posed by the stability of funding is medium to high. • Other drivers of funding risk (e.g. reputational risk, access to funding markets) are medium to high. • The composition and stability of longer-term funding (>1 year) pose a medium level of risk in relation to the activities and business model of the institution. • The overall recovery capacity of the institution with regard to liquidity, resulting from the supervisory assessment, is ‘adequate with room for improvement’ or ‘weak’. responsibilities and tasks between risk-takers and management and control functions. • Liquidity and funding risk measurement, monitoring and reporting systems are not undertaken with sufficient accuracy and frequency. • Internal limits and the control framework for liquidity and funding risk are not in line with the institution’s risk management strategy or risk appetite. • The institution has a liquidity contingency plan that is unlikely to be effective or the institution has no liquidity contingency plan, or one that is manifestly inadequate 4 There is a high risk of significant prudential impact on the institution considering the level of inherent risk and the management and controls. • Mismatches (e.g. between maturities, currencies) entail high risk. • The risk posed by the size and composition of the liquidity buffer is high. • The level of other drivers of liquidity risk (e.g. reputational risk, inability to transfer intra-group liquidity) is high. • The institution’s counterbalancing capacity and liquidity buffers are rapidly deteriorating and/or are below the supervisory quantitative requirements, and there are serious concerns about the institution’s ability to restore compliance with these requirements in a timely manner.

147 Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls • The free flow of liquidity between entities in the group, where relevant, is severely impeded. • The risk posed by the institution’s funding profile and its sustainability is high. • The risk posed by the stability of funding is high. • Other drivers of funding risk (e.g. reputational risk, access to funding markets) are high. • The composition and stability of longer-term funding (>1 year) pose a high level of risk in relation to the activities and business model of the institution. • The overall recovery capacity of the institution with regard to liquidity, resulting from the supervisory assessment, is ‘weak’. 424. Following the liquidity and funding adequacy scoring of section 8.5, competent authorities should determine whether it is necessary to set specific liquidity and funding requirements to cover risks to liquidity and funding to which an institution is or might be exposed. 425. The next table provides a non-exhaustive list of qualitative and quantitative supervisory measures that competent authorities may use in case a specific deficiency is identified. Competent authorities may apply additional supervisory measures (including quantitative measures in accordance with Article 104(1)(a) of Directive 2014/36/EU or a combination of them if these are deemed more appropriate to address the identified deficiencies. 426. Where competent authorities determine that quantitative measures may be necessary, they should refer to the additional guidance in the subsequent section on benchmarking and setting quantitative liquidity and funding measures. 427. It is relevant to note that part of the measures mentioned in table 18 are of a qualitative nature. Where fundamental weaknesses arise, particularly in terms of management of liquidity and funding, qualitative measures should be prioritised, where possible. Table 18. Potential and non-exhaustive supervisory measures for liquidity and funding risk Potential supervisory measures for competent authorities in accordance with Articles 102, 104(1), points (b), (e), (f), (j), (k), (i), and (n) and Article 105 of Directive 2013/36/EU, Article 8 of Commission Delegated Regulation (EU) 2015/61, and Article 428b(5) of Regulation (EU) No 575/2013 A. require institutions to hold an LCR higher than the regulatory minimum, of such a size that shortcomings identified are sufficiently mitigated; B. require institutions to apply a minimum survival period of such length that identified shortcomings are sufficiently mitigated;

148 Potential supervisory measures for competent authorities in accordance with Articles 102, 104(1), points (b), (e), (f), (j), (k), (i), and (n) and Article 105 of Directive 2013/36/EU, Article 8 of Commission Delegated Regulation (EU) 2015/61, and Article 428b(5) of Regulation (EU) No 575/2013 C. require institutions to hold a minimum total amount of liquid assets or counterbalancing capacity, of such a size that identified shortcomings are sufficiently mitigated; D. require institutions to hold a NSFR higher than the regulatory minimum, of such a size that shortcomings identified are sufficiently mitigated; E. require institutions to hold a minimum total amount of available stable funding, of such a size that identified shortcomings are sufficiently mitigated; F. impose specific liquidity requirements, including restrictions on maturity mismatches between assets and liabilities; G. impose administrative penalties or other administrative measures, including prudential charges; H. impose requirements on the concentration of the liquid assets held, including:

• requirements for the composition of the institution’s liquid-assets profile in respect of counterparties, currency; and/or
• caps, limits or restrictions on funding concentrations. I. impose restrictions on short-term contractual or behavioural maturity mismatches between assets and liabilities, including:
• limits on maturity mismatches (in specific time buckets) between assets and liabilities;
• limits on minimum survival periods; and/or
• limits on dependency on certain short-term funding sources, such as money market funding. J. impose additional or more frequent reporting requirements on liquidity positions, including:
• the frequency of regulatory reporting on LCR; and/or
• the frequency and granularity of other liquidity reports, such as ‘additional monitoring metrics’. K. require action to be taken to address deficiencies identified with regard to the institution’s ability to identify, measure, monitor and control liquidity risk, by means including:
• enhancing its stress testing capacity to improve its ability to identify and quantify material sources of liquidity risk to the institution;
• enhancing its ability to monetise its liquid assets;
• enhancing its liquidity contingency plan and liquidity early warning indicators framework; and/or
• enhancing reporting of liquidity management information to the institution’s management body and senior management. L. require action to be taken to amend the institution’s funding profile, including:
• reducing its dependency on certain (potentially volatile) funding markets,, such as wholesale funding markets, such as wholesale funding;
• reducing the concentration of its funding profile with respect to counterparties, peaks in the long-term maturity profile, (mismatches in) currencies, etc.; and/or
• reducing the amount of its encumbered assets, potentially differentiating between total encumbrance and overcollateralisation (e.g. for covered bonds, margin calls). M. Require additional or more frequent reporting on the institution’s funding positions, including:
• increased frequency of regulatory reporting relevant to the monitoring of the funding profile (such as the NSFR report and ‘additional monitoring metrics’); and/or
• increased frequency of reporting on the institution’s funding plan to the supervisors. N. Require actions to be taken to address deficiencies identified with regard to the institution’s control of funding risk, including:
• requiring actions to be taken to address deficiencies identified with regard to the institution’s control of funding risk, including:
• enhancing reporting on funding risk to the institution’s management body and senior management;
• restating or enhancing the funding plan; and/or
• placing limits on its risk appetite;
• enhancing the institution’s stress testing capabilities by means including requiring the institution to cover a longer stress period.

149 428. When setting structural, long-term supervisory requirements, competent authorities should consider the need for additional short/medium-term liquidity and/or own fund requirements as an interim solution to mitigate the risks that persist while the structural requirements produce the desired effects. 429. Where competent authorities conclude that there is a high risk that the institution’s cost of funding will increase notably, they should consider requesting changes to the funding structure to mitigate the funding cost risk, or even own funds measures (as covered in Title 7) to compensate for the P&L impact if the institution cannot pass the increased costs of funding to its customer. 8.6. Benchmarking and setting of quantitative liquidity and funding requirements Determination of specific quantitative liquidity and funding requirements 430. To support their liquidity and funding adequacy scoring and calibrate specific quantitative requirements where deemed potentially necessary (e.g. any of the measure referred to in table 18 above that are quantitative), competent authorities should consider supervisory liquidity and funding benchmarks as quantitative tools. They should be used to provide a prudent, consistent, transparent and comparable benchmark with which to calculate and compare specific quantitative liquidity requirements for institutions with similar business models and risk profiles. In developing supervisory benchmarks, competent authorities should use supervisory assessment of risks to liquidity and funding, and the results of supervisory liquidity stress testing. 431. Competent authorities should use the most appropriate benchmark for the institution’s business model, applying judgement to the outcome of the benchmark to account for business-model-specific considerations where necessary. When competent authorities take supervisory benchmarks into consideration for the determination of specific liquidity requirements, they should explain to the institution the rationale and general underlying principles behind the benchmarks. 432. Competent authorities should assess the suitability of any benchmarks applied to institutions and continually review and update them in light of the experience of using them. 433. A key input to the competent authority’s benchmarks for the quantification of specific quantitative liquidity or funding requirements will be the data collected through the supervisory reporting in accordance with Article 415 of Regulation (EU) No 575/2013 covering liquidity and stable funding on an individual and consolidated basis, and additional liquidity monitoring metrics. 434. Below are some examples of the possible approaches:

150 a. Example 1: Institution with an initial liquidity buffer of EUR 1,200 million cumulative inflows and cumulative outflows estimated under stressed conditions are projected through a time horizon of five months. During this time horizon, the institution makes use of the liquidity buffer each time inflows fall below outflows. The result is that, under the stressed conditions defined, the institution would be able to survive for four and a half months, which is longer than the minimum survival period set by supervisors (in this example, three months); Table 19. Illustrative example of benchmark for liquidity quantification

151 Figure 4. Illustrative example of setting specific quantitative liquidity requirement b. Example 2: The supervisory minimum survival period is set at three months. An alternative measure to setting a minimum survival period, which can also address the supervisory concern that the gap between inflows and outflows is unacceptably high, is to set a cap on outflows. In the figure below, the mechanism for setting a cap on outflows is shown by the black horizontal bar. An institution is required to reduce its outflows to a level below the cap. The cap can be set for one or more-time buckets and for net outflows (following correction for inflows) or gross outflows. The alternative of adding a buffer requirement instead is shown in the third column. Figure 5. Illustrative example of setting specific quantitative requirements 435. Where competent authorities have not developed their own benchmark for the quantification of specific quantitative liquidity requirements, they can apply a benchmark using the following steps particularly in the case of liquidity risk: a. perform a comparative analysis, under stressed conditions, of net cash outflows and eligible liquid assets over a set of time horizons: up to one month (including overnight), from one month to three months, and from three months to one year; for this purpose, competent authorities should project net outflows (gross outflows and inflows);

152 b. counterbalance capacity throughout different maturity buckets, considering stressed conditions (for example, prudent valuation under stress assumptions for liquid assets versus current valuation under normal conditions and after a haircut), building a stressed maturity ladder for the year ahead; c. estimate the survival period of the institution, based on the assessment of the stressed maturity ladder; d. determinate the desired/supervisory minimum survival period, taking into account the institution’s risk profile and market and macroeconomic conditions; e. if the desired/supervisory minimum survival period is longer than the institution’s current survival period, competent authorities may estimate additional amounts of liquid assets (additional liquidity buffers) to be held by the institution to extend its survival period to the minimum required. Articulation of specific quantitative liquidity and funding requirements 436. To articulate the specific quantitative liquidity requirements, competent authorities should use one of the following approaches, unless another approach is considered more appropriate in specific circumstances: a. Approach 1 – Require an LCR higher than the regulatory minimum, of such a size that shortcomings identified are sufficiently mitigated. b. Approach 2 – Require a minimum survival period of such a length that identified shortcomings are sufficiently mitigated; the survival period can be set either directly, as a requirement, or indirectly, by setting a cap on the amount of outflows over the relevant time buckets considered; competent authorities may require different types of liquid assets (e.g. assets eligible for central banks), to cover risks not (adequately) covered by the LCR. c. Approach 3 – Require a minimum total amount of liquid assets or counterbalancing capacity, either as a minimum total amount or as a minimum amount in excess of the applicable regulatory minimum, of such a size that identified shortcomings are sufficiently mitigated; competent authorities may set requirements for the composition of liquid assets, including operational requirements (e.g. direct convertibility to cash, or deposit of the liquid assets at the central bank). 437. To articulate the specific quantitative stable funding requirements appropriately, competent authorities should use one of the following approaches, unless another approach is considered more appropriate in specific circumstances: a. Approach 4 – Require a NSFR higher than the regulatory minimum, of such a size that shortcomings identified are sufficiently mitigated. b. Approach 5 – Require a minimum total amount of available stable funding, either as a minimum total amount or as a minimum amount in excess of the applicable regulatory minimum, of such a size that identified shortcomings are sufficiently mitigated.

153 438. Competent authorities should structure quantitative liquidity or funding requirements in such a manner as to deliver broadly consistent prudential outcomes across institutions, bearing in mind that the types of requirements may differ between institutions because of their individual circumstances. In addition to the quantity, the structure should specify the expected composition and nature of the requirement. In all cases, it should specify the supervisory requirement and any applicable Directive 2013/36/EU requirements. Liquidity buffers and counterbalancing capacity held by the institution to meet supervisory requirements should be available for use by the institution during times of stress. 439. Competent authorities should ensure that the institution immediately notifies them if it does not meet the requirements or does not expect to meet the requirements in the short term. The notification should be accompanied by a plan drawn up by the institution for the timely restoration of compliance with the requirements. Competent authorities should assess the feasibility of the plan and take appropriate supervisory measures if the plan is not considered feasible. Where the plan is considered feasible, competent authorities should: determine any necessary interim supervisory measures based on the institution’s circumstances; monitor the implementation of the restoration plan; and closely monitor the institution’s liquidity position, asking the institution to increase its reporting frequency if necessary. 440. Notwithstanding the above, competent authorities may also set qualitative requirements in the form of restrictions/caps/limits on mismatches, concentrations, risk appetite, quantitative restrictions on the issuance of secured loans, etc., in accordance with the criteria specified in Title 9 of the Guidelines. 441. Below are some examples of the different approaches for the structure of specific quantitative liquidity requirements: Example of specific requirements articulation As of 1 January 2025, and until otherwise directed, Bank X is required to: a. Approach 1: ensure that its counterbalancing capacity is at all times equal to or higher than e.g. 125% of its liquidity net outflows as measured in the LCR. b. Approach 2: ensure that its counterbalancing capacity results at all times in a survival period that is greater than or equal to three months, measured by the internal liquidity stress test/the maturity ladder/specific metrics developed by the supervisor. c. Approach 3: − ensure that its counterbalancing capacity is at all times equal to or higher than EUR X billion; or − ensure that its counterbalancing capacity is at all times equal to or higher than EUR X billion in excess of the minimum requirement in accordance with the LCR. d. Approach 4: ensure that its available stable funding is at all times equal to or higher than e.g. 125% of its required stable funding as measured in the NSFR. e. Approach 5:

154 − ensure that its available stable funding is at all times equal to or higher than EUR X billion; or − ensure that its available stable funding is at all times equal to or higher than EUR X billion in excess of the minimum requirement in accordance with the NSFR. 9. Title 9. Overall SREP assessment and communication 9.1. General considerations 442. This title covers how the findings from the assessments of each SREP elements are combined into the overall SREP assessment, as well as how the respective outcome is communicated – including the articulation and justification of own funds requirements and guidance. It also addresses how the non-exhaustive supervisory measures listed at the end of each relevant sections and titles of these guidelines interact with other relevant frameworks (i.e. early intervention measures, resolution authorities’ assessments, macroprudential measures and AML/CFT). 9.2. Overall SREP assessment 443. In determining the overall SREP assessment, competent authorities should consider the findings of the assessments of the SREP elements, specifically: a. the risks to which the institution is or may be exposed; b. the likelihood that the institution’s governance, control deficiencies and/or business model or strategy are likely to exacerbate or mitigate these risks, or expose the institution to new sources of risk; c. whether the institution’s own funds and liquidity resources provide sound coverage of these risks; d. the potential for positive and negative interaction between the elements (e.g. competent authorities may consider a strong capital position to be a potential mitigating factor for certain concerns identified in the area of liquidity and funding, or by contrast, that a weak capital position may exacerbate concerns in that area). 444.On the basis of these considerations, competent authorities should determine the institution’s viability, defined as its proximity to a point of non-viability on the basis of the adequacy of its own funds and liquidity resources, governance, controls and/or business model or strategy to cover the risks to which it is or may be exposed. As a result of this determination, competent authorities should:

155 a. take any supervisory measures necessary to address concerns; b. determine future supervisory resourcing and planning for the institution, including whether any specific supervisory activities should be planned for the institution as part of the Supervisory Examination Programme; c. determine the need for early intervention measures as specified in Article 27 of Directive 2014/59/EU; d. determine whether the institution can be considered to be ‘failing or likely to fail’ within the meaning of Article 32 of Directive 2014/59/EU. 445. The overall SREP assessment should be reflected in a viability score based on the considerations specified in table 20 and clearly documented in an annual summary of the overall SREP assessment. This annual summary should also include the overall SREP score and scores for elements of the SREP, and any supervisory findings made over the course of the previous 12 months. Table 20. Supervisory considerations for assigning the overall SREP score Score Supervisory view Considerations 1 The risks identified pose a low level of risk to the viability of the institution. • The institution’s business model and strategy do not raise concerns. • The internal governance and institution-wide control arrangements do not raise concerns. • The institution’s risks to capital and liquidity pose a non￾material/a very low risk of a significant prudential impact. • The composition and quantity of own funds held do not raise concerns. • The institution’s liquidity position and funding profile do not raise concerns. • No material concerns about the credibility and feasibility of the institution’s recovery plan. 2 The risks identified pose a medium-low level of risk to the viability of the institution. • There is a low to medium level of concern about the institution’s business model and strategy. • There is a low to medium level of concern about the institution’s governance or institution-wide control arrangements. • There is a low to medium level of risk of a significant prudential impact caused by risks to capital and liquidity. • There is a low to medium level of concern about the composition and quantity of own funds held. • There is a low to medium level of concern about the institution’s liquidity position and/or funding profile. • There is a low to medium level of concern about the credibility and feasibility of the institution’s recovery plan. 3 The risks identified pose a medium-high level of risk to the viability of the institution. • There is a medium to high level of concern about the institution’s business model and strategy. • There is a medium to high level of concern about the institution’s governance or institution-wide control arrangements. • There is a medium to high level of risk of a significant prudential impact caused by risks to capital and liquidity.

156 Score Supervisory view Considerations • There is a medium to high level of concern about the composition and quantity of own funds held by the institution. • There is a medium to high level of concern about the institution’s liquidity position and/or funding profile. • There is a medium to high level of concern about the credibility and feasibility of the institution’s recovery plan 4 The risks identified pose a high level of risk to the viability of the institution. • There is a high level of concern about the institution’s business model and strategy. • There is a high level of concern about the institution’s governance or institution-wide control arrangements. • There is a high level of risk of a significant prudential impact caused by risks to capital and liquidity. • There is a high level of concern about the composition and quantity of own funds held by the institution. • There is a high level of concern about the institution’s liquidity position and/or funding profile. • There is a high level of concern about the credibility and feasibility of the institution’s recovery plan. 446. When determining that an institution is ‘failing or likely to fail’, as reflected by an overall SREP score of ‘F’, competent authorities should engage with the resolution authorities to consult on findings following the procedure specified in Article 32 of Directive 2014/59/EU. 9.3. Communication of the outcome of the SREP assessment 447. Competent authorities should communicate, in accordance with the SREP engagement model set out in section 2.4, the outcome of the SREP assessment to the institution in writing. The communication should be addressed to the management body of the institution. 448. The communication of the outcome of the SREP assessment to institutions, and, where relevant, to other competent or resolution authorities, should at least include the following elements: a. the relevant level of application, the date and the date of the application of the SREP assessment, as well as the reference dates of the information used in its preparation in accordance with Article 10 of the Commission Implementing Regulation (EU) No 710/2014; b. a description of the outcome of the SREP, including a summary of the assessment, material supervisory findings, and the overall SREP score. Where remedial action is required from the institution for specific SREP elements or sub-elements, competent authorities should consider including an appropriate timeframe for remediation and sharing the score for these elements and sub-elements, where appropriate; c. the required level and quality of the P2R, in accordance with the process and criteria specified in Title 7, including the institution-specific justification for setting the requirements, separately for the risk of excessive leverage and for other types of risks. The justification should provide a clear indication of the material risk drivers contributing to the P2R. In case of relevant changes to the regulatory framework for determining the P1R

157 applicable to an institution, communication should include the outcome of the assessment performed as per paragraph 294 of Title 7. In justifying P2R, competent authorities should: i. refer, to the extent possible, to the risk categories and subcategories/elements as described in Title 6 and sections 7.2 and 7.3, taking into account the existing definitions of specific risk types in the applicable legislation, with the aim of ensuring overall comparability across institutions; ii. identify the main deficiencies to be covered by these requirements until they are addressed line with paragraph 320. d. in communicating the required level of capital and quality of the Pillar 2 requirements in accordance with the previous point, competent authorities should: i. communicate the institution’s TSCR as a proportion (ratio) of the TREA, broken down in terms of the composition of the requirement. The TSCR should be expressed using the following formula: 𝑇𝑆𝐶𝑅 𝑟𝑎𝑡𝑖𝑜 = 𝑇𝑆𝐶𝑅 𝑇𝑅𝐸𝐴 ii. communicate the institution’s TSLRR as a proportion (ratio) of the leverage ratio exposure (LRE), broken down in terms of the composition of the requirement. The TSLRR should be expressed using the following formula: 𝑇𝑆𝐿𝑅𝑅 𝑟𝑎𝑡𝑖𝑜 = 𝑇𝑆𝐿𝑅𝑅 𝐿𝑅𝐸 iii. communicate the institution’s OCR and its component parts – the Pillar 1 own funds requirements, P2R and the buffer requirements – as a proportion (ratio) of the TREA, broken down in terms of the composition of the requirement; iv. communicate the institution’s OLRR and its component parts – the leverage ratio own funds requirement, P2R-LR and G-SII leverage ratio buffer requirement – as a proportion (ratio) of the LRE, broken down in terms of the composition of the requirement. e. The expected level and quality of the P2G and P2G-LR in accordance with the process and criteria specified in section 7.6, where their determination results in a positive value, including: i. all applicable own funds ratios affected by P2G (CET1, T1 and total own funds) and leverage ratio requirement affected by P2G-LR and that own funds held for the purposes of P2G cannot be used to meet any of the elements of OCR and that P2G-LR cannot be used to meet any of the elements of OLRR; ii. the relevant time limits for its establishment; iii. the institution-specific justification for setting the guidance and the main elements of the methodology used; iv. the potential supervisory reaction to situations where P2G and P2G-LR are not met. f. a statement on the liquidity held and any specific liquidity requirements set by the competent authority other than those laid down in Article 4(2) Commission Delegated

158 Regulation 2015/61 and 428b(2) of Regulation No 575/2013, including the institution￾specific reasons for these requirements; g. if applicable, a statement on other supervisory measures, whether qualitative or quantitative, including any early intervention measures that the competent authority intends to take. 9.4. Supervisory reaction to a situation where TSCR or OCR is not met 449. TSCR as determined in accordance with these guidelines and communicated in the SREP assessment is a legally binding requirement that institutions have to meet at all times, including in stressed conditions. If TSCR is no longer met, the competent authorities should consider additional intervention powers in accordance with Directives 2013/36/EU and 2014/59/EU, including withdrawal of authorisation in accordance with Article 18(d) of Directive 2013/36/EU, application of early intervention measures in accordance with Article 27 of Directive 2014/59/EU, determination that an institution is failing or likely to fail in accordance with Article 32(4)4a of Directive 2014/59/EU and relevant Guidelines and resolution actions in accordance with that Directive. When exercising those powers, competent authorities should consider whether measures are proportionate to the circumstances and their judgement on how the situation is likely to develop. 450. Competent authorities should also monitor whether the institutions meet the OCR. Where necessary, competent authorities should take measures to ensure that institutions comply with requirements set out in Articles 141 to 142 of Directive 2013/36/EU. 9.5. Supervisory reaction to a situation where P2G is not met 451. Competent authorities should monitor whether the amount of own funds expected in accordance with P2G is established and maintained by the institution over time. When the institution’s own funds drop, or are likely to drop, below the level determined by P2G, the competent authority should expect the institution to notify it and prepare a revised capital plan. In its notification, the institution should explain what adverse consequences are likely to force it to do so and what actions are envisaged for the eventual restoration of compliance with P2G as part of an enhanced supervisory dialogue. 452. There are generally three situations to be considered by a competent authority in which an institution could fail to meet its P2G: a. Where the level of own funds falls below the level of P2G (while remaining above OCR) in institution-specific or external circumstances in which risks that P2G was aimed at covering have materialised, the competent authority may allow the institution to temporarily operate below the level of P2G, provided that the revised capital plan is considered credible in accordance with the criteria set out in section 7.7. The competent authority may also consider adjusting the level of P2G where appropriate;

159 b. Where the level of own funds falls below the level of P2G (while remaining above the OCR) in institution-specific or external circumstances as a result of the materialisation of risks that P2G was not aimed at covering, competent authorities should expect the institution to increase the level of own funds to the level of P2G within an appropriate timeline; c. Where the institution disregards P2G, does not incorporate it into its risk management framework or does not establish own funds to meet P2G within the relevant time limits set out by the competent authority, this may lead to competent authorities applying additional supervisory measures as set out in table 16. Where the permission to operate below the level of P2G as referred to in point (a) has not been granted and the institution’s own funds are repeatedly below the level of P2G, the competent authority should impose P2R in accordance with Title 7. 453. Notwithstanding particular supervisory responses in accordance with the previous paragraph, competent authorities may also consider the application of the capital and additional supervisory measures set out in Title 7, where these are deemed more appropriate to address the reasons for the own funds falling below the level determined by P2G. 9.6. Interaction between supervisory, early intervention measures and resolution authorities’ assessment 454. In addition to the supervisory measures, competent authorities may apply early intervention measures as specified in Article 27 of Directive 2014/59/EU, which are intended to supplement the set of supervisory measures specified in Articles 104 and 105 of Directive 2013/36/EU. 455. Competent authorities should apply early intervention measures without prejudice to any other supervisory measures and, when applying early intervention measures, should choose the most appropriate measure(s) to ensure a response that is proportionate to the particular circumstances. 456. When setting supervisory or early intervention measures, competent authorities should, in addition to considering the escalation framework set out in Title 2, also take into account the results of the resolvability assessment conducted by the resolution authority, including the related work programme, with a view to ensuring consistency in supervisory actions. 9.7. Interaction between supervisory and macroprudential measures 457. Where an institution is subject to macroprudential measures and the SREP assessment determines that these macroprudential measures do not adequately address the institution￾specific risk profile or deficiencies present in the institution (i.e. the institution is exposed to or poses a higher level of risk than the level targeted by the macroprudential measure, or the deficiencies identified are more material than those targeted by the measure), competent

160 authorities should consider supplementing the macroprudential measures with additional institution-specific measures. 9.8. Interaction between supervisory and AML/CFT measures 458. When applying supervisory measures to address prudential deficiencies related to ML/TF risk, competent authorities should engage with AML/CFT supervisors so that the underlying deficiencies/vulnerabilities are adequately addressed by the appropriate measures within the respective remit of AML/CFT supervisors and competent authorities from their respective perspectives58 . 459. Where competent authorities in the course of exercising their supervisory activities have reasonable indications of deficiencies in the institution’s systems and controls framework or the internal governance framework that are related to AML/CFT or reasonable grounds to suspect that the institution has increased exposure to ML/TF risks, they should: a. notify the AML/CFT supervisor of these deficiencies and risks as soon as they are identified and liaise with them in line with the AML/CFT Cooperation Guidelines; b. assess the impact that such deficiencies and risks may have on the prudential situation of the institution; c. liaise with AML/CFT supervisors and in line with the respective authorities’ mandates and functions, consider the most appropriate prudential supervisory measures to address these deficiencies and risks in addition to any measures taken by the AML/CFT supervisors. 460. Where the competent authorities are notified or become aware of supervisory measures or sanctions planned or imposed by the AML/CFT supervisors, they should consider whether and how the potential prudential implications of the weaknesses and failures identified by the AML/CFT supervisors need to be mitigated. 58 In accordance with the EBA AML/CFT Cooperation Guidelines (EBA/GL/2021/15).

161 10.Title 10. Application of the SREP to cross-border groups 461. This title addresses the application of the SREP procedures and methodology as specified in these guidelines in relation to cross-border groups and their entities. It also provides links with the joint assessment and decision process to be carried out pursuant to Article 113 of Directive 2013/36/EU and the Commission Implementing Regulation (EU) No 710/2014. 462. In the SREP, competent authorities should also consider the potential ML/TF risks and risks of non-implementation and evasion of targeted financial sanctions, taking into account input received from the AML/CFT competent authority of the Member State where a parent undertaking is established as well as AML/CFT supervisors responsible for the AML/CFT supervision of the group’s establishments in different jurisdictions, in particular the assessments of ML/TF risks, material weaknesses and breaches of AML/CFT legislation that are linked to the cross-border banking group structure. 463. When assessing prudential implications of ML/TF risks and risks of non-implementation and evasion of targeted financial sanctions in the SREP for a cross-border group, competent authorities should leverage the information obtained through bilateral engagements with relevant AML/CFT competent authorities in accordance with the AML/CFT Cooperation Guidelines and through their participation in AML/CFT colleges59 and prudential colleges. 10.1. Application of the SREP to cross-border groups 464. When applying the SREP and these guidelines to cross-border groups, competent authorities should assess the viability of the group as a whole, as well as its individual entities. Consolidating supervisors should perform the initial assessment of the parent undertaking and the group of institutions on a consolidated level, while the other competent authorities should perform the initial assessment of the entities under their supervision (individual, or sub￾consolidated, where relevant). 465. When these guidelines are applied to the subsidiaries of a cross-border group, competent authorities for subsidiaries should, when performing their initial assessment, primarily consider institutions on an individual basis, as they would with a standalone institution. The findings from such initial assessments, where relevant, should also include the identification of key vulnerabilities in the cross-border or group context, and reflect strengths and mitigating factors related to the entity being part of the group. 59 AML/CFT colleges as defined in the Joint guidelines on cooperation and information exchange for the purpose of Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions (‘The AML/CFT Colleges Guidelines’ and in Article 2(8) of Directive (EU) 2024/1640.

162 466. The results of any such initial assessment of the SREP elements, including, if identified, views on key dependencies on the parent/group, should serve as an input into the joint assessment and decision process pursuant to the requirements of Article 113 of Directive 2013/36/EU. These results should therefore be discussed by the competent authorities within the framework of the colleges of supervisors established pursuant to Article 116 of Directive 2013/36/EU. 467. In accordance with Article 3 of the Commission Implementing Regulation (EU) No 710/2014, prior to the start of the joint decision process the consolidating supervisor and the relevant competent authorities need to agree on a joint decision timetable setting out steps to be followed in the process and adhere to the agreed timetable throughout the process. 468. Following the discussions within the colleges of supervisors and the outcomes of the joint assessment process, competent authorities should finalise their respective SREP assessments, making the necessary adjustments based on the outcomes of the college discussions. 469. Where a competent authority’s assessment revealed specific deficiencies related to intra￾group positions negatively affecting the overall viability of the entity on an individual basis, competent authorities should, within the colleges of supervisors, discuss whether the final assessment of an entity should be changed considering the overall group dimension, including the consolidated group business model, strategy and the existence and specific features of intra-group financial support arrangements. 470. Competent authorities should discuss and coordinate the following within the colleges of supervisors: a. planning, including frequency, and timelines for performing the assessment of various SREP elements for the consolidated group and its entities to facilitate preparation of the group risk and liquidity risk reports required for the joint decisions as specified in Article 113 of Directive 2013/36/EU and in Article 3 of the Commission Implementing Regulation (EU) No 710/2014 taking into account the proportionality and supervisory engagement set out in Title 2; b. details of the application of benchmarks used for the assessment of SREP elements; c. approach to assessing and scoring subcategories of risks individually, where such subcategories have been identified as material; d. inputs required from the institution at consolidated and entity level for conducting the assessment of SREP elements, including those from the ICAAP and ILAAP; e. outcomes of the assessment, including the SREP scores assigned to various elements, and the overall SREP assessment and overall SREP score at consolidated and entity level. When discussing the assessment of individual risks to capital and liquidity, competent authorities should focus on the risks that are identified as material for the respective entities; f. cross-border prudential implications of ML/TF risks, risks of non-implementation and evasion of targeted financial sanctions and concerns; and

163 g. planned supervisory and early intervention measures, if relevant. 471. When preparing the summary of the overall SREP assessment for the cross-border group and its entities, competent authorities should structure it in a way that will facilitate filling in the templates for the SREP report, group risk report, liquidity risk assessment and group liquidity risk assessment report templates required for the joint decision in accordance with Article 113 of Directive 2013/36/EU as specified in the Commission Implementing Regulation (EU) No 710/2014. 10.2. SREP capital assessment and institution-specific prudential requirements 472. The determination of capital adequacy, and related requirements and guidance in accordance with the process described in Title 7 for cross-border groups is part of the competent authorities’ joint decision process pursuant to Article 113 of Directive 2013/36/EU. 473. For parent or subsidiary institutions of a cross-border group, the application of P2R and P2R￾LR pursuant to Article 104(1)(a) of Directive 2013/36/EU should be carried out in accordance with the joint decision process provided for in Article 113(1)(a) of that Directive. 474. In the context of discussions on the adequacy of the level of own funds and determining P2R and P2R-LR, competent authorities should consider: a. the assessment of the materiality of risks and deficiencies identified at both consolidated and individual entity level (i.e. which risks are material to the group as a whole and which are material to just one entity) and the level of own funds required to cover such risks; b. where deficiencies identified are common across all entities (e.g. same governance deficiencies present in all entities, or deficiencies in the models used across several entities), coordinating the assessment and supervisory response, and in particular, deciding whether measures should be imposed at a consolidated level or proportionally at entity level for the entities where common deficiencies are present; c. outcomes of ICAAP assessments and views on the reliability of ICAAP calculations and their possible use as an input in determining P2R; d. outcomes of the supervisory benchmark calculations used to determine P2R for all entities within the group and at a consolidated level; e. P2R to be imposed on entities and at a consolidated level to ensure there is consistency of final own funds requirements and whether there is a need for transferring own funds from consolidated to entity level. 475. To determine the TSCR as specified in Title 7, competent authorities should consider the same level of application as the joint decision requirements in accordance with Article 113(1)(a) of Directive 2013/36/EU. In particular, the TSCR and other capital measures, if applicable, should be set at consolidated and solo levels for entities operating in other Member States. For the sub-consolidated level, the TSCR and other capital measures should cover only the parent

164 undertaking of the sub-consolidated group to avoid double counting of P2R considered by competent authorities for subsidiaries in other Member States. 476. If the outcome of the supervisory assessment of the risk of excessive leverage for the parent or subsidiary institutions of a cross-border group is that Pillar 2 requirements to address the risk of excessive leverage P2R-LR should be set, this should be carried out in accordance with the joint decision process provided for in Article 113(1)(a) of the CRD and should reflect the separate stack of own funds requirements based on the leverage ratio. 477. In the context of the discussions on the adequacy of the level of own funds to cover the risk of excessive leverage and determining P2R-LR, competent authorities should consider: a. aspects included in paragraph 3266; b. Pillar 2 requirements to cover the risk of excessive leverage imposed on entities and at a consolidated level to ensure there is consistency of final own funds requirements and whether there is a need for transferring own funds from consolidated to entity level. 478. All the relevant information regarding the determination of P2G and P2G-LR for parent or subsidiary institutions of a cross-border group should be shared among competent authorities, and their setting should be carried out in accordance with the joint decision process pursuant to Article 113(1)(c), of Directive 2013/36/EU. In particular, competent authorities should discuss the approach to establishing P2G and P2G-LR at solo level where no data from the supervisory stress tests are available at that level, or, where relevant, agree on the application of P2G and P2G-LR at consolidated level only. The P2G and P2G-LR should be duly reflected in the joint decision document prepared in accordance with Article 113 of Directive 2013/36/EU. 10.3. SREP liquidity assessment and institution-specific prudential requirements 479. The determination of measures to address any significant matters and material findings relating to liquidity supervision and to the need for institution-specific liquidity requirements should be conducted in accordance with the joint decision process pursuant to Article 113 of Directive 2013/36/EU. 480. For Article 113(1)(b) of Directive 2013/36/EU, competent authorities should consider ‘matters’ to be significant and/or ‘findings’ to be material at least where: a. specific quantitative liquidity requirements are proposed by competent authorities; and/or b. measures other than specific quantitative liquidity requirements are proposed by competent authorities and the score assigned to liquidity risk and/or funding risk adequacy is ‘3’ or ‘4’.

165 10.4. Application of other supervisory measures 481. Competent authorities responsible for the supervision of cross-border groups and their entities should discuss and coordinate, where possible, application of all supervisory and early intervention measures to the group and/or its material entities to ensure that the most appropriate measures are consistently applied to the identified vulnerabilities, taking into account the group dimension, including inter-dependencies and intra-group arrangements as discussed above. 482. Competent authorities responsible for the prudential supervision of entities of a cross-border group should – when imposing supervisory or administrative measures, including sanctions, on institutions for their failure to address deficiencies related to ML/TF risks adequately – liaise with the relevant AML/CFT supervisors in accordance with section 8 of the AML/CFT Cooperation Guidelines60 , and – in line with the respective authorities’ mandates and functions – consider the most appropriate prudential supervisory measures to address these deficiencies and risks in addition to any measures taken by the AML/CFT supervisors. 60 EBA AML/CFT Cooperation Guidelines (EBA/GL/2021/15).

166 11.Title 11. Supervisory stress testing 11.1. Use of supervisory stress testing by competent authorities 483. Competent authorities should, also on the basis of Article 100 of Directive 2013/36/EU, use supervisory stress testing to facilitate the SREP and, in particular, the supervisory assessment of its key elements, as described in Titles 4 to 8. The integration of ESG factors into supervisory stress testing should be carried out in accordance with the Joint Guidelines on integrating ESG risks in supervisory stress tests, giving priority to environmental risks. In particular, supervisory stress testing should help competent authorities, where appropriate, with the following: a. the assessment of institutions’ individual risks to capital as referred to in Title 6, or risks to liquidity and funding as referred to in Title 8; b. the assessment of the reliability of institutions’ stress testing programmes, as well as the relevance, severity and plausibility of scenarios for institutions’ own stress tests used for ICAAP and ILAAP purposes. This may include challenging institutions’ main assumptions and risk drivers; c. the assessment of institutions’ ability to meet TSCR and OCR in the context of the assessment of capital adequacy, as specified in section 7.7. Depending on the coverage and type of supervisory stress test, this assessment may be limited only to some elements of TSCR covered by the design features of the supervisory stress testing (e.g. P2R for individual risk categories, if the stress test covers only such risk categories); d. the determination of P2G for institutions; e. the identification of possible vulnerabilities or weaknesses in institutions’ risk management and controls on individual risk areas; f. the identification of possible deficiencies in overall governance arrangements or institution￾wide controls referred to in Title 5. In particular, if a competent authority identifies by means of supervisory stress testing, deficiencies in the institution’s own stress testing programmes or supporting risk data infrastructure, these should be taken into account in the assessment of the overall governance and risk management framework of that institution; g. the determination of specific quantitative liquidity requirements in the context of the assessment of liquidity adequacy, especially where a competent authority has not developed specific supervisory benchmarks for liquidity requirements. Certain elements of the liquidity supervisory stress tests should, where appropriate, be used as inputs when setting specific liquidity requirements for institutions as specified in section 8.6. 484. Furthermore, supervisory stress testing should help competent authorities to assess supervisory organisational procedures and to plan supervisory resources, considering also other relevant information, in particular for the more frequent and in-depth assessment of

167 certain SREP elements in the case of non-Category 1 institutions, and for the purposes of determining the scope of the supervisory examination programme required by Article 99 of Directive 2013/36/EU. 485. Competent authorities should also, where appropriate, use supervisory stress testing outcomes to: a. support the analysis needed for the purposes of granting various permissions and authorisations required by Regulation (EU) No 575/2013 or Directive 2013/36/EU, for example in relation to qualifying holdings, mergers and acquisitions, and shares buy-backs; b. support a thematic analysis of the potential vulnerabilities of a group of institutions with similar risk profiles; c. support the analysis of the potential impacts of ESG factors on the institutions' business model on the basis of a medium to long-term scenario analysis carried out in accordance with the Joint Guidelines on integrating ESG risks in supervisory stress tests; d. motivate institutions to enhance their internal stress testing and risk management capabilities: in particular, a supervisory stress test with a bottom-up component could motivate institutions to further develop and improve their data aggregation, risk modelling and IT tools for stress testing and risk management purposes. 11.2. Key elements of supervisory stress testing 486. When deciding on the key elements of supervisory stress testing, competent authorities should consider, inter alia, the following: a. coverage, in terms of covering certain risk factors or multiple risk factors, certain individual portfolios or activities or sectors/geographies, all or several portfolios; b. design, in terms of the following: single-factor or simple multi-factor sensitivity analysis, solvency or liquidity stress testing, reverse stress testing or medium to long-term scenario analysis. Competent authorities should choose the design that is most appropriate for the objective pursued by the stress test; c. scope, in terms of covering the perimeter of cross-border groups, ensuring that all relevant group entities are taken into account; d. sample of institutions covered by stress tests: when planning supervisory stress testing, competent authorities should consider the appropriate sample for the purposes of the exercise, in particular when using supervisory stress testing for thematic assessments of certain business lines/models or impact studies/assessments; e. approach, namely top-down stress test, bottom-up stress test, combination of both, prescribing specific anchor scenarios for institutions. 487. When designing and conducting supervisory stress tests for SREP purposes, competent authorities should consider the outcomes of asset quality reviews (AQR), where available, appropriate and not already incorporated into institutions’ financial statements. Combining supervisory stress testing with AQRs can be considered useful in ensuring that the balance-

168 sheet positions of the institutions covered by the supervisory stress tests are reported accurately with improved and comparable starting points across participating institutions. 11.3. Organisational and governance arrangements within competent authorities 488. Competent authorities should establish an effective programme for supervisory stress testing. This programme should be supported by appropriate organisation, governance and IT arrangements ensuring that supervisory stress tests can be conducted with appropriate frequency. The supervisory stress testing programme should support the effective implementation of the supervisory examination programme for individual institutions. The programme should also reflect how the competent authority takes decisions regarding the choice of forms of supervisory stress testing in close connection with the objectives of each exercise. 489. The governance, organisation and IT arrangements supporting the supervisory stress testing programme should include at least the following: a. sufficient human and material resources, data and IT infrastructure to design and conduct supervisory stress tests. In particular, the supervisory stress testing programme should be supported by adequate data and an appropriate methodological approach covering all aspects, including scenarios and assumptions (e.g. templates, guidance, documentation), and ensuring both flexibility and appropriate levels of quality and controls; b. a quality assurance process covering stress testing design, development and execution, and the comparability of results across institutions; c. the integration of supervisory stress testing into other relevant supervisory processes. Hence, when required and subject to any legal constraints, the organisation should support the internal sharing of information and utilisation of all aspects of the stress testing programme. 490. As part of governance arrangements, competent authorities should ensure that the supervisory stress testing programme is reviewed regularly, both qualitatively and quantitatively, to ensure that its continued adequacy. 491. Competent authorities should ensure that they have processes and arrangements in place for an effective dialogue with institutions regarding supervisory stress tests and their outcomes. This dialogue should reflect the intended objectives, be established in particular but not exclusively when supervisory stress tests are run for the purposes of the assessment of institutions’ overall capital adequacy, and be organised within the more general context of the SREP assessments as set out in these guidelines. For the purposes of such a dialogue both at the technical and managerial level, where relevant, the competent authorities should ensure that:

169 a. adequate, sufficiently detailed and accurate explanation and guidance is provided to institutions on the application of the methodologies and assumptions used in a bottom-up stress test; b. adequate, sufficiently detailed and accurate instructions are given to institutions with regard to the supporting information required by them to be submitted to competent authorities along with the results of the stress tests; c. explanation is provided to institutions following discussions, where relevant, of the outcomes of supervisory stress tests that lead to the application of supervisory measures. This should be considered by competent authorities in particular in the context of system￾wide stress tests that trigger supervisory measures. 492. When applying supervisory stress testing to cross-border groups, competent authorities should exchange information and, where feasible, appropriately discuss the process within the colleges of supervisors. In particular, competent authorities should ensure that relevant details on the methodologies, scenarios and major assumptions, as well as the results of supervisory stress tests, especially those aimed at assessing capital or liquidity adequacy, are made available and discussed. 493. Competent authorities should also identify what information regarding supervisory stress tests and their outcomes may be publicly disclosed, taking into account the intended purposes of the supervisory stress tests. When deciding on the public disclosure of the results or methodologies of supervisory stress tests, competent authorities should consider their own role in the exercise and the approach chosen and also consider the extent of their own analysis that will accompany published results.

170 12.Title 12. Assessing third-country branches 494. This title addresses the application of the SREP procedures and methodology as specified in these guidelines in relation to third-country branches (TCBs) as defined in Article 47(3) of Directive 2013/36/EU. It also addresses the application by competent authorities of supervisory measures to address deficiencies identified through the SREP assessment of TCBs. 495. When performing the SREP assessment for TCBs, competent authorities should evaluate inter alia the compliance of the institution with the legal acts published separately on the EBA website as referred to in paragraph 12. 496. The SREP assessment of a TCB should include an assessment of the branch’s business model, internal governance arrangements and controls, capital endowment and liquidity resources and booking arrangements (the SREP elements for TCBs). In line with the supervisory review and evaluation process for credit institutions (the SREP for credit institutions), the assessment of these areas should be conducted on a continuous basis and accompanied by ongoing monitoring of key indicators. 497. The review should be conducted with a level of frequency and intensity that is proportionate to the TCB’s classification as class 1 or class 2 in accordance with Article 48a of Directive 2013/36/EU and the nature, scale, and complexity of the TCBs’ activities. For class 1 TCBs, competent authorities should apply at a minimum the level of supervisory engagement for category 3 institutions as set out in table 1 of section 2.4. For class 2 TCBs, competent authorities should apply at a minimum the level of supervisory engagement for category 4 institutions as set out in table 1 of section 2.4. 498. In addition to assessing the core SREP elements for TCBs, competent authorities should ensure they understand the branch’s other material risks and how these are mitigated. This includes any significant exposures to credit risk, market risk, operational risk and IRRBB. Competent authorities may deem it appropriate to perform a more in-depth assessment of one or more of these areas based on the relevance and materiality of the risk for the TCB. In such cases, competent authorities should use the guidance in the relevant corresponding titles of these Guidelines as the basis for the assessment and seek to apply the principles contained in a manner proportionate to the TCB. 499. Where competent authorities exercise their right in accordance with Article 48a of Directive 2013/36/EU to subject the TCB to requirements for credit institutions in accordance with the Directive, effectively treating the TCB as a subsidiary, competent authorities should apply the SREP for credit institutions to the TCB in question and refer to the relevant titles of these

171 Guidelines (Titles 2, 3, 4, 5, 6, 7, 8, 9, 10, and 11, as well as section 12.1.2 of this section, on business model analysis). 500. Competent authorities should use the findings from the assessment of the individual SREP elements for TCBs to score each area. The competent authority should use this analysis to form an overall assessment and score for the TCB and use the considerations in table 21 as a guide in this regard. The overall assessment and score should also take account of the assessment and scoring of the TCB’s other material risks (where applicable). Based on the overall SREP assessment and the assessment of the individual SREP elements for TCBs, competent authorities should take supervisory measures as specified in section 12.2 of this title to address any deficiencies identified. 12.1. Application of SREP to third-country branches 12.1.1. General considerations 501. The SREP assessment should focus on the TCB’s material risks and how these are dependent on the business, and the risk profile of the rest of the group and how they are managed. Recognising the status of the branch and its reliance on the third-country parent, the assessment should also focus on whether the branch has sufficient independence in its governance and risk management to act in the best interests of the branch, safeguarding its safety, soundness and viability, and its capacity to fulfil its commitment to clients and counterparties within the Member State where they have been authorised to carry out business. 502. To inform the assessment, competent authorities should take into account the results of the independent third-party assessment of the branch and the independent opinion on compliance with booking requirements mandated by Articles 48g(8) and 48h(3) of Directive 2013/36/EU, respectively. They should also cooperate with the authority responsible for supervision of the head undertaking (‘the home authority’) in accordance with administrative or other arrangements in accordance with Article 48c(2) of Directive 2013/36/EU and take into account the results of the home authority’s supervisory assessments of the branch where available. 503. Competent authorities should ensure that the scope of the assessment contains measures to identify TCBs of systemic importance or posing financial stability risks. Further, the assessment should enable identification of TCBs for which authorisation in accordance with Title III, Chapter 1 of Directive 2013/36/EU (as a subsidiary) may be appropriate. Competent authorities should refer to Article 48i for criteria to consider in this regard. 504. Where the review of the TCB’s governance, business model, or activities, gives competent authorities reasonable ground to suspect that, in connection with the TCB, money laundering or terrorist financing is being or has been committed or attempted, or that there is increased

172 risk thereof, the competent authority is required to immediately notify the EBA and the TCB’s AML/CFT supervisor in accordance with Article 48n(4) of Directive 2013/36/EU. 12.1.2. Business model analysis 505. Competent authorities should analyse the TCB’s business model and strategy to understand the key drivers of its risks. They should use the guidance provided in Title 4 as the basis for the assessment and seek to apply the principles contained in a manner proportionate to the TCB. Competent authorities should verify that the strategy for the third-country branch and a separate assessment of the associated risks is adequately documented along with evidence of its review and scrutiny by branch management. 506. Competent authorities should pay specific attention to the outreach of the TCB activities, to assess whether it complies with the territorial scope of the authorisation granted by the competent authority where the TCB is established. Attention should also be paid to any cross￾border business activity carried out upon reverse solicitation. 507. Competent authorities should consider how the head undertaking’s strategic priorities for the TCB impact its risk profile. They should pay attention to any earnings or strategic targets set for the TCB branch and whether these are supported by the TCB’s resourcing and risk management capabilities. They should also assess the nature of the services and activities offered by the TCB and how, if at all, these diverge from the offering of the wider group and whether this results in any increased risks or go beyond the scope of services and activities authorised to be carried out by the TCB, which cannot be more extensive than that of the direct head undertaking in the third country. 12.1.3. Assessment of internal governance arrangements and controls 508. Competent authorities should assess the adequacy of the TCB’s governance arrangements using Title 5 and section 7 of the EBA Guidelines on Internal Governance in accordance with Directive 2013/36/EU61 as a guide as well as the TCB-specific considerations below. The assessment should include the overall framework, risk culture and risk conduct, remuneration policies and practices, and the internal control and risk management framework including the management of ICT risks and third-party risks. 509. In conducting the assessment of internal governance, competent authorities should consider whether the TCB maintains sufficient substance in the Member State in accordance with the requirements in paragraph 90(g) of the EBA Guidelines on internal governance. Organisational framework 510. Competent authorities should assess whether the persons directing the TCB: 61 EBA/GL/2021/05

173 a. have sufficient understanding of the activities and risks of the branch and knowledge of the local market, as well as of EU and national regulations of the Member State; b. have sufficient authority, stature, and independence, taking into account the extent they are empowered to contribute to decisions by the head undertaking affecting the branch; c. spend sufficient time within its Member State and in the premises of the branch to effectively fulfil their role. 511. Where the TCB branch has established a management committee, competent authorities should review its role in ensuring adequate governance. In the absence of such body, competent authorities should review whether an appropriate and proportionate alternative framework for senior management oversight of the TCB’s activities and risks has been implemented. Relation with the head undertaking 512. Competent authorities should assess the TCB’s relation with the head undertaking, including whether the branch is integrated into the group governance and risk management framework effectively. They should take into account whether: a. the branch’s reporting to the head undertaking provides sufficient visibility of the branch’s material risks; d. the risk framework applied to the TCB adequately addresses EU financial services regulations. 513. Where the TCB engages in back-to-back or intragroup operations, competent authorities should verify that the branch has an appropriate framework for managing its counterparty credit risk. Internal control framework and third-party risk management 514. Competent authorities should assess whether the TCB has robust internal control functions. For class 1 TCBs (and class 2 TCBs where applicable in accordance with Article 48g(3) of Directive 2013/36/EU), competent authorities should assess whether suitable heads of internal control functions have been appointed who are independent and have sufficient capacity to fulfil the function as provided for in Article 76(6) of Directive 2013/36/EU. 515. Competent authorities should assess whether the TCB conducts appropriate due diligence and ongoing oversight of functions provided by third-party service providers. They should verify that third-party arrangements, including intragroup arrangements, are governed by documented agreements and that the TCB has access to all information required to exercise its monitoring obligations, including when subcontractors are used. Competent authorities should review the TCB’s management of its ICT risks, including whether the TCB maintains an appropriate register of its third-party service providers including when subcontractors performing critical or important function are used.

174 12.1.4. Assessment of capital endowment and liquidity resources 516. Competent authorities should assess: a. whether the TCB branch meets the minimum capital endowment requirement as specified in Article 48e(1) of Directive 2013/36/EU; b. whether the concentration of the capital endowment on a particular form of instrument or on instruments from a particular geographical location, or the currency inconsistency of the capital endowment instruments with the TCB’s liabilities, especially with deposits, would lead to heightened volatility of the value of the instruments and to the potential breach of the minimum requirement; c. whether the capital endowment is held in an eligible escrow account in the Member State where the third-country branch has been authorised and the capital endowment instruments meet the criteria specified in Article 48e(2) of Directive 2013/36/EU and the conditions set in the EBA Guidelines on instruments available for third-country branches for unrestricted and immediate use to cover risks or losses62 . 517. Competent authorities should assess whether the institution holds sufficient liquid and unencumbered assets to mitigate its liquidity risks and in particular that the branch’s liquid assets are sufficient for cover liquidity outflows over a minimum of 30 days in line with Article 48f(1) of Directive 2013/36/EU. For Class 1 TCBs, the assessment should cover the branch’s compliance with the liquidity coverage requirement as described in the same Article. 518. In conducting the capital endowment and liquidity assessment, competent authorities should consider whether the TCB maintains documentation that is adequate for a prompt and accurate review of its compliance with the minimum capital endowment and liquidity requirement. 519. Competent authorities should assess: a. the quality of the engagement between the TCB and head undertaking on capital and liquidity management decisions – including how the branch is covered in group capital and liquidity planning processes, monitoring and stress testing and the existence of appropriate escalation mechanisms for the branch to promptly notify the head undertaking of potential or actual capital or liquidity issues; b. whether the cross-border intra-group funding arrangements are within the limits of the exception allowed in accordance with Article 48c(4) (d) of Directive 2013/36/EU and do not disguise cross-border business activities in breach of the territorial scope of the authorisation – for instance where the intragroup funding provided to a TCB established in another Member State in exchange for a (total or partial) share of the economic risks and returns of a specific asset. 62 EBA/CP/2025/17

175 12.1.5. Assessment of booking arrangements 520. Competent authorities should assess whether the TCB has an adequate framework for managing and recording assets and liabilities booked or originated in the Member State, including off-balance sheet items. Competent authorities shall verify that the TCB’s framework includes a registry book that adequately documents all assets and liabilities booked or originated by the branch in line with Regulatory Technical Standards in accordance with Article 48h(4) of Directive 2013/36/EU and a policy in compliance with Article 48h of Directive 2013/36/EU. 521. Competent authorities should assess whether the activities performed by the TCB, its assets and liabilities booked or originated, or other hedging arrangements identified in the registry book are in line with the TCB’s policy on booking arrangements and its business strategy. 522. Where the TCB engages in back-to-back booking arrangements, competent authorities should assess whether the TCB appropriately manages the risks of back-to-back and remote booking arrangements respectively, including counterparty credit risk, CVA risk, and settlement risk. 523. Competent authorities should assess whether the TCB manages assets and liabilities autonomously. They should consider whether the TCB demonstrates independence in accepting new activities, including through the enforcement of a risk appetite agreed by the branch management. They should consider whether the TCB has sufficient controls and reporting to independently understand and act upon the risks of actual or prospective activities. They should take into account whether the TCB’s framework adequately addresses both the prudential risks of the booked activities in so far as they impact the branch’s capital and liquidity risk profile, and AML/CFT risks. 524. Where the TCB originates assets and liabilities for other branches or subsidiaries of the same group, competent authorities should assess whether any particular risks arise from these arrangements including operational vulnerabilities and legal constraints. 12.2. Summary of findings, scoring and supervisory measures 525. Following the above assessment, competent authorities should form an overall risk on the key risks of the TCB. This view should be reflected in an annual summary of the overall SREP assessment, accompanied by a viability score based on the considerations specified in table 21. The annual summary should also include any supervisory findings made over the course of the previous 12 months.

176 Table 21. Supervisory considerations for assigning the overall SREP score Score Supervisory view Considerations 1 The risks identified pose a low level of risk to the viability of the TCB branch. • The TCB’s business model and strategy do not raise concerns. • The TCB’s internal governance and controls arrangements do not raise concerns. • The TCB’s risks are not material or risk management and controls are adequate to mitigate those risks that are identified as material. • The TCB’s capital endowment and liquidity position do not raise concerns. • The TCB’s booking arrangements do not raise concerns. 2 The risks identified pose a medium-low level of risk to the viability of the TCB. • There is a low to medium level of concern about the TCB’s business model and strategy. • There is a low to medium level of concern about the TCB’s governance or control arrangements. • There is a low to medium level of concern about the TCB’s material risks and their management and control. • There is a low to medium level of concern about the TCB's capital endowment and/or liquidity position. • There is a low to medium level of concern about the TCB’s booking arrangements. 3 The risks identified pose a medium-high level of risk to the viability of the TCB. • There is a medium to high level of concern about the TCB’s business model and strategy. • There is a medium to high level of concern about the TCB’s governance or control arrangements. • There is a medium to high level of concern about the TCB’s material risks and their management and control. • There is a medium to high level of concern about the TCB's capital endowment and/or liquidity position. • There is a medium to high level of concern about the TCB’s booking arrangements. 4 The risks identified pose a high level of risk to the viability of the TCB. • There is a high level of concern about the TCB’s business model and strategy. • There is a high level of concern about the TCB’s governance or control arrangements. • There is a high level of concern about the TCB’s material risks and their management and control. • There is a high level of concern about the TCB’s capital endowment and/or liquidity position. • There is a high level of concern about the TCB’s booking arrangements. 526. Competent authorities may, on the basis of the vulnerabilities and deficiencies identified in the assessment of the SREP elements for TCBs, impose supervisory measures requiring the TCB to: a. hold an amount of capital endowment in excess of the minimum requirements laid down in Article 48e of Directive 2013/36/EU;

177 b. restrict the form of instruments allowed in accordance with the EBA Guidelines on instruments available for third-country branches for unrestricted and immediate use to cover risks or losses in accordance with Article 48e(2)(c) of Directive 2013/36/EU, the instruments from a particular jurisdiction or the instruments denominated in a particular currency; c. introduce operational conditions additional to those in accordance with the EBA Guidelines on instruments available for third-country branches for unrestricted and immediate use to cover risks or losses in accordance with Article 48e(2)(c) of Directive 2013/36/EU; d. meet other specific liquidity requirements in addition to the requirements laid down in Article 48f of Directive 2013/36/EU; e. reinforce their governance, risk management or booking arrangements; f. restrict or limit the scope of their business or of the activities they conduct, as well as the counterparties to those activities; g. reduce the risk inherent in their activities, products and systems, including outsourced activities, and stop engaging in such activities or offering such products; h. comply with additional reporting requirements in accordance with Article 48k(3) or increase the frequency of the regular reporting; i. make public disclosures; j. On a case-by-case basis and having had regard to the criteria in Article 48i(1) of Directive 2013/36/EU, competent authorities may require the TCB to apply for authorisation as a subsidiary in accordance with Title III, Chapter 1 of the Directive. This includes where the competent authority assesses that the TCB is of systemic importance or poses significant financial stability risks in line with Article 48j of Directive 2013/36/EU. 527. For TCBs of systemic importance, competent authorities may also consider: a) Requiring the TCB to structure its assets or activities in such a manner that it ceases to qualify as of systemic importance or that it ceases to pose an undue risk to the financial stability of the Union or the Member State where it is established; b) imposing additional prudential – including governance – requirements on the TCB. 528. Competent authorities should communicate the outcomes of the SREP assessment to the management of the third-country branch and inform them of any action the third-country branch has to take to comply with supervisory measures applied based on the findings. Competent authorities should communicate the outcomes of the SREP assessment including any supervisory measures applied to the authority responsible for the supervision of the head undertaking in accordance with the administrative agreements or other arrangements concluded in accordance with Article 48c(2) of Directive 2013/36/EU.

Annex I – Credit risk sub-categories The table below presents a non-exhaustive list of sub-categories for credit risk that competent authorities should consider when relevant. Credit risk sub￾categories Legal references/Definitions Assessment areas Legal references related to the assessment areas Credit concentration risk The risk that the institution will incur significant credit losses stemming from a concentration of exposures to a small group of borrowers, to a set of borrowers with similar default behaviour or to highly correlated financial assets and concentrated credit risk mitigation • Single-name concentrations (including a client or group of connected clients as defined for large exposures) • Sectoral concentrations • Geographical concentrations • Product concentration • Collateral and guarantees concentration • Hidden sources of concentration that can materialise under stressed conditions, when the level of credit risk correlation can increase compared to normal conditions Regulation (EU) 575/2013: Articles 129, 170, 171, 184, 207, 209, 395, 400-401 Directive 2013/36/EU: Articles 81, 98 Counterparty credit risk The risk that the counterparty to a transaction could default before the final settlement of the transaction’s cash flows • The quality of counterparties and relevant CVAs and the complexity of transactions • The wrong-way risk arising when the exposure to a counterparty is adversely correlated with its credit quality • The exposure to counterparty credit and settlement risks in terms of both current market values and nominal amount, compared to the overall credit exposure and to own funds • The proportion of transactions processed through financial market infrastructures that provide payment versus delivery settlement • The proportion of transactions to central counterparties and the effectiveness of loss protection mechanisms for them • The proportion of transactions to central counterparties established in third countries the effectiveness of loss protection mechanisms for them, and how any excessive exposure to non-EU CCPs is reduced • The proportion of non-centrally cleared OTC transactions and the effectiveness of loss protection mechanisms for them Regulation (EU) 575/2013: Articles 181, 246, Part Three, Title II, Chapter 6 Directive 2013/36/EU: Article 79

179 Credit risk sub￾categories Legal references/Definitions Assessment areas Legal references related to the assessment areas • The existence, significance, effectiveness and enforceability of netting agreements Settlement and delivery risk The risk arising in the case of transactions with debt instruments, equities, foreign currencies and commodities (excluding repurchase transactions and securities or commodities lending and securities or commodities borrowing) remain unsettled after their due delivery date Regulation (EU) 575/2013: Articles 1,92, Part Three, Title V Country risk The risk that the institution will incur credit losses associated to the business carried out in a specific country due to adverse circumstances and/or events, including the impact of geopolitical events, in the specific country • The risk of a deterioration in the quality of an institution’s exposures in a specific country (including collective debtor risk – i.e. the default by a large group of debtors), stemming from threats, occurrences, and the escalation of adverse events associated with wars, terrorism, and tensions among states and political actors affecting international relations • The degree of concentration within all types of exposures to country risk, including sovereign exposures, in proportion to the whole institution’s credit portfolio (per obligor and amount) • The economic strength and stability of the borrower’s country and its track record in terms of punctual payment and occurrence of serious default events • The risk of other forms of sovereign intervention that can materially impair the creditworthiness of borrowers (e.g. deposit freezes, expropriation or punitive taxation) • The transfer risk linked to cross-border foreign currency lending for material cross-border lending and exposures in foreign currencies

180 Credit risk sub￾categories Legal references/Definitions Assessment areas Legal references related to the assessment areas Credit risk from securitisations The risks arising from securitisation transactions in relation to which the credit institutions are investor, originator or sponsor, including reputational risks, such as arise in relation to complex structures or products • The appropriateness of allocation of securitisation exposures to the banking book and trading book and the consistency with the institution’s securitisation strategy • The rating and the performance of the securitisation tranches held by the institution, the nature, composition and quality of the underlying assets • The consistency of the capital relief with the actual risk transfer for originated securitisations • Whether there is a clear distinction between drawn and undrawn amounts for liquidity facilities provided to the securitisation vehicle • The existence of contingency plans for Asset-Backed Commercial Paper conduits managed by the institution in the event that an issuance of commercial paper is not possible because of liquidity conditions, and the impact on the total credit risk exposure of the institution Regulation (EU) 575/2013: Article 67, Part Three, Title II, Chapter 5 Directive 2013/36/EU: Article 82 FX lending risk The additional credit risk arising from FX lending exposures to unhedged retail and SME borrowers • Any non-linear relationship between market risk and credit risk where exchange rates may have a disproportional impact on the credit risk of an institution’s FX loans portfolio such as a material increase in both the outstanding value of debt and the flow of payments to service such debt and an increase in the outstanding value of debt compared to the value of collateral assets denominated in the domestic currency Equity risk in the banking book The risk of loss on financial instruments from changes in equities posted in the banking book • The risk of decline in the value of the institution’s equity investments and ensure that this risk is appropriately captured by the institution’s risk framework • Where relevant, on participation risk in strategic holdings (both insurance and non-insurance) Regulation (EU) 575/2013: Article 133

181 Credit risk sub￾categories Legal references/Definitions Assessment areas Legal references related to the assessment areas Real estate risk The risk of loss due to changes in the market value of real estate own assets or of financial instruments linked to real estate assets • The risk of decline in the value of the institution’s real estate investments • Where relevant, the value of financial instruments linked to real estate assets (e.g. real estate investment trusts, REITs) For immovable properties owned by an institution Regulation (EU) 575/2013: Article 134(1) - SA Article 156 - IRB Dilution risk Article 4 (53) of the CRR • Dilution risk for all credit portfolios for which the IRB approach is not adopted, and for those whose dilution risk is deemed immaterial from a portfolio perspective • How exposures that are immaterial within each portfolio or exposure class are factored in the institution’s aggregate dilution risk assessment • Where relevant, whether the risk assessment of exposures to dilution risk in the acquiring business for merchant payment systems (for example, in the portfolio of contingent liabilities for chargeback positions) is appropriate and based upon a consistent segmentation of the underlying positions in accordance with their key contractual features – i.e. the nature of underlying sales transactions, the timing of processed payments, and the application of standard risk mitigation mechanisms. Model risk (for regulatory approved models) Article 4(1), point (52b) of the CRR • Monitor whether the institution continues to fulfil the minimum requirements and ensure that related own funds requirements are not underestimated • The assessment may be based on the insights gained in other supervisory actions, including those carried out in accordance with Article 101 of Directive 2013/36/EU Directive 2013/36/EU: Article 3

Annex II – Market risk sub-categories The table below presents a non-exhaustive list of sub-categories for market risk that competent authorities should consider when relevant. Market risk sub￾categories (level 1) Legal references/Definitions63 General interest rate risk (trading book) The risk of losses arising from changes in the market value of debt instruments due to a change in the level of interest rates unrelated to any specific attributes of those individual debt instruments. Relevant legal references for capital treatment:

Pre-Fundamental Review of the Trading Book (FRTB) – internal models Regulation (EU) 575/2013, Part Three, Title IV, Chapter 5 – Article 362 Pre-FRTB – Standardised Approach /Post-FRTB – Simplified Standardised Approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 2, Section 2, Subsection 2 – Articles 339-340 (general risk of debt instruments) Post-FRTB – Alternative Standardised Approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 1a, Section 2 – Articles 325d-325k (sensitivity-based method, general interest rate risk) Post-FRTB – Alternative internal model approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 1b – Articles 325az-325bp (expected shortfall /Stress Scenario Risk Measure (SSRM) component) Credit spread risk (trading book) The risk arising from changes in the market value of debt financial instruments due to fluctuations in their credit spread (please refer to ‘Definitions’, Title 1).

• Capital treatment differentiated by type of instrument/portfolio:

1. Credit spread risk of non-securitisations 63 In this table, we refer to ‘Pre-Fundamental Review of the Trading Book (FRTB)’ for the definition and treatment applicable before the FRTB comes into effect. Post-FRTB refers to the definitions and approach applicable once the FRTB comes into effect.

183 Market risk sub￾categories (level 1) Legal references/Definitions63 2) Credit spread risk of securitisations (outside the alternative correlation trading portfolio (ACTP)) 3) Credit spread risk of securitisations included in the ACTP

• Also covers sovereign risk (i.e. risk of losses due to decreasing market values of sovereign exposures) Relevant legal references for capital treatment

Pre-FRTB – internal models Regulation (EU) 575/2013, Part Three, Title IV, Chapter 5 CRR – Article 362 (Value at Risk (VaR) - component; and additional ACTP component (‘comprehensive risk measure’) for positions in the ACTP) Pre-FRTB – Standardised Approach /Post-FRTB - Simplified Standardised Approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 2, Section 2, Subsection 1 – Articles 335-338 (specific risk of debt instruments) Post-FRTB – Alternative Standardised Approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 1a, Section 2 – Articles 325d-325k (sensitivity-based method, credit spread risk (CSR) non-securitisation, CSR securitisation non-ACTP, CSR securitisation-ACTP) Post-FRTB – Alternative internal model approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 1b – Articles 325az-325bp (expected shortfall/SSRM component) Equity risk (trading book) The risk of a change in the market value of an instrument due to a broad equity-market movement or due to factors related to the issuer of the instrument or, in the case of a derivative, the issuer of the underlying instrument. Relevant legal references for capital treatment Pre-FRTB – internal models Regulation (EU) 575/2013, Part Three, Title IV, Chapter 5 – Article 362 CRR Pre-FRTB – Standardised Approach /Post-FRTB – Simplified Standardised Approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 2, Section 3 – Articles 341-344 (general risk of equity instruments + specific risk of equity instruments)

184 Market risk sub￾categories (level 1) Legal references/Definitions63

Post-FRTB – Alternative Standardised Approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 1a, Section 2 – Articles 325d-325k (sensitivity-based method, risk class equity risk) Post-FRTB – Alternative internal model approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 1b – Articles 325az-325bp (expected shortfall/SSRM component) Migration risk The risk of loss on financial instruments due to the deterioration of the creditworthiness of the issuer or of the issuer of reference assets or underlying assets. This excludes default risk. Under FRTB this risk is treated as part of credit spread risk. Relevant legal references for capital treatment Pre-FRTB – internal models Regulation (EU) 575/2013, Part Three, Title IV, Chapter 5, Section 4 – Articles 372-376 Post-FRTB – Alternative Standardised Approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 1a, Section 2 – Articles 325d-325k Post-FRTB – Alternative internal model approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 1b – Articles 325az-325bp Default risk (trading book) The risk of loss on financial instruments due to the default of the issuers of those financial instruments or of the issuers of reference or of underlying assets. Also covers sovereign risk, i.e. risk of losses due to the default of sovereign exposures. Relevant legal references for capital treatment Pre-FRTB – internal models Regulation (EU) 575/2013, Part Three, Title IV, Chapter 5 – Articles 372-376 (‘Incremental default risk charge’-component) Post-FRTB – Alternative Standardised Approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 1a, Section 5 – Articles 325v-325ad

185 Market risk sub￾categories (level 1) Legal references/Definitions63

Post-FRTB – Alternative internal model approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 1b – Articles 325az-325bp (default risk charge) Foreign exchange risk (trading and banking books) Regulation (EU) 575/2013, Article 4(1), point (142) – includes, among others, translation risk and structural foreign exchange risk Relevant legal references for capital treatment I) Exemption for Structural Foreign Exchange positions (S-FX positions)

• Regulation (EU) 575/2013, Article 104c
• Guidelines on S-FX (EBA/2020/09) II) Treatment of positions other than S-FX positions

Pre-FRTB – internal models Regulation (EU) 575/2013, Part Three, Title IV, Chapter 5 – Articles 362-377 Pre-FRTB – Standardised Approach /Post-FRTB – Simplified Standardised Approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 3 – Articles 351-354 Post-FRTB – Alternative Standardised Approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 1a, Section 2 – Articles 325d-325k (sensitivity-based method, risk class foreign exchange risk) Post-FRTB – Alternative internal model approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 1b Articles 325az-325bp (expected shortfall/SSRM component) Commodities risk (trading and banking books) Regulation (EU) 575/2013, Article 4(1), point (143) Relevant legal references for capital treatment Pre-FRTB – internal models Regulation (EU) 575/2013, Part Three, Title IV, Chapter 5 – Articles 362-377

186 Market risk sub￾categories (level 1) Legal references/Definitions63

Pre-FRTB – Standardised Approach /Post-FRTB - Simplified Standardised Approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 4 – Articles 351-354 Post-FRTB – Alternative Standardised Approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 1a, Section 2 – Articles 325d-325k (sensitivity-based method, risk class commodities risk) Post-FRTB – Alternative internal model approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 1b – Articles 325az-325bp (expected shortfall/SSRM component) Credit valuation adjustment risk (trading and banking books) Regulation (EU) 575/2013, Article 381 Valuation risk (trading and non￾trading books) The risk of losses from revisions of or adjustments to the accounting value of fair-valued assets and liabilities (Regulation (EU) 575/2013, Article 105 and Regulation (EU) 2016/101) Market risk sub-categories (level 2) Legal references/Definitions

• Market price uncertainties
• Close-out costs
• Valuation model risks
• Unearned credit spreads
• Investing and funding costs
• Concentrated positions
• Future administrative cost
• Early termination
• Operational (valuation) risks RTS on Prudent Valuation (Regulation (EU) 2016/101)

187 Market risk sub￾categories (level 1) Legal references/Definitions63 Residual risk Regulation (EU) 575/2013, Article 325u and RTS on Residual Risk Add-on (Regulation (EU) 2022/2328) – comprises the broad categories of risks arising from instruments with exotic underlying and residual risk of instruments bearing other residual risks Relevant legal references for capital treatment

Post-FRTB – Alternative Standardised Approach Regulation (EU) 575/2013, Part Three, Title IV, Chapter 1a, Section 4 – Article 325u Market risk: Model risk Regulation (EU) 575/2013, Article 4(1), point (52b) Market risk: Risks by linearity

• Delta risk (risk of changes of the value of a financial instrument due to a change in the value of the risk factor (first order effects))
• Vega risk (risk arising from changes of the volatility of the underlying of a non-linear instrument)
• Curvature risk (including gamma risk) (risks not captured under delta and vega risk, including risk arising from second order effects of changes in the underlying and from other parameters of options) Market risk: Market liquidity and concentration risk The risk that the institution will incur market/liquidity losses stemming from a concentration either from exposures to a single risk factor or from exposures to multiple risk factors that are correlated, or from instruments with high liquidity horizons Market risk: Basis risk Risk of losses due to imperfect correlation in the value change of nominally offsetting instruments

188 Annex III – Operational risk sub-categories The table below presents a non-exhaustive list of sub-categories for operational risk that competent authorities should consider when relevant. Operational risk sub￾categories (level 1) Legal references/Definitions Operational risk sub￾categories (level 2) Legal references/Definitions Legal risk Article 4(1), point (52a) of the CRR Model risk Article 4(1), point (52b) of the CRR ICT risk Article 4(1), point (52c) of the CRR ICT availability and continuity risk The risk that performance and availability of ICT systems, data or services are adversely impacted, including the inability to timely recover the institution’s services, due to a failure of ICT hardware or software components; weaknesses in ICT system management; or any other event ICT security risk (including cyber) The risk that unauthorised access or malicious or intentional acts compromise ICT systems, data or services irrespective of whether they originate from within or outside the institution (e.g. cyber￾attacks) ICT change risk The risk arising from the inability of the institution to manage changes to ICT systems or ICT services in a timely and controlled manner ICT data integrity risk The risk that data stored and processed by ICT systems are incomplete, inaccurate or inconsistent across different ICT systems impairing the soundness or continuity of the institution’s services and activities and potentially resulting in operational, financial, legal, or reputational impact

189 Operational risk sub￾categories (level 1) Legal references/Definitions Operational risk sub￾categories (level 2) Legal references/Definitions ICT third-party risk the risk that may arise for an institution in relation to its use of ICT services provided by ICT third-party service providers or by subcontractors of the latter, including through outsourcing arrangements (Article 3 (18) of DORA), including ICT concentration risk (Article 3 (29) of DORA) on both critical and non-critical ICT third-party services providers Third-party risk (non-ICT) The risk that may arise for a financial entity in relation to the use of function provided by third-party service providers or by subcontractors of the latter, including the provision of a function or the support to a function, including through outsourcing arrangements (upcoming EBA Guidelines on sound management of third-party risk) Credit risk (operational risk events related to credit risk not accounted for in the risk-weighted exposure for credit risk) Article 317 (5) of the CRR Market risk (operational risk events related to market risk) Article 317 (6) of the CRR

Annex IV – IRRBB sub-categories The table below presents a non-exhaustive list of sub-categories for IRRBB that competent authorities should consider when relevant. IRRBB sub￾categories (level 1) Legal references/Definitions IRRBB sub-categories (level 2) Legal references/Definitions Gap risk EBA/GL/2022/14 (paragraph7 ‘Definitions’) Basis risk EBA/GL/2022/14 (paragraph7 ‘Definitions’) Option risk EBA/GL/2022/14 (paragraph7 ‘Definitions’) Automatic option risk EBA/GL/2022/14 (paragraph7 ‘Definitions’) Behavioural option risk EBA/GL/2022/14 (paragraph7 ‘Definitions’)

Annex V – Transfer pricing risk measurement P2R for transfer pricing risk should be determined by summing up the P2R corresponding to the risk linked to each transfer pricing arrangement (TPA) that is based on the transaction profit￾method (TPM) as referred to in paragraph 173 of these Guidelines. Other types of TPA, similarly transferring material losses to the EU entity,should be assessed in a similar way. P2R corresponding to a TPA belonging to the set TPM should be determined as follows: a) The institution should identify the portfolio whose profits and losses are used as a basis to determine the amount to be allocated to the institution in accordance with the TPA. b) On the basis of (i) empirical evidence and (ii) key-metrics included in the pricing arrangement as referred to in paragraph 1743, point (b), of these Guidelines, the institution should determine its marginal contribution ‘m’ to the key metrics used to determine the portion of profits and losses to be allocated across the entities taking part to the TPA. c) The institution should obtain the market risk capital requirements (C_MRPortfolio) relating to the portfolio identified in point (a). d) The P2R for the transfer pricing arrangement is m × C_MRPortfolio. This may be capped by the maximum loss that can be allocated to the institution in accordance with the TPA. An institution may be provided with C_MRPortfolio by an entity established outside of the Union with which there is the TPA. That entity may provide the capital requirements on the basis of the rules for market risk applicable in the jurisdiction where it is established. Where those third country provisions are based on a Pillar 1 capital framework that is not in line with the Pillar 1 market risk capital framework implemented in the EU in accordance with Regulation (EU) 575/2013, competent authorities should increase the requirement by a factor of 1.5. Competent authorities can lower or increase that multiplier to reflect the materiality of the differences in the market risk rules between the EU and the third country. Competent authorities may set the P2R of a transfer pricing arrangement to a lower value than the one obtained in accordance with the first paragraph of this Annex when all the below conditions are met: a. In the context of that TPA, the institution is assessed to hold and manage most of the market risk relating to the portfolio on which the transfer pricing arrangement is based; b. The booking model implies that the institution may allocate its trading book losses to other entities taking part to the transfer pricing arrangement; c. The institution provides sufficient evidence that, in light of its role as main contributor to the TPA in the sense of point (a), the capital requirements for market risk relating to the positions that are subject to the TPA already cover for potential losses resulting from the TPA.

FINAL REPORT ON THE REVISED SREP GUIDELINES 192 5. Accompanying documents 5.1. Cost-benefit analysis/impact assessment Directive (EU) 2024/1619 amending Directive 2013/36/EU entered into force on 9 July 2024, and will become applicable on 11 January 2026, with certain exceptions, in particular with regard to third-country branches. In this context, the EBA has undertaken a third revision of the Supervisory Review and Evaluation Process (SREP) Guidelines (GL) to ensure alignment with the changes introduced by the CRRIII/CRDVI. The revision reflects key considerations including: (i) the application of proportionality as a key driver of the revision to support risk-based supervision; (ii) considerations on operational resilience to enable a holistic assessment of institution’s ability to deliver critical or important functions in the event of disruptions; (iii) the inclusion of ESG risks to enable a more comprehensive and forward-looking supervisory approach; (iv) the treatment of market risk transfer pricing models to ensure that institutions are adequately capitalised for the risks they bear and to establish a level playing field; (v) considerations on the interaction between the revised Pillar 1 framework (including the output floor) and Pillar 2 to avoid double counting and ensure consistency in capital requirements; (vi) the inclusion of provisions for third-country branches to support the assessment of material risks to their operations; (vii) the introduction of a high-level supervisory escalation framework to promptly identify and address deficiencies in institutions; and (viii) the repeal of the stand-alone ICT SREP GL, with ICT risk assessments now integrated into the general SREP GL. The updates aim to incorporate the relevant CRRIII/CRDVI provisions into the existing set of GL, which underpin the day-to-day activities of supervisory authorities and ensure a coherent, risk￾based, and proportionate supervisory framework across the EU. 5.1.1. Policy objectives The focus of the third revision of the SREP GL is on, inter alia, incorporating elements relating to proportionality, operational resilience, ESG risks, market risk transfer pricing models, interaction between Pillar 1 and Pillar 2 frameworks, third-country branches, supervisory effectiveness, and ICT risk assessments. 5.1.2. Baseline scenario The SREP GL were first published in December 2014 and entered into force in January 2016. The first revision took place in 2017, with the updated GL applying from 2019. A second review was carried out in 2021 to align the GL with the regulatory developments since the last revision. This updated version came into force in January 2023. The revision reflected the changes introduced by

FINAL REPORT ON THE REVISED SREP GUIDELINES 193 Regulation (EU) 2019/876 amending the CRR and Directive (EU) 2019/878 amending the CRD, as well as the other relevant EBA GL and technical standards. 5.1.3. Options considered In preparing these revised SREP GL, the EBA considered the following policy options during the drafting process to ensure alignment with the CRRIII/CRDVI provisions. Proportionality One of the key drivers for the revision of the SREP GL was to further clarify and improve the application of proportionality, which is already embedded in the existing SREP GL, in order to better support risk-based supervision. The revision of the proportionality provisions also took into account the recommendations of the peer review on the application of proportionality in the SREP64 and the relevant recommendations of the EBA’s Advisory Committee on Proportionality (ACP). The revision focused primarily on two areas that are central to the application of proportionality in the SREP: the categorisation of institutions (Section 2.1.1) and the supervisory engagement model (Section 2.4). The minimum supervisory engagement model has been revised to allow for a lighter assessment of SREP elements or risk areas that are considered immaterial or unchanged since the last assessment. In addition, competent authorities are given more flexibility in categorising institutions for SREP purposes — in particular for ‘large’ institutions in accordance with Regulation (EU) No 575/2013 that are not G-SIIs, given their high degree of heterogeneity. Flexibility has also been increased with regard to the frequency and granularity of SREP assessments. In this context, two policy options were considered. Option 1: Retaining the minimum frequency for the assessment of all SREP elements for small and non-complex institutions while increasing flexibility with regard to the granularity of the assessment Under this option, competent authorities would retain the current minimum frequency for the assessment of all SREP elements for all categories of institutions, while at the same time being granted greater flexibility in adjusting the level of granularity of the assessment. This approach would allow competent authorities to adjust the scope and depth of the SREP assessment to reflect the institution’s risk profile, the materiality of individual risks and SREP elements, and emerging risks. It allows for a lighter and more targeted assessment of risks that are considered immaterial and supports maintaining previous assessments and scores where no material changes have occurred, based on available supervisory information (e.g. monitoring indicators and reporting). 64 Peer review report on the application of proportionality in the SREP (EBA/REP/2025/02).

FINAL REPORT ON THE REVISED SREP GUIDELINES 194 The additional flexibility offered under Option 1 is considered sufficient to support a risk-based approach without requiring changes to the minimum frequency of assessments under the supervisory engagement model. Option 2: Extending the minimum frequency for the assessment of all SREP elements for small and non-complex institutions while increasing flexibility with regard to the granularity of the assessment In addition to the flexibility regarding the granularity of the assessment described in Option 1, this option provides for an extension of the minimum frequency for the assessment of all SREP elements from three to five years for a subset of Category 4 institutions (i.e. small and non-complex institutions), provided they meet certain criteria: − a stable, low-risk profile; − stable financial metrics and healthy margins; − no concerns based on the quarterly monitoring of key risk indicators. This extension enables competent authorities to use their supervisory resources more efficiently, particularly in jurisdictions with a large number of small and non-complex institutions. The approach includes safeguards to ensure that:

1. the extended frequency applies only to institutions that meet the above criteria;
2. supervisory attention can be intensified if new risks emerge or other indicators change (in addition to the quarterly monitoring of key risk indicators);
3. the minimum level of dialogue with the institution’s management body and senior management is maintained at a risk-based frequency of at least every three years. This approach is consistent with a multi-year SREP strategy, where in-depth assessments of selected risks or risk factors are planned over a longer (multi-year) time horizon. Option 2 is the preferred option as it supports a risk-based supervisory engagement model and enables a more targeted use of supervisory resources, in particular for competent authorities supervising a large number of small and non-complex institutions. Operational resilience Operational resilience has gained international prominence, particularly through the BCBS framework. Although its key components are already reflected in the EU regulatory framework and embedded in the existing SREP GL, it was considered appropriate to specifically introduce the concept of operational resilience. In this context, two policy options were considered. Option 1: Introduction of a stand-alone module on operational resilience in the SREP GL One option is to introduce a dedicated module within the SREP GL that focuses exclusively on operational resilience. This would improve the visibility of the supervisory assessment of an

FINAL REPORT ON THE REVISED SREP GUIDELINES 195 institution’s ability to maintain critical or important functions during disruptions, thereby increasing the attention paid to this area by both the competent authorities and the supervised institutions. However, given the interdependence of operational risk and operational resilience, this approach would require strong interlinkages with existing SREP elements, in particular with the areas of internal governance and operational risk management. This could lead to overlaps in assessments and duplication of work, which would increase the complexity of the SREP and the burden on both the competent authorities and the supervised institutions. Furthermore, this option would not be consistent with the simplification objective of the revised SREP GL or with the objective of more effective and efficient supervision. In addition, the current EU regulatory framework does not necessarily justify expanding the scope and complexity of the SREP solely for the purpose of operational resilience, particularly given the potential regulatory burden on institutions. Option 2: Integrating operational resilience into existing SREP elements Alternatively, operational resilience could be integrated into the existing SREP elements. This approach would incorporate considerations of operational resilience into the assessment of internal governance, operational risk management, and other relevant elements, making operational resilience a regular ‘business-as-usual’ part of the SREP. This option is more closely aligned with the BCBS framework, which recognises that while operational resilience and operational risk management have different objectives, they are closely related and share common principles. Effective operational risk management supports operational resilience, and together they provide a complementary framework towards reducing the frequency and impact of operational risk events, while safeguarding critical operations. Implementing this integration would require supervisors to assess the institution’s ability to deliver critical or important functions even in the event of disruptions, with a focus on the following areas: − internal governance; − operational risk management; − business continuity planning and testing; − mapping of interconnections and interdependencies; − third-party dependency management; − incident management; − ICT, including cyber security. This approach is also consistent with the BCBS’s Core Principles for Effective Banking Supervision, which group operational risk and operational resilience under a single core principle in relation to prudential regulation and institutional requirements. Option 2 is the preferred option.

FINAL REPORT ON THE REVISED SREP GUIDELINES 196 ESG risks The SREP GL that came into force in January 2023 contained first references to ESG risks. However, in line with the requirements of the CRDVI, a more comprehensive approach to dealing with ESG risks is necessary. In this context, two policy options were considered. Option 1: Introduction of a stand-alone module on ESG risks in the SREP GL One option is to create a dedicated module within the SREP GL that deals exclusively with ESG risks. This would improve visibility of the supervisory assessment of ESG risks and allow for the specific characteristics of these risks, such as their forward-looking nature and their potential to materialise over different, including long-term, time horizons, to be adequately captured. However, this approach would require close interlinkages with existing SREP elements, as ESG risks typically materialise through traditional financial risk categories, as clarified in the CRRIII definition. Moreover, ESG risks should not be managed in isolation by institutions, but rather embedded in the institution’s core business strategy, governance arrangements, and risk management framework. The introduction of a stand-alone module could lead to overlaps and duplication of work, which would increase the complexity of the SREP and the burden on both the competent authorities and the supervised institutions. Option 2: Integrating ESG risks into existing SREP elements Alternatively, ESG risks could be integrated into existing SREP elements. This approach would incorporate ESG considerations into the assessment of the business model, internal governance, risks to capital, and risks to liquidity and funding, thereby making ESG risks a regular ‘business-as￾usual’ part of the SREP. This option is more closely aligned with the regulatory definition of ESG risks and their role as drivers of traditional financial risk categories such as credit, market, and operational risks. Implementing this integration would require targeted guidance and capacity building within the competent authorities, which the EBA could support through its supervisory convergence activities. In addition, while ESG risks would be assessed using existing SREP elements, competent authorities could still leverage insights from specific supervisory activities related to ESG risks (e.g. thematic reviews, on-site inspections) to inform their assessment of the relevant SREP elements. Option 2 is the preferred option. Market risk – transfer pricing models Certain transfer pricing arrangements may expose institutions to market risk that is not adequately captured under the Pillar 1 framework. In particular, entities established in the Union that are part of a third-country group may be subject to re-allocated gains or losses from market risk activities

FINAL REPORT ON THE REVISED SREP GUIDELINES 197 conducted and recorded elsewhere in the group. To ensure these institutions are adequately capitalised for this risk, two policy options were considered. Option 1: Introduction of a methodology for the calculation of Pillar 2 requirements One option is to introduce an approach to address the market risk of transfer pricing arrangements based on a transaction profit method, including a formula for determining P2R65 . This option is grounded in the principle of business neutrality: institutions exposed to market risk through the transfer pricing arrangement should be capitalised in the same way as those managing the risks directly. Thereby, the following two scenarios are considered equivalent from a market risk perspective:

1. The institution manages the risk locally within the Union and calculates a Pillar 1 capital requirement.
2. Initially, the institution transfers its market risk through back-to-back positions to a related entity (e.g. sibling or parent) located outside the Union. Subsequently, the institution enters into a transfer pricing arrangement whereby a portion of the economic gains or losses arising from the market risk activities is re-allocated based on pre-agreed metrics (e.g. 10% of the group’s gains/losses will be allocated to the subsidiary established in the Union). In this scenario, the institution does not calculate a Pillar 1 capital requirement for the risk. In the second scenario, there is no Pillar 1 capital requirement because transfer pricing arrangements typically do not qualify as financial instruments under accounting standards. The Pillar 2 approach can mimic the capital charge that would apply under the assumption that the transfer pricing arrangement is considered a financial instrument. The proposed risk measurement approach is not mandatory and competent authorities can apply equally robust, alternative methodologies that meet certain conditions. This ensures flexibility in addressing institution-specific circumstances and allows for proportionality in supervisory responses. Option 2: Do not introduce a methodology in the SREP GL Alternatively, the SREP GL could not provide for a methodology and competent authorities would be able to determine how best to assess and address the risk. This option may result in inconsistent treatment across jurisdictions and could perpetuate regulatory arbitrage, whereby institutions bearing market risk through transfer pricing arrangements are not subject to equivalent capital requirements. Option 1 is the preferred option. It ensures that institutions are adequately capitalised for market risk arising from transfer pricing arrangements, promotes consistency across supervisory practices, 65 According to this method the profits and losses relating to positions owned by several entities are re-distributed across those entities on the basis of the marginal contribution of each entity towards key metrics set out in the pricing arrangement.

FINAL REPORT ON THE REVISED SREP GUIDELINES 198 and establishes a level playing field between institutions directly capitalising their market risk as part of a Pillar 1 capital requirement and those institutions that bear the risk but have no capital against it. Interaction between the revised Pillar 1 framework (including the output floor) and Pillar 2 The implementation of the revised Basel framework in the EU required careful consideration of the possible interactions between the output floor (OF) and the Pillar 2 requirements (P2R). In particular, there was a risk that applying the OF to an institution’s TREA could lead to double counting of risks that had already been addressed by the P2R set by the competent authorities in accordance with the CRD. To avoid this, the EBA was mandated in accordance with Article 104a(7) of Directive 2013/36/EU to issue GL to ensure that the interaction between the OF and the P2R does not lead to overlapping capital requirements. These GL also operationalise the requirement set out in Article 104a(6) of Directive 2013/36/EU. Given the relevance of this issue for the SREP assessment, the forthcoming GL in accordance with Article 104a(7) of Directive 2013/36/EU have been incorporated into the revised SREP GL. Pending the adoption of the revised SREP GL and to promote harmonised supervisory approaches, both proactive and reactive, the EBA has issued an Opinion on the initial entry into force of the OF. In this context, two policy options were considered, which are not mutually exclusive but rather additive, with Option 2 encompassing Option 1. Option 1: Integration of the EBA Opinion on the output floor This option involves incorporating the provisions already set out in the EBA Opinion into the guidelines, with a specific focus on the interaction between OF and P2R. The following guidance would apply:

1. Once an institution becomes first bound by the OF, the applicable P2R percentage – as communicated to the institution following the last SREP cycle – should be applied to the unfloored TREA (so-called ‘temporary cap’). This operationalises the temporary cap in accordance with Article 104a(6)(a), ensuring that P2R is not increased solely because of OF has become binding.
2. When reviewing double counting, competent authorities should consider offsets for P2R add￾ons related to ‘regulatory model deficiencies’, where these exist. The add-on must relate to a model used to determine the TREA, and the offset amount must not exceed the impact of the OF on the TREA.
3. Competent authorities that use methodologies to determine P2R amounts based on a multiplication of the TREA should pay attention to automatic arithmetic increases (i.e. where the P2R nominal amount increase is not due to an increase in risk but results from the P2R being expressed as a percentage of TREA). These authorities are expected to consider how to prevent undue effects when performing the one-off double counting review of the OF.

FINAL REPORT ON THE REVISED SREP GUIDELINES 199 Option 2: Integration of the EBA Opinion on the output floor and more general provision on the interaction between P1R and P2R In addition to the provisions under Option 1 – limited to the interaction between OF and P2R – this approach would involve a more comprehensive assessment by competent authorities of the interactions between P1R and P2R, where a material impact on an institution’s capital profile is expected due to relevant changes to the regulatory framework for determining P1R. The aim is to ensure that P2R continues to cover risks, or elements of risks, that are not covered or not sufficiently covered by the P1R, in line with Article 104a(1)66 of Directive 2013/36/EU. The revised Pillar 1 framework, as set out in the CRRIII/CRDVI, introduces improved and more risk￾sensitive measurement approaches – both standardised and advanced – for determining TREA. Against this background, and taking into account the overarching requirement to avoid double counting between Pillar 1 and Pillar 2 frameworks, the revised guidelines encourage competent authorities, in cases of relevant changes to the regulatory framework for determining P1R, to ensure that P2R prevent overlaps with risks already covered under Pillar 1. In such cases, this may require a redetermination of the quantity or composition of the P2R to ensure that the institution’s overall own funds requirements are in line with Article 104a(1) of Directive 2013/36/EU. Option 2, which also encompasses Option 1, is the preferred option as it provides a broader operationalisation of the requirement in accordance with Article 104a(1) of Directive 2013/36/EU and aims to ensure that the complementary nature between P1R (including the OF) and P2R is maintained. Third-country branches The EBA is mandated with issuing GL to further specify the common procedures and methodologies for the SREP for third-country branches (TCBs) and for the assessment of material risks to their operations in accordance with Article 48n(6)(a) of Directive 2013/36/EU. As part of this process, competent authorities are expected to evaluate whether the arrangements, strategies, processes, and mechanisms implemented by TCBs – along with their capital endowment and liquidity – ensure sound management and coverage of material risks to their operations and viability. This mandate is part of the new prudential framework for TCBs introduced by CRDVI, which provides competent authorities with the necessary tools to monitor the specific risks posed by TCBs operating within the EU. In this context, two policy options were considered. Option 1: Develop stand-alone SREP GL for third-country branches One option is to develop a dedicated set of GL on common procedures and methodologies for the SREP of TCBs. This approach would be consistent with the precedent set for investment firms, for 66 “Competent authorities shall impose the additional own funds requirement […] where […] the institution is exposed to risks or elements of risks that are not covered or not sufficiently covered […] by the own funds requirements set out in Parts Three, Four, and Seven of Regulation (EU) No 575/2013 and in Chapter 2 of Regulation (EU) 2017/2402 of the European Parliament and of the Council.”

FINAL REPORT ON THE REVISED SREP GUIDELINES 200 which separate SREP GL (EBA/GL/2022/09) were developed in accordance with subparagraph 4 of Article 45(2) of Directive (EU) 2019/2034. However, unlike investment firms, TCBs are governed under a dedicated Title (Title VI) within the existing regulatory framework for credit institutions in accordance with Directive 2013/36/EU. Therefore, developing separate SREP GL for TCBs would represent a departure from the Level 1 approach, which integrates TCBs within the broader framework of credit institutions. This option was also considered in light of the European Commission’s initiative to reduce regulatory burdens and simplifying EU legislation. While separate GL could offer clarity, they could also contribute to fragmentation and complexity in the supervisory framework. Option 2: Incorporate SREP GL for third-country branches into the revised SREP GL for credit institutions Alternatively, the SREP GL for TCBs could be incorporated into the revised SREP GL for credit institutions. This approach would combine both mandates, in accordance with Article 48n(6)(a) and Article 107(3) of Directive 2013/36/EU, into a single, coherent set of GL. There are no legal constraints preventing the consolidation of GL from different but related mandates. Given that the section on TCBs is relatively short and concise, this approach would support the overall streamlining of the revised SREP GL. From a timing perspective, the planned publication of the revised SREP GL by the end of June 2026 would allow for timely fulfilment of the mandate by the legal deadline of 10 July 2026. As an alternative option, in the event of delays, the section on TCBs could be carved out and published separately to ensure compliance with the deadline. From a content perspective, consolidating the SREP GL for credit institutions and TCBs in a single document allows competent authorities to use existing methodologies while addressing the specific risks and context of TCBs in a separate section, which is consistent with the integrated approach at Level 1. Option 2 is the preferred option. Supervisory effectiveness Recent episodes of stress in the banking sector have once again highlighted the importance of effective supervisory measures, in particular the ability of competent authorities to promptly identify and address deficiencies in the institutions under their remit, using the most appropriate supervisory tools available. In this context, two policy options were considered. Option 1: Introduction of an escalation framework for supervisory measures in the SREP GL One option is to introduce a dedicated module within the SREP GL that deals explicitly with supervisory measures, with a focus on establishing a high-level escalation framework. This

FINAL REPORT ON THE REVISED SREP GUIDELINES 201 framework would support the competent authorities in selecting the most appropriate measures – both qualitative and quantitative – to address identified deficiencies. The proposed escalation framework would include the following steps: − supervisory dialogue; − communication of expected corrective actions, such as supervisory expectations or recommendations (non-binding measures); − adoption of specific corrective actions to be implemented by the institution (binding measures); − enforcement of supervisory measures, including administrative penalties, sanctions, and other applicable remedial measures. The general objectives of the escalation framework are:

1. to provide practical guidance and support to supervisors, promoting clarity and consistency across competent authorities;
2. to promote the full and effective use of supervisory tools;
3. to improve predictability and transparency for institutions. The framework should be high-level and flexible. Competent authorities may consider additional or alternative measures based on the supervisory powers granted to them under the applicable legal framework. The steps outlined are not intended to be followed in a strict sequential manner and may be escalated or de-escalated as appropriate, while preserving the discretion of the competent authorities. Option 2: Maintain the current SREP GL unchanged Alternatively, the SREP GL could remain unchanged with regard to supervisory measures, meaning that this issue is not addressed. However, given the central importance of supervisory measures for the SREP assessment and the crucial importance of effective supervision for the timely and appropriate resolution of institutional deficiencies, Option 1 is the preferred option. ICT risk assessment The current SREP GL refer to the ICT SREP GL (EBA/GL/2017/05) for assessing ICT risk and complement the assessment of operational risk (Title 6.4), the business model (Title 4), and internal governance and institution-wide controls (Title 5). Although the ICT SREP GL did not introduce a distinct methodology – they largely mirror the assessment of operational risk – they did establish a separate process, which was often interpreted as treating ICT risk separately from operational risk. This approach has led to certain unintended overlaps and complications in the consolidation of supervisory assessments. In particular, the results of the related peer review (EBA/REP/2022/25) highlighted the challenges of integrating ICT risk into the broader operational risk framework, which has led to inconsistencies in supervisory practices.

FINAL REPORT ON THE REVISED SREP GUIDELINES 202 Since their application from 1 January 2018, the ICT SREP GL have supported competent authorities in improving supervisory attention on ICT risks and promoting harmonised supervisory practices. However, with the entry into force of the Digital Operational Resilience Act (DORA) on 17 January 2025, the regulatory landscape has changed significantly as DORA consolidates ICT risk management requirements across the EU financial services framework. Thereby, Directive 2013/36/EU was amended by Directive (EU) 2022/2556 to explicitly address ICT risks and clarify their inclusion in the scope of the SREP, thereby ensuring legal certainty and enabling supervisory authorities to effectively identify and monitor ICT risks. In this context, two policy options were considered. Option 1: Retaining the ICT SREP GL as a separate policy product and adapting it to DORA Under this option, the ICT SREP GL would be revised to take account of DORA but would remain a separate policy product. However, this approach would require a comprehensive revision that would have only limited added value from both a supervisory and institutional perspective. It could also lead to disproportionate emphasis on ICT risks compared to other SREP elements and would not be consistent with the objective of simplifying the SREP and the EU’s broader efforts to reduce regulatory burden and streamlining of policy frameworks. Option 2: Integration of the ICT SREP GL into the general SREP GL and adapting them to DORA Alternatively, the ICT SREP GL could be repealed and integrated into the general SREP GL in a targeted and comprehensive manner. This approach would ensure balanced supervisory attention across all key SREP elements and align ICT risk assessment with the harmonized requirements of DORA. From a regulatory perspective, the revised Regulation (EU) 575/2013 contains a definition of ICT risk that is consistent with DORA. In addition, the updated definition of operational risk (Article 4(1)(52) of Regulation (EU) 575/2013) explicitly includes ICT risk, and the supplementary technical standards on the taxonomy of operational risk (pursuant to Article 317(9) of Regulation (EU) 575/2013) require that operational loss events be attributed, among other things, to ICT risk. This option also reflects the recommendation of the relevant peer review,67 which took place in October 2022, to integrate the ICT SREP GL into the general SREP GL and ensure that ICT risks are appropriately highlighted within the SREP. Option 2 is the preferred option. 67Report on the peer review on ICT risk assessment under the SREP (EBA/REP/2022/25).

FINAL REPORT ON THE REVISED SREP GUIDELINES 203 5.2. Views of the Banking Stakeholder Group (BSG) Overall, the BSG welcomed the revised SREP Guidelines and highlighted the need to strike an appropriate balance between supervisory convergence and the principle of proportionality, stressing that supervisory judgement and flexibility remain essential to address institution‑specific risks and evolving risk profiles. The BSG broadly supported the integration of ESG risks and welcomed the proposed phased approach, advocating for a gradual and proportionate implementation across all ESG dimensions. The BSG welcomed the increased emphasis on proportionality and invited further clarification on how proportionality should apply in practice. The BSG raised comments on the proposed treatment of transfer pricing arrangements in market risk, highlighting the importance of avoiding double counting, ensuring alignment with the actual risk borne by EU entities and preserving flexibility in methodologies. On the interaction between Pillar 1 and Pillar 2 requirements, the BSG welcomed the additional supervisory guidance while expressing diverging views on the extent to which rebasing of P2R and alignment with macroprudential buffers, such as the countercyclical buffer, should be considered. The BSG supported enhanced transparency and communication of SREP outcomes, stressing that disclosure should not undermine supervisory discretion or lead to mechanistic application of the framework. Lastly, the BSG welcomed guidance aimed at strengthening coordination within supervisory colleges and the assessment of cross‑border groups and third‑country branches, while emphasising the need to avoid duplication, unnecessary fragmentation and undue burden at group level, and to preserve the ability of local authorities to address entity‑specific risks.

FINAL REPORT ON THE REVISED SREP GUIDELINES 204 5.3. Feedback on the public consultation and on the opinion of the BSG The EBA publicly consulted on the draft proposal contained in the consultation paper of the draft revised Guidelines on common procedures and methodologies for the SREP and supervisory stress testing. The consultation period lasted for three months and ended on 06 February 2026. Twenty￾five responses were received, of which nineteen were published on the EBA website. This section presents a summary of the key points and other comments arising from the consultation, the analysis and discussion triggered by these comments and the actions taken to address them if deemed necessary. In many cases, several industry bodies made similar comments, or the same body repeated its comments in the response to different questions. In such cases, the comments, and EBA analysis are included in the section of this paper where the EBA considers them most appropriate. Changes to the draft Guidelines have been incorporated as a result of the responses received during the public consultation. Summary of key issues and the EBA’s response Overall, respondents broadly welcomed the revision of the SREP Guidelines and acknowledged the EBA’s efforts to consolidate, modernise and clarify the framework. The objectives of enhanced risk‑based supervision, improved transparency, and better alignment with recent regulatory developments were generally supported. At the same time, respondents noted the need for effective simplification, proportionality application and reduction of supervisory burden. Respondents highlighted the need to avoid duplication and double counting (e.g. between Pillar 1- Pillar 2 requirements, P2G-macroprudential buffers, SREP-DORA risk frameworks). Respondents suggested greater transparency on scoring, methodologies, thresholds, benchmarking practices, peer selection, and the calibration of P2R/P2G, while still preserving supervisory discretion. Proportionality enhancements were welcomed noting for stronger operationalisation, especially for groups, subsidiaries and small, less complex institutions. Respondents broadly supported the integration of DORA/ICT risk, raising caution to avoid overlaps and duplicative supervisory requests, and suggested more clarity on the boundaries between ICT risk, operational risk, digital operational resilience and operational resilience. Moreover, some respondents considered the introduction of operational resilience as a new framework not fully grounded in the current EU legal framework. On ESG risks, respondents generally supported integration into SREP and advocated for a gradual, proportionate and materiality‑based approach, prioritising climate and environmental risks, a more consistent use of concepts and caution against premature capital impacts. The high‑level escalation framework was welcomed in principle with proposals for clear criteria, sequencing and more practical examples. Enhanced communication of SREP outcomes was widely supported, with suggestions for clearer explanations of scores, key risk drivers, and supervisory expectations, while avoiding excessive mechanisation of the SREP process.

FINAL REPORT ON THE REVISED SREP GUIDELINES 205 The EBA has also considered the response received from the Banking Stakeholder Group (BSG), which was analysed and taken into account alongside the other responses to the public consultation.

Summary of responses to the consultation and the EBA’s analysis Comments Summary of responses received EBA analysis Amendments to the proposals Q1. What are the respondents’ views on the overall amendments and clarifications made to the revised guidelines (across Titles 2 – 12)? Clarifications on information and reporting requests between DORA, SREP and other frameworks Respondents proposed to harmonise the information/reporting requests between DORA, SREP and other frameworks/regulations, to add guidance on the articulation/interaction between SREP and DORA assessments (e.g. how remediation timelines will be coordinated) and to ensure that the revised SREP GL will not impose any new or additional information requirements beyond those included in the existing or upcoming EBA GL. It is clarified that the SREP GL, consistent with their principle-based nature, do not require institutions to produce separate or additional information/reporting where existing governance arrangements already demonstrate compliance. Furthermore, it is highlighted that the SREP GL state the view on all the SREP elements to be based on information gathered through the full range of supervisory activities in line with Title 2, paragraph44. Explanatory text has been added in the ‘Background’ section along with amendment in paragraph 121. Risk sub￾categories (annex) A respondent noted the draft taxonomy is partial and, on some elements, it uses a regulatory approach. It was proposed to adjust it to be more economic and, if possible consistent with that of the ECB. It is clarified that institutions are expected to maintain their own risk taxonomies for risk management purposes as the risk sub￾categorisations set out in the Annex are intended to be used as guidance for the competent authorities and to further promote consistent risk identification across authorities, while remaining non-exhaustive and flexible. No change

207 Level of detail, cross-references and layered requirements Several respondents indicated that further simplification and reduction of complexity is needed in the SREP Guidelines, noting that despite consolidation efforts the framework remains detailed and resource intensive. Respondents suggested reducing regulatory layers, eliminating parallel requirements and cross￾references, and focusing more strongly on risk-based supervision rather than process-heavy documentation requirements. Respective comments were made to the individual Titles hence respective responses/analysis are provided separately in the below questions. The use of cross-references should not form an impediment to the proportionate approach to be applied throughout the SREP assessment focusing on the risks and sub-categories of risk insofar as they are material for the institution. It is also clarified that SREP is considered an ongoing process that integrates the outcome of all the supervisory activities and all available sources of information into a comprehensive supervisory overview of an institution (please refer to paragraph13). Targeted clarifications (please see comments further down) References to regulatory products In this context of simplification, a respondent proposed to reduce or remove the references to relevant regulatory products at the beginning of each Title as this renders the use of SREP GL a complex issue for practitioners. Moreover, a respondent suggested to remove references to products addressed to competent authorities (e.g. EBA GL on ICAAP and ILAAP information) as institutions are not obliged to comply with them. The removal of outdated provisions or assessments already set out in other relevant regulatory products was partially facilitated through the list of relevant regulatory products at the beginning of each Title. To further facilitate transparency, the references to applicable EU legal and regulatory requirements will be published as a separate list on the EBA website. Moreover, the removal of references to regulatory products addressed to competent authorities could undermine the very purpose of the SREP GL as a supervisory tool. Removal of related tables and development of a separate list of legal acts facilitating SREP assessments to be published on the EBA website. Interaction with other regulatory Respondents noted the draft revised SREP GL interacted with other EBA GL which were going through parallel consultation (e.g. EBA Internal The EBA acknowledges the interaction of the revised SREP GL with other upcoming EBA GL, which were also going through public Legal acts facilitating SREP assessments to be

208 products and timeline Governance GL), hence it was challenging to provide comments on certain aspects. Respondents suggested to ensure alignment of content and implementation deadlines, allowing for a sufficient implementation period before being considered in the SREP assessment. A respondent suggested that any reference to non-final provisions (e.g. mapping of duties, individual statements) should remain limited, high-level and principle based. Respondents suggested clarifying the scope and limits of early implementation before the official application date of January 2027, noting that unclear timing could create legal uncertainty for institutions. A respondent proposed to encourage competent authorities to start the reassessment for the possible redetermination of P2R at an earlier stage, where possible. consultation. It is clarified that the revised SREP GL aim to be future-proof and fully aligned with the final adopted text of regulatory products, including EBA GL. This is ensured via direct references to applicable EU legislation and adopted regulatory products. published as a separate list on the EBA website. Investment firms under scope Respondents requested to ensure consistency on the distinction between credit institutions and investment firms, with one respondent pointing out that the Guidelines clearly distinguish credit institutions and Class 1 investment firms from Class 2 and Class 3 investment firms, inviting the EBA to review the scope of other related prudential frameworks – for example the scope of the BRRD – to ensure consistency. All institutions and investment firms that are subject to the CRD-CRR requirements are in scope of the SREP GL under the CRD-CRR, and the investment firms that are subject to IFD-IFR requirements are in scope of the SREP GL for investment firms. The same logic is applied in the Level 2 and Level 3 work under the CRD-CRR and under IFD-IFR. The BRRD framework is outside of the scope of these SREP GL. No change AML/CFT aspects Respondents requested to future proof references to the new EU AML package and AMLA supervision, with one respondent suggesting to already align the SREP GL (applicable as of 1 Jan 2027) with the new EU AML package including AMLD6 (coming into force by and It is clarified that references to Directive (EU) 2015/849 will be automatically repealed and construed as references to the new AML framework once Article 77 of Directive (EU) 2024/1640 (AMLD6) enters into force. This will Additional clarity in the ‘Background’ and the definitions, along with the addition of

209 large as of 10 July 2027), and direct supervision by AMLA of selected obliged entities as of 2028. Some respondents suggested to ensure close alignment with AMLA on common understanding what to consider as material finding/shortcoming and align definitions of AML/CFT supervisors and ML/TF risk to the new EU AML package. Few respondents noted the need of close coordination between supervisory authorities and AML/CFT authorities for cross-cutting deficiencies to avoid conflicting or duplicative supervisory measures. Moreover, a respondent suggested to add in paragraph105 that close coordination between supervisory and AML/CFT authorities should also cover potential measures to avoid duplicative or conflicting measures. ensure full alignment with the new AML package as well as the definition of ‘AML/CFT supervisors’ (Article 2(45) of Regulation (EU) 2024/1624) which also includes AMLA. Moreover, to ensure better alignment with the new AML package, references to the ‘risks of non-implementation and evasion of targeted financial sanctions’ has been incorporated in the SREP GL, noting the transitional application of the related references from 10 July 2027 onwards. Section 9.8 of the draft revised SREP GL already promotes cooperation with AML/CFT supervisors, in particular when applying supervisory measures. The EBA takes note of the comment as it informs the ongoing implementation of the recommendations in the EBA TFE report, in particular the setup of supervisory platforms that bring together authorities from different horizons in pilot cases for specific institutions (recommendation 14). transitional provision for aspects becoming applicable with the new AMLD6/AMLR. Quality assurance Consistency in the application of supervisory judgement across banks (within the same authority)/quality assurance. At the roundtable discussion, participants suggested to add quality assurance aspects to the revised SREP GL to ensure consistency in the application of supervisory judgment within the same authority. A respondent proposed adding further clarity on expectations for consistency The EBA notes that quality assurance processes and internal consistency mechanisms fall within the organisational and governance arrangements of competent authorities. The revised SREP Guidelines are considered to provide sufficient clarity on supervisory expectations, while allowing competent authorities the necessary flexibility to apply supervisory judgement in a proportionate Paragraph 40 has been expanded to strengthen quality assurance and supervisory consistency.

210 and transparency across competent authorities and supervisory teams. manner. Additional clarification has been added in section 2.3 to further encourage adequate internal quality assurance arrangements and to enhance supervisory effectiveness. Comparisons with non-EU peers and non-EU regulatory developments as input to SREP Suggestion to add peer comparisons with non-EU peers and non-EU regulatory developments as input to SREP – one respondent suggested to requiring CAs to take into account for the SREP and adding to paragraph 13: (i) peer comparisons, including third￾country groups active in the EU/EEA and relevant peers in countries outside the EU/EEA where the supervised institution operates and (ii) regulatory developments, including in countries outside the EU/EEA, to ensure a level playing field with cross￾border groups. The SREP GL already requires competent authorities to consider the broader context in which institutions operate, including their international activities and group structures, and the principle-based nature of paragraph 13 aims to preserve supervisory judgment on which inputs are material for a given institution. Making peer comparisons with non-EU peers and non-EU regulatory developments a mandatory SREP input would risk imposing a disproportionate and operationally burdensome obligation on competent authorities, particularly for institutions with limited cross-border exposure where such comparisons would add little supervisory value. No change Ad-hoc reporting A respondent raised concerns about the potential use of ad-hoc reporting agreed bilaterally with institutions, noting that such practices may introduce subjectivity and suggested that benchmarking-related reporting should be standardised across peer groups. It was further suggested to refrain from ad-hoc reporting agreed bilaterally with institutions from paragraph 124. The EBA acknowledges the concern raised by the respondent regarding the potential subjectivity associated with ad-hoc reporting agreed bilaterally with institutions. In this respect, competent authorities are expected to make use of existing regulatory and supervisory reporting frameworks to the maximum extent possible. At the same time, the SREP framework needs to retain a degree of supervisory flexibility to allow competent authorities to request additional information where necessary to support risk Paragraph 121 has been amended to prioritise the use of regular and readily available information sources, having regard to the objective of minimising the reporting burden on

211 assessments or benchmarking analyses that cannot be adequately performed using existing data sources. Such requests are expected to remain limited and proportionate and should be justified by the specific supervisory need. Wording has been adjusted in this regard. institutions and avoiding unnecessary or duplicative data requests. List of supervisory measures A respondent suggested the review of the supervisory measures listed in the respective tables across the SREP Titles and replace them with more general references to the supervisory powers in accordance with Article 104 of the CRD as some interfere with the institutions’ business and risk policy decisions. It is noted that the consideration on any necessary supervisory measures to address concerns emerged by the SREP has been moved from Title 10 of the previous SREP GL to the specific assessment areas (in the form of a table) to directly link them with the relevant assessment areas. This aims to enhance the relevance of supervisory measures and hence supervisory effectiveness. No change Q2. What are the respondents’ views on the integration of ESG risks and factors across the existing SREP elements in the revised guidelines? ESG risks as drivers within existing SREP elements Broad support for integrating ESG risks as drivers within existing SREP elements rather than creating a standalone ESG element or module, with respondents agreeing this approach is aligned with CRR/CRD, EBA GL and risk-based supervision, and helps avoid redundancy and over complexity. The EBA acknowledges the support for the proposed approach. ESG risks are embedded as drivers of traditional risk types and existing SREP elements where relevant in the final GL. No change

212 Terminology Terminology flagged as problematic, with respondents noting interchangeable use of ‘ESG’, ‘environmental’, ‘climate and environmental’ ‘risks’ or ‘factors’. A gradual, sequenced approach is supported by banking sector respondents, prioritising climate risk first, followed by other environmental risks, and only later social and governance risks, reflecting differences in data availability and methodological maturity. Several respondents request to explicitly and consistently embed this sequencing in the final Guidelines and not only in the background. They also suggest that the guidelines should concentrate on C&E ‘risks’ rather than ‘factors’. On the other hand, other respondents consider that the GL should include explicit expectations for supervisors on nature-related risks, recognising the potential significant impacts of these risks on financial institutions’ portfolios and leveraging the work already undertaken in international fora (e.g. NGFS, TNFD). The EBA has taken into account that the CRD provisions refer to ESG risks, e.g. Article 98(9) on the incorporation of ESG into the SREP. On the other hand, the EBA recognises that supervisors have so far mostly focused on climate-related risks and a sequential approach giving priority to environmental risks is recognised both by recital 40 of the CRDVI and various EBA Guidelines (GL on the management of ESG risks, GL on environmental scenario analysis, Joint GL on ESG stress testing). The EBA has reviewed and harmonised terminology across the SREP GL while remaining aligned with the CRD (i.e. the GL refer to ESG risks but highlight more consistently that priority should be given to environmental risks). To reflect the specific focus of paragraph 69 (medium- to long-term resilience) and ensure consistency with EBA GL on environmental scenario analysis, this paragraph only refers to environmental risks. To allow for further developments on environmental risks beyond climate, referring to ‘environmental risks’ is more appropriate than a restricted focus on ‘climate-related risks’ only. The CRR definition of environmental risks captures both climate and other environmental risks. The GL still recognise in the background the greater capacity to quantify climate-related risks at this point. Wording amended and aligned throughout the GL.

213 Finally, while most provisions refer to ‘risks’ rather than ‘factors’, the term ‘ESG factors’ is still used in specific paragraphs when it better fits the context and/or to ensure alignment with the CRD text. Proportionality, materiality and feasibility challenges Some respondents stress proportionality, materiality and feasibility challenges, highlighting that ESG integration should only affect scores and capital where there is clear evidence of material financial risk, and should not lead to disproportionate capital add-ons, especially given recent regulatory developments, persistent data gaps and methodological immaturity. In this respect, it should be clarified that only material ESG risks are concerned throughout the guidelines and particularly when referring to potential supervisory measures. Proportionality and materiality principles are key overarching, cross cutting principles in the SREP GL and they apply to the treatment of ESG risks. The GL expect CAs to take into account ESG risks as well as a range of other considerations when assigning a score e.g. in BMA, internal governance, and risks to capital elements. Where deficiencies relating to the management of ESG risks are identified that could pose material risks to the institution’s solvability, CAs may take supervisory measures with due consideration to the escalation framework and ensure respective communication. Clarification in the ‘Background’ section. Strengthening the treatment of climate and environmental risks in SREP Some respondents call for a more precautionary and forward-looking supervisory approach, urging stronger recognition of uncertainty, tail risks and tipping points associated with climate and environmental risks. These specific characteristics, if unaccounted, can significantly distort the results of supervisory assessments. The SREP GL should also mandate systematic assessment of transition plan robustness The SREP GL explicitly require CAs to include in the scope of their analysis the institutions’ plans to address ESG risks to be developed in accordance with the CRD, with specific reference to these plans included in sections relating to elements 1 and 2. Regarding supervisory measures, the GL provide that institutions’ exposure to and management of ESG risks No change on transition plan, supervisory measures and fossil fuels. The background of the GL further

214 and promote readiness to use Pillar 2 measures where ESG risks are mismanaged. In addition, the GL should explicitly require supervisors to consider fossil fuel exposures as part of assets and activities subject to elevated risk, as these exposures – especially when financing new fossil fuel developments –- are inherently misaligned with climate objectives or associated with high and difficult-to-mitigate transition risks, while at the same contributing to increased system-wide physical risks. should be taken into account when assigning scores and deciding on potential supervisory measures. With regard to fossil fuel exposures, a specific and systematic focus on those exposures would not be consistent with the general and high-level nature of the SREP GL, which should remain relevant to all types of institutions with different business models and/or portfolios, along with supervisory judgement. However, the EBA is updating its Pillar 3 disclosure and supervisory reporting technical standards to facilitate information gathering on institutions’ exposure to fossil fuel sector entities, which would allow CAs to consider this information in their assessment where relevant. clarifies the need to take into account the specific characteristics of environmental risks, whilst keeping in mind methodological challenges especially when considering long￾term horizons. Time horizons for assessing climate and environmental risks Some respondents raise concerns on time horizons highlighting the tension between long term ESG horizons (10+ years) and shorter prudential planning cycles, calling for clearer guidance on how uncertainty should be treated and avoided in capital determinations. On the other hand, other respondents consider that expectations on time horizons remain insufficient to fully capture climate- and nature￾related risks, especially those that are more likely to materialise over longer timeframes, and they suggest articulating expectations more consistently across the guidelines by extending the long-term perspective to ESG risks can materialise across different time horizons. The need for a forward-looking approach is recognised in the GL and has been further emphasized in the background. While challenges related to longer time horizons are acknowledged, it remains relevant for the competent authorities to review how institutions ensure long-term resilience to ESG risks in particular as part of the BMA, including by considering transition planning developments and assessing environmental business model resilience analyses performed by institutions. New paragraph 43 in the ‘Background’ section and greater recognition of uncertainties associated with long-term projections in paragraph 146.

215 20 or 30 years or until 2050, aligning with the Paris Agreement. Finally, other respondents suggested defining time horizons for ESG assessment in the BMA (paragraph 58) in the following manner: less than two years for short-term, two to five years for medium￾term, and more than five years for long-term. For this, the BMA section includes a reference to a long-term time horizon of at least 10 years, which is aligned with the CRD Article 87a(2) and other EBA Guidelines. The consideration given to medium- and long-term horizons specifically in the BMA section, along with the stronger recognition of uncertainties associated with long-term projections and the clarification that any supervisory measure should address ESG risks that could pose material risks to the institution’s solvability., overall provides appropriate guidance for the treatment of ESG risks and time horizons. Concerns about supervisory expectations regarding prudential transition plans Some respondents consider that given the nascent nature of prudential transition plans (PTPs) and the fact that supervisory practices around their review are still evolving, requiring institutions to adjust their strategies based on an assessment of an institution’s PTP appears premature (paragraph 71.h). Such an approach could have significant negative impacts on institutions’ abilities to set their own strategies and could undermine the quality and credibility of both strategies and transition planning. They therefore recommend at a minimum amending paragraph 71.h to frame the envisaged supervisory measure in a broader, principles-based manner. It is acknowledged that the supervision of institutions’ plans to address ESG risks will be an iterative process. However on this point, the GL reflect Article 104(1)(m) of the CRD (‘competent authorities shall have at least the power to (…) require institutions to reduce the risks arising in the short, medium and long term from ESG factors, including those arising from the process of adjustment and from transition trends in the context of the relevant Union, Member States or third-country legal and regulatory objectives, through adjustments to their business strategies, governance and risk management for which a reinforcement of the targets, measures, Reference to this potential supervisory measure kept in table 3 with wording adjustments to more closely align with the CRD provision.

216 and actions included in their plans to be prepared in accordance with Article 76(2) could be requested’). Role of portfolio alignment in supervisory assessment of transition plans Respondents express different views on transition planning and the role of portfolio alignment methodologies and/or criteria. On the one hand, some respondents flag that there is a clear delineation in both the level one legislation and the underlying EBA GL between the plan required in accordance with CRD Article 76(2), and broader transition plans. They request clarity in the SREP Guidelines that the plans mandated by CRD do not require the institution to be aligned to either Union or Member State transition objectives or trajectories, to avoid the supervision leading to divergence between Members States/CAs. On the other hand, other respondents consider that the SREP GL should require a systematic assessment of alignment of the institution’s plan with climate objectives, i.e. degree of alignment of the entity's plan with international climate goals and its own climate commitments, and they should refer more clearly to the risks of misalignment. The focus of the SREP GL is on the assessment of the plan to be prepared by institutions in accordance with Article 76(2) of the CRD. The EBA guidelines do not require the CRD-based plans to set out an objective of fully aligning with Member States or Union sustainability objectives or one specific transition trajectory. At the same time, it must be noted that plans developed by institutions to monitor and address ESG risks in accordance with the CRD also need to consider and ensure consistency with institutions’ voluntary commitments, broader business strategy, and other requirements stemming from non-prudential regulations. In addition, while institutions remain responsible for setting their business strategy, institutions need to assess financial risks stemming from misalignments of their portfolios with relevant EU regulatory objectives, in particular climate-related objectives. Wording adjustment in paragraph 68a to clarify that the focus is on assessing the institution’s plan to address ESG risks, including risks from misaligned portfolios with specific reference to climate objectives (as in the CRD). Credit risk assessment scope Respondents highlighted that the proposed expansion of the scope of the assessment of credit risk, which The inclusion of ESG risks in the guidelines follows a proportionate and gradual approach, No change

217 and uncertainty in estimates now also includes ESG factors, leads to a considerable level of detail, which should be reviewed critically. This expansion is seen as leading to a focus on documentation requirements, which would dilute the principle of risk-based supervision. Some respondents highlighted that assessing the medium- and long-term impacts of ESG factors on the inherent credit risk (§149) is still particularly difficult. One respondent suggested that the current paragraph 149 should explicitly acknowledge the radical uncertainty surrounding ESG factors, which makes them particularly difficult to model, especially in the area of credit risk. Competent authorities should therefore ensure that banks have applied conservative estimates in order to mitigate the impact of such uncertainty in their modelling. One respondent suggested explicitly reflecting ESG risk considerations not only in the assessment of inherent credit risk, but also in the assessment of the credit risk management and control framework, as the current wording could otherwise result in a lower degree of supervisory attention being paid to ESG risk management, including risk-mitigating actions. taking into account the ongoing consolidation of supervisory practices in this area. As a result, only targeted references to ESG risks have been included in the credit risk section, without introducing a significant level of additional detail and focusing on the most relevant aspects of environment-related credit risk. As mentioned above, the specific characteristics of environmental risks including time horizons and uncertainties have been further emphasized in the ‘Background’ section and in the credit risk section, paragraph 146, while still noting the need for CAs to build capacity and improve assessment methods over time. Table 6 ‘Supervisory considerations for assigning a credit and counterparty risk score’ includes ESG risks among the considerations in relation to adequate management and controls. New paragraph 43 in the background section and adjustment of paragraph 146. No change

218 Clarification of supervisory expectations for ESG risks in SREP Some respondents request further guidance to ensure consistent and actionable supervisory outcomes relating to ESG risks, noting that the SREP GL remain sometimes vague and high-level. They encourage the EBA to further clarify aspects such as proportionality and/or materiality thresholds and triggers, minimum expectations for ESG-related governance and internal controls, and the way ESG-related forward-looking considerations should be used. They also recommend explicit guidance on how supervisors should address information gaps and expectations for remediation plans where ESG-related risk identification is incomplete. One respondent also suggested including additional details in the guidelines concerning the weight of ESG factors in the overall BMA. The SREP GL provide a high-level framework for competent authorities and now include further guidance for the treatment of ESG risks while still achieving an overall simplification. While it is recognised that the GL do not provide detailed operational guidance, the EBA is in parallel actively engaging with supervisors and providing tools to support a consistent implementation of the ESG-related aspects of the SREP GL. It is also reminded that some principles in the GL are applicable across the board i.e. including to the treatment of ESG risks, such as proportionality and categorization of institutions, and that the expectations for institutions are not set out in the SREP GL but in other GL (EBA GL on ESG risks management, EBA GL on environmental scenario analysis, EBA GL on internal governance, EBA GL on loan origination and monitoring). Finally, the SREP GL do not aim at providing any specific weight for any SREP elements or sub-elements as the overarching objective is not to mechanistically produce SREP scores combining different SREP elements and sub-elements but, instead, to provide a common and holistic assessment framework to be taken into account by competent authorities when performing the SREP. No change

219 Consistency between ESG risk assessment, ICAAP and stress testing Some respondents highlight the need for consistency with ICAAP and stress testing, avoiding double counting. Where ESG drivers are captured via internal and supervisory stress tests and through the ICAAP and ILAAP, the Guidelines should clarify how outcomes feed into P2R/P2G in a coherent manner, so that the same underlying ESG-related risk is not counted multiple times (e.g. via business model, governance findings, risk-specific add-ons and stress testing simultaneously). Title 7 (SREP capital assessment) and Title 9 (Overall SREP assessment) of the GL explain how competent authorities should determine P2R and P2G and how the findings from the assessment of each SREP element are combined into the overall SREP assessment, respectively, including with a view to avoid double counting of the same risks. This guidance applies to the treatment of ESG risks. No change Fragmented international landscape Some respondents warn that due to the current fragmented international landscape, it is important to allow certain requirements to be applied in a way that permits the banking groups to comply with local laws and regulations in line with the objectives of such local jurisdictions. The SREP GL are addressed to competent authorities and do not introduce new requirements for institutions. Competent authorities shall apply the review and evaluation process in accordance with the level of application of the requirements of Regulation (EU) No 575/2013 set out in Part One, Title II of that Regulation. The supervision of institutions’ plans to address ESG risks should take into account how the institution manages risks stemming from the transition toward regulatory objectives, in particular climate-related objectives, applicable in the jurisdiction(s) where the institution operates. No change

220 Regulatory simplification and alignment with legislative developments Some respondents advocate for reviewing banking regulation to reflect the changes being made via the recently agreed Omnibus I, by changing level 1 texts and reviewing supervisory expectations and EBA guidelines with a view to streamlining and simplification. Regardless of the legislative processes that this might entail, the need to simplify and streamline the regulatory burden for European banks should be considered in the context of supervisors applying the SREP GL. Also, it is important that the EU remains broadly aligned with global prudential standards and avoids gold-plating. The SREP GL address the CRD mandate given to the EBA and reflect the new regulatory requirements for the prudential supervision of ESG risks. They do so in a proportionate and efficient manner, by embedding ESG risks where relevant without changing the SREP structure, and through concise, targeted amendments. Hence the treatment of ESG risks in the SREP GL is consistent with the broader EBA efforts and objectives for achieving simplification and efficiency in the regulatory framework. Regarding international prudential standards, the review of the SREP GL takes into account the BCBS Core Principles for effective banking supervision which expect supervisors to consider climate-related financial risks in their supervision, in a flexible manner. No change Q3. What are the respondents’ views on the enhanced simplification and proportionality aspects?

221 Proportionality clarifications Many respondents stated that proportionality is not sufficiently operationalised beyond reduced assessment frequency and lacks concrete guidance. Respondents proposed to clarify how proportionality should apply to the scope, level of detail, documentation, information requests and continuous supervision, including how it should work in groups with different risk profiles across subsidiaries and parent entities. Respondents stated that the administrative burden remains high also for small, low-risk and non-complex institutions due to extensive requirements and new regulatory layers. The provision on the adaptation of focus and granularity of assessments to reflect the risk profile of the institution, the materiality of the risks, trends and risks emerging, stress testing or outcome of previous SREP assessments applies throughout the SREP GL providing flexibility in the application of proportionality to take into account differences in business models and risk profiles. The comments will inform the implementation of the recommendations in the EBA Report on the efficiency of the regulatory and supervisory framework (EBA/REP/2025/26), in particular on the consideration for a more systematic application of simpler requirements for the SNCI category, while preserving a single-bank regime and examining the potential expansion of the category, and the reduction of the reporting burden. No change Lighter SREP assessment Respondents suggested to further clarify how the following will be applied in practice: ‘The minimum supervisory engagement model has been revised to allow for a lighter assessment of SREP elements or risk areas that are considered immaterial or unchanged since the last assessment.’ The aim is to support competent authorities to adapt their supervisory activities to the specific level of risk in the institution supporting the risk￾based approach and allowing for an efficient use of supervisory resources. The comments will inform the implementation of the recommendations in the EBA Report on the efficiency of the regulatory and supervisory framework (EBA/REP/2025/26), in particular on No change

222 the consideration for a more systematic application of simpler requirements for the SNCI category. Poor SREP score One responded suggested to clarify what is considered a poor overall SREP score in paragraph 45. A SREP score is considered to be poor when it reflects severe supervisory concerns. Wording adjustment in paragraph 45. Prior impact assessment of the Supervisory Examination Programmes Several respondents suggested a prior impact assessment of the feasibility of the annual Supervisory Examination Programme for both supervised entities and competent authorities to allow orderly execution of activities, and ease accurate supervisory conclusions. The comment will inform the ongoing implementation of the recommendations in the EBA Report on the efficiency of the regulatory and supervisory framework (EBA/REP/2025/26), in particular the set-up of supervisory platforms that bring together authorities from different horizons in pilot cases for specific institutions (recommendation 14). No change Minimum frequency for assessing all SREP elements for smallest Category 4 institutions A few respondents asked to reword paragraph 12 of the background section to read that ‘for a subset of the smallest Category 4 institutions, the minimum frequency for assessing all SREP elements should be extended from three to five years, provided they maintain a stable low-risk profile, sound financial metrics and healthy margins, and quarterly monitoring does not raise material concerns.’ The wording in paragraph 12 of the background section has been aligned to the one used in paragraph 46 of Title 2 as follows: ‘The revised SREP GL provide for an extension of the minimum frequency for the assessment of all SREP elements from three to five years for a subset of Category 4 institutions, provided they maintain a stable low-risk profile, sound financial metrics and healthy margins, and quarterly monitoring does not raise material concerns.’ Wording adjustment in paragraph 12 of the background section.

223 Issues with continuous supervision Several respondents suggested for the SREP GL to address issues related to continuous supervision, such as reducing the operative burden related to the intense scrutiny on internal models, as well as the related portfolios. The revised SREP GL support a risk-based and proportionate supervisory approach noting at the same time that decisions on materiality of risks depend on the supervisory judgement. No change Reference to the CRD Article 97(4) One respondent asked to clarify how the provision of Article 97(4) of Directive 2013/36/EU would be implemented in the SREP GL. As laid out in paragraph 14 of Title 2, Article 97(4) of Directive 2013/36/EU should be taken into account by competent authorities when categorising institutions under their supervisory remit into the four categories driving the application of proportionality in the SREP, also considering the size, systemic importance, nature, scale and complexity of their activities. No change Increased transparency on categorisation of institutions Several respondents asked for competent authorities to inform banks of their SREP categorisation to ensure transparency, convergence and predictability on the (minimum) supervisory engagement, and to further clarify the criteria and methodological considerations for determining the SREP categorisation. The current criteria and methodological considerations for determining the SREP categorisation are deemed sufficiently clear, and competent authorities have discretion over the transparency of the categorisation towards institutions, also retaining the ability to adapt the intensity of the supervisory engagement to evolving/emerging risks. No change Increased clarity and transparency on (periodic/ad hoc) re￾categorisation of institutions One respondent suggested providing an expected timeline for category reassessment and further clarifying how supervisors’ review of the category assignments over time may be driven by specific factors, and how institutions will be informed about potential changes. The current provisions on the periodic and ad hoc re-categorisation of institutions are deemed sufficiently clear, and competent authorities have the discretion over how to inform institutions about potential changes. No change

224 Reliance on prior assessment A few respondents asked if competent authorities can rely on a previous assessment of a risk area for any category of institution where there is clear evidence that the risk profile has not materially changed? Competent authorities can rely on a previous assessment of a risk area if nothing has materially changed in accordance with the available information for any category of institution. The wording in paragraph 46 has been adjusted to clarify the reliance on previous assessments can be done ‘regardless of the SREP categorisation’. Wording adjustment in paragraph 46. Q4. What are the respondents’ views on the introduction of a high-level escalation framework? Clear criteria or examples for transitioning between escalation stages, underlying drivers and acknowledgement of institutions’ history of remediation Respondents proposed to consider clear criteria, or illustrative examples and references to qualitative considerations, for transitioning between escalation stages to anticipate supervisory expectations. Furthermore, it was proposed to clarify within the SREP GL the underlying drivers determining the supervisors’ decision (interaction between actions in paragraph21 and considerations in paragraph22) and acknowledge the institutions’ history of remediation when evaluating the necessity for escalation. Further proposals to clarify that the order of the measures should be specifically explained and justified to the respective institution. The revised SREP GL introduces this high-level and flexible escalation framework for supervisory measures drawing on past supervisory and relevant experiences, lessons learned, and with a view to strengthening supervisory effectiveness and establishing a high-level common framework across the EU. The principle-based escalation framework intends to guide competent authorities in selecting measures proportionate to the nature, severity and persistence of identified deficiencies, while preserving the necessary flexibility to address institution-specific circumstances. Moreover, paragraph22 already envisages the identification of the full escalation path when selecting supervisory actions, taking into account the information available and the Paragraph 20 has been amended to strengthen supervisory effectiveness. More structured, transparent and predictable use of Few respondents encouraged a more structured, transparent and predictable use of supervisory measures, including a clearer articulation of escalation mechanisms and their role within the overall SREP

225 supervisory measures framework. It was further proposed to add more clarity on the alignment of this escalation framework with existing governance and remediation practices. nature, size and complexity of the institution, as well as the severity of the deficiencies. Centralisation of supervisory activities and escalation information at colleges Respondents mentioned cases where different teams within the same authority (e.g. supervisory teams, on￾site inspections, horizontal teams) investigate the same or overlapping topics, hence the need to ensure that decisions regarding such topics are centralised to avoid multiple supervisory actions for the same issue. A respondent noted that for cross-border groups, supervisory colleges should play an active role in avoiding contradictory signals and ensuring that escalation decisions and measures are coherent across levels of consolidation. The EBA notes these concerns. It is clarified that the revised SREP GL position the SREP as the overarching process integrating all supervisory outcomes (including on-site inspections, horizontal reviews and internal model assessments) with the aim of ensuring consistent feedback to institutions and avoiding fragmented supervisory actions. Paragraph 49, which requires competent authorities to coordinate SREP activities with all parties involved in the assessment, has been expanded to facilitate a coherence assessment. In relation to cross-border groups, paragraph 6 requires that procedural requirements be applied in a coordinated manner within the framework of supervisory colleges in accordance with Articles 51 and 116 of the CRD, with Title 10 setting out the applicable arrangements in detail. Therefore, on this point, the existing provisions are considered sufficient. Paragraph 49 has been expanded to encompass all supervisory activities and to enable a coherence assessment by the competent authorities.

226 Alignment with supervisory priorities and link with other activities and measures Respondents mentioned cases where the escalation progressed quite rapidly (on ESG), partly due to its alignment with supervisory priorities. However supervisory priorities are not included as a consideration in paragraph22 for selecting the appropriate measure. Respondents also suggested to clarify whether the escalation framework also applies outside the SREP context e.g. onsite inspections. A respondent proposed to ensure a clear distinction and a coherent interaction between escalation measures and capital-based requirements to preserve the consistency of the SREP framework and to avoid unintended double counting. It is acknowledged that supervisory priorities can inform focus and timing and preserve predictability. However, supervisory measure selection should remain risk-based. For the purposes of paragraph 22, supervisory priorities can be taken into account, while the need to timely remediate has been added. It is clarified, in line with paragraph 21(c), that capital-based measures form part of the escalation framework and may be used where the nature or severity of deficiencies warrants prudential reinforcement. Paragraph23 also clarifies that all available quantitative and qualitative measures should be used by the competent authorities in a way that allows to best address the risk level and/or deficiencies. It is also clarified that SREP is considered an ongoing process that integrates the outcome of all the supervisory activities and all available sources of information into a comprehensive supervisory overview of an institution (please refer to paragraph13). However, the high-level escalation framework does not prevent competent authorities from taking immediate supervisory measures arising directly from other supervisory activities whenever those activities reveal material deficiencies that require prompt action (please refer to paragraph24). Paragraph 22 has been amended to embed consideration on timely remediation of identified efficiencies.

227 Time to remediate A respondent proposed to emphasise that supervised institutions shall at all times have sufficient time to remediate any findings. The revised SREP GL already emphasise a proportionate and risk‑based supervisory approach, under which escalation measures should reflect the nature, severity and persistence of deficiencies and the institution’s demonstrated ability to remediate them in a timely manner. No change Application of supervisory measures and escalation path A respondent noted that part of the wording in paragraph22 and 23 could be understood as supervisory measures should be applied in accordance with the maximum principle rather than to the extent necessary and appropriate in each specific case. It was further noted that it is not always necessary to identify an escalation path from the outset. Other respondents argued that the selection of measures should not depend on the category (nature, size and complexity) of the institution, which is relevant only for the frequency and engagement intensity of the assessment, hence the deletion of the related wording from paragraph22. Supervisory measures should be based only on the characteristics and materiality of the deficiencies, maintaining a risk-focused dimension. Another respondent suggested to add further clarity on how proportionality should guide escalation The EBA clarifies that the escalation framework is principle‑based and risk-focused and that supervisory measures should be appropriate and commensurate with the nature, severity and persistence of identified deficiencies. The measures are selected based on supervisory judgement informed by the considerations listed in paragraph22. Proportionality considerations guide the intensity, scope and frequency of supervisory engagement however, they should not limit the supervisor’s ability to act where material deficiencies are present. Paragraph 22 has been amended to embed consideration on timely remediation of identified efficiencies.

228 choices for institutions with different risk profiles or SREP categories. Role and impact of institution self￾assessment A respondent proposed to provide more information on the role and impact (if any) of the self-assessment of the institution in the enhanced supervisory dialogue. Within the escalation framework, self‑assessments provided by institutions could serve as useful inputs to the supervisory analysis, supporting the understanding of the institution’s risks evaluation, remediation progress and prioritisation. It could be part of the enhanced dialogue to inform supervisory judgement on the nature and materiality of deficiencies and on the sequencing of measures, without altering the supervisor’s responsibility to form an independent view under the escalation framework. No change Q5. Do you consider the coverage and level of detail of Title 3 appropriate for its intended purpose? Tailoring of indicators Some respondents suggested that the minimum set of indicators and thresholds should be tailored to each category of institution (1 to 4), and further examples should be added for instance, on governance, operational resilience, DORA‑related and macroeconomic indicators. Proportionality is covered at high-level in paragraph53. The framework strikes a balance between minimum harmonisation and flexibility, by identifying the main categories and types of risk indicators while leaving flexibility to design and adjust as needed, including to reflect proportionality. No change

229 Supervisory response Some respondents expressed concerns about mechanical supervisory reactions and emphasised that indicators should serve as early‑warning tools supporting supervisory dialogue and holistic assessment, and not as automatic triggers for score downgrades, escalation or capital add‑ons without institution‑specific analysis. The revised SREP GL are clear that material changes to the indicators should prompt an analysis of the causes rather than automatic responses. No change Transparency Some respondents requested more transparency on key risk indicators, benchmarks and monitoring concepts (e.g. on what constitutes a ‘material change’ and an ‘anomaly’) to support consistency and help maintain a level playing field across competent authorities. Some recommended that competent authorities should systematically communicate indicators and benchmark results to institutions to ensure consistency and a level playing field. Title 9 of the revised guidelines already envisages a dedicated section devoted to the communication of the SREP assessment, comprising all the relevant information that competent authorities are expected to share with institutions as a basis for an enhanced supervisory dialogue. No change Review for effectiveness Need for regular review, back‑testing and feedback loops for indicators and benchmarks, especially where they influence risk scores, with respondents asking supervisors to periodically reassess indicator relevance, learn from cases where indicators prove misleading, and adjust monitoring methodologies accordingly. To ensure supervisory effectiveness, it is important to clarify that the monitor indicators are subject to regular review to ensure they maintain their relevance. Paragraph 50 has been amended to include regular review and update of indicators where necessary.

230 Q6. Do you consider the coverage and level of detail of Title 4 appropriate for its intended purpose? Examples of acceptability of returns Some respondents suggested removing the illustrative reference to return on equity and cost of equity when assessing the acceptability of an institution’s returns. They argued that the assessment should focus on the safety and soundness of the institutions rather than on value generation above a hurdle rate, advocating a more principles-based approach instead of prescriptive metrics. They also noted that the calculation of cost of equity can vary across methodologies and institutions, leading to inconsistencies. Additionally, institutions may face one-off events or restructuring in certain periods, which can affect profitability. While the reference was intended for illustrative purposes only, it is acknowledged that it may not be fully exhaustive in all cases. Therefore, it has been removed from paragraph 56. Paragraph 56 has been amended. Recovery and resolution plans in BMA Some respondents argue that, by their nature, recovery and resolution plans are not intended to reflect an institution’s normal or forward-looking business model. They therefore consider that their current informative role within the BMA is not fully appropriate and should be reconsidered. With regard specifically to the outcome of the resolvability assessment, respondents noted that this is expected to affect the calibration of MREL or subordinated MREL, rather than the P2R/P2G capital stack, and should therefore be taken into The informative role of recovery and resolution plans, as one of the many sources of information, has been retained from the previous version of the Guidelines. The intention is to make use of all available and relevant information to inform the BMA assessment, without prescribing any mechanical manner in which such information should be used. For example, a recovery plan may identify potential vulnerabilities in certain institutions’ portfolios that could usefully inform supervisors’ focus on No change

231 account in that context. They accordingly advise against the proposal. the business model assessment. Likewise, where the resolvability assessment may lead an institution to adjust certain aspects of its business model, such as its funding structure in order to comply with MREL requirements, competent authorities should be aware of this in the context of the SREP assessment. The current wording does not imply any impact on the setting of capital requirements. Use of prior assessment as a baseline in case of limited changes to the institution’s business model across different SREP cycles Respondents supported the more explicit reference to the possibility of relying on prior or existing assessments in cases of non-material changes to institutions’ BMA. However, they suggested further clarifying the wording to more explicitly steer competent authorities toward using previous assessments. Additionally, some wording suggestions were proposed for the elements to be considered in the materiality assessment under paragraphs 62 and 63. The EBA considers that the current wording on the use of prior assessments to define the scope and depth of the BMA is already sufficiently comprehensive. It appropriately balances the need for competent authorities to form a view on the overall viability and sustainability of an institution’s business model, while avoiding undue burden on institutions where no material changes have occurred. Therefore, no changes are made in this respect. Wording suggestions relating to the materiality assessment under paragraphs 62 and 63 have been incorporated. Paragraphs 62 and 63 have been amended. Operational resilience in BMA Some respondents suggested that dependencies on third-party service providers, including ICT providers and other critical service providers, are an integral and strategic component of the operating model rather than an inherent weakness of the business model. They It is clarified that competent authorities are expected to assess the nature and governance of third-party dependencies — distinguishing between dependencies that are strategically embedded, appropriately managed and subject Paragraph 65 has been amended.

232 therefore considered that the BMA should clearly distinguish between unmanaged or excessive dependencies, on the one hand, and dependencies that are appropriately governed, diversified and mitigated through robust third-party risk management and operational resilience frameworks, including those implemented under DORA, on the other hand. to appropriate controls, and those that are unmanaged, concentrated or insufficiently mitigated — rather than treating dependency as an inherent weakness per se. A short clarificatory sentence to that effect has been added in paragraph 65. Crypto assets in BMA Some respondents suggested removing references to crypto-assets from the BMA, as these are already covered in other sections of the Guidelines. As engaging in crypto-asset activities may represent a change in an institution’s business profile, the current high-level reference has been retained as potentially relevant to the BMA. It is further noted that amended Article 98 of the CRDVI requires competent authorities to assess institutions’ governance and risk management processes for crypto-asset exposures and the provision of crypto-asset services, including by considering institutions’ policies and procedures for identifying risks, as well as the adequacy of the results of the assessments. No change Geopolitical factors inclusion Respondents welcomed the inclusion of geopolitical factors within the scope of the BMA. However, they called for more specific guidance and examples in order to avoid making the assessment of those factors overly subjective. It was also suggested to address it as geopolitical ‘risk’ rather than ‘factor’. Finally, The introduction of geopolitical factors among those that can materially affect institutions’ business model is meant to be kept at a high level at this stage to leave room for a flexible approach by competent authorities as those factors may – by their very nature – materialise Paragraph 68 has been amended.

233 respondents proposed that, when assessing such risks, potential mitigating elements should be taken into account, such as an institution’s capacity to withstand these uncertainties, for instance through diversification of its geographic footprint and business profile. in different manners and impacting institutions and jurisdictions in very specific manner. The term ‘risk’ has been used instead of ‘factor’ in the relevant paragraph, and a reference to the elements that may influence how this risk affects the business model has been added. Time horizon and proportionality in BMA Respondents suggested linking the BMA time horizon more explicitly to the time horizons already used in institutions’ operating environment, with strategic plans, ICAAP/ILAAP and recovery plans typically covering a three- to five-year period. In addition, they suggested that competent authorities should focus their assessment on the most material areas and, where there is clear evidence that no material change has occurred, be able to rely on previous supervisory assessments as a baseline. This was considered helpful in promoting risk-based supervision and reducing unnecessary burden. As the title already refers to those processes as relevant sources of information for the BMA, the link is already reflected in the text. This has been further reinforced through the explicit introduction of the possibility for competent authorities to rely on previous assessments and to focus only on material changes, where these have occurred. Paragraph 62, as well as the background and rationale, already explicitly allows prior supervisory assessments to be used as a baseline for the BMA where no material changes have occurred since the previous SREP cycle, provided that materiality has been duly assessed. No change Interplay between BMA and other SREP elements, supervisory The BMA should be appropriately articulated with the ICAAP, ILAAP, governance and operational resilience frameworks so as to avoid duplication or double A non-exhaustive list of potential supervisory measures is already included in the Guidelines. The purpose of the table is to summarise, in an indicative manner, the supervisory measures No change

234 measures potentially stemming from the BMA counting of risks, for example in the context of ESG assessments or stress testing. that may arise from the BMA in accordance with the existing supervisory powers provided for in Article 104 of the CRD. The aim is to ensure a common baseline for competent authorities, without expanding the powers conferred by the CRD or creating any obligation for competent authorities to apply specific measures where a particular circumstance arises. Assessment of qualitative BMA elements Some respondents urged either the provision of further guidance or the removal of the more qualitative elements of the BMA, such as assessments of the competitive dynamics of the business environment or execution-related considerations, in order to avoid overly judgement-driven concepts. They also raised concerns about areas in which metrics or scenarios remain insufficiently mature in terms of quantification and precision, such as environmental scenario analysis, AI-related risks and other emerging non-financial risks and considered that greater clarity would be needed to support consistent outcomes. The qualitative elements of the BMA have been maintained, as they are needed to complement the quantitative assessment and to ensure a sufficiently comprehensive view. Quantitative indicators alone may not fully capture certain aspects of the business environment, execution capacity or emerging risks. In this context, a degree of expert supervisory judgement remains necessary, particularly in relatively new areas where methodologies and metrics are still evolving. The intention is not to promote an unduly judgement-driven approach, but to allow competent authorities to combine quantitative evidence with qualitative assessment in a proportionate and informed manner. No change Q7. What are the respondents’ views on the updated section 5.7 ‘ICT systems, risk data aggregation and risk reporting’?

235 Clarifications on terminology Some respondents requested further clarity on certain terminologies to reduce subjectivity and to better frame the assessment: • risk awareness (paragraph85c) • appropriate understanding (paragraph83c) • sufficient knowledge and skills (paragraph83c) • through regular training (paragraph83c) • other emerging risks (paragraph83c) It is clarified that all terms are already used and stem directly from the CRD and/or other EBA Guidelines. No change Assessment criteria to ensure ‘appropriateness of ICT systems, data aggregation, and risk reporting’ A respondent requested further clarity on the exact requirements to ensure the ‘appropriateness of ICT systems, data aggregation, and risk reporting’. Section 5.7 already sets out the core elements of this assessment. The requirements are comprehensively addressed in the EU legal and regulatory framework (e.g. the CRR/CRD, DORA, EBA GL) and the SREP GL do not duplicate those provisions but assess, from a prudential perspective, whether institutions effectively implement them. The SREP GL build on the existing legal requirements and do not intend to change or limit these requirements. No change Role of management body in the risk data aggregation and risk reporting framework A respondent proposed to remove the reference of ‘senior management’ from paragraph104 as only the management body can take decisions. Another respondent proposed to replace the word ‘validated’ in paragraph104 with the word ‘reviewed’ as it does not refer to validation activities in the strict sense. The revised SREP GL distinguish between the approval of the risk data aggregation and risk reporting framework, which rests with the management body, and its implementation, maintenance and ensuring its effective operation, responsibility of the senior management. It is therefore clarified that reference to ‘senior management’ in Paragraph 101 has been amended to clarify the role of the management body and the independent validation in accordance with the

236 paragraph101 did not assign decision-making authority but reflected its implementation role, in line with the CRD provisions. It is further clarified that the validation of the risk data aggregation capabilities and risk reporting practices should be independent to ensure that risk data aggregation and reporting processes are functioning as intended and are appropriate for the institution’s risk profile. These activities should be aligned and integrated with the other independent review activities within the institution’s risk management framework. institution’s internal control framework. Alignment with DORA/ICT strategy In relation to paragraph92(g), some respondents noted potential duplication of strategies and governance complexity as (i) it was understood that no separate document on DORA/ICT strategy would be required as long as the requirements could be evidenced within existing or other strategies and (ii) DORA only requires the institutions to be able to describe how the DOR strategy supports their business strategy. It is clarified that the revised SREP GL, consistent with their principle‑based nature, do not require institutions to produce separate or additional information/reporting where existing governance arrangements already demonstrate compliance. In this regard, Article 6(8), points (a) to (h), of DORA specify the elements that the digital operational resilience strategy shall include. Specifically, Article 6(8)(a) requires institutions’ ICT risk management framework to include a digital operational resilience strategy setting out how the framework shall be implemented. The digital operational resilience strategy shall explain how the ICT risk management framework supports the No change

237 institution’s business strategy and objectives. Moreover, Article 6(9) of DORA provides additional details in case institutions include (within the strategy) an ICT multi-vendor strategy. It is further noted that the EBA Guidelines on ICT risk assessment under the SREP (EBA/GL/2017/05) already envisaged the assessment of the alignment between the ICT strategy and the business strategy due to the strong links between the two. ICT-specific view for sub-section 5.8 A respondent noted that the newly added sub-chapter 5.7 will also require institutions to provide an ICT￾specific view even for risk types covering ICT and non￾ICT aspects. It is clarified that sub-section 5.8 of the revised SREP GL covers, among other elements, the assessment of the reliability, resilience and adequacy of ICT systems insofar as they support the institution’s risk data aggregation and risk reporting. No change Addition of operational clarifications Two respondents proposed to add operational clarifications/examples and, where feasible, indicative benchmarks in relation to risk data aggregation and risk reporting, including supervisory expectations (e.g. data governance framework, data architecture, data management and data governance, data quality management, timeliness, testing of continuity and recovery, governance and monitoring of third-party arrangements), guidance on escalation protocols, and further references to documentation standards and evidence requirements. The proposals go beyond the level of principle-based guidance envisaged for the SREP GL. Moreover, this revision aims to reduce over￾prescription and to refrain from detailed operational specifications. This would preserve the appropriate flexibility for the CAs, avoid unintended compliance burden to the institutions and remain consistent with the objectives of the SREP GL. No change

238 References to mapping of duties and individual statements A respondent proposed to reduce the level of granularity of paragraph84, in particular by removing references to the mapping of duties and individual statements, to avoid the creation of additional documentation layers that do not materially enhance supervisory outcomes. It was further noted that any expectation to maintain these mappings or statements at consolidated level exceeds the scope of the CRDVI and would generate disproportionate burdens for complex groups. Paragraph 81 reflects the requirements of Article 74 of the CRD, which mandates robust governance arrangements, including clear allocation of responsibilities. The mapping of duties and individual statements of responsibilities are tools to operationalise this requirement. The SREP GL build on the existing legal requirements and do not intend to change or limit these requirements nor to add further documentation layers beyond what the legal framework requires. On the concern regarding consolidated application, the SRER GL apply in accordance with the scope of consolidation set out in the CRDVI. Competent authorities retain supervisory judgment in assessing proportionality, including for complex groups, in line with the general proportionality framework set out in Title 2. No amendment is made. No change References to compliance risk A respondent proposed to closer align paragraph90 with the CRDVI, in particular clarify that compliance function assesses and mitigates compliance risk. The EBA welcomes the proposal to fully align paragraph90 with Article 76(5) of the CRDVI, which supports one of the objectives of this revision, the alignment with the latest regulatory developments such as the CRDVI. Paragraph 87 has been amended.

239 Reference to common standards on risk data aggregation and risk reporting Another respondent proposed explicitly referring to key risk data aggregation and risk reporting standards commonly considered (e.g. BCBS 239) to support a common understanding of supervisory expectations and promote consistent supervisory assessment. The Guidelines remain principle-based and anchored to the applicable EU legislation. It is noted that while BCBS 239 principles are applicable to global systemically important banks, related expectations have been already set by competent authorities (where deemed necessary) as robust internal governance and effective processes to identify, measure, manage and monitor all material risks are expected by all the institutions. According to the ICT SREP GL, for managing material ICT data integrity risks, institutions that fall under the scope of the BCBS 239 principles should assess their risk reporting and data aggregation capabilities against those principles and maintain appropriate supporting documentation. A footnote has been added to clarify this point. Paragraph 100 has been amended to refer to the BCBS 239 for the institutions that under fall their scope. Types of institutions’ stress testing A respondent suggested the review of paragraph100 as it may be currently implied that all types of stress testing should be considered, which might contradict the expectations of reverse stress tests. It is clarified that paragraph 97 refers specifically to conventional adverse scenarios used for capital adequacy assessments, in line with Title 7, and does not extend to reverse stress tests, which aim to identify scenarios that would render the institution unviable rather than to test ongoing compliance with capital requirements. A footnote has been added in paragraph 97. Delegated responsibilities Respondents noted that paragraph232(c) does not recognise that the management body may delegate It is clarified the revised SREP GL do not prohibit delegation to committees, where these apply, Paragraph 229(c) has been amended

240 some of its responsibilities for follow-up and response to audit findings, nor does it consider the materiality of audit findings in question. It was therefore proposed to amend it as follows: ‘adequate follow-up and response by the management body or its delegates on material ICT related audit findings and findings reported under Article 13(5) of DORA’. and are fully aligned with the EBA Guidelines on Internal Governance. In particular, paragraph 151 of those Guidelines clarifies that the management body should follow up on the findings of the internal control functions in a timely and effective manner and require adequate remedial actions. Furthermore, paragraph 45 of same GL clarifies that committees should support the supervisory function in specific areas and facilitate the development and implementation of a sound internal governance framework. At the same time, delegating to committees does not in any way release the management body in its supervisory function from collectively fulfilling its duties and responsibilities. The reference to ‘ICT audit findings’ has been slightly adjusted to fully align with Article 6(7) of DORA. to refer to critical ICT audit findings. Contractual arrangements A respondent proposed to clarify that contractual matters should be addressed separately under DORA. Another respondent requested enabling the competent authorities to recognise and consider the use of standardised contractual terms on operational resilience as reliable evidence of resilience for third‑party dependencies supporting critical or important functions. It was further proposed to harmonise risk oversight through accredited audit Contractual requirements on third-party services are comprehensively addressed under DORA and the upcoming EBA Guidelines on the sound management of third-party risk management. The SREP GL do not duplicate those provisions but assesses, from a prudential perspective, whether institutions effectively implement and manage them within their overall risk management framework. No change

241 regimes based on agreed auditing standards, which could be developed jointly by the ESAs-ENISA. Taxonomy for deficiencies A respondent suggested introducing a shared supervisory taxonomy for deficiencies considered in paragraph 80. The SREP is inherently risk-based and relies on supervisory judgement, taking into account the specific risk profile, size, and complexity of each institution. Introducing a common taxonomy could unduly constrain this judgement and risk oversimplifying supervisory findings. Furthermore, the existing framework already provides sufficient guidance to ensure an appropriate level of consistency and comparability across competent authorities, while preserving the necessary flexibility. A predefined taxonomy could incentivise a more mechanical or ‘box-ticking’ approach and reduce the forward-looking nature of supervisory assessments. Lastly, the introduction of such a taxonomy would increase operational complexity with uncertain evidence of commensurate benefits in terms of supervisory convergence or effectiveness. No change Q8. Do you consider the coverage and level of detail of Title 6.2 appropriate for its intended purpose? Proposed credit risk taxonomy Respondents suggested that the proposed taxonomy should be more economic and consistent with others used in supervisory practice. The fact that ensuring As noted at the beginning of the feedback table, the risk sub-categorisations set out in the Annex are intended to serve as guidance for competent No change

242 greater alignment and clearer mapping principles would help institutions reconcile classifications across frameworks (e.g. ICAAP, including diversification effects) was hinted at. authorities and to further promote consistent risk identification across authorities, while remaining non-exhaustive and flexible. Practical guidance on new/expanded items Respondents noted that the inclusion of dilution risk and the expanded wording on model risk for approved regulatory models would benefit from brief practical guidance on supervisory expectations in the assessment. This would support supervisory convergence and facilitate implementation by institutions. A question was also raised as to whether specialised lending should be treated as a separate sub-category of credit risk. While dilution risk has indeed been added to the list of credit risk sub-categories, this is already qualified in the Level 1 text. The wording on model risk for approved regulatory models has not been expanded in the credit risk section. On the contrary, its relevance is expected to diminish in light of the output floor provisions set out in Title 7. Specialised lending remains a relevant element of the assessment, particularly where it is considered material. However, it is viewed more as a specific type of transaction giving rise to credit risk than as a distinct category of credit risk in its own right. This is why it is addressed in the relevant credit risk section but not included as such in the list of credit risk sub-categories. No change Reference to the IRB EBA Supervisory handbook for the validation of Respondents suggested removing the reference to the EBA Supervisory Handbook on IRB validation of internal ratings-based systems from the table in paragraph 127, as it is not applicable to institutions. It is acknowledged that, since the handbook is addressed to competent authorities, an indirect reference to compliance checks from an institution’s perspective should not be included. Paragraph 124 has been amended.

243 internal ratings￾based systems Use of internal credit risk parameters for the materiality assessment of credit risk portfolio A respondent suggested that paragraph 136 should refer primarily to IRB institutions and that the text should be amended accordingly. The paragraph already includes a statement (‘As additional source of information for the materiality assessment, competent authorities should – where available and appropriate – consider the internal credit risk parameters used by the institution […]’) that allows competent authorities to use this information where it is more relevant. No change Q9. Do you agree with the treatment proposed to account for transfer pricing risk in the context of trading book activities? Please elaborate. General feedback on the new approach to transfer pricing arrangements Some respondents supported the proposal to introduce a new approach to address the market risk of transfer pricing arrangements (TPA) based on a transaction profit method, including a formula for determining a P2 capital requirement. They supported ensuring that material risks are adequately capitalised, and depositor funds and investor capital are protected from hidden risks and losses. Others challenged a prescriptive approach with a fixed formula, noting that applying supervisory judgement would ensure proportionality and avoid unintended capital increases. Concerns about commercial impact on advance pricing agreements (APAs) negotiated The costs and benefits of introducing a new approach to support supervisors’ assessment of TPA risks have been analysed and set out as part of the EBA consultation. It was concluded that the proposed approach promotes consistency across supervisory practices and establishes a level-playing field between institutions directly capitalising their market risk as part of a Pillar 1 capital requirement and those institutions that bear the risk but have no capital against it. The fact that the TPA are agreed with governments via APA does not change the risk embedded in such agreements. No change

244 between banks and governments, which are based on expectations about where capital and risk reside. As regards the concern on using a prescribed formula for the measurement, the SREP GL set out, in paragraph 174, point (c), that ‘competent authorities may use […] an alternative methodology that provides accurate measurement of the risk not covered in P1R and identifies the consequent P2R, considering as a reference the methodology in Annex V.’ Risk capture and measurement Some respondents observed that the adjustment should be risk‑based, TP‑method‑agnostic and limited to residual risk borne by the EU entity; or expressed concern about double counting with Pillar 1 market risk and other regulatory requirements (e.g. intra‑group exposures); or asked to have flexibility to reduce the 1.5 multiplier when the differences in the market risk rules between the EU and the third country are not significant. One respondent suggested having a Pillar 1 requirement. Limited adjustments made to clarify that other types of TPA similarly transferring losses to the EU entity should be assessed in a similar way; and to confirm that the 1.5 multiplier, which addresses differences in the market risk rules between the EU and the third country, can be adjusted to reflect the materiality of these differences. As regards the risk measurement, the approach described in the GL already aims to target the loss that may crystallise in the EU entity. Any double counting is expected to be assessed as part of the overall SREP. The first and second paragraphs in Annex V have been amended. Further clarifications Some respondents suggested clarifying further the supervisory expectations (e.g. in relation to governance, documentation), and having examples and illustrative scenarios. The approach should be considered in the broader context of other GL or requirements on governance, documentation, etc. No change

245 Q10. What are the respondents’ views on the integration of the EBA GL on ICT risk assessment under the SREP (EBA/GL/2017/05) and DORA aspects? ICT risk as part of OpRisk Respondents argued that the revised GL should not duplicate efforts of activities within the overall operational risk management framework, of which ICT risk represents a key, but not exclusive component. It was hence recommended that the ICT risk maintains its normal weight within operational risk. Other respondents noted that ICT risk is covered repeatedly throughout the SREP GL and welcomed a rationalisation. At the same time, another respondent strongly argued for the reclassification and recognition of ICT risk (including digital resilience) as a primary and independent non-financial risk (NFR) and hence the development of the new Title dedicated to ICT risk. This could guarantee the relevance of ICT risk, its alignment with DORA and other EU-level regulations/strategies, and its consistency with specialised supervisory groups. The structure of the SREP GL reflects the assessment of ICT risk within the operational risk framework, along with related linkage to internal governance (reflecting DORA) and risk data aggregation aspects. This cross‑referencing is intended to ensure that ICT considerations are integrated consistently across the relevant SREP elements, in line with the holistic assessment approach central to the SREP GL. The revised SREP GL reflect the applicable EU legal framework: Article 4(52) of the CRR includes ICT risk under operational risk, and DORA (recital 12) specifies that ICT risk requirements are consolidated and upgraded as part of the operational risk requirements. Moreover, the DORA Directive amends the prudential framework by making ICT risk an explicit component of the SREP. It is further noted that ‘Title 6.4 – Assessment of operational risk’ of the revised SREP GL explicitly embeds DORA into the ICT risk assessment, replacing and integrating the separate ICT SREP GL and aligning expectations with applicable legislation. It is further noted that CAs are expected to take into account relevant supervisory findings and Explanatory text has been added in the ‘Background’ section to further clarify that within the EU regulatory framework, ICT risk is part of operational risk, and DORA strengthens its prudential treatment through digital operational resilience requirements. Together these contribute to the broader objective of operational resilience Interconnection of DORA, ICT risk and operational resilience Respondents requested more clarity on the interconnection of DORA, ICT risk and operational resilience, for example in the form of a consistent taxonomy. Other respondents noted the need for further clarification on how DORA-based assessments can be leveraged to inform or partially substitute existing ICT and operational risk evaluations under the

246 SREP to reduce unnecessary duplication and ensure supervisory focus on material risk drivers assessments conducted under DORA as part of their SREP/ICT risk assessments, thereby avoiding unnecessary duplication while maintaining a comprehensive evaluation of material risks. This approach ensures that DORA￾based supervisory work informs SREP outcomes where appropriate, consistent with the risk￾focused and proportionate supervisory objectives of the revised SREP framework. Operational resilience, which constitutes an integral element of the robust governance arrangements and adequate internal control mechanisms required under Article 74 of the CRD, is considered as an outcome, not risk category, a cross-cutting capability that sits above existing risk frameworks. Operational resilience does not replace operational risk; it extends it beyond loss prevention into service continuity. Therefore, the institution’s frameworks on operational risk, ICT risk and third-party risk management should be used as inputs into a broader resilience evaluation. The operational risk sub-categories (Annex III) already cover ICT risk and third-party risk, which constitute the foundational layers upon which operational resilience is built.

247 Unimprovable ICT risk score to subsidiaries A respondent mentioned cases where subsidiaries were provided an unimprovable ICT risk score due to perceived risk associated with being a subsidiary. It was noted that subsidiaries retain the autonomy to implement additional internal controls and arrangements if necessary to comply with local regulatory requirements, where relevant in alignment or consultation with the parent company. Another respondent argued for the SREP GL to adequately recognise how cybersecurity risk is effectively managed in cross‑border groups, where centralised policies, expertise and incident‑response capabilities often strengthen ICT risk management. Caution was raised against treating subsidiaries as inherently higher‑risk or requiring full subsidiarisation of ICT controls, and proposed a more nuanced assessment that reflects actual dependencies, centralised mitigants, and the institution‑specific effectiveness of cybersecurity arrangements. The EBA takes note of these cases, and it is clarified that under the revised SREP GL, competent authorities may assign different categories to the group subsidiaries and/or consolidated entity (section 2.1.1). The assessment at subsidiary level should cover whether group-wide policies and procedures are implemented consistently and whether group entities have taken appropriate measures to ensure that their activities are compliant with all applicable laws and regulations. In the case of subsidiaries of a cross-border group, competent authorities should consider subsidiaries on an individual basis and the findings from initial assessments should also include the identification of key vulnerabilities in the cross￾border or group context and reflect strengths and mitigating factors related to the entity being part of the group. The SREP framework does not envisage predetermined or structural scores linked to an institution’s position within a group in line with the requirement to continuously assess risks using institution‑specific supervisory judgment and to avoid mechanistic scoring. No change Inputs to the SREP score Respondents proposed adding further clarification on how each ICT-related input impacts the CAs’ risk assessment and influences the SREP score. It was SREP scoring remains a holistic, expert-based supervisory judgement that takes into account a broad range of quantitative and qualitative No change

248 further noted that ICT-related inputs to the SREP could benefit from industry input and welcomed further engagement with CAs before the assignment of the SREP scores to avoid misinterpretation and to ensure proactive communication (cases reported where banks were unaware of risks perceived by the supervisors and expressed with supervisory letters). Other respondents noted that significant importance is placed on the quantification of ICT risk and the utilisation of an institution’s reporting metrics (e.g. reported incidents, internal reporting) which directly correlates to a higher risk score to larger institutions with strong reporting cultures. It was hence recommended to give greater consideration to the other SREP instruments available to competent authorities, along with the supervisory experience, which should be considered for the risk score. elements. ICT-related inputs are assessed in context and do not mechanically translate into a specific score. The SREP GL do not introduce an automatic link between individual ICT indicators and the SREP outcome. It is also noted that CAs are expected, in line with the existing SREP framework, to engage in an ongoing supervisory dialogue with institutions, including the communication of key risk drivers underpinning supervisory assessments. The SREP decision process, including the opportunity for institutions to provide factual clarifications prior to the final decision, is intended to mitigate the risk of misinterpretation and to promote transparency. Regarding the quantification of ICT risk and the use of reporting metrics, it is reiterated that supervisory assessments should consider the effectiveness of an institution’s risk management framework and control environment, including its reporting culture. CAs are expected to consider all relevant supervisory tools and evidence, including qualitative assessments, on-site findings and supervisory experience, when forming their overall judgement and assigning SREP scores. Capital as mitigant for ICT risk A respondent noted that institutions have developed dedicated ICT/cyber risk frameworks that sometimes The revised SREP GL aim to further specify the assessment of ICT risk as a component of No change

249 go beyond the traditional operational risk management structure. It was proposed that the SREP GL to acknowledge this and limit the imposition of additional capital requirements to situations where there is evidence of a material and quantifiable prudential risk. It was further mentioned that the treatment of ICT risk should primarily focus on qualitative measures. operational risk under Article 85 of Directive 2013/36/EU. This assessment will result in a summary of findings which, based on a set of considerations, will form the operational risk score – which will inform among others the determination of additional own funds requirements. As noted in paragraph 16, ICT risk may be assessed and scored individually as a sub-category of operational risk if deemed material by the competent authorities. In such a case, the scoring table (table 1) in these Guidelines should be used to reach a score. It is also noted that DORA sets targeted qualitative requirements for the protection, detection, containment, recovery and repair capabilities against ICT-related incidents, as well as reporting and digital testing capabilities, thereby addressing ICT risk prevention, mitigation and recovery in a manner that capital measures alone may not achieve. Proportionality application Few respondents indicated the need for further clarity on proportionality and supervisory intensity, especially for SNCIs, and the overall application of proportionality in the ICT risk assessment, primarily on the information and tasks requested by institutions within a year (e.g. ICT self-assessment questionnaires, ICT RM review report, onsite inspection, TLPT, cyber stress test participation). Another respondent noted The revised SREP GL clarify that the assessment of ICT risk is subject to the overarching SREP principle of proportionality, including where applicable as regards the frequency, scope and depth of supervisory tools. CAs are expected to calibrate supervisory engagement to the institution’s size, business model, risk profile and systemic relevance, thereby avoiding undue Paragraph 121 has been amended.

250 that reinforcing proportionality in the application of ICT expectations would also help maintain a clear distinction between prudential issues and issues falling under the broader compliance with DORA. burden and ensuring a focus on material risk drivers. In addition, DORA itself embeds a proportionate application of its requirements, taking into account the institution’s size, overall risk profile and the nature, scale and complexity of its services and activities. The integration of DORA elements within the SREP therefore builds on this existing proportionality framework. Assessment of materiality of operational risk arising from third￾party providers Some respondents proposed to amend paragraph197 as it would be more appropriate for the competent authorities to assess the institution’s approach to determining the materiality of operational risk arising from third-party providers. For the same paragraph, a respondent requested to clarify the delimitation of the references to DORA and EBA GL on third-party risk management to ensure the SREP does not unintentionally expand the scope of the aforementioned frameworks. It is noted that paragraph194 stems directly from the previous SREP GL (paragraph273) where ‘competent authorities should assess the materiality of operational risk arising from outsourced services and activities’. It is further clarified that materiality assessment depends on the supervisory judgement (paragraph116). Regarding the delineation of DORA and the upcoming EBA Guidelines on the sound management of third-party risk, it is clarified that the revised SREP GL do not intend to expand the scope of either framework. The reference to DORA is limited to ICT services provided by ICT third-party service providers, while the EBA Guidelines apply to all other third￾party services, consistent with the respective scopes of those frameworks. The clarification wording has been moved to the ‘Background’ section while paragraph 194 has been amended. Paragraph 194 has been adjusted along with explanatory text in the ‘Background’ section

251 Third-party risk assessment Some respondents proposed to clarify expectations for third-party ICT concentration risk and subcontracting chain visibility/complexity, and to reinforce supervisory attention to third-party and concentration risk. Another respondent proposed to clarify that subcontracting chain complexity should be considered by competent authorities as a contextual factor, rather than a standalone proxy for concentration risk. Paragraph 194 already refers to a risk-based supervisory assessment of operational risk arising from third-party service providers. Article 3(29) of DORA provides a definition of concentration risk focused on critical ICT TPPs and Article 29 (1) provides further specifications on the assessment of including concentration risk, as the competent authorities are expected to assess whether institutions adequately identify, measure, monitor and mitigate third￾party concentration risk, taking into account the institution’s size, business model, systemic relevance and complexity. As per Title 6.4.2.3 and paragraph 216, supervisory assessments are expected to rely on a holistic evaluation of dependency, criticality, substitutability and risk mitigation capacity. Paragraph 194 has been amended to clarify the concentration level and to reinforce supervisory attention to third-party concentration risk. Paragraph 194 has been amended. Risk-based and proportionate approach in the assessment of third-party risk A respondent strongly proposed the application of a risk-based and proportionate approach in the assessment of third-party risk, focusing on dependencies that could affect critical or important functions and deprioritize low impact support services. In line with the principle‑based design of the SREP (Title 2) and also paragraph 194, supervisors assess risks arising from third‑party providers to the extent relevant for the institution’s prudential profile and particularly No change

252 It was further noted that the assessment of non-ICT third-party risk should in practice not lead to an overly broad supervisory focus given the non-material impact of most non-ICT third party services to institutions. It was proposed to explicitly exclude from the assessment functions that are either legally required to be performed by a third-party provider or are typically performed by a supervised entity and are not regularly carried out by the institutions themselves or provided by other institutions or licensed financial entities. Moreover, it was proposed that third-party audits should be leveraged in a standardised and widely recognised format, preferably aligned with the established frameworks such as ISO certification, as this would reduce unnecessary costs without jeopardising industry-wide resilience. where these affect critical or important functions. The revised SREP GL enable competent authorities to rely on work performed under other supervisory activities and the broader SREP provisions on leveraging other supervisory evidence. It is further noted that the scope, definitions, assurance/audit requirements applicable to ICT and non‑ICT third‑party arrangements, along with their respective proportionality application, are set directly in the relevant legal/regulatory frameworks (DORA and upcoming EBA GL on the sound management of third-party risk), and are not established by the SREP GL. Incident reporting and cyber-threats A respondent requested further clarity on how major ICT-related incidents and remediation maturity influence scoring and escalation. Some respondents noted that paragraph208 refers to competent authorities using reports of significant cyber threats as a source of information. However the reporting of significant cyber threats is performed on a voluntary basis under DORA and may not be available to all competent authorities, hence it was proposed to It is clarified that paragraph 205 refers to Article 17(2) of DORA where financial entities are required to record all ICT‑related incidents and significant cyber threats as part of their ICT‑related incident management process. Therefore, in the context of the SREP, competent authorities could draw on the information that institutions are already required to maintain internally. This does not imply, nor should it be interpreted as, a requirement for institutions to submit or No change

253 clarify this may be a source of information where available. proactively transmit those records on threats to competent authorities. Clarifications and wording alignment A respondent encouraged greater considerations of the factors competent authorities should take into account to assess inherent ICT risk (as listed in paragraph216) and to provide further detail in explaining why those factors relate to risk. It was argued the factors listed in paragraph216 vary widely in impact and may lead to highly subjective supervisory interpretations. Moreover, it was noted that, when reliance is placed on Lead Overseer recommendations regarding CTPPs, institution‑specific mitigating controls and actual dependency levels may be overlooked. Some respondents noted that paragraph216(i) could benefit from defining the term ‘digital technologies’. Moreover, it was proposed to link this point to a specific desired outcome otherwise it risks overstepping the boundary of supervisory It is clarified that paragraph 214 provides a non‑exhaustive set of elements that competent authorities should consider where relevant when identifying the materiality of inherent ICT risk. These factors should not predetermine outcomes, nor be applied in isolation as supervisory judgement considers the institution‑specific context, including the design and effectiveness of the controls in place, the institution’s dependency structure, and its actual exposure to ICT‑related vulnerabilities. Having said that, references to external inputs (e.g. Lead Overseers’ recommendations) form one source of information and should be assessed together with the institution’s mitigating controls, contractual arrangements, and dependency profile. Point (i) of paragraph 214 stems from paragraph39(b) of the ICT SREP GL where, in the context of reviewing an institution’s ICT risk profile, competent authorities should consider whether the institution may be subject to ICT risks due to high adoption of innovative ICT solutions. It is noted that the term ‘ICT solutions’ No change Paragraph 214(i) has been amended to refer to ‘innovative ICT solutions’.

254 responsibility into taking a direct hand in institutions’ ICT strategy. Some respondents proposed to clarify in paragraph216(o) the type of vulnerabilities that can be used for the SREP. It was further noted that sharing of vulnerabilities outside the institution can pose a material security risk hence it is proposed that instead the competent authorities should consider the institution’s approach to identifying the external threat environment. Some respondents proposed paragraph 217 to instead require CAs to review the approach that institutions have taken to determine which ICT systems and ICT services support their critical or important functions. Some respondents noted that the title, ‘Identification and mapping of material ICT risks to critical ICT systems and ICT services’ on page 89 uses terminology which is not present in the existing regulatory framework. It was therefore proposed to amend this to ‘ICT systems and ICT services supporting critical or important functions’. is also used in DORA (Article 2). The SREP GL have been adjusted on that basis. It is clarified that the reference to the external threat environment in paragraph 214 concerns independent external threat data (e.g. ENISA threat landscape report) that CAs should use to inform their supervisory assessment and does not entail disclose of vulnerabilities that could pose a security risk. The SREP GL have been adjusted on that basis. It is noted that paragraph 215 stems from paragraph 40 of the ICT SREP GL where CAs should form an opinion on which ICT systems and services are critical for the adequate functioning, availability, continuity and security of the institution’s essential activities. Similarly, the title in page 89 has been adjusted accordingly. Paragraph 214(o) has been amended to refer to threat and vulnerability intelligence. Paragraph 215 and title in page 89 have been amended accordingly.

255 Some respondents proposed adjusting paragraph218 as it would be more appropriate for the CAs to review the institution’s approach to determining the material ICT risks to which they are exposed. A respondent proposed the deletion of the parenthesis in paragraph221 – ‘ICT risk appetite and digital operational resiliency strategy’ – as the emphasis on these two elements risks narrowing the focus from the institution’s overall material risks, which should form the foundation of its strategy and risk appetite. A respondent proposed to further clarify paragraph227 and paragraph229(e) to ensure full alignment with DORA, in particular to clarify that It is noted that paragraph 216 stems from paragraph 42 of the ICT SREP GL where CAs should form an opinion on the material ICT risks that, in their supervisory judgement, can have a significant prudential impact on the institution’s critical ICT systems and services. The reference to ICT risk appetite (already in the ICT SREP GL) and digital operational resilience strategy do not narrow the focus of the assessment but rather clarify in light of DORA, which establishes specific requirements for ICT risk management. ICT risk remains a component of operational risk, and it is assessed within the broader framework of all material risks under the SREP. The amendment aims to ensure alignment with DORA while maintaining the holistic, risk-based nature of the SREP assessment, which continues to be grounded in the institution’s overall material risk profile. It is noted that Article 6(a) of DORA requires financial entities to test the ICT business continuity plans and the ICT response and recovery plans in relation to ICT systems No change No change Paragraph 226(e) has been amended to fully align with the DORA framework

256 institutions maintain their own BCPs when using TPSPs and in turn TPSPs maintain their own independent resilience frameworks. Respondents noted that paragraph232(c) does not recognise that the management body may delegate some of its responsibilities for follow-up and response to audit findings, nor does it consider the materiality of audit findings in question. It was therefore supporting all functions at least yearly. Moreover, Article 11(4) of DORA requires financial entities to put in place, maintain and periodically test appropriate ICT business continuity plans, notably with regard to critical or important functions outsourced or contracted through arrangements with ICT TPSPs. Moreover, Article 25(2) of the Delegated Regulation (EU) 2024/1774 requires that financial entities’ testing of ICT business continuity plans contain the testing of ICT services provided by ICT TPSPs, where applicable, and contain procedures to verify the ability of the financial entities’ ICT TPSPs to respond adequately to the relevant scenarios. Lastly, Article 25(4) of the same Delegated Regulation requires financial entities to consider and implement continuity measures to mitigate failures of ICT TPSPs of ICT services supporting critical or important functions as part of the ICT response and recovery plans. It is clarified the revised SREP GL do not prohibit delegation to committees, where these apply, and are fully aligned with the EBA Guidelines on Internal Governance. In particular (paragraph 151 of those Guidelines clarifies that), the regarding the ICT BCPs when using ICT TPPs. Paragraph 229(c) has been adjusted to fully align with the DORA framework

257 proposed to amend it as follows: ‘adequate follow-up and response by the management body or its delegates on material ICT related audit findings and findings reported under Article 13(5) of DORA’. A respondent proposed to remove the term ‘adequacy’ from paragraph233, points (a), (b), (c), as this could add subjectivity and divergence across the competent authorities and potentially going beyond DORA requirements. management body should follow up on the findings of the internal control functions in a timely and effective manner and require adequate remedial actions. Furthermore, paragraph45 of same GL clarifies that committees should support the supervisory function in specific areas and facilitate the development and implementation of a sound internal governance framework. At the same time, delegating to committees does not in any way release the management body in its supervisory function from collectively fulfilling its duties and responsibilities. The reference to ‘ICT audit findings’ has been slightly adjusted to fully align with Article 6(7) of DORA. The proposal is acknowledged and, in an effort, to enhance clarity while preserving the risk￾based and proportionate nature of the SREP, the wording has been refined to better reflect the supervisory objective under Directive 2013/36/EU. regarding critical ICT audit findings. Paragraph 230, points (a), (b) and (c), have been adjusted to refer to appropriateness, effectiveness and implementation. Technical risk taxonomy Some respondents proposed the development of a clear, stable and technically coherent risk taxonomy, in which ICT risk is consistently positioned as a component of operational risk, to support the It is clarified that the SREP GL treat ICT risk as part of operational risk (consistent with te CRR Article 4.1(52), EBA/RTS/2025/03, DORA recital 12) and embeds ICT/governance assessments Wording adjustments in ICT risk sub-categories.

258 integration of DORA into the SREP. This should be closely linked to business processes, critical or important functions, and the underlying applications and ICT assets supporting those functions. Another respondent noted that the ICT risk￾subcategories (Annex III) are not defined in DORA and this may lead to classification and delimitation issues. across Titles 5 and 6, enabling competent authorities to rely on other supervisory work and artefacts where appropriate while maintaining supervisory judgement and proportionality. Accordingly, supervisors can consider DORA‑driven information as evidence inputs in the SREP. It is further noted that the sub-categorisation reflected in Annex III is based on the taxonomy already established in the ICT SREP GL, also reflecting DORA, hence it does not introduce new concepts or additional regulatory obligations. The sub-categories serve a supervisory methodology purpose, enabling competent authorities to perform a structured, consistent and risk-based assessment of risks under the CRD. Accordingly, the continued use of this supervisory classification does not create classification or delimitation issues but supports convergence and continuity in the assessment of ICT risk. It is therefore clarified that institutions are expected to maintain their own risk taxonomies for risk management purposes as the risk sub-categorisations set out in the Annex is intended to be used as guidance for the competent authorities and to further promote

259 consistent risk identification across authorities, while remaining non-exhaustive and flexible. Supervisory measures In relation to the potential supervisory measures in table 11, a respondent noted that competent authorities’ powers are covered under Article 50 of DORA and the SREP GL should not extend these further or include explicit rights not included under DORA. It is clarified that competent authorities may, on a risk-based and proportionate basis, exercise their supervisory powers under Directive 2013/36/EU, including Article 104, to address material deficiencies in governance and risk management arising from outsourced arrangements. No change Audit findings related to TPSPs A respondent proposed to clarify that paragraph235, points (c) and (d), apply to the institution’s own remediation processes and governance, and that competent authorities should assess whether institutions have appropriate processes for reviewing audit findings including with third-party service providers, when applicable. Paragraph 232 is not considered to extend audit or remediation obligations beyond those established under DORA. DORA requires financial entities to maintain an effective internal control framework, including independent review mechanisms, and to remain fully responsible for ICT risk, including risks arising from ICT third-party arrangements. Paragraph 232 does not impose audit obligations directly on third-party service providers nor require alignment of their internal risk management approaches with those of the institution. The provision reflects the institution’s responsibility for effective ICT risk management and oversight and remains aligned No change

260 with both the CRD supervisory framework and the requirements of DORA. Operational risk exposure and assessment A respondent suggested to clarify the concept of ‘operational risk exposure’ and to specify it refers to operational risk losses arising from operational risk events and to risks not captured under Pillar 1 requirements. It was further suggested to clarify that the assessment of operational risk losses for the purposes of inherent risk should be based on net losses rather than gross losses, in order to appropriately reflect existing risk mitigants, such as insurance policies, and provide a more accurate view of the institution’s effective operational risk exposure. It is noted that the concept of ‘operational risk exposure’ is already used and consistently applied since the initial SREP GL, in line with the definitions and scope of operational risk set out in the CRR. The SREP assessment considers risks to which the institutions are or might be exposed in accordance with Articles 97 and 104 of the CRD. Therefore, further clarification as suggested is not considered necessary. Under the CRR operational risk framework, capital requirements are based on gross losses from insurance since, in accordance with Article 314(7), point (b) of the CRR, payments received from insurance or reinsurance policies purchased must not be used in the calculation of the Business Indicator. This ensures consistency and comparability across institutions. The SREP distinguishes between inherent risk and the effectiveness of risk management and mitigants. Inherent risk reflects the underlying level of operational risk exposure before the effect of controls or risk transfer mechanisms. Insurance and other mitigants are assessed separately as part of the evaluation of internal governance No change

261 and risk management, and may be considered in the overall SREP outcome where appropriate. However, using net from insurance losses for the assessment of inherent risk would not be consistent with this framework and could obscure the institution’s underlying risk profile. The SREP GL will therefore remain aligned with the CRR framework and continue to rely on gross loss from insurance information for the assessment of inherent operational risk. Metrics in relative terms A respondent suggested clarifying in paragraph204 that the metrics used should be expressed in relative terms as the use of absolute metrics in the SREP assessment could result in undue size bias and potential double counting, while a relative assessment would better reflect the institution’s risk profile and ensure consistency between Pillar 1 and SREP assessments. A respondent proposed to clarify in paragraph211 that existing provisions already constituted by the institution should be considered as a mitigating factor The SREP assessment should be risk-based and forward-looking and not intended to replicate the calibration of Pillar 1 requirements. The SREP GL do not prescribe the exclusive use of absolute metrics and supervisors are expected to exercise judgement and may use both absolute and relative indicators, as appropriate, to ensure a proportionate and risk-sensitive assessment. In certain cases, absolute metrics may provide relevant information on the scale and potential impact of operational risk exposures. It is noted that the assessment in paragraph 209 focuses on the institution’s underlying exposure to legal risk on a forward-looking basis. While No change No change

262 to support a more comprehensive and risk-sensitive view of the institution’s exposure to legal risk. A respondent recommended to consolidate paragraph225 with section 6.4.2.2 (Model Risk) to reduce repetition. existing accounting provisions may be considered as part of the overall supervisory assessment, they do not eliminate the underlying risk or the uncertainty surrounding potential outcomes. The EBA acknowledges the benefit from consolidating paragraph 222 with section 6.4.2.2 on model risk to improve coherence and enhance clarity of the SREP GL. Paragraph 222 moved before paragraph 212. Supervisory considerations for assigning an operational risk score A respondent suggested to further specify qualitative descriptors or support them with quantitative criteria or clear benchmarks, where possible, when considering inherent risk to assess frequency and severity. This could help reduce subjectivity and enhance consistency of the SREP assessment across institutions. It was further proposed to add clarity on supervisory expectations regarding the use of scenario analysis within the inherent risk assessment, including its role, calibration and interaction with other elements of the operational risk framework. The qualitative descriptors referred to are intended to allow for a proportionate and risk￾based assessment across institutions with diverse business models and risk profiles. The SREP GL do not introduce mechanically binding quantitative thresholds, as this could reduce supervisory flexibility and risk sensitivity. Since the initial SREP GL, scenario analysis was recognised relevant as a forward-looking tool within the operational risk framework. The use, calibration and integration of scenario analysis are assessed as part of the review of the institution’s risk management and internal No change

263 governance arrangements, taking into account proportionality and the nature, scale and complexity of activities. Further prescriptive clarification is therefore not considered necessary. Status of OpRisk technical standards A respondent noted that paragraph195 does not reflect the draft status of the first three RTS related to operational risk. The EBA takes note of the comment, and it is clarified that the first three RTS related to operational risk were referring to the final draft RTS published by the EBA. In this regard, amendments have been made to clarify in the separate list. Removal of related tables and development of a separate list of legal acts to be published on the EBA website. Use of business lines A respondent suggested removing the reference to business lines in the context of operational risk or clarifying the references are not intended for operational risk assessment purposes to avoid misalignment with the current Pillar 1 framework. The reference to business lines (paragraph 202) is used in a descriptive context, without implying supervisors should apply the previous business line categorisation for the purposes of the operational risk assessment or creating misalignment with the Standardised Measurement Approach under the CRR. Accordingly, no amendment is considered necessary. No change Operational Risk Metrics, Loss Treatment and Comparability A respondent proposed that operational risk assessments should rely on relative, normalised metrics rather than absolute ones, the framework should distinguish historical losses from current It is noted that the SREP assessment of operational risk under the CRD Articles 97 and 104 does not intend to replicate Pillar 1 requirements, nor to rely mechanically on No change

264 operational risk, and it should also differentiate manageable from non‑manageable losses. It was also proposed that internal risk metrics be recognised as not comparable across institutions, and therefore used cautiously in benchmarking, and that horizontal comparisons of loss data be avoided, given the lack of consistent industry‑wide loss‑recording practices. Lastly, it was proposed to not take into account credit boundary events when assessing operational risk gross losses to avoid overlap between credit and operational risk assessments. individual metrics. Further, the SREP GL do not prescribe the exclusive use of absolute or relative indicators. Supervisors may use a combination of both, as appropriate, to ensure a proportionate and risk-sensitive assessment. Historical losses are one input into the analysis and should not be applied mechanically, in particular where root causes have been addressed. Supervisors are also expected to consider the nature and drivers of losses, including the institution’s resilience and response capacity. Internal metrics are assessed within a harmonised supervisory framework to promote consistency, while acknowledging institution-specific methodologies. In line with the CRR, gross losses provide a consistent basis for assessing underlying exposure, while insurance and other mitigants are considered separately in the evaluation of risk management and control effectiveness. Accordingly, no amendments to the Guidelines are considered necessary. Reputational risk Two respondents noted that the way reputational risk implications can be identified, quantified and compared between institutions in order to ensure a proportionate approach remains subjective. One of these participants suggested removing reputational It is acknowledged that the assessment of reputational risk involves a degree of supervisory judgement. As set out in the existing SREP GL, reputational risk is typically a consequence or amplification channel of other No change

265 risk from the operational risk section. Another participant suggested clarifying in section 6.4.4 that strategic and reputational risks should not form part of the operational risk assessment but instead be assessed under the relevant underlying risk category, depending on their source, consistently with the approach outlined in the introductory section of the Guidelines. risk categories rather than a standalone risk type. Supervisors are expected to assess it in a proportionate manner, taking into account institution-specific circumstances and using a combination of quantitative and qualitative indicators to ensure comparability across institutions. Concerning the suggestion to exclude strategic and reputational risks from the operational risk assessment, the SREP GL already clarify in the introductory section that risks should be assessed under the relevant underlying risk category, depending on their source. Accordingly, strategic and reputational risks are not treated as independent risk categories within the operational risk assessment but are considered in connection with the originating risk drivers. Further clarification in Section 6.4.4 is therefore not deemed necessary. Q11. What are the respondents’ views on the introduction of operational resilience (section 6.4.5)? Introduction of operational resilience Some respondents raised concerns that the introduction of ‘operational resilience’ as a holistic concept in the SREP lacks a clear legal or regulatory basis, goes beyond DORA’s mandate, and risks creating a new supervisory framework without Level 1 legislation or dedicated consultation. On the other Operational resilience constitutes an integral element of the robust governance arrangements and adequate internal control mechanisms required under Article 74 of Directive 2013/36/EU (CRD). Operational resilience-related elements are already Explanatory text has been added in the ‘Background’ section to clarify the introduction of operational

266 hand, some respondents clearly support operational resilience, which is consistent with the direction of supervisory developments, including BCBS framework, and with the holistic view expected under DORA, provided it avoids duplicative or parallel related testing by building on existing elements and work already performed by institutions. evaluated through the existing EU legal and regulatory framework (e.g. the CRD/CRR, DORA, EBA GL). The integration of operational resilience should be seen as a coherent supervisory consolidation of existing requirements, not as imposing new requirements. The introduction of operational resilience does not introduce a new framework, nor it intends to introduce duplicative reporting or testing beyond the requirements already established across the EU regulatory framework. The supervisors would be expected to form a view on the institution’s operational resilience approach leveraging existing information provided by the institutions. The comment on paragraph 242 is noted and it is clarified the reference to ‘maturity level’ did not intend to undermine the application of proportionality principle. In this regard, to better reflect a risk‑based supervisory assessment and to support consistent application the wording has been adjusted to place greater emphasis on the effectiveness of the institution’s operational resilience approach, taking into account the nature, scale and complexity of the risks to which it is exposed. resilience. Paragraph 242 has been adjusted to refer to the effectiveness of the institution’s operational resilience approach. Proposal for a new taxonomy and clarification on operational resilience maturity Some respondents suggested (i) establishing a consistent taxonomy that explicitly defines the concepts of operational resilience, operational risk, ICT risk, and digital operational resilience, outlines their interrelationships, and specifies which elements fall under the operational resilience assessment versus other frameworks, and (ii) avoiding vague concepts such as ‘maturity level’ or undefined notions of resilience.

267 Impact on smaller institutions Few respondents mentioned that the introduction of operational resilience could impose additional and potentially disproportionate requirements on smaller, less complex institutions. It was proposed that further proportionality measures be clarified (for example in paragraph244), existing elements be used and additional reporting/testing burdens beyond DORA be avoided. Operational resilience applies to all institutions, in a proportionate manner, as disruptions can occur to all institutions and can jeopardise their ability to deliver critical services, undermine trust and potentially cause wider market disruption. The introduction of operational resilience does not intend to introduce duplicative reporting or testing beyond the requirements already established across the EU regulatory framework. The supervisors would be expected to form a view on the institution’s operational resilience approach leveraging existing information provided by the institutions. Explanatory text has been added in the ‘Background’” section to clarify the introduction of operational resilience should not impose additional requirements. Paragraph 241 has been adjusted to refer explicitly to the application of proportionality principle. Materiality thresholds for register of information A respondent proposed the CAs to apply materiality thresholds when using DORA register of information for the SREP (e.g., based on contract value or exclude low-impact contracts) or simplifying function identifiers and to avoid ad-hoc granular information requests unless justified by specific supervisory concerns. These would reduce reporting burden for the institutions without weakening oversight and make the SREP use of ROI data more proportionate and effective. It is clarified that the content and reporting requirements of the DORA register of information are not defined in the SREP GL. As mentioned in the draft revised GL, the DORA register of information is one of the information sources the supervisors should utilise to assess the institution’s ICT risk. The materiality threshold is acknowledged and considered to support one of the objectives of this revision towards a more risk-based and proportionate supervisory approach. However, it is clarified Paragraph 213(e) has been amended to focus on C&I functions.

268 that this should not restrict CAs’ supervisory work. Contractual arrangements A respondent proposed to clarify that contractual matters should be addressed separately under DORA. Another respondent requested enabling the competent authorities to recognise and consider the use of standardised contractual terms on operational resilience as reliable evidence of resilience for third‑party dependencies supporting critical or important functions. It was further proposed that risk oversight be harmonised through accredited audit regimes based on agreed auditing standards, which could be developed jointly by the ESAs-ENISA. Contractual requirements on third-party services are comprehensively addressed under DORA and the EBA Guidelines on the sound management of third-party risk management. The SREP GL do not duplicate those provisions but assesses, from a prudential perspective, whether institutions effectively implement and manage them within their overall risk management framework. No change Introduction of a new framework Few respondents proposed to refrain from referring to ‘operational resilience framework’ in paragraph68(c) as there is currently no explicit regulatory requirement. The intention of the provision is not to introduce an additional framework but rather to ensure that institutions adopt a coherent and proportionate approach embedded within their existing frameworks/arrangements. Explanatory text has been added in the ‘Background’ section to clarify the introduction of operational resilience. Residual risk as an assessment basis Few respondents suggested further clarifying that the operational resilience assessment should be based on the residual risk rather than inherent risk to enable a more proportionate, risk‑sensitive and outcome‑based supervisory approach. The revised SREP GL further promote a proportionate and risk-based supervision. It is noted that risks were already assessed on a net basis, considering both inherent risks and the effectiveness of controls. The supervisory view on the institution’s operational resilience should therefore reflect the institution’s mitigation No change

269 capacity and continuity capabilities rather than inherent exposure alone. At the same time, given its forward-looking and cross-cutting nature, forming such a view requires supervisory judgement and should not be reduced to a purely residual-risk metric. Operational resilience and operational continuity in resolution A respondent noted that operational resilience and operational continuity in resolution (OCIR) should be aligned under the BIS Principles as a single, integrated resilience model, so that DORA and OCIR rely on shared governance, assessments, testing and information sets, avoiding duplication between supervisory and resolution requirements while simplifying supervision and reducing reporting and compliance burdens for institutions. It is acknowledged that both operational resilience and operational continuity in resolution (OCIR) rely on similar elements such as governance, identification of critical functions, operational dependencies and testing. However, the two areas serve distinct purposes and fall under separate supervisory and resolution mandates. Authorities could leverage the overlapping areas in their respective assessments (e.g. documentation, scenario testing outcomes, registers and critical function mappings) to reduce duplication and supporting efficiencies, without necessitating formal integration into a single framework. No change Further clarity on certain terms A respondent requested further guidance on the terms ‘timely reporting’ and ‘major deficiencies’ (paragraph245b) as it would help institutions design effective escalation and governance processes. Another respondent proposed to include specific These terms are used consistently across the EBA products, reflecting a common supervisory understanding. For the purposes of this paragraph, ‘timely reporting’ refers to the prompt internal escalation of relevant information to the management body without No change

270 expectations on the management body in determining and defining ‘active role’. undue delay, once such information is necessary to support effective oversight and decision￾making, and ‘major deficiencies’ are considered significant weaknesses or shortcomings that could materially affect the institution’s ability to deliver its critical or important functions, hence warranting escalation to the management body. Implementation challenges Some respondents indicated lack of coherence across Member States in digital and ICT matters, along with the absence of a fully harmonised supervisory field, resulting in overlapping supervisory requests and an unclear allocation of responsibilities among banks, other regulated entities, and TPSPs. In addition, national initiatives on defence and ICT resilience further increase divergence among banks across jurisdictions. It was therefore proposed to carefully incorporate the following sentence in paragraph 244: ‘However, the supervisory assessment should take into consideration the existing variety across Member States in addressing operational resilience and the relevance of practical obstacles for banks in addressing certain deficiencies related to third-party providers that may not be in the purview of the institutions’. The EBA takes notes of respondents’ concerns regarding supervisory coherence across Member States, overlapping requests, and the allocation of responsibilities in relation to digital/ICT aspects. It is further acknowledged that certain related national initiatives may coexist alongside the Union framework. Supervisory assessments should aim to remain risk-based and proportionate, taking into account the nature, scale and complexity of institutions’ activities, as well as the broader national context in which they operate. It is noted that paragraph 49 already envisages coordination of supervisory activities with other parties directly or indirectly involved in the assessment, in particular when input is required from them. No change

271 Q12. What are respondents’ views on the additional section on CSRBB and the combined score for IRRBB and CSRBB? Concerns on double counting Several respondents voiced understanding of why CSRBB is introduced in the SREP GL but raised concerns that duplication and double counting should be avoided as IRRBB and CSRBB are already holistically addressed in ICAAP. There should be no double counting since in line with the requirements for institutions under the Guidelines on IRRBB and CSRBB (EBA/GL/2022/14), competent authorities should also have separate assessments of CSRBB and other risks, including IRRBB. Also, competent authorities should leverage the knowledge gained on IRRBB and CSRBB from the ICAAP information collected for SREP purposes. No change Transparency on the contributions of each component of IRRBB and CSRBB score Several respondents supported the combined IRRBB and CSRBB score that allows for simplification, provided transparency is ensured on the contributions of each component, and that sub-scores, weightings and individual contributions remain visible and explainable. A minority of respondents favored separate scores (at least initially) given the differing nature and mature of IRRBB and CSRBB. The criteria for the IRRB and CSRBB scoring are in line with the general approach used for scoring in the SREP GL providing flexibility to competent authorities to adapt the weightings of individual components of the score. For the IRRBB and CSRBB score this allows competent authorities to adapt the weightings to the lower degree of maturity of CSRBB compared to IRRBB. Paragraph 249 has been reworded to provide for the reflection of the outcome of the assessment of the individual risks in a summary of findings and an explanation of the main risk drivers. Paragraph 249 has been adjusted to provide for the outcome of the assessment of the individual risks to be reflected in a summary of findings and an explanation of the main risk drivers. Proportionality and phased implementation of CSRBB Several respondents asked for a proportionate and phased implementation of CSRBB, reflecting the lower methodological maturity, limited comparability across banks and EU-specific nature of CSRBB. A progressive approach has been applied to introduce CSRBB in the SREP assessment taking into account the less mature stage of this risk compared to IRRBB. No change

272 The implementation of CSRBB in the EU regulatory framework at the level of Directive 2013/36/EU, in the Guidelines on IRRBB and CSRBB (EBA/GL/2022/14) as regards to the expectations for institutions, and in the SREP GL as regards the assessment by competent authorities in the context of the SREP has been performed in alignment with the BCBS standards. Proportionality in exclusion of idiosyncratic spreads One respondent asked to clarify if idiosyncratic spreads may only be excluded for proportionality reasons, does this imply that institutions of higher SREP categories may not exclude idiosyncratic spreads even if the results were conservative, and which SREP categories would be affected. Proportionality can be applied in the exclusion of idiosyncratic spread in the institution’s measurement of CSRBB as long as it is ensured that the measures will yield more conservative results regardless of the SREP category of the institution. Paragraph 285 has been updated to clarify that the application of proportionality applies across all SREP categories. Paragraph 285 has been updated to clarify the proportionality applies regardless of the SREP categorisation. Proportionality in determination of CSRBB perimeter One respondent asked for paragraph 286 to take into account the principle of proportionality and materiality as not every minor CSRBB sensitivity should lead to mandatory inclusion in the perimeter. Another respondent indicated that paragraph 286 seems to further narrow down the scope of CSRBB. The provision in paragraph 283 is in line with the provision under paragraph 124 of Guidelines on IRRBB and CSRBB (EBA/GL/2022/14) requiring that institutions not exclude any instrument in the banking book from the perimeter of CSRBB ex ante and that any potential exclusion of instruments from the relevant perimeter should be done in the case of the absence of sensitivity to credit spread risk, and should be appropriately documented and justified. It is a prerogative of the institutions to define the criteria under which No change

273 the instruments are to be considered sensitive to credit spread risk. Application of SOTs at consolidated level Several respondents asked to clarify in the SREP GL that for supervisory outlier tests (SOTs) where a legal entity appears as an ‘outlier’ based on the solo level indicators, if the SOT thresholds are met at consolidated level, the bank should not be considered as an ‘outlier’ for the purpose of the IRRBB score acknowledging that this risk is often managed at group level. Similar to the Guidelines on IRRBB and CSRBB (EBA/GL/2022/14), also the SREP GL apply at the entity level (i.e. at the level of institutions as defined in point 3 of Article 4(1) of Regulation (EU) No 575/2013). The level of application is in line with the level of application of requirements applicable to the institution under Regulation (EU) No 575/2013 and Directive 2013/36/EU, including the SOT requirement under the CRD Article 98(5), and an assessment at the individual entity level can allow to identify vulnerabilities specific to certain entities, which can be relevant in a broader context. Furthermore the IRRBB score is determined on the basis of the overall assessment (including the SOT) and evaluation that the institution’s management of IRRBB is adequate and that the institution is not excessively exposed to IRRBB. No change Role of NII SOT in SREP assessment One respondent voiced strong support for the fact that the NII SOT is not used directly in the final SREP assessment but pointed out that its binding legal status elevates it far beyond the complementary measures. This raises a risk that in practice the legally binding threshold will play a dominant role compared to the non-binding additional dimensions designed to provide a broader economic perspective (market￾The NII SOT is reflected in the EU regulatory framework in accordance with Article 98(5) of Directive 2013/36/EU. However, the provision under Article 98(5) does not provide for an automatic link between the identification of an institution as an outlier under the SOT NII and the use of measures and specifically mentions that competent authorities shall not be obliged No change

274 value effects, administrative and operating expenses, net fees and commissions, embedded gains/losses). to exercise supervisory powers where they consider, based on the review and evaluation that the institution’s management of IRRBB is adequate and that the institution is not excessively exposed to IRRBB. In accordance with the Level 1 text, the SREP GL provide in paragraph 258 for competent authorities to consider analysing additional dimensions to complement the NII outlier test. Reflect the broader set of earnings-related aspects One respondent suggested complementing table 12 the criteria on the sensitivity of earnings to changes in interest rates, with a reference to the consideration of the additional dimensions of earnings related aspects under paragraph 261. Paragraph 258 already provides for an analysis of the additional dimensions to complement the assessment where an institution is identified as an outlier by the supervisory outlier test on net interest income. Also, in table 12 an already extensive reference to the profitability dimension is provided. No change Structural interaction between EVE and NII sensitivities One respondent pointed out that the structural interaction between EVE and NII sensitivities means that some configurations in table 12 are unlikely to arise under standard balance-sheet positioning across the rate cycle, and asked for clarification on how the scoring criteria should be applied to enhance consistency, reflect the economic realities of IRRBB and prevent unintended penalisation of prudent ALM practices. The criteria outlined in table 12 are not cumulative (i.e. not all of the criteria must be met for a given score). No change Q13. What are the respondents’ views on the proposed assessment of the interaction between Pillar 1 and Pillar 2 requirements and on the proposed approach for operationalising concerning cases where an institution becomes bound by the output floor?

275 Holistic and risk￾based reassessment of P2R when Pillar 1 changes materially Respondents expressed consensus on the need to avoid double counting between Pillar 1 and Pillar 2, with repeated calls for a holistic, risk-based reassessment of P2R when Pillar 1 changes materially (e.g. CRRIII, output floor), and for clearer scope of application of paragraph 297. The current wording already ensures that competent authorities conduct a holistic assessment to preserve the ongoing complementarity between P1R and P2R in the event of material regulatory changes to the Pillar 1 framework. For the sake of clarity, a more explicit reference has been introduced to TREA dynamics, the potential ongoing impact of the output floor implementation, and the possibility of adjusting (either upward or downward) the level of P2R to ensure that its calibration remains appropriate to the institution’s risk profile in light of its P1R. With regard to arithmetic effects, the term ‘undue’ has been removed from paragraph 317 to avoid potential confusion. Once any double counting between P2R and the output floor has been identified and eliminated, the ongoing impact of the output floor is considered as part of the holistic assessment referred to in paragraph 294, without the need to repeat all the steps (including the continued application of the P2R ‘temporary cap’) set out in paragraph 317. Change to paragraphs 294 and 317 and clarification in the background and rationale. Neutralisation of arithmetic effects Many respondents argued that ‘arithmetic effects’ arising from the output floor should always be neutralised, in addition to any P2R set to address regulatory model deficiencies. They further contended that this neutralisation should be applied over time for as long as the output floor is binding (including the impact of transitional factors), in order to avoid mechanical and unwarranted increases in P2R. Use of P2R/P2G to address governance and Respondents requested clarification on how findings related to BMA and governance aspects may translate into supervisory measures, ensuring that any impact The Guidelines already recall, in paragraph 298, the situations listed in Article 104a(1) of Directive 2013/36/EU, including deficiencies in No change.

276 business model deficiencies on P2R or P2G is confined to cases involving clearly identifiable prudential implications and does not overlap with risks already captured under P1R. internal governance – such as internal control arrangements and other shortcomings – as well as risks arising from the institution’s business model, where other supervisory measures have not been effective or are considered insufficient to address the identified deficiencies. Interaction between P2G and macroprudential buffers Respondents called for a more systematic or clearer offset between P2G and macroprudential buffers (particularly the CCyB) in stress scenarios. It was argued that the CCyB would be systematically released in stress scenarios such as those used in the EU-wide stress test and should therefore be offset against the P2G. Other respondents cautioned more broadly against weakening the distinction between micro- and macroprudential objectives. In principle, under the current framework, only limited overlap between P2G and the CCyB is expected, and this is already addressed in the SREP GL, including considerations about the design of the stress scenarios. However, it is not evident why the CCyB would be systematically released in the scenarios adopted for the EU￾wide stress test, nor how this would consistently overlap with the P2G. No change. ORC in SREP scoring Respondents expressed some reservations about including Overall Recovery Capacity (ORC) in SREP scoring for capital and liquidity adequacy, citing subjectivity, lack of comparability, short time horizons, risk of double counting and increased complexity, alongside calls for much greater transparency if ORC is retained. It is further clarified that the objective is not to create a mechanistic link between ORC and the capital and liquidity adequacy scores, but rather to consider it as one of the many elements contributing to the resilience of an institution’s capital and liquidity profile, with the aim of fostering a stronger risk management continuum between ongoing supervision and crisis preparedness. Clarification in the background and rationale. Q14. What are the respondents’ views on the merger with the ‘SREP liquidity assessment’ and the merger of the scores into a combined liquidity and funding adequacy score?

277 Clarification on group-level versus entity level responsibilities Several respondents asked for clarification on group-level versus entity-level responsibilities, with strong agreement that while all material legal entities should be covered, findings and remediation in consolidated groups should be coordinated and steered by the consolidating entity, recognising group￾wide liquidity management frameworks and intra￾group support arrangements. Title 10 provides guidance on the SREP assessment in the cross-border or group context taking into account interactions between the assessments at individual entity level and consolidated level, reflecting strengths and mitigating factors related to the entity being part of the group, taking into account the group dimension, including inter-dependencies and intra-group arrangements. No change Transparent methodology A few respondents asked for a clear and transparent methodology, weighting and benchmarking, including explicit explanation of how liquidity vs. funding components are weighted, peer benchmarking is performed, and results influence the final score. The criteria for the combined liquidity and funding adequacy scoring are in line with the general approach used to scoring in the SREP GL, providing flexibility to competent authorities to adapt the weightings of individual components of the score. Paragraph 371 provides for the outcome of the assessment of each individual risk to be reflected in a summary of findings and an explanation of the main risk drivers. No change Transparency on the individual components of the combined score Several respondents supported the combined liquidity and funding adequacy score allowing for simplification, with respondents asking to ensure transparency of the individual assessments of the two components (liquidity and funding) and their impact on the overall score. The criteria for the combined liquidity and funding adequacy scoring are in line with the general approach used to scoring in the SREP GL providing flexibility to competent authorities to adapt the weightings of individual components of the score. Also, paragraph 422 allows competent authorities to use intermediate scores for liquidity and funding risk where relevant. Paragraph 371 provides for the outcome of the assessment of each individual No change

278 risk to be reflected in a summary of findings and an explanation of the main risk drivers. Integration of ORC One respondent asked to clarify what considerations competent authorities can consider if they should include the score of the liquidity overall recovery capacity in recovery planning when setting the liquidity and funding adequacy score. The integration of the ORC in the capital and liquidity and funding adequacy scoring allows CAs to positively reflect a sounder recovery planning in those scores. If the overall recovery capacity in the context of liquidity adequacy is considered to be weak this should also be reflected in the determination of the liquidity and funding adequacy score No change Significant impact in the liquidity and funding score A few respondents suggested to clarify in paragraph 29 of Title 2 what makes an impact significant in the liquidity and funding score. The risk scores aim to capture the likelihood that the risks to capital, liquidity and funding will have a significant impact on the institution. When assigning risk scores, SREP elements’ scores and the overall SREP score, competent authorities should refer to the supervisory considerations outlined in the tables at the end of each relevant section and title of the SREP GL, alongside the application of supervisory judgment. The SREP element scores and the overall SREP score indicate the magnitude of risks to the institution’s viability. No change Level of detail in potential funding and liquidity measures One respondent suggested that the level of detail in potential funding and liquidity measures appears extensive compared to capital measures and some of these could influence a bank’s strategic decisions. Following the streamlining, at the end of the Title 8 a table has been added with a non￾exhaustive, illustrative list of supervisory measures that could be employed by competent authorities to address deficiencies identified in the assessment of liquidity and liquidity risk or No change

279 funding risk. The measures include the quantitative measures previously included in section 9.5 and the supervisory measures previously included in Title 10. Whereas the consolidation of the measures into one table, in particular following the merger of Titles 8 and 9, might give the impression that the list is extensive, it is solely meant as a reference for competent authorities and measures are not meant to be applied mechanically. Interaction between the supervisory liquidity stress testing framework and the LCR framework One respondent suggested clarifying the interaction between the supervisory liquidity stress testing framework (paragraph 386) and the LCR framework and its associated liquidity buffer. The paragraph is addressed to competent authorities and specifies that – when designing and calibrating supervisory liquidity stress tests – supervisors may consider the LCR stress scenario (and its calibration) as a starting point, but are also encouraged to extend the scope and calibration of such stress tests (e.g. by looking beyond the 30 calendar day time horizon of the LCR and also applying a calibration that is more severe than the LCR stress scenario). No change Q15. What are the respondents’ views in relation to enhanced communication aspects? Enhanced transparency and communication of SREP outcomes Several respondents indicated that greater transparency and clearer methodology are needed for risk scoring and overall SREP scoring, especially clearer justification of scores, material risk drivers, and deficiencies, to help institutions prioritise remediation and allocate resources efficiently. Respondents The EBA acknowledges the support for enhanced transparency. The revised SREP GL already provides sufficient guidance on the communication of SREP outcomes (including the SREP score and justification providing a clear indication of the material risk drivers Paragraph 448(b) has been amended to refer to material supervisory findings and the appropriate

280 suggested clarifying how overall SREP scores are derived from sub-scores, defining drivers for supervisory judgement, and specifying how inherent risk and risk management controls are assessed. Respondents indicated that communication of SREP outcomes could be improved. A wording proposal on paragraph 39 suggested the following: ‘shall disclose to institutions the SREP scores for relevant elements or sub-elements.’ contributing to the P2R) in a manner that preserves the necessary supervisory flexibility while providing institutions adequate clarity to prioritise remediation and allocate resources efficiently. Slight adjustment to focus on material findings and remediation. timeframe for remediation. Transparency on P2R composition and calibration Repeated demands for transparency on P2R composition and calibration, including clearer explanation of how scores translate into P2R/P2G, breakdowns by main risk drivers, and communication of ‘before/after’ effects where relevant. The calibration and composition of P2R and P2G, including the translation of SREP scores into capital requirements and guidance, involve supervisory judgment that is institution-specific and inherently sensitive. The current SREP GL provides sufficient guidance on the communication of SREP outcomes while preserving the necessary supervisory discretion in this regard. Moreover, timely communication throughout the findings’ lifecycle is already embedded in the existing guidance on SREP communication. No amendments are therefore considered necessary. No change Granularity in communicated scores Calls for greater granularity in communicated scores, including disclosure of element and sub-element scores, qualifiers and severity labels for qualitative requirements, and consistent treatment across group and subsidiary levels. Higher communication granularity is already envisaged in the revised consultation paper, on a material risk basis. No change

281 Benchmarking transparency Support for benchmarking transparency, with requests that peer groups, criteria and results be clearly defined and systematically communicated to institutions but not used mechanically as enforcement tools. It is not clear how disclosing peer groups would be beneficial in fostering higher-quality supervisory dialogue. No amendments are therefore considered necessary. No change Preservation of supervisory discretion and flexibility Caution against over-standardisation of communication, with some respondents stressing the need to preserve supervisory discretion and flexibility, particularly for LSIs and timing of communication. No specific communication template is foreseen in the GL. No change Q16. Do you consider the coverage and level of detail of Title 10 appropriate for its intended purpose? Interaction between consolidated and local assessments A few respondents asked for a clearer articulation between consolidated and local assessments, including how group-level tools (stress tests, recovery planning, ORC) should inform entity-level SREP decisions to avoid fragmentation. Title 10 provides guidance on taking into account key vulnerabilities in the cross-border or group context and reflecting strengths and mitigating factors related to the entity being part of the group into the assessment of the individual entities of the group (paragraph 465); using views on key dependencies on the parent/group as an input into the joint assessment and decision for the group (paragraph 466); adjusting assessments of individual entities based on the outcomes of the college discussions (paragraph 468); discussing in the college context deficiencies related to No change

282 intra-group positions of an individual entity considering the overall group dimension, including the consolidated group business model, strategy and existence and specific features of intra-group financial support arrangements (paragraph 469); discussing and coordinating within the college details of the application of benchmarks used for the assessment of SREP elements, where common deficiencies are identified across all entities coordinating the assessment and supervisory response and deciding whether measures should be imposed at a consolidated level or proportionally at entity level (paragraph 474(b)); discussing outcomes of the supervisory benchmark calculations used to determine P2R for all entities within the group and at consolidated level (paragraph 474(d)). Coordination within supervisory colleges Several respondents suggested stronger coordination within supervisory colleges in the following areas: (i) fostering convergence, especially to harmonise methodologies for cross-border banking groups; (ii) guaranteeing flow of information between competent authorities; The role and tasks of colleges of supervisors are set out in Commission Delegated Regulation (EU) 2025/791 and in Commission Implementing Regulation (EU) 2025/790 aimed at ensuring a consistent, efficient and effective functioning of colleges of supervisors and to facilitate cooperation and coordination between competent authorities including for the planning of supervisory activities, for the SREP No change

283 (iii) supporting coordinated planning of supervisory actions and intervention measures; (iv) managing divergent home/host views; (v) managing the complexity of cross-border financial groups to ensure the vulnerabilities arising from individual entities are properly assessed in their group-wide context while recognising that consolidated supervision should not prevent local authorities from adopting proportionate measures in response to risks that are specific to a particular entity or market. assessment and for the joint decision process. The colleges of supervisors shall also facilitate the identification of early warning signs, potential risks and vulnerabilities for the group and its entities, and increase the effectiveness and efficiency of the group supervision. In this context we also refer to the review of the Implementing Technical Standards on joint decisions on institution-specific capital and liquidity requirements in colleges of supervisors under Article 113 of Directive 2013/36/EU, and to the work on enhanced and integrated coordination between public authorities under recommendation 14 of the EBA Report on the efficiency of the regulatory and supervisory framework (EBA/REP/2025/26). Moreover, the common SREP GL aim to harmonise the methodologies used for the SREP; and Title 10 provides for the coordinated execution of the SREP assessment and the coordination of planned supervisory and early intervention measures and joint decisions for cross-border groups.

284 Planning of supervisory activities Several respondents asked for more predictability and better planning of the supervisory activities with the Yearly Supervisory Examination Programmes (SEP) to be submitted for prior feasibility/impact assessment to competent authorities and supervised entities to allow orderly execution on both sides. The role and tasks of colleges of supervisors are set out in Commission Delegated Regulation (EU) 2025/791 and in Commission Implementing Regulation (EU) 2025/790 aimed at ensuring a consistent, efficient and effective functioning of colleges of supervisors and facilitating cooperation and coordination between competent authorities, including for the planning of supervisory activities, including off￾site activities and onsite inspections, and areas of joint work. The comment will inform the ongoing implementation of the recommendations in the EBA Report on the efficiency of the regulatory and supervisory framework (EBA/REP/2025/26), in particular the set-up of supervisory platforms that bring together authorities from different horizons in pilot cases for specific institutions (recommendation 14). No change Group-wide consolidation of risks A few respondents voiced support for group-wide consolidation of risks beyond capital and leverage, with requests to pay more systematic attention to risk concentration, contagion channels and cross-sectoral risks within groups. The SREP GL provide for the assessment of contagion risks in the liquidity context as per paragraph 376(b) and of key vulnerabilities in the cross-border or group context (paragraph 465), specific deficiencies related to intra-group positions (paragraph 469), and cross-border No change

285 prudential implications of ML/TF risks and concerns (paragraph 470(f)). Proportionality and avoidance of undue burden on groups A few respondents asked for proportionality and avoidance of undue burden on groups, particularly where subsidiary-level measures deviate significantly from group-wide frameworks without clear risk justification. The SREP GL provide for competent authorities to consider the assessment of the materiality of risks and deficiencies at consolidated and individual entity level, to coordinate the assessment and supervisory response and decide whether measures should be imposed at consolidated or entity level where deficiencies identified are common across all entities, and for competent authorities to coordinate the application of supervisory and early intervention measures to the group and its material entities. No change Q17. Do you consider the coverage and level of detail of Title 11 appropriate for its intended purpose? Use of AQR in supervisory stress test Respondents noted that the current wording on the use of the outcomes of asset quality reviews (AQR) when designing and conducting supervisory stress tests for SREP purposes in paragraph 490 could potentially lead to inconsistencies and suggested it may need further clarification. The reference to AQR in the supervisory stress test has not been amended with respect to the previous version. As specified in the remaining part of the paragraph, AQRs may help ensure that the balance-sheet positions of the institutions covered by the supervisory stress tests are reported accurately with improved and comparable starting points across participating institutions. No change

286 Target capital ratios in stress test Respondents called for more predictable rules on target capital ratios, regarding the conditions under which they are set, how they relate to P2G and buffers, and how they are communicated. The title focuses on the use of supervisory stress testing, its key elements, and the organisational and governance arrangements within competent authorities. In this context, the possible use of target capital ratios – which are not explicitly mentioned in the guidelines – may fall within the broader uses of supervisory stress testing, including the assessment of institutions’ ability to meet the TSCR and OCR. However, it remains in the competent authorities’ remit whether to define and use such ratios. No change Prudent timeline and design for new resilience￾oriented and ESG￾related scenarios Respondents suggested that new resilience-oriented stress tests, including those incorporating ESG factors, should build on existing frameworks and should not be launched before a sufficiently mature EU-wide approach has been agreed, ideally not before the 2029 EU-wide stress test. The reference to the integration of ESG factors into supervisory stress testing has already been made at a high level. The design of future EU￾wide stress tests is outside the scope of these guidelines. No change Use of institution’s internal data and methodology Respondents encouraged competent authorities to leverage, to the largest extent possible, institutions’ internal models and data, with supervisory overlays where necessary. One of the potential uses of supervisory stress testing is to support competent authorities in assessing the reliability of institutions’ stress￾testing programmes. Accordingly, while competent authorities should have a sufficient understanding of the internal models and data underpinning institutions’ stress-testing frameworks, those models and data are not No change

287 expected to constitute the main basis for the supervisory stress test Articulation between supervisory stress test and other SREP elements Respondents noted it would be helpful for the Guidelines to clarify how stress test outcomes will be articulated with other SREP assessments to ensure consistency and avoid double-counting of risks. Paragraph 483 already covers the relationship between supervisory stress test and other relevant SREP elements. No change Proportionality in supervisory stress testing Respondents suggested including additional guidance on how to achieve greater proportionality, in particular through simplification options for institutions in SREP categories 3 and 4. Proportionality elements are addressed on a cross-cutting basis in Title 2, rather than in the specific title. No change Q18. Do respondents consider the guidance for the assessment of third-country branches appropriate and sufficiently clear? Scope of application Several respondents asked for clarification on the scope of application, especially whether the guidance applies only to the list of third-country branches published by the EBA on 13 October 2025 or more broadly based on materiality and supervisory judgement. Paragraph 494 has been updated to clarify that Title 12 should be applied for third-country branches as defined in Article 47(3) of Directive 2013/36/EU. Paragraph 494 has been updated to clarify the scope of application of Title 12. Application of proportionality One respondent asked to apply increased proportionality for class 1 branches which are part of a G-SII and allow for a lower assessment frequency of the SREP elements than an annual review. For class 1 TCBs, competent authorities should apply at a minimum the level of supervisory engagement for category 3 institutions as set No change

288 out in table 1 of section 2.4.5, thus evaluating all SREP elements at least every three years. As for all SREP categories, competent authorities should provide an annual summary of the overall SREP assessment. Home-host cooperation Several respondents focused on structured home–host cooperation and information sharing, and requested clearer channels for information sharing, and consultation with the home authority where host measures depend on group-level policies, systems or arrangements. The modalities for the cooperation between competent authorities and the functioning of colleges of supervisors for third-country branches under Article 48p of Directive 2013/36/EU are set out in draft Regulatory Technical Standards on cooperation and colleges of supervisors for third-country branches (EBA/RTS/2026/02) published on the EBA website in January 2026 and submitted to the European Commission for adoption. In line with the requirement under Article 48p(b) and (c) of Directive 2013/36/EU, the draft Regulatory Technical Standards also provide for competent authorities to exchange information on the results of the SREP and to endeavour to align the application of the supervisory measures and powers referred to in Article 48o of Directive 2013/36/EU. No change

289 Branch independence A few respondents raised concerns about excessive expectations of branch ‘independence’, stressing that branches are legally dependent parts of the parent and that requirements should remain proportionate and avoid costly duplication of resources. Whereas a branch is, by nature, a legally dependent part of its parent institution and can be subject to a range of intragroup dependencies such as for funding/liquidity support, risk transfer arrangements, shared services/ICT reliance, and outsourcing to group entities, the branch is functioning in a local context and is subject to legal requirements and local supervision to ensure consumer protection and safeguarding of financial stability. Hence it should ensure sufficient independence towards the group in terms of governance and risk management to safeguard its safety, soundness and viability and its capacity to fulfil its commitment to clients and counterparties. No change Use of subcontractors One respondent asked for clarification of access to information when using subcontractors and suggested the wording should be amended to avoid overly broad interpretations by limiting the scope to information the head undertaking has access to and that is necessary for the third-country branch to exercise its monitoring obligations, including when subcontractors are used. The current provision limits the access to information to the information that is required for the third-country branch to exercise its monitoring. The wording in paragraph 515 has been amended to clarify the access to information for exercising the monitoring obligations of the third-country branch. Paragraph 515 has been updated to clarify the access to information for exercising the monitoring obligations of the third-country branch

290 Aggregation of SREP score A few respondents asked for clarification on the aggregation logic for the SREP outcomes for third￾country branches, and how the overall viability score is derived from the individual components. The criteria for the scoring of the viability of third-country branches are in line with the general approach used for scoring in the SREP GL, providing flexibility to competent authorities to adapt the weightings of individual components and aggregate them into the overall score of the viability of the third-country branch defined as its proximity to a point of non￾viability on the basis of the evaluation of whether the arrangements, strategies, processes and mechanisms implemented and the capital endowment and liquidity held by the third￾country branch ensure a sound management and coverage of its material risks. No change Communication of SREP outcomes A few respondents asked for clarification on the modalities for the communication of the SREP outcomes for third-country branches to branch management, to the head undertaking and to the authority responsible for the supervision of the head undertaking (the ‘home authority’), and how findings interact with group-level remediation. Paragraph 528 has been added to provide clarity on the modalities for the communication of the SREP outcomes and related measures for third￾country branches in terms of communication to the management of the third-country branch, and to the authority responsible for the supervision of the head undertaking in accordance with the administrative agreements or other arrangements concluded under Article 48c(2) of Directive 2013/36/EU. Paragraph 528 added to provide clarity on modalities for communication of SREP outcomes for third-country branches