GENERAL GUIDELINES

Financial institutions

GENERAL GUIDELINES AND METHODOLOGY

for the supervisory review and evaluation process for financial institutions

9th edition

March 2026

Table of contents

Introduction 4

1 The Financial Supervisory Authority's supervisory review and evaluation process 6

1.1. General 6

1.2. Significant-institution classification 7

1.3. Monitoring of key risk indicators 8

1.4. Assessment of risk factors and risk assessment score 8

1.5. Overall risk assessment and supervisory measures 15

2 The Financial Supervisory Authority's assessment of additional capital requirements 17

2.1. General 17

2.2. Minimum requirement for capital base 17

2.3. The Financial Supervisory Authority's assessment of additional capital requirements 17

2.4. Combined requirement for capital add-ons 20

2.5. Overall requirement for capital base 21

2.6. Measures in case of insufficient own funds 22

2.7. Notification and public disclosure of the outcome of the Financial Supervisory Authority's supervisory review and evaluation process 22

Annex I 23

Annex II 44

Introduction

Legislation on prudential requirements and supervision of financial institutions is fundamentally the same in all member states of the European Economic Area. In this country, financial institutions operate pursuant to Act No. 161/2002 on financial institutions, cf. Regulation (EU) No. 575/2013 (CRR).1 One of the main roles of the Central Bank of Iceland is to exercise forward-looking and risk-based supervision of the activities of financial institutions in accordance with the same laws, cf. Act No. 87/1998 on public supervision of financial activities.

A financial institution shall have a robust risk management system at its disposal and shall address risk factors in its activities. The board and the chief executive officer of a financial institution shall regularly assess the capital and liquidity needs of the institution in view of its risk level, including risks arising from, or which may result from, its activities. The assessment is carried out in an internal assessment process (en. internal capital adequacy assessment process, ICAAP, and internal liquidity adequacy assessment process, ILAAP), which is generally carried out annually, and the financial institution shall account for the assessment in the so-called ICAAP/ILAAP report.

The Financial Supervisory Authority of the Central Bank of Iceland assesses the risk factors arising from the activities of a financial institution in the supervisory review and evaluation process (en. supervisory review and evaluation process, SREP). In the process, the financial institution's management of the risk factors arising from its activities is also assessed. The supervisory review and evaluation process is carried out annually, every two years or every three years, depending on size, systemic importance, nature, scope and how multifaceted the activities are. The assessment of specific key risk factors is generally carried out annually, and monitoring of key risk indicators takes place at least quarterly.

The objective of these guidelines is to define and inform in general terms the methodology and implementation of the Financial Supervisory Authority's supervisory review and evaluation process. The methodology is in accordance with the European Banking Authority's (EBA) guidelines on the supervisory review and evaluation process and stress testing.2 The EBA guidelines provide a more detailed description of the methodology for the supervisory review and evaluation process which the Financial Supervisory Authority applies in its supervisory practice, and reference is therefore generally made to them for further explanations.

Chapter 1 provides a general discussion of the methodology of the Financial Supervisory Authority's supervisory review and evaluation process. It discusses the significant-institution classification of financial institutions, monitoring of key risk indicators, assessment of the main risk factors in the activities of financial institutions and risk assessment scores, overall risk assessment of the activities of financial institutions and supervisory measures.

Chapter 2 discusses the Financial Supervisory Authority's assessment of the capital requirements of financial institutions and the different types of capital requirements that financial institutions are required to meet. It also discusses measures in case of insufficient own funds and notification of the outcome of the supervisory review and evaluation process and public disclosure of the outcome.

Two annexes accompany the guidelines. Annex I sets out the Financial Supervisory Authority's benchmarks for assessing capital requirements (en. supervisory benchmarks).3 The benchmarks cover business models, governance and internal control systems, credit and concentration risk, market and interest rate risk and operational risk. Annex II discusses capital add-ons and their application.4

[1] See also the relevant delegated regulations and implementing regulations of the EU, which have been adopted on the basis of the Act on financial institutions, and regulations of the minister, rules, guidance of the Central Bank of Iceland and guidelines, recommendations and opinions of the European supervisory authorities for financial markets.

[2] Guidelines on common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing under Directive 2013/36/EU (EBA/GL/2022/03).

[3] Annex I: Benchmarks for assessing additional capital requirements (pillar II-R).

[4] Annex II: Capital add-ons.

The publication of the general guidelines is in accordance with the Act on financial institutions and the Central Bank's policy on public disclosure.5 On the other hand, certain elements of the Financial Supervisory Authority's methodology are not made public, such as variables relating to the significant-institution classification of financial institutions, specific key risk indicators and overall risk assessment scores. In the opinion of the Financial Supervisory Authority, such disclosure may increase the likelihood of regulatory arbitrage and may, depending on the circumstances, work against the supervisory judgement that is intended to underlie the supervisory review and evaluation process.

[5] See the Central Bank's policy on public disclosure of the outcome of administrative cases and, for reference, information published on the basis of Article 107 of the Act on financial institutions.

1 The Financial Supervisory Authority's supervisory review and evaluation process

1.1. General

The Financial Supervisory Authority's supervisory review and evaluation process is in essence carried out in accordance with the provisions of Chapter IX of the Act on financial institutions, cf. Article 107a of the same Act.

The Financial Supervisory Authority examines and assesses the arrangements and methods of a financial institution for assessing risk in order to satisfy the prudential requirements made for that purpose, cf. paragraph 2 of Article 80 of the Act on financial institutions. In the examination, the Financial Supervisory Authority examines the policies and internal processes and their implementation at the financial institution concerned and takes into account the technical benchmarks set out in Article 81 of the Act. The review and assessment process covers all obligations and requirements imposed on a financial undertaking pursuant to the Act on Financial Undertakings and administrative orders issued on the basis thereof, cf. paragraph 3 of Article 80 of the Act. In its assessment, the Financial Supervisory Authority focuses on the following elements:

a. risks that the financial undertaking faces or may face,

b. risks revealed by stress tests, in view of the nature, scope and the extent to which the financial undertaking's activities are diversified, and

c. risks revealed by digital operational resilience testing in accordance with Chapter IV of Regulation (EU) 2022/2554, cf. Act No. 78/2025 on digital operational resilience for the financial market.

On the basis of the review and assessment process, the Financial Supervisory Authority determines whether the arrangements, measures and methods of the financial undertaking, together with its internal processes and their implementation, are adequate, whether governance arrangements are robust and whether its capital base and liquidity position are adequate in view of the risks involved in its activities, cf. paragraph 4 of Article 80 of the Act.

The review and assessment process is divided into several main elements that form its framework, cf. Figure 1. The main elements of the review and assessment process are discussed in more detail in sections 1.2.-1.5.

Figure 1 Framework of the review and assessment process (en. SREP framework)

Significance classification of financial undertakings Timely intervention Monitoring of key risk indicators Overall risk assessment Assessment of risk elements that affect own funds Business model analysis Assessment of risk elements that affect liquidity and funding Assessment of governance and internal control systems Measures relating to own funds Measures relating to liquidity Other supervisory measures Supervisory measures Assessment of inherent risk and risk management Determination of capital requirement and performance of stress test Assessment of capital position Assessment of inherent risk and risk management Determination of liquidity requirement and performance of stress test Assessment of liquidity position

To ensure appropriate supervision of each individual financial undertaking, the Financial Supervisory Authority has defined a minimum-engagement model, cf. Table 1, in which the types of supervisory tasks and their frequency are defined for each significance classification, cf. Article 82 of the Act on Financial Undertakings. The minimum-engagement model describes supervisory tasks which, in the opinion of the Financial Supervisory Authority, are necessary to maintain an overview of risk elements in the activities of financial undertakings. According to the model, a comprehensive review and assessment process is more frequent for a financial undertaking with a high significance classification and less frequent for a financial undertaking with a low significance classification. It is also envisaged that the nature of the reviews and the scope of the work underlying each individual supervisory task shall depend on the significance classification into which the financial undertaking falls and the activities it carries out, cf. a more detailed discussion in section 1.2.

Table 1 Minimum-engagement model*
Significance classification	Monitoring of key risk indicators	Review and assessment process / Determination of capital requirement	Overall risk assessment	Communication with financial undertakings
1.	Quarterly	Annually	Annually	Regular communication with the board and management
2.	Quarterly	Every other year	Annually	Regular communication with the board and management
3.	Quarterly	Every third year	Annually	Regular communication with the board and management
4.	Quarterly	Every third year	Annually	Risk-based communication with the board and management
* This is a simplified version of the supervisory model.

1.2. Impact classification

The Financial Supervisory Authority takes into account the principle of proportionality in its supervisory practice. Financial undertakings are divided into four categories according to impact in accordance with the methodology of the Financial Supervisory Authority, cf. Table 2.

Table 2 Impact classification of financial undertakings
Impact classification	Description
1. High impact	Financial undertakings that can threaten financial stability if they encounter operational difficulties or operational stoppage.
2. Medium-high impact	Financial undertakings that do not threaten financial stability if they encounter operational difficulties or operational stoppage but can nevertheless have considerable effects on the financial system and a large part of customers.
3. Medium-low impact	Financial undertakings that generally have little effect on the financial system if they encounter operational difficulties or operational stoppage but can nevertheless have effects on a certain number of customers.
4. Low impact	Financial undertakings that have insignificant effects on the financial system if they encounter operational difficulties or operational stoppage but can nevertheless have effects on a small group of customers.

The impact classification affects the frequency and scope of the review and assessment process at each individual financial undertaking. In the impact classification, account is taken of the size of the financial undertaking, its systemic importance, the nature, scope and how complex its activities are, cf. the fifth paragraph of Article 80 of the Act on Financial Undertakings. Furthermore, regard is had to the definitions of small and simple financial undertakings and large financial undertakings, cf. points 145 and 146 of the first paragraph of Article 4. CRR. At the same time, the Financial Supervisory Authority may apply a coordinated review and assessment process if financial undertakings have similar risk profiles, though in such a way that due account is taken of the risk that each financial undertaking faces, cf. the sixth paragraph of Article 80 of the Act on Financial Undertakings.

The review and assessment process takes place at a minimum annually, every other year or every third year depending on which impact class the financial undertaking in question falls into. At commercial banks, the process takes place annually. The process covers the entity, consolidated and sub-consolidated basis of the financial undertaking, as applicable at any given time, cf. Article 109 of the Act on Financial Undertakings.

The impact classification is based primarily on information from the financial undertakings' regular data submissions to the Financial Supervisory Authority, on-site inspections1 and other specific inspections (off-site inspections) and other available data and information.

[1] Cf. further the Financial Supervisory Authority's guidance on on-site inspections.

1.3. Monitoring of key risk indicators

The Financial Supervisory Authority monitors key risk indicators at financial undertakings at least quarterly, cf. Table 1, along with monitoring developments in the financial market as a whole. The monitoring involves monitoring changes in the financial position and risk profile of financial undertakings between the times the review and assessment process takes place. Thus, the monitoring can provide an indication of which risk factors need to be examined more closely later. At the same time, the monitoring contributes to the Financial Supervisory Authority's regular reassessment of key risk indicators that it assesses in the review and assessment process.2

In monitoring key risk indicators, the basis is primarily information from the financial undertakings' regular data submissions to the Financial Supervisory Authority.

1.4. Assessment of risk factors and risk assessment score

1.4.1. General

The Financial Supervisory Authority carries out an overall assessment of risk factors in the activities of financial undertakings generally annually, cf. Table 1.

According to Article 81 of the Act on Financial Undertakings, cf. Articles 79 and 80 of the same Act, the Financial Supervisory Authority is required to analyse the business model of a financial undertaking and assess the governance and internal control system of the undertaking and assess individual risk factors in its activities. On the one hand, the Financial Supervisory Authority assesses risk factors that can affect the own funds of the financial undertaking in question, in particular credit, counterparty and concentration risk, risk due to securitisation, market risk, interest rate risk due to non-trading book business and operational risk, along with the risk of excessive leverage, and on the other hand risk factors that can affect liquid funds and funding, in particular liquidity risk and funding risk. The assessment of risk factors is discussed further in sections 1.4.3-1.4.6.

The assessment of risk factors, which affect on the one hand own funds and on the other hand liquid funds and funding, is based on an analysis of inherent risk and risk management and controls at the financial undertaking in question (institution-specific). In other words, the risk assessment is intended to shed light on the underlying risk in the activities of the financial undertaking, taking into account the measures that the financial undertaking in question has taken to reduce the risk.

The basis for the assessment of risk factors includes examinations and analyses of data and information that shed light on potential risk in the activities of financial undertakings and focus on one or more risk factors at one or more financial undertakings at a time. In the risk assessment, use is made, among other things, of regular data submissions and on-site inspections and other specific inspections of individual risk factors and other available data and information.

Following the risk assessment, the Financial Supervisory Authority gives a risk assessment score for each risk factor at each individual financial undertaking, cf. further discussion in section 1.4.7.

1.4.2. Special considerations regarding measures against money laundering and terrorist financing and UFS

The Financial Supervisory Authority places special emphasis on financial undertakings taking increased account of measures against money laundering and terrorist financing alongside the assessment of individual risk factors, since failure in such measures can affect other risk factors in their activities and therefore affect their financial soundness, trust in the financial market and financial stability. In accordance with this, emphasis has been placed on increased cooperation between those responsible for prudential supervision, supervision of measures against money laundering and terrorist financing and the police's financial intelligence unit (FIU), cf. Article 109 dd of the Act on Financial Undertakings.3

Sustainable financial activity contributes to the integration of criteria on environmental and social factors and governance, or ESG (environmental, social and governance, ESG), into the financial services of financial undertakings. It also aims to increase awareness and transparency among financial undertakings about the necessity of reducing risk related to ESG, or ESG risk (ESG-risks), through appropriate governance, in particular with regard to the nature of the risk in

[2] The key risk indicators are based, among other things, on the risk indicators that EBA uses at any given time: Methodological guide – EBA indicators for risk assessment and resolution and DRATs).

[3] Guidelines on cooperation and information exchange between prudential supervisors, AML/CFT supervisors and financial intelligence units under Directive 2013/36/EU (EBA/2021/15).

the longer term and the uncertainty that it entails in connection with valuation and pricing. The risk has been defined as the risk of negative financial effects on a financial undertaking, which arises from current or expected effects of environmental, social or governance factors on a counterparty of the relevant financial undertaking or its assets.4 The Financial Supervisory Authority therefore expects financial undertakings to handle ESG risk in their operations in an appropriate manner, in particular climate-related risks (climate-related risks), in accordance with size, systemic importance, nature, scope and the extent to which the operations are multifaceted.5 A financial undertaking shall emphasise integrating ESG risk into the business model and assessing it in connection with the assessment of other risk factors in the operations, since the risk materialises through traditional types of financial risk. The roles and responsibilities of the board of directors and managing director and other employees with respect to the risk must be defined and adequate knowledge of the risk must be built up and maintained within the relevant financial undertaking. A financial undertaking shall list all important sub-risk factors of ESG risk and define risk appetite with respect to them, as well as ensure regular information to the board of directors on the status of the risk. Furthermore, the metrics in the internal control system of a financial undertaking shall cover the important risk factors within ESG risk, in particular climate-related risk, i.e. both physical and transition risks (physical and transition risks), and they shall be managed in accordance with risk policy and appetite. For this purpose, a financial undertaking shall use stress tests and scenario analysis in assessing the risk. At the same time, a financial undertaking shall publicly disclose significant information on the ESG risk it faces.

1.4.3. Business model analysis (plan and policy)

The Financial Supervisory Authority analyses the business model of a financial undertaking (business model analysis, BMA), cf. item i of the first paragraph of Article 81 of the Act on Financial Undertakings. In the analysis, an assessment is made of factors that are considered capable of threatening the viability6 of the current business model and the sustainability7 of the business policy of the relevant financial undertaking. The business plan and policy of the financial undertaking are analysed and examined with respect to its risk policy and appetite and its operating results in recent years. It is assessed whether the operational and financial assumptions are sufficiently clear and realistic. Consideration is given to whether there are large fluctuations in the financial undertaking's performance and an assessment is made of whether the operating result is in accordance with the plans of previous years. The position of the financial undertaking in the business environment is assessed, the main key figures are analysed and an assessment is made of qualitative and quantitative (qualitative and quantitative) factors of the business model as well as the overall policy of the financial undertaking.

It is then examined whether the relevant financial undertaking has integrated ESG risk into the business model and whether it has been taken into account in the formulation of risk policy and appetite. If applicable, an assessment is made of the financial undertaking's measures in response to imminent geopolitical risk (geopolitical risk).

In the assessment of the business model, consideration is also given to risk due to the financial undertaking's ownership of other supervised entities, e.g. an insurance company. Such ownership may entail risk beyond traditional share ownership. In the Financial Supervisory Authority's assessment, it is assumed that if a financial undertaking has control over such an entity, it may need to provide financial support if it encounters financial difficulties. The assessment in question is based on reputational risk and strategic interests.

At the same time, the Financial Supervisory Authority examines what effect the baseline scenario of stress tests has on the financial undertaking's income statement and balance sheet and whether its capital base is sufficient to meet the overall capital requirement (overall capital requirement, OCR) over the forecast period, cf. further discussion in Chapter 2.3.8

The analysis is carried out on the basis of the financial undertaking's business plan and policy, its ICAAP/ILAAP report and other regular data submissions as well as other data and information requested at any given time. The information is then compared with previous examinations and the business models of other comparable financial undertakings. Where applicable, interviews are conducted with board members, the managing director and other managers, key staff

[4] Cf. further definitions according to item 52. d - item 52. i of the first paragraph of Article 4. CRR.

[5] Climate-related risk and its management are assessed, among other things, with regard to Guidelines on the management of environmental, social and governance (ESG) risks (EBA/GL/2025/01) and other material that EBA has issued on sustainable financial activity. Consideration is also given to the Basel Committee's core principles for banking supervision on effective management and supervision of climate-related risk, Principles for the effective management and supervision of climaterelated financial risks, from June 2022.

[6] The viability (e. viability) of a business model is a financial undertaking's ability to achieve acceptable returns over the next 12 months.

[7] The sustainability (e. sustainability) of a business strategy is a financial undertaking's ability to achieve acceptable returns in the future for at least three years, based on strategic plans and financial forecasts.

[8] When analysing a business model, the Financial Supervisory Authority uses, among other things, the EBA handbook for competent authorities on the analysis of business models.

men and other employees and the auditor of the financial undertaking concerned, among other things to obtain a deeper and more comprehensive picture of the interaction between the business plan and risk management.

In Annex I there are criteria for the Financial Supervisory Authority's assessment of additional capital requirements due to the business model and ownership in an insurance company.

1.4.4. Assessment of governance and internal control system

According to Article 50 of the Act on Financial Undertakings, a financial undertaking shall have sound governance arrangements which include a clear management structure with a well-defined, transparent and consistent division of responsibilities, effective processes to verify, manage, monitor and report on risk factors which it faces or may face and an adequate internal control system, cf. Articles 77 a and 77 b of the same Act, including sound administrative and accounting procedures, network and information systems, which are set up and managed in accordance with the Act on Digital Operational Resilience for the Financial Sector and a remuneration policy and its implementation which is consistent with and promotes sound and effective risk management, cf. Article 57 a of the Act.

The Financial Supervisory Authority's assessment of governance and internal control system (e. assessing internal governance and institution-wide controls) includes an assessment of whether the governance of the financial undertaking meets current requirements and is appropriate and in accordance with the risk policy and risk appetite, business plan and the nature and scale of the activities of the financial undertaking concerned. Emphasis is placed on assessing whether the governance arrangements ensure sound risk management and include appropriate internal controls in accordance with the three lines model (e. the three lines model).

When assessing governance and internal control system, consideration is given to whether weaknesses in governance and internal control create risks and affect the operations and sustainability of the financial undertaking. The assessment particularly takes into account the following factors:

the overall framework of governance and internal organisation,
the effectiveness and functioning of the board,
corporate and risk culture,
remuneration policy and its implementation,
the internal control framework, including the areas of risk management, compliance and the internal audit department,
the risk management framework, including ICAAP/ILAAP and stress tests,
outsourcing policy and outsourcing arrangements,
information and communication technology systems and business continuity,
disclosure requirements (Pillar 3),
measures against money laundering and terrorist financing,
the remediation plan and
where applicable, governance within the group.

The assessment is based primarily on information from the ICAAP/ILAAP report, regular data submissions, interviews with board members, the CEO and other managers, key function holders, the internal auditor and other employees and the auditor of the financial undertaking concerned, on-site inspections and other specific examinations as well as other available data and information.

The assessment of governance and internal control system is carried out with reference to various EBA guidelines, in particular the guidelines on internal governance,9 the assessment of suitability10 and remuneration,11 as well as other guidelines,12 and recognised guidance on governance.

[9] Guidelines on internal governance under Directive 2013/36/EU (EBA/GL/2021/05).

[10] Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU (EBA/GL/2021/06), cf. also rules No. 150/2017, on the implementation of the suitability assessment of the CEO and board members of financial undertakings.

[11] Guidelines on sound remuneration policies under Directive 2013/36/EU (EBA/GL/2021/04), Guidelines on benchmarking of diversity practices, including diversity policies and gender pay gap, under Directive 2013/36/EU and Directive (EU) 2019/2034 (EBA/GL/2023/08) and Guidelines on the applicable notional discount rate for variable remuneration (EBA/GL/2014/01).

[12] Cf. Guidelines on product oversight and governance arrangements for retail banking products (EBA/GL/2015/18), Guidelines on ICAAP and ILAAP information collected for SREP purposes (EBA/GL/2016/10), Guidelines on institutions’ stress testing (EBA/GL/2018/04), Guidelines on disclosure requirements under Part Eight of Regulation (EU) No 575/2013 (EBA/GL/2016/11) and Guidelines on outsourcing arrangements (EBA/GL/2019/02).

In Annex I there are criteria for the Financial Supervisory Authority's assessment of additional capital requirements due to governance and internal control system.

Attention is drawn to the fact that risk management factors that focus on individual risk factors are assessed separately by the Financial Supervisory Authority under the relevant risk factors, cf. further discussion in Chapters 1.4.5. and 1.4.6.

1.4.5. Assessment of risk factors that affect own funds

General

The assessment of the main risk factors in the activities of the financial undertaking concerned, which affect own funds (e. assessment of risks to capital), is carried out in a systematic manner. On the one hand, inherent risk (e. inherent risk) is assessed and, on the other hand, the quality and effectiveness of risk management (e. risk management and controls) related to each risk factor. For financial undertakings, the risk factors credit, counterparty and concentration risk, securitisation risk, market risk, risk related to trading outside the trading book, operational risk and, where applicable, other risk factors are assessed. An assessment is also made of the risk of excessive leverage, but its assessment is separate from the assessment of other risk factors that affect the own funds of the financial undertaking.

The Financial Supervisory Authority's assessment of risk factors that affect own funds is primarily based on data and information provided in the financial undertaking's regular reporting, in particular the results of the internal assessment process of the financial undertaking concerned, cf. ICAAP-/ILAAP report, on-site inspections and other specific examinations, as well as other data and information that may be important for the assessment. The Financial Supervisory Authority also obtains additional information from other parties that is useful for its assessment, e.g. to verify data and information from financial undertakings.

Credit, counterparty and concentration risk

A financial undertaking shall apply its own methodology that enables it to assess credit and counterparty risk of exposures of individual customers, securities, securitised positions and the loan portfolio as a whole in accordance with Article 78 a of the Act on Financial Undertakings.

A financial undertaking shall also assess and manage concentration risk arising from each counterparty of the undertaking within the same sector of the economy, in the same geographical area or in the same industry, or from parties producing the same raw material in accordance with Article 78 c of the Act on Financial Undertakings.

Furthermore, a financial undertaking shall, through policy and procedures, address and manage the risk that remains when its recognised methods for mitigating credit risk prove not to be as effective as expected (residual risk), cf. Article 78 b of the Act on Financial Undertakings.

Credit risk is the risk of loss from a customer failing to meet its obligations towards the lender, i.e. failing to meet its obligations in accordance with agreed terms. Counterparty risk means the risk of loss from a counterparty in derivative transactions, securities lending or repurchase transactions failing to meet its obligations in accordance with agreed terms. Concentration risk is the risk of loss due to insufficient diversification of the loan portfolio and is divided into concentration due to borrowers (single-name), sector (sectoral) and geographical areas (geographical).

When assessing a financial undertaking's credit and counterparty risk, both the inherent credit and counterparty risk and its management are assessed.13 Among the things assessed are:

the nature, size, composition and quality of the loan portfolio,
defaults and forbearance and their treatment,
write-downs and the methodology for assessing them and
risk mitigation and risk management, including whether the financial undertaking concerned has assessed ESG risk in the loan portfolio, in particular climate-related risk.

When assessing inherent concentration risk, the Financial Supervisory Authority examines risk that can be traced to few exposures or exposures that are comparable with respect to defaults and the financial undertaking's management of them. The assessment includes an analysis of possible correlation of exposures, especially during stress periods, and

[13] Cf. among others Guidelines on the application of the definition of default under Article 178 of Regulation (EU) No 575/2013 (EBA/GL/2016/07), Guidelines on management of non-performing and forborne exposures (EBA/GL/2018/06) and Guidelines on loan origination and monitoring (EBA/GL/2020/06).

large exposures14 and limits on them.15 In the assessment, particular consideration is given to borrower concentration, sector concentration, geographical concentration and concentration in product offerings, collateral and guarantees. In Annex I there are criteria for the Financial Supervisory Authority's assessment of additional capital requirements due to credit and concentration risk.

Securitisation risk

According to Article 78 d of the Act on Financial Undertakings, a financial undertaking shall, among other things through policy and procedures, assess and address risk, including reputational risk, due to securitisation, where the undertaking is an investor, originator or sponsor of such instruments.16 A financial undertaking shall also ensure that the economic substance of the transactions is fully reflected in the risk assessment and management decisions. A financial undertaking that is the originator of a securitisation of exposures from working capital financing with provisions on the right to payment before maturity shall have a liquidity plan in place that takes into account expected repayments and repayments before maturity.

The Financial Supervisory Authority assesses how financial undertakings address securitisation risk with respect to whether the financial undertaking concerned is an investor, originator or sponsor of such instruments.

Market risk

A financial undertaking shall have policy and procedures to identify, measure and manage all significant factors that cause market risk and the effects that arise from it in accordance with Article 78 e of the Act on Financial Undertakings. Market risk means the risk of loss resulting from movements in market prices, including exchange rates or commodity prices, cf. point 39 of the first paragraph of Article 1 b of the Act on Financial Undertakings.

Sub-risk factors of market risk are among others:

interest rate risk in the trading book,17
credit spread and default risk in the trading book,
equity risk in the trading book,
foreign exchange risk, FX risk, 18
commodities risk,
credit valuation adjustment risk, CVA risk,
non-delta risk,
basis risk,
market liquidity risk,
model risk for regulatory approved models and
inflation indexation risk.

The Financial Supervisory Authority assesses financial undertakings' inherent market risk and its management, both for the trading and investment book. The Financial Supervisory Authority also assesses the above-mentioned sub-risk factors based on its own criteria, which are based among other things on sensitivity and VaR analyses.19

In Annex I there are criteria for the Financial Supervisory Authority's assessment of additional capital requirements due to market risk.

Interest rate risk due to transactions outside the trading book

A financial undertaking shall, through internal processes or the standardised approach or the simplified standardised approach, identify, assess, manage and mitigate the risk of possible interest rate changes that affect both the economic value of own equity and net interest income from transactions outside the trading book, cf. Article 78 f of the Act on Financial Undertakings. A financial undertaking shall also

[14] An exposure to a customer or a group of connected customers is considered a large exposure if its value amounts to 10% or more of tier 1 capital, cf. Article 392. CRR. When assessing a group of connected customers, the Financial Supervisory Authority has regard to the Guidelines on connected clients under Article 4(1)(39) of Regulation (EU) No 575/2013 (EBA/GL/2017/15).

[15] The main rule is that a financial undertaking shall not incur an exposure, taking into account the effects of credit risk mitigation, to a customer or a group of connected customers where the value exceeds 25% of tier 1 capital, cf. Article 395. CRR.

[16] Cf. for reference Act No. 71/2025, on securitisation.

[17] Cf. Guidelines on corrections to modified duration for debt instruments (EBA/GL/2016/09).

[18] Cf. Guidelines on the treatment of structural FX under Article 352(2) of Regulation (EU) No 575/2013 (CRR) (EBA/GL/2020/09).

[19] Cf. [footnote]: Guidelines on stressed value at risk (Stressed VaR) (EBA/GL/2012/2).

have policies and processes to identify and monitor the risk of possible changes in interest rate levels that affect both the economic value of own equity and net interest income from its transactions outside the trading book.

Interest rate risk from transactions outside the trading book, or so-called fixed-rate risk (e. interest rate risk arising from non-trading book transactions, IRRBB), is the risk of depreciation in the present value of interest-bearing assets and liabilities in the investment book due to unfavourable changes in market interest rates.

The Financial Supervisory Authority assesses the quality of a financial undertaking's management of fixed-rate risk.20 The effects of shifting relevant interest rate curves out over the lifetime are examined. The effects of these interest rate shifts on the present value of interest-bearing assets and liabilities in each currency form the basis of the Financial Supervisory Authority's risk assessment for this risk factor.

In Annex I there are criteria for the Financial Supervisory Authority's assessment of additional capital requirements due to fixed-rate risk.

Operational risk

A financial undertaking shall have policies and processes to assess and manage operational risk (e. operational risk), including due to models, outsourcing and infrequent events that can have serious consequences according to Article 78 g of the Act on Financial Undertakings.

A financial undertaking shall then have a response plan and a business continuity plan to ensure its continued operations and limitation of loss if a serious disruption occurs in the undertaking's operations, including policies and plans for the operational continuity of information and communication technology and response and recovery plans for that technology in accordance with the Act on Digital Operational Resilience for the Financial Market.

Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events, including but not limited to legal risk, model risk or information and communication technology risk, but excluding strategic and reputational risk cf. point 54 of the first paragraph of Article 1 b of the Act on Financial Undertakings.

Sub-risk factors of operational risk include:

legal risk (e. legal risk),21 including compliance risk (e. compliance risk) and conduct risk (e. conduct risk),
model risk (e. model risk),22
operational resilience (e. operational resilience),
business continuity and response and recovery plans (e. business continuity, response and recovery),
risk arising from third parties (e. risk arising from third-party service providers),
money laundering and terrorist financing risk (e. money laundering and terrorist financing risk),
risk relating to new products, processes and systems and changes to them (e. risk relating to new products, processes and systems and changes to them),
information and communication technology risk (e. information and communication technology risk, ICT risk), and
ESG risk in operations, with emphasis on environmental risk, e.g. processes to assess and manage the risk.

The Financial Supervisory Authority assesses inherent operational risk and its management with emphasis on the aforementioned sub-risk factors, especially those considered particularly risky at any given time.23

In Annex I there are criteria for the Financial Supervisory Authority's assessment of additional capital requirements due to operational risk.

Risk of excessive leverage

A financial undertaking shall have policies and processes to identify, manage and monitor the risk of excessive leverage (e. risk of excessive leverage). Among the risk indicators for the risk of excessive leverage is the calculation of the leverage ratio and mismatches between the financial undertaking's assets and liabilities, cf. Article 78 i and the sixth paragraph of Article 81 of the Act on Financial Undertakings.

[20] Cf. Guidelines issued on the basis of Article 84(6) of Directive 2013/36/EU specifying criteria for the identification, evaluation, management and mitiga-tion of the risks arising from potential changes in interest rates and of the assessment and monitoring of credit spread risk, of institutions’ non-trading book activities (EBA/GL/2022/14) and delegated regulations (EU) 2024/856 and 2024/857, cf. rules No. 1588/2025, on the assessment of interest rate risk from transactions outside the trading book.

[21] Legal risk means the risk of loss, including costs, fines, sanctions or punitive damages, that could be imposed on a financial undertaking due to circumstances leading to litigation, cf. point 34 of the first paragraph of Article 1 b of the Act on Financial Undertakings.

[22] Model risk is the risk of loss caused by decisions taken on the basis of the results of one's own models due to errors in the design, development, assessment of risk variables, implementation, use or monitoring of such models, cf. point 37 of the first paragraph of Article 1 b of the Act on Financial Undertakings.

[23] Operational risk and its management are assessed, among other things, with regard to the Basel Committee on Banking Supervision's principles for the sound management of operational risk, Principles for the Sound Management of Operational Risk, from March 2021.

The risk of excessive leverage refers to the risk arising from the sensitivity of a financial undertaking due to leverage or uncertain leverage that may require unforeseen remedial measures to its business plan, including the rapid sale of assets that may lead to loss or revaluation of the value of remaining assets, cf. point 28 of the first paragraph of Article 1 b. of the Act on Financial Undertakings.

According to point d of the first paragraph of Article 92. CRR, the leverage ratio of a financial undertaking shall be at least 3%. The calculation of the leverage ratio shall be in accordance with Article 429. CRR. The requirement for a minimum leverage ratio is intended to support the risk-weighted capital requirement with the aim of limiting the leverage of financial undertakings during an economic upswing.

The Financial Supervisory Authority examines whether financial undertakings handle the risk of excessive leverage prudently and take into account potential increased risk due to a reduction in own funds due to expected or realized losses and whether it can withstand various stress events related to the risk of excessive leverage. In addition to assessing the systems and processes of a financial undertaking to manage the risk of excessive leverage, the Financial Supervisory Authority also takes into account the business model of the financial undertaking. Attention is drawn to the fact that the assessment of the risk of excessive leverage is separate from the assessment of other risk factors that affect the own funds of a financial undertaking, cf. further discussion in section 2.3.4.

1.4.6. Assessment of risk factors that affect liquid funds and funding

General

The assessment of liquid funds and funding is an important part of the examination and assessment process, cf. Articles 79 and 81 of the Act on Financial Undertakings. The assessment is based on three components: firstly, on the assessment of the management of liquidity and funding risk (e. risk management and controls), secondly on the assessment of inherent liquidity risk (e. liquidity risk) and thirdly on the assessment of inherent funding risk (e. funding risk).

When assessing the management of liquidity and funding risk, an assessment is made, among other things, of the liquidity policy and tolerance limits, procedures, analysis, measurement, management and monitoring and information disclosure regarding the risk, stress tests, contingency plans and funding plans.24 The assessment takes into account the nature and scope of the activities of the financial undertaking concerned. Emphasis is then placed on examining how well financial undertakings are prepared for a liquidity and funding crisis that could affect the financial undertaking concerned or even the financial market as a whole.

The assessment of the aforementioned factors is based, among other things, on the result of the internal assessment process of the financial undertaking, cf. ICAAP-/ILAAP report, regular data submissions, results of on-site inspections and other specific examinations as well as other data and information that may be important for the assessment.

The result of the assessment may lead to a specific requirement for liquid funds being made according to point 10 of the third paragraph of Article 107 a of the Act on Financial Undertakings, cf. the ninth paragraph of the same article, and improved management and monitoring of the risk factors. The result may also lead to a requirement being made to extend the maturity of funding, reduce off-balance sheet liabilities, etc.

Liquidity risk

A financial undertaking shall have plans, policy, procedures, methods and systems to identify, assess, manage and monitor liquidity risk covering an appropriate time horizon, including intraday, to ensure that the financial undertaking has sufficient liquid funds, cf. the first paragraph of Article 78 h of the Act on Financial Undertakings.

Credit institutions shall maintain a 100% liquidity coverage ratio (e. liquidity coverage ratio, LCR) in all currencies in total, and they shall also monitor the ratio in individual currencies where total liabilities are equal to or exceed 5% of the total liabilities of the credit institution (e. significant currency). Credit institutions shall then satisfy a minimum of 50% liquidity coverage ratio in Icelandic krónur. Furthermore, a requirement is made that credit institutions satisfy a minimum of 80% liquidity coverage ratio in euros, if liabilities in euros amount to 10% or more of the total liabilities of the credit institution concerned.25

If the liquidity coverage ratio of a credit institution falls below the applicable minimum, whether it occurs during a stress period or not, or if it is foreseeable that it will occur within the next six months, the credit institution shall without delay notify the Central Bank in writing and specify the reasons for this in a satisfactory manner. The credit institution concerned shall still

[24] The assessment takes into account, among other things, the core principles of the Basel Committee on Banking Supervision, Principles for Sound Liquidity Risk Management and Supervisions, from September 2008.

[25] According to Articles 2 and 3 of rules no. 1520/2022, on the liquidity coverage ratio of credit institutions, cf. Article 4 of delegated regulation (EU) 2015/61.

rather submit to the Central Bank a time-bound plan on how it intends to reach the applicable minimum liquidity coverage ratio. Until the minimum is reached, the credit institution shall submit a report on liquid funds at the end of each day.26 When assessing inherent liquidity risk, an assessment is made, among other things, of the position and development of liquidity ratios, short and medium-term liquidity needs, intraday liquidity risk, liquid assets, especially volume, composition and quality, and scope for countermeasures as well as for the Central Bank's stress tests due to liquidity risk.

Funding risk

A financial undertaking shall develop a methodology to identify, measure, manage and monitor funding positions, cf. the third paragraph of Article 78 h of the Act on Financial Undertakings. Credit institutions shall maintain a 100% net stable funding ratio (e. net stable funding ratio, NSFR) in all currencies in total, and they shall also monitor the ratio in individual currencies where total liabilities are equal to or exceed 5% of the total liabilities of the credit institution, cf. Article 428 b of the CRR. If a credit institution is, or it is foreseeable that it will be, below the minimum net stable funding ratio, it shall without delay notify the Central Bank in writing and specify the reasons in a satisfactory manner. The credit institution concerned shall furthermore submit a time-bound plan on how it intends to reach the minimum net stable funding ratio, cf. Article 414 and the third paragraph of Article 428 b of the CRR.

In the assessment of inherent funding risk, an assessment is made, among other things, of the composition of funding, the threat to financial stability due to the composition, access to markets and the expected change in funding risk with regard to the funding plan, the ratio of encumbered assets and stress tests.

1.4.7. Risk assessment rating

The Financial Supervisory Authority gives a rating following an assessment of each individual risk factor in the operations of a financial undertaking, cf. Figure 2.

Figure 2 Assessment of risk factors and risk management

Inherent risk
Assessment of risk factors that affect liquid funds and funding Assessment of risk factors that affect own funds Corporate governance and internal control system Business model Risk management 1 2 3 4

The risk assessment rating is given in whole numbers and the rating scale is from 1 to 4, where the rating 1 denotes insignificant or low risk and the rating 4 high risk.

The risk assessment ratings are used in supervisory practice, among other things in the preparation of the supervisory plan, e.g. in the prioritisation of tasks, and they are considered part of the risk assessment system of the Financial Supervisory Authority. The ratings do not have a direct effect on supervisory measures towards a financial undertaking and they are not published to individual financial undertakings.

1.5. Overall risk assessment and supervisory measures

The Financial Supervisory Authority carries out an annual overall risk assessment of the operations of a financial undertaking. The annual overall risk assessment entails that the results of the risk assessment of individual risk factors in the operations of a financial undertaking are summarised, cf. further discussion in Chapter 1.4., and the financial undertaking concerned is given a rating. The overall risk assessment is carried out for all financial undertakings regardless of how often and how detailed an assessment has been carried out of individual risk factors in their operations and their management of them. The overall risk assessment rating is given in whole numbers and the rating scale of the assessment is generally from 1 to 4, cf. Table 3.

[26] According to the second paragraph of Article 5 of the rules on the liquidity ratio of credit institutions, cf. the fourth paragraph of Article 4 of delegated regulation (EU) 2015/61 and Article 414 CRR.

Table 3 Overall risk assessment

Rating	Description
1.	Insignificant or low risk present.
2.	Relatively low risk present in the operations of the financial undertaking, but there is potential for improvement and it is important to monitor weaknesses in the operations.
3.	Relatively high risk present in the operations of the financial undertaking. It is necessary to direct the attention of the party concerned to the matter and demand improvements. In special circumstances, the application of early intervention measures according to Articles 107 c – 107 e of the Act on Financial Undertakings may also come into consideration.
4.	High risk in the operations of the financial undertaking. It is necessary to intervene and demand immediate improvements. The application of early intervention measures comes under serious consideration.

Following the overall risk assessment and after a discussion process between the Financial Supervisory Authority and the financial undertaking concerned, appropriate supervisory measures are determined and the financial undertaking is informed of them. Appropriate supervisory measures refer to measures concerning capital and liquidity requirements and other supervisory measures, including a demand for improvements. Such supervisory measures entail an administrative decision, cf. the Administrative Procedure Act No. 37/1993, and they are therefore notified to the financial undertaking concerned in a formal manner, cf. further discussion in Chapter 2.7.

In the overall risk assessment, a financial undertaking may also receive the rating F, which indicates that the financial undertaking concerned is failing or likely to fail within the meaning of point 2 of the first paragraph of Article 3 of No. 70/2020, on the resolution of credit institutions and securities firms,27 cf. Article 34 of the same Act and Article 52 e of the Act on Financial Undertakings. If a financial undertaking is failing or likely to fail, this leads to resolution being initiated according to the Act on the Resolution of Credit Institutions and Securities Firms or winding-up proceedings according to Chapter XII of the Act on Financial Undertakings, cf. Figure 3.

Figure 3 The relationship between regular supervision, early intervention and whether a financial undertaking is failing or likely to fail

All supervisory activities
(on-site inspections and other examinations)
The supervisory review and evaluation process and its results Early intervention Failing or likely to fail Supervisory measures 1 2 3 4 F Preparation/ Regular supervision Act No. 161/2002 and CRR Act No. 70/2020 and Act No. 161/2002 Temporary intervention Winding-up or insolvency proceedings Overall risk assessment rating

[27] See also Guidelines on the interpretation of the different circumstances when an institution shall be considered as failing or likely to fail under Article 32(6) of Directive 2014/59/EU (EBA/GL/2015/07).

The Financial Supervisory Authority's assessment of additional capital requirements

2.1. General

Financial undertakings are obliged to meet requirements regarding their own funds base. The requirements can be classified into three categories. First, mention must be made of the minimum requirement for the own funds base amounting to 8% of the risk base of the financial undertaking, cf. further discussion in Chapter 2.2. Next, an additional requirement for the own funds base which the Financial Supervisory Authority decides upon following an assessment of risk factors at each individual financial undertaking, cf. further discussion in Chapters 1.4 and 2.3, and finally a combined requirement for capital buffers intended to address risks in the economic and financial system, cf. further discussion in Chapter 2.4.

The first two requirements together form the Financial Supervisory Authority's minimum requirement for the own funds base. All the requirements together form the total requirement for the own funds base.

2.2. Minimum requirement for the own funds base

The minimum requirement for the own funds base (e. minimum own funds requirements) is calculated in accordance with the CRR. The requirement is that the own funds base of a financial undertaking shall amount to at least 8% of the risk base (Pillar I), cf. point (c) of the first paragraph of Article 92. CRR.

The minimum requirement shall consist of tier 1 capital (e. tier 1 capital, T1), i.e. common equity tier 1 capital (e. common equity tier 1 capital, CET1) and additional tier 1 capital (e. additional tier 1 capital, AT1), tier 2 capital (e. tier 2 capital, T2) and deductions. Of this, common equity tier 1 capital, after deductions, shall amount to at least 4.5% of the risk base, and tier 1 capital, after deductions, shall amount to at least 6% of the risk base, cf. points (a) and (b) of the first paragraph of Article 92. CRR. The risk base of financial undertakings is the sum of the weighted risk factors that the activity entails, cf. the third paragraph of the same Article.

2.3. The Financial Supervisory Authority's assessment of additional capital requirements

2.3.1. General

One of the main tasks of the supervisory review and evaluation process is to assess risk factors that affect the equity of a financial undertaking. The objective of the assessment is to examine whether the own funds base of the financial undertaking concerned is adequate in view of the risk involved in its activities. The result may lead to the Financial Supervisory Authority using its authority to prescribe a higher own funds base than 8% of the risk base, i.e. a requirement for additional own funds, or a requirement under Pillar II.

The Financial Supervisory Authority assesses the capital requirement under Pillar II in the following manner:

Assessment of capital requirement due to risk factors. On the one hand due to underestimation of expected losses and on the other hand unexpected losses that are not sufficiently taken into account when calculating the minimum capital requirement according to the CRR, or Pillar I (e. pillar 1), based on a 12-month period (Pillar II-R (e. pillar 2 capital requirement)).
Assessment of capital requirement during stress periods, or capital stress, i.e. due to potential effects of stress events (e. stressed conditions) that are not sufficiently taken into account under Pillar I and Pillar II-R or with active capital buffers (Pillar II-G (e. pillar 2 capital guidance)).
Assessment of capital requirement due to the risk of excessive leverage with regard to the leverage ratio that is not sufficiently taken into account according to the CRR, or Pillar I, (Pillar II-R – LR (e. pillar 2 capital requirement for the risk of excessive leverage), and during stress events (Pillar II-G – LR (e. pillar 2 capital guidance for the risk of excessive leverage).

2.3.2. The Financial Supervisory Authority's assessment of additional capital requirements due to risk factors

General

The board of directors and the managing director of a financial undertaking shall regularly assess the type, distribution and amount of the undertaking's capital requirement in view of its risk level, including the risk involved in, or that may result from, its activities, cf. the first paragraph of Article 80 of the Act on Financial Undertakings. The assessment takes place in the internal assessment process and the financial undertaking shall report the assessment to the Financial Supervisory Authority when requested with a so-called ICAAP/ILAAP report.

In the supervisory review and evaluation process, the Financial Supervisory Authority assesses, among other things, risk factors in the activities of a financial undertaking according to Articles 79–81 of the Act on Financial Undertakings, cf. Article 107 a of the same Act, cf. further discussion in Chapter 1.4. The assessment is based in particular on information presented in the financial undertaking's regular data submissions, especially ICAAP/ILAAP reports, annual financial statements and reports of the internal audit department. The Financial Supervisory Authority also obtains information at meetings with the board of directors and managers of financial undertakings, through on-site inspections and other specific examinations as well as other communications during the process.

The Financial Supervisory Authority's assessment leads to a conclusion on the extent to which the measures and methods applied by the financial undertaking concerned, together with internal processes and their implementation, are adequate, whether governance is sound and whether the own funds base and liquidity position are adequate in view of the risk involved in the activities. The result may lead to the Financial Supervisory Authority using its authority to prescribe the following supervisory measures according to the third paragraph of Article 107 a of the Act on Financial Undertakings:

1. Higher own funds base than 8% of the risk base.

2. Improvements to internal processes, cf. Chapter IX of the Act.

3. That a financial undertaking submit a specific plan for how the undertaking will meet the requirements of the Act in addition to regulations and rules issued under it, as well as setting deadlines for the financial undertaking regarding the implementation of the plan, including due to delays or improvements made to the plan.

4. Write-down of assets in the calculation of the own funds base.

5. Restrictions on or limitation of the activities of a financial undertaking or, where applicable, sale of assets or business units that create excessive risk.

6. That risk involved in the activities, business products or systems of a financial undertaking be reduced, including due to outsourced activities.

7. That a financial undertaking limits bonuses to a proportion of net profit where their payment results in an inadequate capital base.

8. That a financial undertaking uses net profit to strengthen the capital base.

9. That dividend and interest payments to shareholders, holders of share capital and holders of instruments of additional tier 1 capital shall be limited or prohibited, provided that this does not entail default on the part of the financial undertaking.

10. Special requirements to maintain liquid funds, including due to mismatches in the maturity of assets and liabilities of the financial undertaking.

11. Increased data reporting.

12. Specific disclosure to the market.

Furthermore, the Financial Supervisory Authority may submit comments and suggestions in accordance with the first paragraph of Article 10 of the Act on Public Supervision of Financial Activities.

In the Financial Supervisory Authority's assessment of additional capital requirements, cf. point 1 of the third paragraph of Article 107 a of the Act on Financial Undertakings, an assessment is made of the main risk factors in the operations of the financial undertaking that affect its own funds, i.e. credit, counterparty and concentration risk, market risk, interest rate risk due to transactions outside the trading book and operational risk. The assessment of additional capital requirements due to the risk of excessive leverage is carried out with regard to the business model and leverage ratio of the financial undertaking and is separate from the assessment of other risk factors, since the additional capital requirement due to such risk entails a requirement for a higher leverage ratio. Furthermore, an assessment is made of additional capital requirements due to the business model, governance and internal control system and the management of the aforementioned risk factors, but an additional capital requirement due to such factors may be considered to address serious weaknesses and when other supervisory measures are considered inadequate or not appropriate to ensure appropriate remediation. Such a requirement may be temporary and only valid while the financial undertaking works on satisfactory remediation.

In the Financial Supervisory Authority's assessment of additional capital requirements, the following data and information are mainly used:

The ICAAP/ILAAP report of the financial undertaking concerned,
the Financial Supervisory Authority's benchmarks for assessing capital requirements due to individual risk factors, cf. Annex I, and
other relevant data and information, such as expert assessments, assessment of own funds of other comparable financial undertakings and information that appears in regular supervision and data reporting and other communications with the financial undertaking concerned.

With the aim of increasing the quality of the Financial Supervisory Authority's assessment of risk factors, it has set its own benchmarks for sub-risk factors of individual risk factors, cf. Annex I. Nevertheless, emphasis is placed on financial undertakings developing and applying their own more detailed methodology for assessing inherent risk. If the Financial Supervisory Authority considers that the methodology of the financial undertaking is satisfactory and appropriate, it is mainly used as a basis for assessing its capital requirements. If the Financial Supervisory Authority considers that the benchmarks of the financial undertaking are not satisfactory or appropriate1, it bases its assessment of the financial undertaking's capital requirements rather on its own benchmarks, taking into account the risk factors that each undertaking faces (institution-specific). The supervisory benchmarks are not intended to be the basis for a financial undertaking's own risk assessment for inherent risk, but it is important that the undertaking carries out its own assessment of the risk factors in its operations in a satisfactory manner. In the Financial Supervisory Authority's assessment of additional capital requirements (Pillar II-R), own funds that a financial undertaking maintains due to the minimum capital base requirement (Pillar I) are not offset against the own funds that the financial undertaking must maintain due to the risk factors assessed therein and which form the additional capital requirement. Similarly, no account is taken of risk diversification and possible effects between individual risk factors (inter-risk diversification), such as between credit, counterparty and concentration risk, market risk and operational risk. On the other hand, the Financial Supervisory Authority takes into account risk diversification and effects between sub-risk factors of individual risk factors in the assessment (intra-risk diversification), such as geographical concentration, sector concentration and other relevant individual sub-risk factors, and assesses capital requirements due to each sub-risk factor, where applicable. However, such diversification effects do not, as stated above, affect the assessment of risk factors taken into account in the calculation of the minimum capital base requirement.

In assessing additional capital requirements, the Financial Supervisory Authority generally uses financial information at the turn of the year. Although the final assessment of capital requirements is available about half a year later, no account is taken of changes in the development of individual sub-risk factors during the period, unless the overall effect of all sub-risk factors leads to a significant increase or decrease in capital requirements. By its nature, this only applies to risk factors that affect own funds.

The Financial Supervisory Authority's additional requirement for the capital base

If the result of the review and assessment process is that the capital base of the financial undertaking is not satisfactory with regard to the risk involved in its operations, the Financial Supervisory Authority may, as previously stated, prescribe an additional requirement for the capital base (Pillar II-R) (additional own funds requirements). The requirement is based on the authorisation in point 1 of the third paragraph of Article 107 a of the Act on Financial Undertakings, cf. the fourth paragraph of the same Article. It states that the Financial Supervisory Authority is authorised to prescribe a higher capital base than 8% of the risk base. If the Financial Supervisory Authority takes such a decision, the financial undertaking concerned must at all times maintain a capital base to meet that requirement. The capital base due to the additional requirement shall amount to at least 56.25% of common equity tier 1 and 75% of tier 1 capital, cf. the sixth paragraph of Article 107 a of the Act on Financial Undertakings.

The Financial Supervisory Authority's minimum requirement for the capital base

The Financial Supervisory Authority's minimum requirement for the capital base (total SREP capital requirement, TSCR) refers to the sum of the statutory minimum requirement for the capital base, i.e. a capital base amounting to 8% of the risk base according to point c of the first paragraph of Article 92. CRR (Pillar I), and additional own funds requirement according to the supervisory assessment of capital needs (Pillar II-R). The requirement shall be composed of the same own funds items as the requirements that form it, cf. further discussion in this chapter above and section 2.2.

[1] By satisfactory is meant whether the methodology is statistically robust or prudent. By appropriate is meant whether the methodology covers the risk factors that matter most at any given time. In its assessment, the Financial Supervisory Authority considers, among other things, whether the financial undertaking's methods are sufficiently detailed, credible, understandable and comparable.

2.3.3. Capital add-on

A financial undertaking shall take into account the capital requirement under stress events when preparing its capital planning, in risk management and when preparing a recovery plan. A financial undertaking shall therefore maintain a capital base that withstands different stress events.

The Financial Supervisory Authority also assesses the capital requirement of a financial undertaking with regard to potential shocks according to stress tests, cf. Paragraph 7 of Article 80 and Article 107 b of the Act on Financial Undertakings. The Financial Supervisory Authority bases the assessment on the results of its own supervisory stress testing. In addition, it reviews the results of stress tests of other supervisory authorities and stress tests that the relevant financial undertaking carries out on the basis of its own business model (ICAAP stress test (own scenario)).2

In the Financial Supervisory Authority's stress tests, an assessment is made of what effects adverse scenarios have on the common equity tier 1 ratio of a financial undertaking and its risk base over the forecast period. An assessment is also made of what effects the stress tests have on the leverage ratio of a financial undertaking, cf. further discussion in section 2.3.4.

The Financial Supervisory Authority has the authority to notify a financial undertaking to maintain increased own funds that it considers desirable on the basis of stress tests (Pillar II-G), or so-called guidance on additional own funds for stressed conditions. This is done in particular when the results of stress tests indicate that the common equity tier 1 of a financial undertaking may decrease beyond the capital conservation buffer and in special cases beyond the countercyclical capital buffer in addition. The capital add-on is, however, not part of the total own funds requirement. When the Financial Supervisory Authority assesses how much own funds a financial undertaking needs to maintain due to stress events, account is taken of plans based on credible management actions of the relevant financial undertaking intended to mitigate the impact of the shock on the undertaking's own funds. An assessment is made of what the common equity tier 1 ratio is when it is lowest in the shock and what the composition of the total own funds requirement is at the same time.

If a financial undertaking's capital base does not meet the Financial Supervisory Authority's capital add-on, it may lead to further actions on its part, such as increased supervision or an additional own funds requirement under specific circumstances (Pillar II-R), cf. Item 5 of Paragraph 4 of Article 107 a of the Act on Financial Undertakings.

2.3.4. Assessment of capital needs due to the risk of excessive leverage

The Financial Supervisory Authority shall assess the risk of excessive leverage of a financial undertaking with regard to its business model and leverage ratio, cf. Paragraph 6 of Article 81 of the Act on Financial Undertakings. The risk is assessed separately, i.e. independently of the assessment of other risk factors that affect own funds, cf. also the discussion in section 1.4.5.

Financial undertakings shall maintain a requirement of a 3% leverage ratio according to Point d of Paragraph 1 of Article 92. CRR, cf. Article 429 of the same regulation, but it is based on the total exposure measure. The leverage ratio requirement is intended to be a kind of backstop due to shortcomings considered to exist in the risk-weighted capital requirement, and it limits the indebtedness of a financial undertaking in an upturn. The leverage ratio does not provide information on the underlying risk and can therefore act as an incentive for increased risk-taking. There is no substitution between the leverage ratio and the risk-weighted capital ratio, but the ratios support each other well, as previously stated.

If the Financial Supervisory Authority considers that the risk of excessive leverage requires action on its part, it has the authority to prescribe a higher own funds base from total exposure measure. The requirement shall consist of own funds tier 1, cf. Paragraph 7 of Article 107 a of the Act on Financial Undertakings (Pillar II-R – LR). In other words, the Financial Supervisory Authority can impose a requirement for a higher leverage ratio than the 3% minimum, cf. Point d of Paragraph 1 of Article 92. CRR.

In the assessment, the Financial Supervisory Authority also takes into account the effects of stress tests on the business model and leverage ratio and can for that purpose notify a financial undertaking of a capital add-on if it considers there to be a risk of excessive leverage under stress events (Pillar II-G – LR).

2.4. Combined buffer requirement

According to Chapter X of the Act on Financial Undertakings, a financial undertaking shall, in addition to the Financial Supervisory Authority's minimum requirement for own funds, maintain a combined buffer requirement.

[2] Cf. Guidelines on institutions’ stress testing (EBA/GL/2018/04).

The combined buffer requirement consists of capital buffers, which are:

systemic risk buffer,
capital buffer for other systemically important institutions, O-SII buffer,
capital buffer for global systemically important institutions, G-SII buffer,
countercyclical capital buffer, and
capital conservation buffer.

Only own funds items that are considered common equity tier 1 may be counted towards capital buffers, cf. Article 83 a of the Act on Financial Undertakings.

The Central Bank of Iceland has set rules on the systemic risk buffer,3 capital buffer for other systemically important institutions4 and countercyclical capital buffer5 after prior approval of the Financial Stability Committee. The capital conservation buffer applies to specifically designated financial undertakings according to the Act on Financial Undertakings6 .

The capital buffers and their surcharges are discussed in more detail in Annex II.

2.5. Overall capital requirement

The overall capital requirement (OCR) refers to the financial supervisory authority's minimum requirement for the capital base and the combined buffer requirement, cf. Figure 4.7

Figure 4 Overall capital requirement and its composition, including the ordering of capital buffers

Pillar II-G
(CET1)
Capital conservation buffer
(CET1)
Countercyclical capital buffer
(CET1)
Buffer for systemically important institutions (CET1) Pillar II-R (CET1, AT1 and T2) Systemic risk buffer (CET1) Pillar I (CET1, AT1 and T2) Overall capital requirement (e. overall capital requirement, OCR) Minimum requirement for the capital base (e. minimum own funds requirement) Additional capital requirement (e. additional capital requirement) Capital guidance (e. guidance on additional own funds for stressed conditions) Combined buffer requirement (e. combined buffer requirement) Minimum requirement of the financial supervisory authority for the capital base (e. total SREP capital require- ment, TSCR) Overall requirement for the capital base due to the risk of excessive leverage (e. overall leverage ratio requirement) Capital guidance due to the risk of excessive leverage (e. leverage ratio guidance) Risk-weighted capital requirements and capital guidance Pillar II-G - LR (CET1) Pillar II-R - LR (CET1 and AT1) Pillar I - LR (CET1 and AT1) Risk-weighted own funds requirements and own funds buffer

[3] Cf. rules no. 1414/2024, on the systemic risk buffer for financial undertakings.

[4] Cf. rules no. 1415/2024, on the buffer for systemically important financial undertakings.

[5] Cf. rules no. 256/2023, on the countercyclical buffer for financial undertakings.

[6] Cf. Article 84 and Article 84 a of the Act.

[7] In addition to the total own funds requirement, financial undertakings may need to maintain a minimum requirement for own funds and eligible liabilities (MREL), cf. Chapter IV of the Act on Resolution of Credit Institutions and Securities Firms. See further the Central Bank's resolution authority's MREL policy.

2.6. Measures for insufficient own funds

If a financial undertaking does not meet prudential requirements, or if it is likely that they will not be met in the next twelve months, it must notify the Financial Supervisory Authority thereof in accordance with Article 52 e of the Act on Financial Undertakings and state what measures it intends to take to bring the operations into lawful order.

If the total own funds requirement is not met, the distribution of profits, payment of dividends, repurchase of own shares and bonus payments are restricted, among other things, cf. Articles 86 m - 86 o of the Act on Financial Undertakings. In addition, the board of the financial undertaking concerned shall send the Financial Supervisory Authority a plan for the protection of own funds pursuant to Article 86 s of the same Act.

If the Financial Supervisory Authority's minimum own funds requirement is not met by a financial undertaking, i.e. an own funds base amounting to 8% of the risk base, cf. point (c) of the first paragraph of Article 92 of the CRR, and an additional own funds requirement according to the supervisory assessment, cf. point 1 of the third paragraph of Article 107 a of the Act on Financial Undertakings, or if it is likely that the requirement will not be met due to a deteriorating financial position, the Financial Supervisory Authority may decide on early intervention, cf. Articles 107 c – 107 e of the same Act.

If a financial undertaking is considered to be failing or likely to fail, this leads to resolution under the Act on Resolution of Credit Institutions and Securities Firms or, as the case may be, winding-up proceedings under Chapter XII of the Act on Financial Undertakings, cf. also the discussion in Chapter 1.5.

2.7. Notification and public disclosure of the outcome of the Financial Supervisory Authority's review and evaluation process

The Financial Supervisory Authority formally notifies a financial undertaking of the outcome of the review and evaluation process by a decision letter after having granted the required right to be heard, cf. Chapter IV of the Administrative Procedure Act.

In the letter, the Financial Supervisory Authority's minimum own funds requirement (Pillar I, Pillar II-R and, as applicable, Pillar II-R – LR) is broken down by main risk factors, which are:

credit, counterparty and concentration risk,
market and interest rate risk and
other risk, e.g. operational risk.

The main risk drivers within each risk factor as assessed by the Financial Supervisory Authority are then specified and, as applicable, other supervisory measures vis-à-vis the financial undertaking concerned. The total own funds requirement is also reported. If a financial undertaking is notified of an own funds add-on (Pillar II-G and, as applicable, Pillar II-G – LR), the Financial Supervisory Authority shall explain this. The outcome applies to the financial undertaking on an individual, consolidated and sub-consolidated basis, as applicable.

The Financial Supervisory Authority publicly discloses, in the form of a transparency notice, cf. Article 9 a of the Act on Public Supervision of Financial Activities and the Central Bank's policy on public disclosure,8 the main results of the review and evaluation process in a summarised form, including its minimum requirement and total own funds requirement.9 In addition, information on the own funds requirements of financial undertakings at any given time is published on the Central Bank's website.

[8] The Central Bank of Iceland's policy on public disclosure of the results of administrative cases.

[9] The total own funds requirement, which is published in a transparency notice, includes the combined buffer requirement applicable to the financial undertaking concerned on the date of publication. It takes into account, among other things, the weighted average of the systemic risk buffer and the countercyclical buffer for foreign risk exposures. The value of the buffers in question and their weighting may therefore change following publication.

BENCHMARKS FOR ASSESSING THE ADDITIONAL OWN FUNDS REQUIREMENT (PILLAR II-R)

Appendix I

Introduction 25

1 Business model and ownership of insurance companies 26

1.1. Analysis of the business model 26

1.2. Risk due to ownership of an insurance company 26

2 Governance and internal control 28

3 Credit and concentration risk 29

3.1. Credit risk 29

3.2. Concentration risk 33

4 Market and interest rate risk 35

4.1. VaR and SVaR 35

4.2. Assessment of the trading book 36

4.3. Assessment of the investment book 38

4.4. Assessment of risk originating in both books 40

5 Operational risk 42

Appendix 43

Introduction

Appendix I describes the methodology and benchmarks (supervisory benchmarks) applied by the Financial Supervisory Authority of the Central Bank of Iceland in assessing risk factors and the additional own funds requirement (Pillar II-R) of financial undertakings in the review and evaluation process (SREP).

The benchmarks are based on a methodology developed by the Financial Supervisory Authority to assess the additional own funds requirement for individual risk factors and their sub-factors, which, in the Financial Supervisory Authority's assessment, are not taken into account under Regulation (EU) no. 575/2013 (CRR), cf. Act no. 161/2002 on Financial Undertakings (Pillar I). The benchmarks therefore support the decision on the additional own funds requirement for each individual risk factor.

The additional own funds requirement is determined for each individual risk factor following an expert assessment based on the internal assessment of the financial undertaking concerned (ICAAP), the Financial Supervisory Authority's benchmarks and other available data and information.

The criteria generally apply to financial undertakings that use the standardised approach to calculate their capital requirement. In light of the different business models of financial undertakings, it is possible that individual criteria are not appropriate for all financial undertakings. The criteria aim to avoid double counting in the assessment of the capital requirement.

This appendix discusses in more detail the criteria for assessing additional capital requirements due to business model and ownership in an insurance company (Chapter 1), governance (Chapter 2), credit and concentration risk (Chapter 3), market and fixed interest rate risk (Chapter 4) and operational risk (Chapter 5).

Business model and ownership of insurance companies

1.1. Analysis of the business model

The analysis of the business model is discussed in Chapter 1.4.3. in the general part of the criteria. Furthermore, it is stated in Chapter 2.3.2 that if an analysis of the business model reveals serious weaknesses and other supervisory measures are considered inadequate or not appropriate to ensure appropriate improvements, it may lead to an additional capital requirement (Pillar II-R). The additional capital requirement due to the business model may amount to a total of up to 2 percentage points as a ratio of the risk base, but in very serious cases it may be higher. Table 1.1 provides examples of assessment factors in the analysis of the business model that may lead to an additional capital requirement (Pillar II-R).

Table 1.1 Analysis of the business model
Assessment factor	Examples
Uniform or risky business model	• Unusually high concentration in revenue items, products or customers. • Significant change in the business model, e.g. with high growth, entry into a new market or new products without risk management or infrastructure supporting it.
Unrealistic assumptions of the operating plan and/or business model	• Substantial deficiencies or unrealistic expectations about the position and development of the economic environment, competitive position and business environment. • Limited consistency between risk appetite and assumptions in the business plan.
Unclear strategy or lack of ability to implement and follow up on strategy	• The governance framework for the business strategy is weak. • Infrastructure and risk management are not consistent with the objectives of the business strategy. • It has repeatedly been revealed that the party does not have at its disposal sufficient ability to implement and execute projects related to the business strategy.
Lack of sustainability or viability of the business model	• Persistent operating losses without realistic measures to improve performance. • Risky financing or unrealistic financing plans. • Persistent imbalance on the balance sheet, (capital ratios, LCR, NSFR, LR etc.).

1.2. Risk due to ownership of an insurance company

This chapter explains the Financial Supervisory Authority's methodology for assessing the additional capital requirement due to risk arising from a financial undertaking's ownership of an insurance company, cf. the discussion in Chapter 1.4.3 in the general part of the criteria.

In the opinion of the Financial Supervisory Authority, a controlling ownership interest of a financial undertaking in an insurance company may involve risk beyond the risk inherent in a conventional shareholding. If an insurance company suffers an operational failure, it is likely that the financial undertaking, as the controlling owner, will need to provide the company with increased capital to strengthen its operations, not only based on the interests of the insurance company but also based on the overall interests of the financial undertaking concerned. The likelihood increases as the integration of the companies' activities is greater and if the financial undertaking holds a controlling ownership interest, defined as a direct or indirect ownership interest of at least 50%.

The extent of the risk is determined by the integration of the companies' activities, the risk profile and the financial position of the insurance company. To assess the additional capital requirement, the Financial Supervisory Authority applies a method based on the solvency ratio (SCRratio) of the insurance company. The additional capital requirement is calculated as the product of the book value (BV) of the ownership interest and a surcharge percentage in the range of 20-49%, which is determined by the solvency ratio of the insurance company concerned. If the solvency ratio is 1.5 or higher, no additional capital requirement is calculated. The surcharge percentage increases linearly from 20% to 49% as the solvency ratio decreases from 1.5 to 1. If the solvency ratio falls below 1.2, a capital requirement is added corresponding to the financial undertaking's share to bring the solvency ratio to 1.2.1 The additional capital requirement cannot be negative.

When determining the additional capital requirement due to ownership in insurance companies, account is taken of the capital requirement that is already taken into account in the capital calculation under the CRR, cf. the fourth paragraph of Article 48 and the fourth paragraph of Article 49 of the Regulation.2 Amounts deducted from the capital base due to the size of the investment or goodwill are also excluded in the assessment of the additional capital requirement.

The additional capital requirement (K) is calculated as follows:

K = max(0;(min(49%; 20% + (1.5-SCRratio ) × 0.58) × BV) + max(0;SCR × 1.2 - OF) × Ownership% - Pillar I)

Explanations:

Pillar I: Capital requirement for the ownership interest under Pillar I
BV: Book value of the ownership interest excluding the amounts deducted from the capital base due to the size of the investment or goodwill.
OF: The sum of eligible solvency items to meet the solvency requirement according to Chapter XV of Act No. 100/2016 on insurance activities.
SCR: The solvency requirement of the insurance company according to Chapter XVI of the Act on insurance activities.
SCRratio: The ratio of eligible solvency items (OF) and the solvency requirement (SCR).
Ownership %: Direct and indirect ownership interest in an insurance company.

Example: A financial undertaking holds a 100% ownership interest in an insurance company that is recognised at 90. The solvency requirement is 70, solvency is 100 and the solvency ratio is 1.43. The capital requirement under Pillar I amounts to 18 (90 × 250% × 8%) and the additional capital requirement (K) under Pillar II-R is 3.76:

K = max(0;(min(49%; 20% + (1.5 - 1.43) × 0.58) × 90) + max(0; 70 × 1.2 - 100) × 100% - 18)

The requirement therefore amounts to a total (Pillar I + Pillar II-R) of 21.76.

[1] The solvency ratio of 1.2 is considered a minimum to ensure the continued viability of the insurance company. The ratio is determined with regard to practice in the Icelandic financial market that has developed since the implementation of Directive 2009/138/EC (Solvency II).

[2] Holdings in financial market participants that are exempt from deduction from Common Equity Tier 1 pursuant to Article 48. CRR, carry a 250% risk weight. Holdings that are exempt from deduction pursuant to Article 49. CRR carry, where applicable, a risk weight pursuant to Chapter 2 or 3 of Title II of Part Three of the CRR.

2 Governance and internal control

Assessment of governance is discussed in section 1.4.4 of the general part of the guidelines. Furthermore, it is stated in section 2.3.2 that if the assessment of governance and internal control reveals serious weaknesses and other supervisory measures are considered inadequate or not appropriate to ensure appropriate remediation, it may lead to an additional capital requirement (Pillar II-R). The additional capital requirement for governance and internal control may amount to a total of up to 2 percentage points as a ratio of the risk base, but in very serious cases it may be higher. Table 2.1 provides examples of weaknesses in governance and internal control that may lead to an additional capital requirement (Pillar II-R)

Table 2.1 Governance and internal control

Assessment factor	Examples
Effectiveness and functioning of the board	• The board does not assess its own work and does not respond to weaknesses in its composition, e.g. lack of technical expertise. • High turnover on the board. • The board does not discuss the main risk factors and/or the writing of minutes is significantly deficient. • The board is not functional due to disagreement.
Corporate and risk culture	• Remediation requirements of internal/external auditors not met and/or deadlines repeatedly exceeded. • Lack of response to breaches of compliance with laws and internal rules. • Policy and procedures for conflicts of interest not in place and/or implementation significantly deficient. • Transactions between related parties not in accordance with requirements.
Remuneration policy	• Remuneration policy and/or bonus scheme does not take risk appetite and risk tolerance into account, e.g. performance metrics do not reflect the priorities of the board's strategy. • Remuneration policy not in place and/or not in accordance with requirements.
Internal control framework	• Infrastructure not in accordance with policy, e.g. control units poorly staffed and/or lacking knowledge, competence and experience. • Control unit, e.g. compliance, not independent in its activities.
Risk management	• Lack of effectiveness of the defence lines, e.g. lack of controls in the front line. • Policy and procedures significantly deficient or not in place. • Lack of ability to implement policy. • Significant shortcomings in the ICAAP/ILAAP process or stress tests.

Lending and concentration risk

3.1. Credit risk

This section describes the methodology and the benchmarks used by the Financial Supervisory Authority in assessing credit risk, cf. the discussion in section 1.4.5. of the general part of the benchmarks.

3.1.1. Holding companies with limited payment capacity

Loans to holding companies that do not have independent cash flows are generally riskier than lending to companies with conventional operations (operating companies). In the assessment of the Financial Supervisory Authority, a risk weight of 150% is appropriate for such lending. If the Financial Supervisory Authority considers the value of collateral or the deduction thereof to be insufficient, this may result in an additional own funds requirement.

A holding company is considered to have an independent cash flow if either of the following conditions is met:

a. Regular cash flow1 is sufficient to cover the normal payment burden of interest-bearing debt.

b. Operating companies, which are subsidiaries of the holding company, are debt-free and do not have the authority to take out long-term loans.

The additional own funds requirement (K) for holding companies is calculated as follows:

K = (X – Y) × Book value of loans × 8%

	X	Y
Corporate loans (en. Corporates)	150%	100%
Retail loans (en. Retail)	150%	75%

The benchmark of the Financial Supervisory Authority is not applied in cases where the holding company is in arrears or under forbearance, as a higher risk weight applies in such cases.

3.1.2. Loans in arrears with forbearance measures

In the assessment of the Financial Supervisory Authority, a limited volume of forbearance measures is considered normal for the operation of a financial undertaking. An increased proportion of forbearance measures is an indication of declining lending quality. The Financial Supervisory Authority therefore considers it appropriate to require additional own funds for loans that are in arrears with forbearance measures within portfolios classified as non-financial corporations (en. non-financial corporations) and households (en. households), in accordance with the definitions in FINREP, when the proportion of forbearance measures exceeds certain benchmarks. The benchmarks for each portfolio are:

	Lower benchmark	Higher benchmark
Non-financial corporations ((AQT 42.2.5)	2,0%	5,0%
Households (AQT 42.2.6)	1,0%	3,0%

The additional own funds requirement (K), for each loan portfolio, is calculated as follows:

K = (X – Y) × Book value of loans × 8%

[1] Dividends and sale of assets are not considered part of regular cash flow

	X	Y
Corporate loans	150%	100%
Retail loans	150%	75%
Municipalities	150%	20%
Real estate: Loans that meet the conditions of paragraph 1 of Article 125 of the CRR	100%	20%
Real estate: Loans that meet the conditions of paragraph 2 of Article 125 of the CRR	100%	30-105%
Real estate: Loans meeting the conditions of paragraph 1 of Article 126 of the CRR	100%	60%
Real estate: Loans meeting the conditions of paragraph 2 of Article 126 of the CRR	150%	70-110%
Real estate: Loans meeting the conditions for a 75% risk weight	150%	75%
Real estate: Loans meeting the conditions for a 100% risk weight	150%	100%
Loans for construction projects meeting the conditions for a 100% risk weight pursuant to paragraph 2 of Article 126a of the CRR	150%	100%
Loans for construction projects meeting the conditions for a 150% risk weight	250%	150%

Where the proportion of forbearance in the relevant loan portfolio, measured as the proportion of loans in arrears with forbearance under the cross default methodology (i.e. all loans to customers who have one or more loans with forbearance), is below the lower threshold, the Financial Supervisory Authority will not require additional own funds for the portfolio.

Where the proportion of forbearance is above the upper threshold, the Financial Supervisory Authority will require additional own funds corresponding to the calculated additional own funds requirement (K).

Where the proportion of forbearance is between the lower and upper thresholds, the Financial Supervisory Authority will require additional own funds that increase linearly from 0% up to 100% of the calculated additional own funds requirement (K) between the thresholds.

3.1.3. Debtors with no or limited cash flow from operations

The same considerations apply here as for holding companies, see section 3.1.1. This threshold applies to a debtor who does not have regular cash flow to cover the regular debt service burden of loans and whose repayment capacity is based on the sale of underlying assets. In such cases, irrespective of the forbearance or default status, the Financial Supervisory Authority considers it appropriate to apply a haircut to the best estimate of underlying collateral in order to address marketability risk, collection costs, the collection and sale process of pledged assets and maintenance costs for certain asset classes.

The Financial Supervisory Authority bases its assessment on the following haircuts for different asset classes:

Asset classes	Haircut
Cash	0%
Residential property	15%
Commercial property	20%
Land ready for development	25%
Fishing vessels (together with fishing quotas, see annex)	25%
Vehicles	30%
Agricultural land	30%
Other land	35%
Listed shares (main market)	50%
Other assets	50%
Trade receivables	50%
Listed shares (First North)	60%
Unlisted shares	70%
Inventories	70%

In cases where the carrying value of a loan is based on the value of collateral rather than regular cash flows, the additional own funds requirement (K) is calculated as follows:

K = M – (M × RW × 8%)
M = B – E + (H × E)

RW: Risk weight of the loan
H: Deduction
E: Fair value of asset
B: Book value of loan
M: Loan premium

Example: A loan premium of 1.000 m.ISK (M) to a holding company secured by unlisted shares with a value of 1.200 m.ISK without any impairment (book value = receivable value) is as follows:

M = 640 m.ISK = 1.000 m.ISK – 1.200 m.ISK + (70% × 1.200 m.ISK)

The benchmark for the additional own funds requirement shall therefore be as follows:

K = 589 m.ISK = 640 m.ISK – (640 m.ISK × 100% × 8%)

What remains of the book value (360 m.ISK) receives a 150% risk weight in accordance with section 3.1.1.2

3.1.4. Debt benchmarks for significantly indebted municipalities

A municipality is considered significantly indebted if its debt ratio exceeds 150% and it does not meet certain minimum requirements for cash flow from operations in relation to revenue, see the table below. If the debt benchmark exceeds certain ratios (150%; 200%; 250%; 300%), cash flow from operations in relation to revenue must exceed certain minimums (7.5%; 10%; 12.5%; 15%) which are linked to the debt benchmarks in the table below, for the municipality not to be considered significantly indebted.

In general, municipalities with a debt ratio below 150% are not considered indebted, regardless of the ratio of cash flow to revenue.

Municipalities with cash flow from operations higher than 15% of revenue are not considered indebted, regardless of their debt ratio.

The additional own funds requirement (K) is calculated as follows:

K = (X – Y) × Book value of loans × 8%

Debt benchmark	≥150%	≥200%	≥250%	≥300%
Cash flow from operations in relation to revenue	<7.5%	<10%	<12.5%	<15%

	X	Y
Municipalities	150%	20%

3.1.5. Loans to individuals

The Financial Supervisory Authority considers that the standardised approach may, in some cases, underestimate the risk associated with loans to individuals, such as credit card loans, overdraft loans, car loans and other consumer loans (non-performing loans and housing loans are excluded).

The Financial Supervisory Authority's benchmark for loans to individuals is partly based on the methodology for the additional own funds requirement for credit risk used by the British financial supervisory authority (Prudential Regulation Authority, PRA) and is based on a comparison of the risk weights of financial institutions' loan portfolios according to the standardised approach and the reference risk weight according to the internal ratings-based approach.3

The benchmark shall be applied in exceptional cases, taking into account expert assessments and taking into account the assessment of the financial institution concerned. Cases that may lead to the application of the benchmark include, among others but not exclusively, if there are significant risk exposures towards individuals and/or inadequate diversification in the loan portfolio or residual risks such as repurchase risk on car loans.

[2] Loans with inadequate deductions may receive a higher additional own funds requirement if they fall under risk factors as outlined in sections 3.1.1, 3.1.2 and 3.1.4.

[3] The PRA's methodologies for setting Pillar 2 capital

The additional own funds requirement (K) is calculated as follows:

K = (X – Y) × Book value of loans × 8%

	X	Y
Car loans	100%	75%
Other loans to individuals	110%	75%

3.1.6. Loan commitments with a 0% conversion factor4

In the opinion of the Financial Supervisory Authority, loan commitments that fall under a 0% conversion factor are generally not risk-free, as it can be difficult for financial institutions to revoke granted loan commitments with the short notice required to apply a 0% conversion factor in practice. Therefore, consideration should be given to setting an additional capital requirement for loan portfolios of this type.

The additional capital requirement (K) for off-balance-sheet items with a 0% conversion factor is calculated as follows:

K = Off-balance-sheet items with 0% conversion factor × 10% × 8%

3.1.7. Assessment of credit quality

The Financial Supervisory Authority regularly assesses the quality of financial undertakings' loan portfolios. Following the assessment, the Financial Supervisory Authority may direct the relevant financial undertaking to review its assessment or require it to write down assets in the calculation of the capital base. Alternatively, the Financial Supervisory Authority reserves the right to require additional own funds to cover the write-down need.

3.1.8. Rapid credit growth

Rapid credit growth of financial undertakings is one of the key factors in increased credit risk, but such growth is often at the expense of credit quality, and although risk weights under the CRR cover part of the risk associated with high credit growth, very rapid growth can lead to credit risk arising that the requirements of the CRR do not manage to capture. This applies in particular to aspects relating to credit management and monitoring of the loan portfolio. Experience has also shown that high exposures outside the geographical market area of financial undertakings have proven to be particularly risky.

The methodology of the Financial Supervisory Authority aims to capture excess risk associated with rapid credit growth, i.e. growth in excess of 8%. It distinguishes between loans to individuals, undertakings and foreign parties, regardless of the currency of issue of the loans. All foreign parties are treated as undertakings under this methodology. Loans to the public sector and financial undertakings are excluded.

The additional capital requirement is based on specific data collection from the relevant financial undertaking. Increased risk is considered to be related to the length of the period of high credit growth, and the Financial Supervisory Authority has chosen to measure credit growth over a three-year period, i.e. the last two preceding financial years and the expected growth in the next financial year according to the financial undertaking's business plan.

The additional capital requirement is determined on the basis of the exposure value of loans under the specialist assessment. The Financial Supervisory Authority will take into account the nature of the credit growth and assess the need for changes to the capital requirement, e.g. when loan portfolios are purchased. The Financial Supervisory Authority will also consider a floor amounting to 50% of the estimated capital requirements due to credit growth for the preceding year. Risk parameters used to determine the additional capital requirement are based on default experience. According to the above definitions of loan portfolios, each loan portfolio may contain both loans in Icelandic krónur and foreign currencies. When calculating credit growth, the Financial Supervisory Authority will look at the real growth of all loans in Icelandic krónur, but credit growth for loans in foreign currencies will be calculated at nominal value.

[4] With the entry into force of CRR3, the conversion factor under Pillar I will become 10%. However, that change does not take effect until 2029.

The assessment of the additional capital requirement (K) for credit growth in excess of 8% is calculated as follows for loan portfolios of individuals (I), undertakings (C) and foreign parties (F):

KI = Max[LI (1-e²(0.08-GI ) )0.02 ; 0.5KI
(t-1) ;0]
KC = Max[LC (1-e²(0.08-GC ) )0.05 ; 0.5KC (t-1) ;0] KF = Max[LF (1-e²(0.08-GF ) )0.05 ; 0.5KF (t-1) ;0]

L: Total loan portfolio (exposure value).
G: Credit growth over a three-year period on an annual basis (geometric average).

G = (
)
1/3
-1
Lt+1
Lt-2

3.2. Concentration risk

This chapter explains the methodology and the criteria used by the Financial Supervisory Authority in assessing concentration risk, cf. the discussion in Chapter 1.4.5. of the general part of the criteria.

3.2.1. Borrower concentration

Borrower concentration covers the risk associated with the distribution of financial undertakings' exposures.

The assessment of the concentration of individual debtors within the portfolio is based on the Herfindahl-Hirschman Index (HHI), which concerns the value of exposures:

HHISN = (
)
2 EADi
Σ EADTotal net n i=1

n: Total number of exposures, excluding exposures with 0% risk weight and exposures in default.
EADi
: Amount of exposure i.5
EADTotal net: Net total exposure, i.e. the total amount of exposures excluding exposures with 0% risk weight and exposures in default.

It is also possible to approximate the HHI coefficient based on the 100 largest exposures:

HHISN = (
)
2 EADi
Σ EADTotal net
100 i=1

s100.
×(1 - S100)

s100: The ratio of the value of the hundredth largest exposure to net total exposure (EADTotal net) S100: The ratio of the value of the sum of all 100 largest exposures to net total exposure (EADTotal net)

The additional capital requirement due to borrower concentration (KSN) will therefore be:

KSN=1.6 × HHISN × EADTotal net

For larger entities and entities with significant concentration, according to the decision of the Financial Supervisory Authority, more complex methods may be used to calculate borrower concentration, which must at least take into account the characteristics of the 100 largest exposures. Financial undertakings that use such methods must demonstrate their ability to assess the characteristics of large exposures satisfactorily.

The additional capital requirement due to borrower concentration is based on the Financial Supervisory Authority's criteria for borrower concentration, prudent expert judgment and, where appropriate, further analyses.

[5] According to Article 390. CRR.

3.2.2. Sector concentration

Sector concentration covers the risk of excessive concentration of exposures in one or several sectors, or a higher proportion of total exposures in more volatile sectors compared to the Icelandic market as a whole. The method is based on Standard & Poor's method for the same risk factor6 and Harry Markowitz's method for calculating the volatility of portfolios.7

The relative standard deviation of return on assets (vi ) in sixteen industries8 calculated using information from Statistics Iceland:,910

Vi = σi σ

Vi : Standard deviation of return on assets in sector i.

σ: Average of standard deviations of return on assets in all sectors.

Where the average standard deviation σ is:

S n i=1 σ = n σi

The correlation matrix of return on assets for individual industries (R) is calculated where the element ρi,j in the matrix is equal to:

cov(i,j) σi ρi,j = × σj

cov(i,j): Covariance in return on assets in sectors i and j.

The proportion of total exposure in sector i (Si ) calculated:

Si = EADi S EADi n i=1

EADi : Total exposure in sector i.

The vector of weighted sector composition (a) is calculated where element i is equal to:

ai = si × vi

The sector concentration load factor (L) calculated:

L =√(aT × R × a)

The sector concentration load factor for the Icelandic market (LIceland) is calculated in a comparable manner.11

The uncalibrated calculated additional capital requirement due to sector concentration calculated:

KSector,u = 13.5% × ( )× L – LIceland S 16 i=1 LIceland EADi

The calibrated calculated additional capital requirement is calculated so that a loan portfolio containing only assets in the sector that fluctuates most (max vi ) leads to a 4% additional capital requirement as a proportion of total exposure in all sectors:

KSector = 4% × ( )× EADTotal L – LIceland Vvol – LIceland

The additional capital requirement due to sector concentration is determined based on the calculated capital requirement and prudent expert judgment. Such expert judgment can, among other things, involve a closer examination of the legitimacy of the sector classification of larger entities.

[6] Standard and Poor's, Bank Capital Methodology and Assumptions, 2010.

[7] H. Markowitz (1952). Portfolio Selection. The Journal of Finance, (pp. 77-91).

[8] Nineteen sectors presented in Table 6 in FINREP, excluding sector K and where sectors O, P and Q have been combined.

[9] See Operating and financial statements 2002-2024. (Assets = 2-3-1 Long-term liabilities + 2-3-2 Short-term liabilities + 2-4-0 Equity. Profit = 1-8-0 Profit)

[10] ÍSAT2008 is the Icelandic industry classification used by Statistics Iceland. It is based on the NACE industry classification of the European Union, but FINREP is based on NACE.

[11] The Financial Supervisory Authority will either provide Icelandic banks with LIceland or they can estimate the sector distribution based on published data from the Central Bank of Iceland on lending by deposit institutions by sector .

Market and fixed interest risk

This chapter describes the methodology and the criteria used by the Financial Supervisory Authority in assessing market and fixed interest risk, cf. the discussion in Chapter 1.4.5. in the general part of the criteria. According to the European Banking Authority's (EBA) guidelines on the supervisory review and evaluation process and stress testing, competent authorities shall assess market risk in the trading book, as well as interest rate risk and equity risk in the investment book. Table 4.1 below shows which risk factors are assessed under the CRR (Pillar I) and which risk factors are examined in the assessment of additional capital requirements (Pillar II-R).1

Table 4.1 Risk factors under Pillar I and II-R

	Stoð I	Stoð II-R
Trading book	General interest rate risk	General interest rate risk
	Specific interest rate risk	General equity risk
	General equity risk
	Specific equity risk
Investment book	General equity risk	General equity risk
		Fixed interest rate risk (IRRBB)
Overall	Currency risk	Currency risk
	Commodity risk	Indexation risk
	CVA risk	Risk management

The Financial Supervisory Authority assesses whether the own funds requirement for general equity risk according to the CRR is sufficient and requests additional own funds if necessary. Since no own funds requirements are made for fixed interest rate risk in the investment book (interest rate risk in the banking book, IRRBB) according to the CRR, the Financial Supervisory Authority assesses additional own funds needs due to the risk factor. The assessment includes a qualitative assessment of concentration and liquidity, both in the trading book and investment book, along with an assessment of risk management. For most risk factors, there are more than one method to assess additional own funds needs, and they have different sensitivities to the various risk factors and will therefore lead to different results. In light of the above, the Financial Supervisory Authority uses more than one method as appropriate to assess additional own funds needs, which is further discussed below.

4.1. VaR and SVaR

Many of the methods used by the Financial Supervisory Authority are based on calculations of Value at Risk (VaR) and Stressed VaR (SVaR). The methods are based on the assumptions set out in the CRR, in addition to EBA guidelines (EBA/GL/2012/2). They are intended to be minimum benchmarks for financial undertakings that use the internal model approach to calculate the own funds requirement for market risk in the trading book.

[1] Own funds requirements are made for equities and bonds in the trading book under credit risk according to the CRR.

Calculations of VaR are based either on historical daily profit and loss or on historical changes in underlying risk factors. The former method assumes that fluctuations in historical daily profit and loss give a good indication of potential future loss of the financial undertaking. The method is often used when limited historical market data is available on individual positions or when satisfactory risk proxies are not available. The latter method is based on the assumption that historical behavior of underlying risk factors likely reflects their future behavior and thus the risk involved in holding current positions. In certain cases, it may be appropriate to give more weight to recent data, especially when volatility is increasing.

The observation period for calculating VaR is generally based on the last 250 business days. For SVaR, the observation period is also 250 days, but the period chosen must cover a significant stress event relevant to the portfolio being assessed. There are several methods to define such a period, e.g., choosing the period with the greatest fluctuations in risk factors or the 12-month period that gives the highest VaR result. For many portfolios, a 12-month period covering significant loss in 2007–2008 can adequately reflect a stress period.

4.2. Assessment of the trading book

Benchmarks for additional own funds requirements are based on calculation of estimated loss due to adverse changes in key sub-factors of market risk. Interest rate and equity risk in the trading book is assessed using VaR models. Commodity risk has so far not been considered part of the overall market risk of financial undertakings, as domestic financial undertakings have so far not taken positions in commodities.

In light of the small size, fluctuations and lack of depth in domestic equity and bond markets, compared to comparable markets in other countries, the Financial Supervisory Authority does not consider it prudent to rely solely on risk weights and nominal value in the trading book. Such an approach also does not ensure that financial undertakings that apply active risk management to their portfolios are rewarded for it. This also means that during stress periods, when volatility increases, the own funds requirement can become higher than the nominal value of bond or equity risk exposures on the reporting date. This is appropriate, since the purpose of own funds requirements is to meet the risk that arises in daily operations, not only the position on the reporting date.

4.2.1. General interest rate risk

To assess own funds requirements for general interest rate risk in accordance with Articles 339 and 340 of the CRR, the Financial Supervisory Authority uses VaR based on historical development (historical VaR) and SVaR (stressed VaR). When calculating VaR and SVaR, the following is assumed:

The Financial Supervisory Authority's benchmark is based on the net historical performance of the portfolio, excluding the cost of carry.
No weighting of historical data is used.
When calculating SVaR, performance figures older than the 250 most recent data points are scaled to reflect changes in the size of the portfolio. The scaling is performed by comparing the size of the portfolio at each data point with the average size of the portfolio over the period covered by the last 250 data points.

The Financial Supervisory Authority's benchmark for general interest rate risk in the trading book is calculated as the sum of the following:

1. 99% VaR on profit and loss, scaled to a 10-day holding period, with the last 250 days as the historical observation period. The higher of:

a. the most recent VaR result, and

b. the average of VaR results calculated over the last 60 business days, which is then multiplied by a backtesting factor of 3.

2. 99% SVaR of profit and loss, scaled to a 10-day holding period, using the most adverse 250-day period over the last five years. The higher of:

a. the most recent SVaR result, and

b. the average of SVaR results calculated over the last 60 trading days, which is then multiplied by a backtesting factor of 3.

The own funds requirement for general interest rate risk under the CRR is deducted from the result.

4.2.2. General equity risk

To assess whether additional own funds are needed for equity risk in the trading book, the Financial Supervisory Authority uses three different methods, described in more detail below.

Risk weighting method

This benchmark for equity risk in the trading book is calculated as the sum of the following items:

1. 370% risk weight for unlisted equities in the trading book.

2. 290% risk weight for listed equities in the trading book.

3. 190% risk weight for exposures due to investments in unlisted companies in diversified portfolios (private equity).

If look-through cannot be applied for trading book exposures in funds, a 370% risk weight is applied. The general and specific own funds requirement for equity risk under the CRR is deducted.

VaR method for profit and loss (P&L VaR)

In the second method, historical VaR and SVaR are used. When calculating VaR and SVaR, the following is assumed:

The Financial Supervisory Authority's benchmark is based on the net historical performance of the portfolio, excluding the cost of carry for positions in the portfolio.
No weighting of historical data is used.
When calculating SVaR, performance figures older than the 250 most recent data points are scaled to reflect changes in the size of the portfolio. The scaling is performed by comparing the size of the portfolio with each data point and the average size of the portfolio over the last 250 data points.

The benchmark for general equity risk in the trading book is the sum of:

1. 99% VaR of profit and loss, scaled to a 10-day holding period, using the last 250 days as the historical observation period. The higher of:

a. the most recent VaR result, and

b. the average of VaR results for the last 60 trading days, which is then multiplied by a backtesting factor of 3.

2. 99% SVaR of profit and loss, scaled to a 10-day holding period, using the most adverse 250-day period of the last five years. The higher of:

a. the most recent SVaR result, and

b. the average of SVaR results for the last 60 trading days, which is then multiplied by a backtesting factor of 3.

The own funds requirement for general equity risk under the CRR is deducted from the result.

Covariance method

In the third method, models based on historical VaR and SVaR are used. When calculating VaR, the natural logarithm of the historical return of positions in the portfolio and a covariance matrix are used. If historical data is lacking for certain positions, the Financial Supervisory Authority uses proxies to calculate the correlation of equities.

To take the SVaR component into account, the Financial Supervisory Authority has decided to scale up VaR with a SVaR multiplier. The minimum value of the multiplier is 2.0, which indicates that the current VaR period is considered to reflect stress in an appropriate manner. As the VaR period becomes less severe, the Financial Supervisory Authority increases the SVaR multiplier. For reference, the average ratio of VaR to SVaR in the EBA's 2018 benchmark exercise was about 3.0 (corresponding to a multiplier of 4.0). The current SVaR multiplier (2.5) therefore reflects the current level of market fluctuations.

The formula for assessing the additional own funds requirement for general equity risk in the trading book is as follows:

1. 99% VaR on the natural logarithm of historical returns, scaled over a 10-day holding period, using the last 250 days as the historical observation period. The higher of:

a. the most recent VaR result, and

b. the average of VaR results calculated over the last 60 trading days, which is then multiplied by a backtesting factor of 3 and a SVaR multiplier of 2.5.

The own funds requirement for general equity risk under the CRR is deducted from the result.

When applying the second and third methods, equity positions in foreign markets are treated as if they were all in a single index, the Nasdaq Composite (IXIC). To reflect that fluctuations in foreign equity positions are generally greater than in the index, the volatility of the index used in the calculations is multiplied by 3.

4.2.3. Market maker discount

Financial undertakings play a key role in promoting liquidity and depth in the equity market as market makers. To reflect the importance of this role, the Financial Supervisory Authority provides a special discount on own funds requirements according to the criteria discussed in Chapter 5.2. The formula for the discount percentage is as follows:

Where:

Discount % = (
)× 50% (min(pi
, ti
))
P
Sn i=1

P = Average value of the portfolio over the last 60 trading days
i = Each share that has been in portfolio P for the last 60 trading days and has an active market-making agreement
pi = Average value of share i in portfolio P over the last 60 trading days
t i = Average daily turnover of share i over the last 60 trading days

As stated in the formula, the discount is only granted on positions where a financial undertaking has an active market-making agreement. In addition, the discount only covers the part of the position that is equal to or lower than the average market turnover per day. The own funds requirement under the CRR acts as a floor, i.e. the discount can never lead to a negative additional own funds requirement. The formula for the additional own funds requirement after discount is therefore as follows:

Pillar II-R after discount = MAX(0; (Pillar I + Pillar II-R) × (1 - discount%) - Pillar I)

4.3. Assessment of the investment book

The criteria for determining the additional own funds requirement for market risk are based on the calculation of the estimated potential loss that may arise due to adverse changes in the most important sub-components of market risk. In the exploration and assessment process, loss risk related to equity, interest rate and real estate risk in the investment book is assessed using stress tests on the portfolios of financial undertakings.

4.3.1. Interest rate risk in the investment book (IRRBB)

Interest rate risk in the investment book is not part of the own funds requirement under the CRR. The assessment of the additional own funds requirement takes into account the methodology and results of the financial undertaking's ICAAP report as well as the results of the Central Bank's benchmarks. The overall assessment is always based on the assessment of the Financial Supervisory Authority with regard to available information and expert judgement.

The main benchmark for interest rate risk in the investment book is based on the EBA guidelines (EBA/GL/2022/14) in addition to delegated regulations (EU) 2024/856 and 2024/857, cf. rules no. 1588/2025. The benchmark includes a measurement of both the economic value of equity (EVE) and net interest income (NII). The older benchmark for fixed interest rate risk (the "Older EVE measure") is, however, still taken into account.

For both measurements, it applies that all interest rate risk exposures arising from activities outside the trading book in currencies where the financial undertaking concerned has relevant positions, i.e. where the book value of financial assets or liabilities is in a specific currency, are either:

5% of total financial assets or liabilities outside the trading book, or
< 5% but it is included to ensure that the combined financial assets and liabilities included in the calculation are higher than 90% of total financial assets outside the trading book, excluding tangible assets, or liabilities.

Six different shock scenarios are used as a basis: 1) parallel shift up, 2) parallel shift down, 3) steeper curve, 4) flatter curve, 5) short-term rates up and 6) short-term rates down. They are all used in the EVE measurement, but only the first two are used for the NII measurement.

Specific parallel, short-term and long-term interest rate shocks are used to set out shock scenarios for each currency. Interest rate shocks for all currencies other than ISK and indexed ISK are specified in Part B of the annex in delegated regulation (EU) 2024/856. Interest rate shocks for ISK and indexed ISK are listed in the table below and the derivation for these six shock scenarios is described in Article 2 of delegated regulation (EU) 2024/856.

	ISK	ISK-indexed
Parallel	350	100
Short-term	500	150
Long-term	250	100

The EVE measure

The EVE measure measures changes in the economic value of equity of a financial undertaking that can be traced to sudden and unexpected interest rate changes according to one of the six shock scenarios listed above. The EVE measure differs from the measure provided for in delegated regulation (EU) 2024/856 in that it is still based on the modified duration method, rather than a cash flow method. Furthermore, behavioural assumptions for deposits are not taken into account in it. The assumptions for the EVE measure are as follows:

a. A balance sheet that runs off where assets at maturity are not renewed.

b. All interest-sensitive assets outside the trading book are included.

c. Small trading book transactions are included, unless their interest rate risk is assessed elsewhere.

d. Automatic and behavioural options are included.

e. Specific interest rate caps and interest rate floors for individual financial instruments are included.

f. All instruments that count as common equity tier 1 and other perpetual own funds instruments without call dates are excluded.

g. Default claims are excluded if they are below 2% of total credit risk, otherwise they are included less write-downs.

h. If interest rate margins and other margin components are excluded, this must be done in a consistent manner, in line with methods for hedging against interest rate risk. The Financial Supervisory Authority must be informed of this.

i. A maturity-related interest rate floor after shock is used for each currency and starts at -150 points for overnight rates (O/N). The floor rises by 3 points per year and finally reaches 0% at a 50-year maturity. If market rates are lower than the floor, they shall apply.

j. Changes due to interest rate shocks are aggregated for each currency. All currencies are converted into the reporting currency using the European Central Bank's end-of-day exchange rate on the reference date. Positive changes are weighted with the factor 50%, or 80% in the case of ERM II currencies.

k. For discounting, the relevant general "risk-free" yield curve shall be used for each currency. The yield curve shall not include specific risk margins or liquidity margins for individual financial instruments, sectors or entities.

Although the Financial Supervisory Authority's benchmark described here is generally simpler than the methodology used by larger financial undertakings in the market, the Financial Supervisory Authority encourages financial undertakings to develop methods that take behavioural assumptions into account. The EVE decision is subject to expert assessment.

The NII metric

The NII metric measures changes in net interest income over a 12-month period that can be attributed to sudden and unexpected interest rate changes according to either of the first two stress scenarios listed above. The assumptions for the NII metric are the same as for EVE, with three exceptions:

a. A constant balance sheet, where size and composition, including on- and off-balance sheet assets, shall be maintained by replacing financial instruments with cash flows at maturity or repricing with new instruments that have comparable characteristics with respect to currency, amount and repricing period. The interest margin of new instruments shall be based on the interest margin of recently bought or sold products with similar characteristics. In the case of instruments with an observable market price, a recent market margin shall be used, not a historical market margin.

b. Interest income and interest expenses over a one-year period are included, regardless of maturity and accounting method of the relevant interest-sensitive instruments outside the trading book.

c. Trading margin and other margin components are always included.

The older EVE metric

Despite the entry into force of the aforementioned new metrics, the older EVE metric may still be considered for use. That metric is based on sudden, unexpected and permanent parallel shifts in the interest rate curve of ±400 points for unindexed Icelandic krónur, ±240 points for indexed Icelandic krónur and ±200 points for other currencies.

Assets and liabilities are discounted with risk-free interest rate curves and with modified duration. A balance sheet that runs off is assumed, no convexity, no options and 0% interest rate floor. It is permitted to exclude defaulted loans and interest-insensitive loans with impairment. No adjustments due to differences between fair value and book value are permitted.

4.3.2. Equity risk

The Financial Supervisory Authority's benchmark for equity risk in the investment book in the trading book is calculated as the sum of the following:

370% risk weight for unlisted equities in the investment book.
290% risk weight for listed equities in the investment book.
If look-through cannot be applied due to investment book exposures in funds, a 370% risk weight is applied.

The own funds requirement for equity risk in the investment book according to CRR is deducted from the result.

4.4. Assessment of risk originating in both books

4.4.1. Foreign exchange risk

To assess whether the calculation of the own funds requirement for foreign exchange risk according to CRR is sufficient for financial undertakings, the Financial Supervisory Authority uses a benchmark based on 99% VaR calculated with a covariance matrix VaR. The benchmark is based on the net position of each financial undertaking in each currency, excluding ISK, on the reporting date. The benchmark is defined as the most adverse historical 250-day period over the last five years, taking into account foreign exchange positions. Daily VaR is scaled to annual VaR with the square root of 250.

To verify whether foreign exchange positions on the reporting date are considered "normal", the VaR result of the reporting date is compared with the average VaR result calculated with foreign exchange positions of the last 60 active days before the reporting date. The own funds requirement for foreign exchange risk according to CRR is then deducted from the result.

4.4.2. Inflation risk

Inflation risk is the risk of loss due to unexpected changes in inflation resulting from a mismatch between indexed assets and liabilities.

Inflation risk is not addressed according to CRR, but it is in nature similar to foreign exchange risk. Inflation is subject to seasonal fluctuations and its historical distribution has both skewness and excess kurtosis. To take these characteristics into account, the historical development of the consumer price index is adjusted for seasonal fluctuations and MVaR2 is used to calculate a one-year 99% VaR for negative inflation balance:

When calculating MVaR for positive positions, a negative data set is used (multiplied by -1). Own funds requirement, as a ratio of inflation balance:

1. Positive position: 3.43%

2. Negative position: 6.08%

K = { –R × 6.06% if R > 0
R × 3.43% if R > 0

When assessing the additional own funds requirement (K), the Financial Supervisory Authority considers that the zero point in the inflation balance (indexed assets and liabilities the same) is not considered to be an appropriate zero point since the own funds requirement is

[2] L.Cavenaile & T. Lejeune (2012). A Note on the Use of Modified Value-at-Risk, Journal of Alternative Investments.

not a specified króna amount but a ratio. Furthermore, the appropriate zero point is considered to be the position when inflation has no effect on the capital ratio. The formula for calculating the additional own funds requirement is as follows:

R = (V - M × EignirVTR × RWVTR )

Where:

M = Pillar I + Pillar II-R + Capital buffers + 1% 1 - Tax percentage

V = Inflation balance (Indexed assets less indexed liabilities)

EignirVTR = Total value of indexed assets

RWVTR = Average weighted risk weight of indexed assets

Pillar I = 8% according to CRR

Pillar II-R= Own funds requirement under Pillar II (e.g. 2%)

Capital buffers = Aggregate capital buffer requirement

Tax percentage = Corporate tax, currently 26%.

Due to historical correlation, financial undertakings are permitted to calculate inflation risk and interest rate risk in the investment book in a common model. Since the correlation is, however, volatile and breaks down in some cases, a 75% floor has been set to limit the benefit of risk diversification of these risk factors.

5 Operational risk

With reference to section 1.4.5 of the general part of the criteria, this appendix deals with the criteria that the Financial Supervisory Authority applies when assessing whether weaknesses in operational risk are present that can lead to an additional capital requirement (Pillar II-R). The additional capital requirement for operational risk takes into account, among other things, the risk profile of the financial undertaking's operations, the quality of risk management and internal control, and historical losses due to operational risk. Financial undertakings that are likely to be subject to such a requirement include, but are not limited to, those that face significant operational risk beyond the requirement calculated in accordance with the CRR (Pillar I). The additional capital requirement due to operational risk may amount to a total of up to 2 percentage points as a ratio of the risk base, but in very serious cases it may however be higher. Table 5.1 contains examples of weaknesses that can lead to an additional capital requirement for operational risk (Pillar II-R)

	Table 5.1: Operational risk
Sub-risk factors		Examples
Legal risk, incl. compliance risk and conduct risk		• Significant risk of loss, incl. costs, fines, sanctions or punitive damages due to events that lead to litigation. • Serious breaches of requirements arising from domestic and/or international administrative or legal provisions, incl. fines due to AML/CFT. • The frequency and severity of operational risk events/losses and deviations have been high and the risk has increased significantly.
Model risk		• Inadequate or serious deficiencies in the framework for models that are used in decision-making and affect important operations in the business. • Models are used without review and an independent validation process.
ICT risk - information and communication technology risk		• Lack of appropriate knowledge and experience on the part of the company's board in information and communication technology risk (ICT). • Weaknesses in data security, backup, storage of backups or recovery. Repeated serious incidents, weaknesses in systems or unclear responsibility. • Weak management of contracts with 3rd party ICT service providers. • Repeated remarks in ICT audits and/or improvements are not addressed in a satisfactory manner. • General ICT tests not carried out in a satisfactory manner.
Third party risk		• Concentration towards third-party service providers is very high with long and complex subcontracting chains. • Significant shortcomings in the outsourcing of important activities. • Inadequate exit or recovery plans.
Operational resilience, business continuity, response and recovery		• Serious threat to or disruption of important activities that could lead to significant operational disruptions (including incidents related to information technology). • The existence and testing of response plans for important activities and external service providers is significantly deficient.
Organisational and internal control framework		• Significant shortcomings in the division of responsibility between the three lines of defence. • Significant deficiencies in the risk management framework, incl. for ICT. • The implementation of risk assessments, the framework for controls and testing of them is significantly deficient. • Inadequate testing and monitoring of new products, processes and systems. • Significant shortcomings in processes and implementation regarding AML/CFT.

Appendix

Criteria for the value of fisheries management rights

Table 1 Criteria for the value and deduction of fisheries management rights
in the quota system

Species	Value kr/kg	Deduction %
Cod	3,128	30
Haddock	1,427	30
Saithe	739	55
Monkfish	805	30
Golden redfish	818	35
Tusk	487	40
Ling	823	35
Deepwater redfish	0	100
Greenland halibut	3,153	45
Sand dab	339	45
Long rough dab	862	30
Langlúra	770	30
Þykkvalúra/sólkoli	1,236	30
Skötuselur	1,513	55
Blálanga	864	55
Hlýri	805	100
Gulllax	395	45
Úthafsrækja	419	100
Grásleppa	N/A	N/A
North Ice Sea cod (Norwegian)	3,128	100
Íslensk sumargotssíld	757	35
	Virði kr pr. 1%
Kolmunni	387	80
Loðna	615	60
Makríll	588	80
Norsk-íslensk síld	485	80

Table 2 Reference values and deductions for fishing permits
in the hook-and-line catch mark system

Species	Value kr/kg	Deduction %
Þorskur	2,659	30
Ýsa	1,213	30
Ufsi	628	55
Steinbítur	684	30
Gullkarfi	695	35
Keila	414	40
Langa	700	35
Litli karfi	0	100
Blálanga	734	55
Hlýri	0	100

Appendix II

CAPITAL BUFFERS

Introduction 49

1 Capital conservation buffer 51

2 Countercyclical capital buffer 52

3 Capital buffer for global systemically important financial institutions 54

4 Capital buffer for domestically systemically important financial institutions 55

5 Systemic risk buffer 56

Introduction

With reference to Chapter 2.4 of the general part of the standards, this appendix discusses in more detail the imposition of capital buffers, their objectives and exemptions from them.

According to Chapter X of Act No. 161/2002 on Financial Undertakings, financial undertakings shall maintain capital buffers. The objective of capital buffers is to respond to systemic risk in the financial system, increase the resilience of financial undertakings against credit losses and reduce the impact of the financial cycle on the real economy. There are five capital buffers:

Capital conservation buffer.
Countercyclical capital buffer.
Capital buffer for global systemically important institutions, G-SII buffer.
Capital buffer for other systemically important institutions, O-SII buffer.
Systemic risk buffer.

In Part A of Chapter X of the Act on Financial Undertakings there are general provisions on capital buffers and the combined capital buffer requirement. The combined capital buffer requirement means the combined requirement of capital buffers that the financial undertaking concerned shall maintain at any given time. Of the combined capital buffer requirement, the systemic risk buffer requirement shall, as applicable, be met first, then the capital buffer requirement for systemically important financial undertakings, then the countercyclical capital buffer requirement and finally the capital conservation buffer requirement, cf. Article 83 of the Act on Financial Undertakings and Figure 1.

The combined capital buffer requirement shall be met with common equity tier 1 (CET1) capital according to Chapter 2 of Part I of Title II of Regulation (EU) No. 575/2013 (CRR), cf. Article 83 a of the Act on Financial Undertakings. The combined capital buffer requirement is calculated on the risk base according to the third paragraph of Article 92. CRR. A financial undertaking shall maintain the combined capital buffer requirement on a consolidated, sub-consolidated or individual basis, as applicable, cf. Article 83 c of the Act.

If a financial undertaking does not maintain the combined capital buffer requirement, the distribution of profits, payment of dividends, repurchase of own shares and bonus payments are restricted as applicable, among other things, cf. Articles 86 m – 86 o of the Act on Financial Undertakings, and the financial undertaking concerned shall also prepare and submit to the Financial Supervisory Authority a capital conservation plan, cf. Article 86 s of the Act.

Figure 1 Combined capital buffer requirement

Capital conservation buffer
(CET1)
Countercyclical capital buffer
(CET1)
Capital buffer for systemically important financial undertakings (CET1) Systemic risk buffer (CET1) 2,5% 0-2,5%1 Global 1-3,5%2 Domestic 0-3%1,2 0-3%1,2

[1] The ratio may however be higher under special circumstances.

[2] The aggregate ratio of the systemic risk buffer and the capital buffer for systemically important financial institutions may generally not be higher than 5% of the risk base.

The provisions of Chapter X of the Act on Financial Undertakings do not generally apply to securities undertakings. On the other hand, securities undertakings, which are required to have paid-up share capital amounting to at least the equivalent of EUR 730 thousand in Icelandic krónur, shall maintain capital buffers unless they satisfy both of the following conditions:

1. The number of annual work units is fewer than 250.

2. Annual turnover according to the annual financial statements is not more than the equivalent of EUR 50 million in Icelandic krónur or assets according to the annual financial statements are not more than the equivalent of EUR 43 million in Icelandic krónur.

Current requirements for capital buffers are published on the Central Bank's website.

1 Capital conservation buffer

According to Part B of Chapter X of the Act on Financial Undertakings, financial undertakings shall satisfy the requirement for a capital conservation buffer. The capital conservation buffer shall amount to 2.5% of the risk base. The requirement shall be satisfied with Common Equity Tier 1 and shall be maintained on a consolidated, sub-consolidated or individual basis, as applicable.

The objective of the statutory requirement for a capital conservation buffer is to preserve increased equity and strengthen the resilience of financial undertakings. Thus financial undertakings have additional equity that they can use to meet loan losses without restricting continued operations, in particular the supply of credit.

2 Countercyclical capital buffer

According to Part C of Chapter X of the Act on Financial Undertakings, the Central Bank may, by rules it sets following prior approval by the Financial Stability Committee, provide that financial undertakings shall maintain a countercyclical capital buffer.1 The requirement shall be satisfied with Common Equity Tier 1 and the requirement shall equal the risk base of the financial undertaking multiplied by the weighted average of the countercyclical capital buffer ratio in those states in the European Economic Area (EEA) where the credit risk exposures of the financial undertaking are located, and the buffer shall be maintained on a consolidated, sub-consolidated or individual basis, as applicable.

Generally, the countercyclical capital buffer due to exposures in this country shall amount to 0–2.5% of the risk base of the financial undertaking and the ratio shall be a multiple of 0.25 percentage points. The ratio may however be higher than 2.5% if the risk factors underlying the assessment of the value of the countercyclical capital buffer give reason for it. Financial undertakings shall publish information on the countercyclical capital buffer in accordance with Article 18 of the Act on Financial Undertakings and Article 440 CRR and Implementing Regulation (EU) 2024/3172, cf. rules No. 1554/2025, on the disclosure obligations of financial undertakings.

The countercyclical capital buffer ratio shall be reviewed at least quarterly. A decision to increase the countercyclical capital buffer ratio shall take effect no later than twelve months after the decision, unless exceptional circumstances justify the decision taking effect earlier. On the other hand, a reduction of the countercyclical capital buffer ratio shall take effect immediately.

The objective of the requirement for a countercyclical capital buffer is to support the financial strength of financial undertakings and counteract an excessive reduction in access to credit during stress periods which could amplify the effects of economic shocks on the financial system and the economy. The countercyclical capital buffer ratio shall take into account cyclical systemic risk. In assessing it, consideration shall be given to the credit cycle, in particular the deviation of the ratio of debt to gross domestic product from its long-term trend, the risk arising from excessive growth in debt in this country and other relevant factors. Particular account shall be taken of the characteristics of the Icelandic economy.

The Financial Stability Committee has approved criteria for determining the value of the countercyclical capital buffer, which state that the positive neutral value of the buffer shall as a rule amount to 2-2.5% of the risk base due to domestic exposures.2

The countercyclical capital buffer ratio varies between financial undertakings as it takes into account the risk base of the financial undertaking concerned and the weighted average of the countercyclical capital buffer ratio in those EEA states where the relevant exposures of the financial undertaking are located.3 The final ratio is therefore calculated as the weighted average of the countercyclical capital buffer ratio applicable in those member states where the credit risk exposures of the financial undertaking are located multiplied by the risk base.

Example: The countercyclical capital buffer in Iceland (2.5%) and in Norway (2.5%), Sweden (2%) and Germany (0.75%) are calculated as a ratio of the risk base. This means, for example, that all loans to Swedish counterparties, regardless of the location of the financial undertaking granting the loan, carry a 2% countercyclical capital buffer. Consequently, a financial undertaking which has 80% of its credit risk towards Icelandic counterparties, 5% towards Swedish counterparties, 6% towards German counterparties and 9% towards Norwegian counterparties shall maintain a countercyclical capital buffer amounting to 2.37% of the risk base, cf. further Table 1.

[1] Currently 2.5% of the risk base, cf. rules No. 256/2023, on the countercyclical capital buffer for financial undertakings.

[2] Criteria for determining the value of the countercyclical capital buffer (December 2024).

[3] Delegated Regulation (EU) No. 1152/2014, cf. rules No. 787/2022, on the calculation of the countercyclical capital buffer ratio for financial undertakings.

Table 1 Example of calculation of the countercyclical capital buffer ratio¹	Ratio (%)	Geographical location of credit risk exposures (%)
Iceland	2,5	80
Norway	2,5	9
Sweden	2,0	5
Germany	0,75	6
Weighted average	2,37	100
1. Countercyclical capital buffer ratios as of March 2026.

Information on countercyclical capital buffer ratios in EEA states is published on the website of the European Systemic Risk Board (ESRB).

Capital buffer for globally systemically important financial institutions

According to Part D of Chapter X of the Act on Financial Undertakings, the Central Bank may, by rules it sets following prior approval by the Financial Stability Committee, provide for a capital buffer for globally systemically important financial institutions.1 The requirement shall be satisfied with Common Equity Tier 1 and shall be maintained on a consolidated, sub-consolidated or individual basis, as applicable.

The rate of the capital buffer for globally systemically important financial institutions shall be 1-3.5% of the risk base and shall be reviewed at least annually.

If both the capital buffer for globally systemically important financial institutions and the capital buffer for domestically systemically important financial institutions apply, the capital buffers shall not be added together; instead, only the higher one shall apply, cf. the first paragraph of Article 83 c of the Act. The combined rate of the systemic risk buffer and the capital buffer for systemically important financial institutions may not be higher than 5% of the risk base unless with the approval of the Standing Committee of the EFTA States, the second paragraph of the same Article.

No financial institution in this country has been defined as globally systemically important. Information on globally systemically important financial institutions and the rates of capital buffers for them can be accessed on the website of the Financial Stability Board (FSB).

[1] According to Article 86 b of the Act on Financial Institutions and the delegated regulation (EU) No. 1222/2014, cf. rules No. 886/2022, on the designation of a globally systemically important financial institution.

4 Capital buffer for domestically systemically important financial institutions

According to Part E of Chapter X of the Act on Financial Institutions, the Central Bank may, by rules it sets after prior approval of the Financial Stability Committee, provide that a financial institution that is considered domestically systemically important according to Article 86 e of the same Act shall maintain a capital buffer for domestically systemically important financial institutions.1 The requirement shall be met with Common Equity Tier 1 and shall be maintained on a consolidated, sub-consolidated or individual basis, as applicable.

The rate of the capital buffer for domestically systemically important financial institutions shall be 0–3% of the risk base. The rate may, however, be higher than 3% with the approval of the Standing Committee of the EFTA States. The combined rate of capital buffers for domestically systemically important financial institutions and the systemic risk buffer may, however, not be higher than 5% of the risk base unless with the approval of the Standing Committee of the EFTA States, cf. the second paragraph of Article 83 c of the Act on Financial Institutions.

Systemically important financial institutions are those that, due to their size and the nature of their operations, can have a significant negative impact on the stability of the financial system and on the real economy if they encounter difficulties. For these reasons and because systemically important financial institutions are generally important for the operation of financial infrastructure and the public's access to payment services and their own savings, the public safety net around them is tighter than otherwise and direct and indirect guarantees of their obligations are more extensive. This magnifies the moral hazard that appears in that these institutions could take more risk than is beneficial for the financial system as a whole. Therefore, there is a need for regulation, especially in the form of increased capital requirements and more active supervision than otherwise, which counteracts this tendency.

According to Article 86 e of the Act on Financial Institutions, cf. point d of Article 13 of Act No. 92/2019, on the Central Bank of Iceland, the Financial Stability Committee determines whether a financial institution shall be considered, on an individual, sub-consolidated or consolidated basis, as applicable, domestically systemically important with regard to whether its operations are of such a nature that they could affect financial stability. In the assessment, at least the following shall be taken into account:2

a. Size.

b. Importance for the economy of the EEA or Iceland.

c. Extent of cross-border activity.

d. The financial institution's or its group's interconnection with the financial system.

The designation of systemically important financial institutions and the rate of the capital buffer shall be reviewed at least annually. The financial institutions Arion banki hf., Íslandsbanki hf. and Landsbankinn hf. have been defined by the Financial Stability Committee as domestically systemically important financial institutions since 2016.

Information on systemically important financial institutions in EEA states and the rates of capital buffers for them can be accessed on the ESRB website.

[1] Currently 3% of the risk base, cf. rules No. 1415/2024, on capital buffers for systemically important financial institutions.

[2] Guidelines on the criteria to determine the conditions of application of Article 131(3) of Directive 2013/36/EU (CRD) in relation to the assessment of other systemically important institutions (O-SIIs) (EBA/GL/2014/10).

5 Systemic risk buffer

According to Part F of Chapter X of the Act on Financial Institutions, the Central Bank may, by rules it sets after prior approval of the Financial Stability Committee, provide that financial institutions shall maintain a systemic risk buffer.1 It is permitted to limit the obligation to maintain a systemic risk buffer to one or more categories of financial institutions. The requirement shall be met with Common Equity Tier 1 and shall be maintained on a consolidated, sub-consolidated or individual basis, as applicable.

The rate of the systemic risk buffer may be in the range of 0-3% of the financial institution's risk base or a certain category or categories of risk exposures2 and shall be reviewed at least every other year. When strong reasons exist, the rate may be higher than 3% with the approval of the Minister. The rate may, however, not exceed 5% without also obtaining the approval of the Standing Committee of the EFTA States. The rate shall be a multiple of 0.5 percentage points. Regarding the interaction between the requirement for a systemic risk buffer and the requirement for a capital buffer for systemically important financial institutions, reference is made to the discussion of the latter buffer in Chapter 4.

The objective of the systemic risk buffer is to prevent or limit the impact of systemic risk, which is related to the basic structure of the economy and changes little over time, on the operations of a financial institution.

As previously stated, the rate of the systemic risk buffer may be on the entire risk base of the financial institution, the domestic risk base or another category or categories of risk exposures. If the systemic risk buffer only covers exposures in this country, its effective rate is calculated on the part of the risk base that is located in this country, cf. the discussion of the weighted average of the countercyclical buffer rate in Chapter 3.

Example: If the domestic part of the risk base amounts to 80% of the risk base of a financial undertaking and the rate of the systemic risk buffer amounts to 2%, its effective rate is 1.6% (80% * 2%) of the risk base.

Information on rates of systemic risk buffers in the states of the EEA may be accessed on the ESRB's website.

[1] Now 2% of the domestic risk base of financial undertakings that have authorisation to receive deposits, cf. rules no. 1414/2024, on capital buffers for financial undertakings due to systemic risk.

[2] Guidelines on the appropriate subsets of sectoral exposures to which competent or designated authorities may apply a systemic risk buffer in accordance with Article 133(5)(f) of Directive 2013/36/EU (EBA/GL/2020/13).