GFSC Guidance Note: Step-in Risk (Banking)

www.gfsc.gi GFSC Guidance Note Step-in risk 1 Month 2017 Version: 1 Publication Date: 30 July 2026

Gibraltar Financial Services Commission Guidance Note – Step-in risk 2 Contents

1. Introduction......................................................................................................................................... 3
2. Indicators of step-in risk ...................................................................................................................... 5
3. Potential responses to step-in risk .................................................................................................... 11
4. Step-in risk policies............................................................................................................................ 15 Annex 1 – Illustrative entity categories...................................................................................................... 17 Annex 2 – Guidelines for completing templates for reporting the step-in risk assessment (SI0, SI1 and SI2) ........................................................................................................................................................... 22

Gibraltar Financial Services Commission Guidance Note – Step-in risk 3

1. Introduction 1.1. This Guidance Note sets out the Gibraltar Financial Services Commission’s (the ‘GFSC’) expectations around firms undertaking step-in risk assessments under regulation 61E of the Financial Services (Credit Institutions and Capital Requirements) Regulations 20201 (the ‘CICR Regulations’). 1.2. This Guidance Note is relevant to all: • Credit institutions2 (‘banks’); • CRR consolidation entities3 ; and • Investment firms to which regulation 4(3) or 4(7) of the Financial Services (Investment Firms) (Prudential Requirements) Regulations 2021 applies, that are required to undertake step-in risk assessments. These entities are collectively referred to as ‘firms’ within this Guidance Note. 1.3. This Guidance Note should be read in conjunction with: • the CICR Regulations (and in particular Chapter 5 of Part 4); • the Financial Services (Capital Requirements) (Technical Standards) Regulations 20264 (the ‘CRR Technical Standards’); • the GFSC’s Risk Appetite Statement5 ; and • the Basel Committee on Banking Supervision Guidelines on identification and management of step-in risk6 . 1.4. Chapter 5 of Part 4 of the CICR Regulations applies on an individual basis for firms that are not part of a consolidated group. For firms that are part of a consolidated group, it applies on a consolidated basis (and at sub-consolidated level where a firm must meet requirements at that level). 1.5. Annex 2 of this Guidance Note also provides guidelines for completing the templates for reporting the step-in risk assessment which are set out in Schedule 2 to the CICR Regulations. These guidelines are intended to help ensure a consistent reporting framework, to enable the 1 https://www.gibraltarlaws.gov.gi/legislations/financial-services-credit-institutions-and-capital-requirements￾regulations-2020-4801 2 ‘Credit institutions’ are defined in Article 4.1 of the CRR Technical Standards. 3 ‘CRR consolidation entities’ are defined in Article 4.1 of the CRR Technical Standards. 4 https://www.gibraltarlaws.gov.gi/legislations/financial-services-capital-requirements-technical-standards￾regulations-2026-8129 5https://www.fsc.gi/uploads/Revised%20Risk%20Appetite%20Statements%20July%202019%20FINAL%20(002).pdf 6 https://www.bis.org/bcbs/publ/d423.htm

Gibraltar Financial Services Commission Guidance Note – Step-in risk 4 GFSC to use the information collected from the step-in risk assessments efficiently and effectively.

Gibraltar Financial Services Commission Guidance Note – Step-in risk 5 2. Indicators of step-in risk 2.1. Step-in risk is the risk that a firm provides financial support to a step-in entity7 in stressed conditions, in the absence of, or in excess of any contractual obligation to do so. Firms are required to assess whether step-in risk in respect of material step-in entities is significant.8 As part of that assessment, firms are required to consider (amongst other things) a number of prescribed indicators of step-in risk9 , which are listed under SI02.00 in Schedule 2 to the CICR Regulations. 2.2. These indicators should be considered both individually and in combination, bearing in mind the purpose and design of the material step-in entities10, considering in particular the relevant activities carried out and administered by the entities and how decisions about those activities are made. This should ensure firms are able to consider fully the nature of their relationship with a step-in entity and whether firms are likely to be incentivised to step in to provide financial support during a time of stress (e.g. due to the potential reputational risks involved). 2.3. The GFSC would expect step-in risk for a material step-in entity (or for a series of similar entities where step-in risk is identified as material in combination) to be significant where there is a strong indication overall that a firm will step in based on analysis of the step-in risk indicators. This may be in situations where two or more of the step-in risk indicators are relevant in indicating that a firm is likely to step in or where a single indicator alone suggests that a firm is likely to step in. Nature and degree of sponsorship 2.4. In considering the nature and degree of sponsorship, the GFSC expects the firm to consider whether, in its role as sponsor, the firm may be exposed to a greater degree of step-in risk in certain cases, such as when it: (a) provides full sponsor support, via a guarantee or other credit enhancement; or (b) provides partial credit enhancements and liquidity facilities while playing a role in decision-making. 2.5. The GFSC would expect the firm to consider this to be a potentially strong indicator in particular where: 7 ‘Step-in entity’ means an unconsolidated entity identified in accordance with regulation 61F(1)(a) of the CICR Regulations. 8 Regulation 61G(1) of the CICR Regulations. 9 Regulation 61G(2) of the CICR Regulations. 10 A ‘material step-in entity means a step-in entity other than an immaterial step-in entity. An ‘immaterial step-in entity’ means a step-in entity which, when step-in risk is considered both individually and in combination with other similar entities, would not, given its size relative to the institution, materially impact the institution’s liquidity or capital positions.

Gibraltar Financial Services Commission Guidance Note – Step-in risk 6 (a) the firm is a full sponsor of an entity; and (b) the firm provides partial upfront facilities to an entity where the firm is also, to a relevant degree, a decision-maker. Degree of influence 2.6. The GFSC expects the firm to consider the degree to which it exercises influence over the step￾in entity. This indicator is not meant to be synonymous with the accounting notion of power or control that is a prerequisite for accounting consolidation but rather a lower threshold (e.g. significant influence). A greater degree of influence over an entity may be indicative of a greater incentive to step in during a time of financial stress. 2.7. The GFSC would expect the firm to consider this as a potentially strong indicator in particular where the firm has: (a) capital ties of less than 50% and power to exercise a significant influence over the entity’s management; (b) capital ties of 50% or more but no regulatory consolidation; (c) no capital ties but the ability to remove and appoint the management body; (d) in the case of Special Purpose Entities (including ’autopilot’11 vehicles), the existence of organisational and financial relationships that effectively transfer to the firm most of the risks and/or benefits of the vehicle’s activities. 2.8. This indicator may be less strong where the firm is merely an agent, making decisions subject to a contractual mandate, and has no other exposure to the entity’s variable returns. This does not preclude the firm from assessing other indicators, which might point to the existence of step-in risk. Implicit support 2.9. The GFSC expects the firm to consider whether it is providing an implicit guarantee, for instance in investors’ rate of return expectations. In considering such expectations, the firm would evaluate, by comparison with other similar entities, whether the investor is accepting a lower rate of return on its investment relative to the risk. This could potentially indicate that the investor expects the sponsoring firm to support the entity in a stress scenario. 2.10. The GFSC would expect the firm to consider this as a potentially strong indicator in particular where: 11 Examples of this may include entities whose activities are predetermined at the outset, so that no substantive management decisions are required to be made under normal circumstances. (See Report on Special Purpose Entities: https://www.bis.org/publ/joint23.htm - page 64 discussion of ‘actively managed’ and ‘passive’ structures).

Gibraltar Financial Services Commission Guidance Note – Step-in risk 7 (a) entities which are assigned a better rating than would have been the case without considering the relationship with the firm (i.e. the entity’s rating is reliant on the firm’s or parent company’s rating to an extent that exceeds a contractual arrangement); (b) entities where the rate of return accepted by investors is materially lower than what is indicated by the risks of the entity’s assets. Capitalisation and reliance on leverage 2.11. The GFSC also expects firms to consider situations where an entity may be highly leveraged at its inception relative to the risks associated with the assets it holds. These entities are often characterised by control being exercised through means other than traditional voting rights. Although these entities are already evaluated under accounting consolidation requirements, this indicator is meant to highlight that these types of entity are more prone to step-in risk than adequately capitalised entities. 2.12. The GFSC would expect the firm to consider this indicator in relation to: (a) structured entities under International Financial Reporting Standards (‘IFRS’); or (b) comparable entities under relevant accounting regimes. Liquidity stress or first-mover incentive 2.13. The GFSC expects firms to consider the potential that a firm’s liquidity stress might be increased and exacerbated, as this is a key element to consider in the step-in analysis. This indicator refers to entities with a limited capacity to access liquidity when facing an unanticipated increase in redemption requests (i.e. they cannot sell enough assets to meet the redemption), which would therefore impact the firm’s liquidity should it conclude that it must provide step in support. This would include situations where long-term assets are funded with short-term liabilities (i.e. maturity mismatch). Therefore, all other things being equal, off￾balance sheet entities that engage in maturity transformation by holding non-risk-free assets (i.e. those other than sovereign-backed bonds) increase the potential for step-in. Entities holding large cash reserves or high-quality liquid asset (‘HQLA’) equivalents for regulatory reasons would be less likely to increase step-in risk because their increased liquidity needs during stress periods would already be covered, at least in part. 2.14. As a result of liquidity concerns, liability run risks are heightened when it is advantageous for an investor to exit the entity before others do. This scenario is more acute when there are no potential barriers to redemptions (i.e. redemption gates). Also of note are entities whose performance depends on an illiquid benchmark and which are hence more prone to volatile valuations and large drops in value during periods of liquidity stress (e.g. emerging market equity index funds, corporate bond funds and high yield bond funds). 2.15. The GFSC would expect the firm to consider this indicator in relation to:

Gibraltar Financial Services Commission Guidance Note – Step-in risk 8

(a) structured investment vehicles (‘SIVs’), as they were particularly prone to investor runs during the financial crisis; (b) funds redeemable at constant net asset values (‘NAV’); (c) funds that do not exercise any type of redemption penalty (e.g. redemption fees, swing prices); (d) significant mismatch between asset and liability maturities. 2.16. This indicator may be less relevant in respect of: (a) index funds; (b) passive investment funds (e.g. exchange-traded funds (‘ETFs’)); (c) funds that have floating/variable NAVs (e.g. open-end mutual funds); (d) funds with substantial redemption costs or the legal ability to impose redemption gates; (e) pass-through securitisations; (f) separately managed/segregated funds (i.e. funds that legally have only a single customer). Transparency and disclosure/investor disclosure 2.17. The GFSC expects the firm to consider an entity’s degree of transparency, and the extent to which investors are provided with detailed information that allows them to understand and assess its risk-adjusted returns. Disclosures are also made to investors within investment offering documents (i.e. in an investment prospectus) regarding any restrictions on the firm’s contractual obligations to support the entity. 2.18. The GFSC would expect the firm to consider this to be a potentially strong indicator in relation to:

(a) entities where the risk in underlying investments is opaque; (b) entities that cannot be rated or where the rating depends on a range of unsupported assumptions; (c) entities with a return that depends on indirect factors which are difficult to quantify. 2.19. This indicator may be less strong in respect of: (a) entities subject to a robust disclosure regime under a regulatory regime that set out the risks to be absorbed by investors; (b) entities that provide clear and frequently updated disclosure of their assets and liabilities.

Gibraltar Financial Services Commission Guidance Note – Step-in risk 9 Accounting Disclosures 2.20. Accounting disclosure requirements can provide meaningful information to evaluate the nature and risks of a firm’s involvement with unconsolidated entities. 2.21. The GFSC would expect the firm to consider this indicator in particular as part of accounting disclosures in relation to: (a) exposures to unconsolidated entities disclosed under IFRS 12, or comparable disclosures made under the relevant accounting regime; (b) any disclosures associated with constant-NAV money market funds; (c) contingent liabilities that meet disclosure requirements but do not meet the loss recognition thresholds under accounting standards. 2.22. This indicator may be less relevant in relation to exposures already recognised in capital through recognition of associated contingent liabilities, with the associated reduction in capital. Investor risk alignment 2.23. The GFSC expects firms to consider entities whose activities do not sufficiently match the risk profiles of their clients/investors with those of the risk exposures of the entity. This risk is not restricted to the narrow case of mis-selling (if such a concept exists in a given jurisdiction); rather, a broad analysis is required of whether the entity’s risk exposures are aligned with investors’ risk appetites to establish whether the risk exists. 2.24. The GFSC would expect the firm to consider this to be a potentially strong indicator in relation to: (a) funds that mix different term and/or wealth expectations into a single fund type; (b) firms that provide investment products to investors who are loss-averse (confidence￾sensitive products); (c) instances where investors have not received any proper explanation of risks (e.g. mis￾selling); (d) firms selling to retail customers products that have bundled, hard-to-price features (e.g. subordinated debt, preferred shares, debt instruments with embedded optionality). 2.25. This indicator may be less strong in respect of entities in jurisdictions where firms are obliged by law to ensure that particular investment products are appropriate and correspond to the needs of the investors to whom they are sold. Reputational risk from branding and cross-selling

Gibraltar Financial Services Commission Guidance Note – Step-in risk 10 2.26. The GFSC expects firms to consider the potential harm to a firm’s reputation when an entity has clients in common with the firm and carries the firm’s brand (e.g. corporate name, logo/symbol). Different brand strategies create different risk profiles. 2.27. Branding could strengthen the presumption of step-in support, especially if the brand is associated with a deposit-taking institution in the same banking group. A distinction could be made between a ‘branded house’ strategy and a ‘house of brands’ strategy. Under the ‘branded house’ strategy, the firm maintains a corporate master brand that acts as a single unifying banner, source of reputation and federating force for all product and service offerings. In a ‘house of brands strategy’, a firm operates through an independent set of standalone brands while keeping the corporate brand itself discrete. To the extent that a branded house strategy aggregates numerous products and business lines, it can be associated with a higher incentive for the firm to step in should one of its products or businesses be compromised, in order to protect its reputation and brand. 2.28. The evaluation of this indicator should consider the degree to which cross-selling is part of the firm’s overall strategy, as a greater degree of cross-selling increases reputational risk and, thus, the incentive to provide step-in support. This is particularly the case if a firm or banking group has standalone deposit-taking institution(s), broker-dealer(s) and asset management unit(s) that cross-sell products. 2.29. The GFSC would expect firms to consider this to be a potentially strong indicator in particular in relation to: (a) firms that actively and successfully cross-sell both on- and off-balance sheet products to their key clients; (b) firms that use a branded house strategy, where the brand is attached to the entity. Historical dependence 2.30. This indicator refers to documented instances where step-in support has been provided previously to specific types of entity. 2.31. An example of this indicator is the step-in support was provided to money market mutual funds and SIVs during the financial crisis. Regulatory restrictions and mitigants 2.32. This indicator refers to banking, securities, market or other financial regulations that restrict, without prohibiting, a firm’s ability and/or propensity to support an entity on terms that are unfavourable to the firm.

Gibraltar Financial Services Commission Guidance Note – Step-in risk 11 2.33. The GFSC would expect firms to consider this indicator in particular in relation to entities for which higher capital requirements are set in order to cover potential step-in situations. 3. Potential responses to step-in risk 3.1. Firms are required to assess the potential impact of providing financial support to material step-in entities if step-in risk were to materialise.12 The GFSC expects that assessment to include consideration of at least the following factors, which firms are also required to report in SI2: the type and size of support anticipated to the material step-in entity and, where it has identified significant step-in risk in relation to that entity, the impact of providing the support on a firm's CET1 ratio, leverage ratio, LCR and NSFR. 3.2. Firms are required to identify, monitor and manage step-in risk.13 Where a firm has identified significant step-in risk in relation to a material step-in entity, it is also required to take all reasonable steps to mitigate that risk.14 The GFSC expects a firm to determine its own response to step-in risk based on the circumstances of each case. This includes considering whether there is any mitigation already in place where significant step-in risk has been identified. There would be no automatic presumption as to how a firm might respond to step-in risk in a particular case. The GFSC expects to discuss the approaches chosen with a firm when it reviews the step-in risk assessment. The GFSC also expects that the risks that arise should be incorporated into the firm’s risk management processes and addressed, if appropriate depending on the firm’s chosen response, in its internal capital adequacy assessment, liquidity contingency and recovery plans. 3.3. A firm’s approach to step-in risk management and measurement should be sensitive to any step-in risk which remains after taking account of possible risk mitigants. A firm should consider the degree and effectiveness of any mitigants for step-in risk, including the scope for mitigants to reduce the potential impact on the firm if step-in risk support were provided. The firm’s risk measurement and management process are designed to ensure that the firm has adequate resources available in advance of potential step-in support, which would thus reduce the procyclicality of such stress. The aim is to avoid a situation where unanticipated support provided by a firm weakens its ability to meet its own contractual commitments and its liquidity and/or capital requirements. 3.4. Potential mitigants that a firm might consider in those circumstances are outlined below. A firm can determine the appropriate choice of measure(s), based on the nature and extent of the anticipated step-in support in each case. A firm may use the approaches below either in isolation or in combination. 12 Regulation 61G(3) of the CICR Regulations. 13 Regulation 61C(a) of the CICR Regulations. 14 Regulation 61C(b) of the CICR Regulations.

Gibraltar Financial Services Commission Guidance Note – Step-in risk 12 Stress testing and scenario analysis 3.5. Scenario analyses or stress testing may provide a useful way of enabling a firm to measure potential impact where it identifies potential significant step-in risk. The purpose of such analysis will be to allow a firm to understand whether and, if so, to what extent, it is likely to step in should the scenario or stress event occur. This should enable the firm to measure impact of the potential step-in risk event on its financial resources. The firm would then need to consider what action to take in response to the results of these analyses. This may be to take additional upfront risk management actions to mitigate adverse effects if the risks covered by the stress or scenario test materialise. Alternatively, the firm may decide that holding additional capital or liquidity in respect of the step-in risk entities might be a more appropriate mitigant. 3.6. Including a step-in risk entity within the regulatory scope of consolidation may be appropriate where a firm assesses that it already has substantial contractual obligations to provide support to a step-in risk at a time of stress, augmented by a significant risk that the firm would go beyond these contractual obligations. 3.7. Inclusion in the regulatory scope of consolidation might therefore be appropriate in circumstances where: (a) the step-in entity appears to have been designed specifically to avoid regulatory consolidation (or exhibits characteristics common to entities that are used to arbitrage regulatory requirements); (b) there have been previous and documented step-in cases in similar circumstances; (c) there are organisational and financial relations that, in substance, assign to the bank the majority of the risks and/or of the benefits arising from the activities of the entities; (d) there is investor expectation of full or significant support during a stress period; (e) there is an expectation that the nature and extent of step-in support would trigger accounting consolidation of the entity and, as a consequence, the inclusion of the entity in the regulatory scope of consolidation. 3.8. The illustrative cases above would generate a strong presumption that consolidation ought to be applied (they are not, however, intended to be exhaustive and other similar circumstances may exist). However, the GFSC’s expectation is that such cases should be limited in practice. A firm should also notify the GFSC if it is considering including a step-in entity in the scope of consolidation. In these circumstances the GFSC may consider exercising its powers under section 70 of the Financial Services Act 2019 to require the inclusion of the entity within the regulatory scope of consolidation15 . 15 Article 18(8) of the CRR Technical Standards.

Gibraltar Financial Services Commission Guidance Note – Step-in risk 13 3.9. This response might not be appropriate when consolidation would artificially improve the capital or liquidity position of the firm, because the entity’s resources might not be available to the firm. Liquidity requirements 3.10. Where a firm identifies non-contractual obligations that might lead to step-in via the provision of additional funding to a relevant entity, then liquidity requirements might provide appropriate risk mitigation (this may depend on the indicator that has led to the identification of step-in risk). In particular, a firm may wish to consider whether the following provisions apply to the step-in risk circumstances that it has identified: (a) Paragraph 98 of Schedule 4 to the Annex of the CRR Technical Standards (Additional liquidity outflows for other products and services); (b) Paragraph 105 of Schedule 4 to the Annex of the CRR Technical Standards (Additional Outflows); (c) Article 428P(9) of the CRR Technical Standards. Large exposure-like internal limit 3.11. Firms are already required to set internal limits regarding their exposures to shadow banking entities. They must set both internal aggregate and individual limits to exposures to individual shadow banking entities with an exposure value, after credit risk mitigation and exemptions, equal to or in excess of 0.25% of the institution’s eligible capital.16 A firm may therefore want to consider whether it should update its internal limits to enable it to better mitigate or risk manage particular step-in risks that it has identified. It may also be appropriate for a firm to consider scenarios in relation to adverse events in sectors where a particular sectoral concentration is identified as part of the step-in risk self-assessment. Therefore, it could also be appropriate for a firm to amend and/or add some stress tests to those that it currently carries out to reflect risk concentrations. Disclosure 3.12. A firm may find it useful to disclose certain information about its step-in risk assessment where this does not lead to a ‘self-fulfilling prophecy’ of a firm being seen to confirm that it will be stepping in to support certain entities. Such disclosures might include:

(a) information about the number, size and nature of unconsolidated entities in terms of step-in risk, and of firms’ own risk assessment and their management of such exposures; 16 EBA Guidelines: limits on exposures to shadow banking entities which carry out banking activities outside a regulated framework under Article 395(2) of Regulation (EU) No 575/2013 (EBA/GL/2015/20).

Gibraltar Financial Services Commission Guidance Note – Step-in risk 14 (b) information about the tools that a firm has used in relation to step-in risk, for example where it has reset its large-exposures internal limits to shadow banking entities; (c) further qualitative information or explanation in a firm’s annual report about its exposure to unconsolidated structured entities, perhaps as part of its International Financial Reporting Standard 12 (‘IFRS 12’) disclosures. 3.13. The disclosure of step-in risk information might, however, be better as a complement to another response to step-in risk rather than being used in isolation. 3.14. A second possibility is that firms may disclose more information where they have used other tools in relation to step-in risk; for example, where they have reset their large exposures internal limits to shadow banking entities. However, another possibility is that firms may wish to provide further qualitative information or explanation in their annual reports about their exposures to unconsolidated structured entities, as per IFRS 12. Where a firm identifies significant step-in risk but decides that no capital or liquidity mitigant is necessary, it might explain in more detail its relationships with unconsolidated structured entities in their Annual Reports or Pillar 3 disclosures. Conversion approach 3.15. In measuring the potential impact of step-in risk, firms may wish to use a conversion-type approach. This would involve: (a) calculating the total assets and off-balance sheet exposures of a step-in entity minus any exposures that the firm has to it; (b) estimating the average risk-weight of the balance-sheet exposures of the step-in entity (in coming to an estimate of the potential risk-weighted assets that it would imply); (c) multiplying the result by an appropriate conversion factor tailored to the likelihood of step-in. 3.16. A similar estimation could be used for liquidity resources. A firm would need to define factors needed within this calculation (total assets, estimate of average risk-weight, and appropriate conversion factor). So, this approach could help a firm in calculating the potential impact of step-in. This may supplement regulatory consolidation (i.e. calculating likely risk-weighted assets where there is relatively limited entity information) or as a way of estimating the changing impact of step-in (the conversion factor might be altered from time to time as the firm revises the likelihood of step-in). Conversion approach 3.17. Where accounting standards have not required firms to make provisions, firms may find it helpful to calculate the potential provision that they might need to make against step-in risk should a loss arise. This could be a useful way of a firm managing its step-in risk by calculating and monitoring its potential exposure. The firm could then consider whether, based on the

Gibraltar Financial Services Commission Guidance Note – Step-in risk 15 likelihood of the step-in arising, their response would be to mitigate this risk by risk managing it or by holding extra capital or liquidity against it. Similar to the conversion approach, this is a tool that a firm could use primarily for calculation and monitoring purposes. This is likely to be a proportionate response to step-in risk, as it ensures that step-in risk is adequately calculated and monitored. 4. Step-in risk policies Materiality policy 4.1. The GFSC expects a firm to determine materiality in describing its approach to identifying immaterial step-in risk entities under regulation 61H(2)(b) of the CICR Regulations using a quantitative metric. Examples might include determining materiality for the purpose of identifying step-in risk as a proportion of its own capital (e.g. Common Equity Tier 1) or total assets. 4.2. A firm’s step-in risk policies and procedures will be drawn up for the consolidated or sub￾consolidated group in most cases (this will not apply where the step-in risk requirements apply on an individual basis). The GFSC would, however, expect a firm’s materiality policy to consider circumstances where a possible step-in entity or entities are material for a regulated firm within its group, but not for the consolidated or sub-consolidated group. So, it should set a relevant threshold for any regulated firm within the consolidated or sub-consolidated group to capture these potential instances. These entities should not be considered as ‘immaterial’ and so should be included as material step-in risk entities for the purposes of the step-in risk assessment. 4.3. When considering whether a step-in entity is material, the GFSC expects firms to also determine the total asset size of the step-in entity, which firms are also required to report in templates SI1 and SI2. Significance 4.4. The GFSC expects firms to outline their approach to determining significance within its step-in risk policies under regulation 61H(2)(c) of the CICR Regulations. This may include consideration of some of the examples of step-in risk given in relation to the indicators in Section 2 of this Guidance Note. Entity types 4.5. The GFSC also expects that a firm’s step-in risk policies should make clear the types of entities that are being considered in its step-in risk analysis. The GFSC expects that these would include at least the entities listed in the definition of unconsolidated entities in regulation 61A of the CICR Regulations and those entity types listed in Annex 1. However, in identifying other types

Gibraltar Financial Services Commission Guidance Note – Step-in risk 16 of entities (as the list of unconsolidated entities and those in Annex 1 is not exhaustive), those policies should be flexible enough to capture all entities that are unconsolidated for regulatory purposes and which pose step-in risk rather than being focused narrowly on particular types of undertakings. Commercial entities may generally be excluded from the step-in risk assessment except to the extent that they are one of the types of entity listed in Annex 1 or are defined as an unconsolidated entity. 4.6. The GFSC does not expect firms to assess entities in relation to the debt or equity investor definition where its only relationship with them is regular commercial lending activity as part of its step-in risk assessment (i.e. where they are lending to an entity rather than investing in its debt or equity). 4.7. A firm undertaking market-making activity may maintain debt or equity positions on its books for longer periods than intended. If so, a firm should note in its policies and procedures the principles it would use to determine whether such investments should remain part of its market-making activity (i.e. to determine whether they should continue to be excluded from its step-in risk assessment). 4.8. The GFSC expects that, where a firm considers that step-in risk may be mitigated due to a legislative provision prohibiting step-in, it should include the details of any such material within its policies and procedures. A firm should clarify in its step-in risk assessment how a specific prohibition would apply in relation to an entity where it considers that the prohibition mitigates potential step-in risk.

Gibraltar Financial Services Commission Guidance Note – Step-in risk 17 Annex 1 – Illustrative entity categories Entities issuing residential mortgage-backed securities (‘RMBS’) and commercial mortgage-backed securities (‘CMBS’) or other assets (i.e. credit cards, auto loans) This structure is especially used under the ‘originate and distribute’ model. The proceeds received by the special purpose entity (‘SPE’) on the issuance of mortgage-backed securities (there are often several tranches of securities, depending on the subordinated rank) are used to buy loans originated or bought by a firm (‘the seller’). The seller uses the proceeds for other purposes, including making loans to other borrowers. The principal and interest payments from the underlying loans are passed through to the securities holders, who are exposed to the delinquency risk of the original borrowers (depending on the tranches they have invested in). During the financial crisis, the ratings of many RMBS/CMBS collapsed. In order to achieve higher ratings for regulatory risk capital purposes, several RMBS/CMBS were converted into re-securitised real estate mortgage investment conduits (‘re-REMICs’). Entities issuing covered bonds Covered bonds are quite similar to mortgage-backed securities. The differences are that they are not always structured through an SPE (i.e. they can be issued directly by the firm) and they are direct obligations of the issuing entity. In other words, the underlying financial assets act as collateral and the covered bondholders are not exposed to the credit quality of these assets unless the issuing entity becomes insolvent. Entities issuing collateralised debt obligations (‘CDOs’) and collateralised loan obligations (‘CLOs’) There are two types of CDO: cash CDOs and synthetic CDOs. In a cash CDO, the proceeds of the securities issued by the SPE are used to purchase the underlying portfolio of financial assets. By contrast, in a synthetic CDO, the seller of protection (‘SPE’) enters into a Credit Default Swap (‘CDS’) contract on a reference portfolio of assets with the protection buyer and uses the proceeds of the issued securities to buy highly liquid and high-quality financial assets to cover the SPE’s obligations under the CDS. Cash CDO The structure of the transaction is similar to the basic securitisation structure, except that the nature of the underlying assets could be more diverse (RMBS, CMBS, corporate bonds, CDOs issued by other SPEs etc). Depending on the type of underlying asset, these SPEs may also be known as CLOs (when the underlying assets are loans) or CBOs (when the underlying assets are bonds). Firms may execute interest rate derivatives with the SPE to eliminate mismatches in the collateral and funding instruments.

Gibraltar Financial Services Commission Guidance Note – Step-in risk 18 Synthetic CDO As mentioned above, the SPE enters into a CDS contract and invests in highly liquid and high-quality assets to collateralise its commitments under the CDS. The premium received on the CDS, together with the revenue on the assets, allows the SPE to pay the interest on the issued securities. In the case of a credit event on the CDS, the SPE pays the protection buyer (the cash comes from the sale of some of the highly liquid and high-quality assets for the corresponding amount) and writes down the issued securities according to the subordinated rank of each. Significant leverage through the use of credit derivatives is often employed as part of the overall strategy for synthetic CDOs. Entities issuing tender option bonds (‘TOBs’) TOBs are essentially a way to fund long-term municipal bonds in the short-term market. Typically, a TOB sponsor will buy a portfolio of fixed rate, long-term municipal bonds (rated between AA and AAA) and combine them with an interest rate swap and create, through securitisation in an SPE, senior short-term tax-exempt floating rate notes that are sold to investors. Two tranches of notes are issued (with different subordination ranks): senior securities and junior notes. Investors in the latter have a leveraged exposure to the underlying municipal bonds. The senior note holders have a put option (the tender option), which allows them to put their bonds back to the issuer at par at any time. Firms may also provide liquidity guarantees and interest rate derivatives to these types of SPE. Entities issuing asset-backed commercial paper (‘ABCP’) Under an ABCP programme, an SPE buys and funds assets using the basic securitisation framework. However, unlike a ‘term’ securitisation, ABCP programmes generally have no maturity and are intended to be essentially perpetual. As the duration of commercial paper is shorter than the maturity of the assets, the issued securities are rolled over, meaning that the proceeds of new commercial paper are used to repay maturing commercial paper. In most cases, when the conduit is unable to issue new commercial paper, it can use a backup liquidity facility or asset purchase agreement provided by a large commercial bank. On the asset side, the SPE buys financial instruments sold by one or multiple sellers. In the former case, a bank securitises its own assets. In the latter, the bank administers an SPE that is used to provide funding for its clients (through the securitisation of the clients’ receivables). Securities arbitrage conduits Securities arbitrage conduits allow sponsors, typically firms, to finance an investment in highly rated securities with short-term borrowing. These conduits can be on-balance or off-balance sheet. They enable the firm to benefit from the term structure of interest rates and credit spreads. Similar to single- and multi-seller conduits, these types of programme rely on the existence of liquidity facilities to ensure that the commercial paper investors can be repaid if the issuer cannot issue new commercial paper.

Gibraltar Financial Services Commission Guidance Note – Step-in risk 19 Structured investment vehicles (‘SIVs’) SIVs are similar to securities arbitrage conduits in the sense that they invest in highly rated securities. However, the structuring of the transactions differs significantly, and SIVs are among the more complex structured finance arrangements. SIVs are leveraged investment vehicles. Unlike securities arbitrage conduits, SIVs raise third-party capital and leverage this capital by issuing both short-term (commercial paper) and medium-term notes. In addition, they do not rely exclusively on firm liquidity facilities to manage their liquidity risk; they also implement a dynamic liquidity management process (i.e. maintenance of liquid assets and firm facilities to cover the upcoming two or three weeks of cumulative net cash outflows). Repackaging vehicles Repackaging vehicles are a client-driven business for firms. They allow firms’ clients to access markets and invest in specific assets that, for regulatory or tax reasons, they may be unable or unwilling to invest in directly. The basic structure entails the purchase by an SPE (established by the structuring firms) of one type of security from another entity. The SPE then issues its own debt or equity securities (the ‘repackaged securities’). This structure allows the benefits of the underlying security to pass on to the holders of the repackaged securities (the firms’ clients) and provide them with a mechanism to acquire exposure to many asset classes and risk profiles in a single instrument. Example of the use of a repackaging vehicle: transaction implying ‘auction rate securities’, when they are structured through an SPE. Real estate investment trusts (‘REITs’) REITs are entities that invest in different kinds of real estate or real estate-related assets, including shopping centres, office buildings, hotels and mortgages secured by real estate. There are basically three types of REIT: (1) Equity REITs, the most common type, invest in or own real estate and provide a return to investors from the rents they collect. (2) Mortgage REITs lend money to owners and developers or invest in financial instruments secured by mortgages on real estate. (3) Hybrid REITs are a combination of equity and mortgage REITs. Mutual funds A mutual fund is an investment vehicle made up of a pool of funds collected from many investors for the purpose of investing in securities such as stocks, bonds, money market instruments and similar assets. The following two types of mutual fund have unique characteristics that bear mention.

Gibraltar Financial Services Commission Guidance Note – Step-in risk 20 Money market funds (and the equivalent mutual funds in other jurisdictions) A money market fund is a type of mutual fund that is required by law to invest in low-risk securities. These funds have relatively low risks compared with other mutual funds and pay dividends that generally reflect short-term interest rates. Money market funds typically invest in government securities, certificates of deposit, corporate commercial paper or other highly liquid and low-risk securities. Exchange-traded funds An exchange-traded fund (‘ETF’) is an indexed fund listed on a stock exchange. An ETF can track an index (e.g. the S&P 500), a commodity or a basket of assets. ETFs experience price changes throughout the day as they are bought and sold. ETFs may also employ leverage, with derivatives or debt as part of their investment strategy. Hedge funds Hedge funds are frequently defined as any pooled investment vehicle that is privately organised, administered by professional investment managers, and not widely available to the public. Unlike mutual funds, hedge funds are not subject to stringent legal or regulatory guidelines concerning their investment strategies. There is a wide variety of investment styles in the hedge fund industry (e.g. global macro funds, market-neutral funds, event-driven funds,short sellers) and of trading strategies within the same investment category. The amount of leverage used by hedge funds largely depends on their trading strategies. Hedge funds that invest mostly in debt securities or equivalent products are known as credit hedge funds. Some firms have set up hedge funds within their asset management businesses. In addition, some have built up extensive businesses with hedge funds as clients: counterparty trading, derivatives activity, brokerage services, direct equity investments and direct lending (‘prime brokerage’). Private equity funds Private equity funds make investments directly in the capital of private companies or conduct buyouts of public companies that result in either majority ownership or full ownership and the delisting of public equity. Capital for private equity is raised from retail and institutional investors, and can be used to fund new technologies, expand working capital within a privately owned company, make acquisitions or strengthen a balance sheet. Finance companies Finance companies include non-bank entities that grant loans (mortgage loans, auto loans etc) or offer financial leasing contracts. This category also includes factoring companies (prepayment of commercial receivables).

Gibraltar Financial Services Commission Guidance Note – Step-in risk 21 Securities firms Securities firms include investment firms, as defined in section 2 of the FSA 2019: ‘“Investment firm” means a legal person whose regular occupation or business is the provision or performance of investment services and activities on a professional basis’.

Gibraltar Financial Services Commission Guidance Note – Step-in risk 22 Annex 2 – Guidelines for completing templates for reporting the step-in risk assessment (SI0, SI1 and SI2) Step-in risk assessment: reporting instructions Firms are expected to report their own assessment of their step-in risk in accordance with Chapter 5 of Part 4 of the CICR Regulations, using the templates set out in Schedule 2 to those Regulations. These notes are to assist firms in completing data items SI700.00 (SI0), SI01.00 (SI1) and SI02.00 (SI2).

1. The reporting framework on step-in risk shall consist of three templates which include the following information: • SI 700.00 - General information (SI0); • SI 01.00 - Identification of step-in entities (SI1); and • SI 02.00 - Detailed reporting of material step-in entities (SI2).
2. All firms should complete template SI0. Firms that identify a step-in entity should complete template SI1. Firms that identify a material step-in entity in SI1 should also complete template SI2.
3. All monetary amounts should be reported in absolute values rounded to the nearest whole number in reporting currency. Do not enter abbreviated values in thousands or other values.
4. All definitions are in line with the FSA 2019, the CICR Regulations and CRR Technical Standards, unless otherwise specified. References to a firm should also be taken to refer to a CRR consolidation entity. SI 700.00 - General information (SI0)
5. Firms should complete the following mandatory fields in General information (SI0): • the basis of reporting (individual, consolidated or sub-consolidated) from the drop-down menu; • at least one of the unique ‘firm reference number’ (‘FRN’) or the LEI code of the firm (please include the LEI code where available); • the name of the reporting firm; • the reporting period start and end dates – these dates should coincide with the Internal Capital Adequacy Assessment (‘ICAAP’) period. In particular, the reporting end date is the balance sheet end date used for purposes of the ICAAP assessment; and • the reporting currency – firms should report in the currency of their ICAAP (i.e. Pounds Sterling (‘GBP’), United States Dollar (‘USD’), Euro (‘EUR’) and Swiss Franc (‘CHF’).

Gibraltar Financial Services Commission Guidance Note – Step-in risk 23 Instructions for specific columns in SI1 and SI2 SI 01.00 – Identification of step-in entities (SI1): Column number Detailed instruction General Please report in template SI1 each step-in entity that has been identified. 0010 Code: The code as part of a row identifier must be unique for each reported entity. For institutions and insurance undertakings, the code shall be the LEI code. For other entities the code shall be the LEI code, or if not available, a national code. The code shall be unique and used consistently across the templates and across time. The code shall always have a value. 0020 Type of code Please indicate the type of code – LEI code or national code – that has been used in column 0010 using the drop-down menu. 0030 Entity type: Please select an entity type from the drop-down list by choosing one of the following: • RMBS/CMBS issuer • Covered bonds issuer • CDOs/CLOs issuer • TOBs issuer • ABCP issuer • Securities arbitrage conduit • Structured investment vehicle • Repackaging vehicle • REIT • Mutual fund • Hedge fund • Private equity fund • Finance company • Securities firm • Other Descriptions of these entity types are set out in Annex 1. 0040 If ‘other’ in 0030, please provide a description: Please include a description of the entity type of the firm in 0030 where the ‘other’ type has been selected. 0050 Total asset size of the entity Please include the total asset size of the step-in entity being reported. 0060 Typical contractual exposure to the entity Please include the typical contractual exposure to the step-in entity being reported.

Gibraltar Financial Services Commission Guidance Note – Step-in risk 24 0070 Is the entity material? Please use the drop-down list to indicate whether the step-in entity identified is material either individually or as part of a group of entities in combination or immaterial under the firm’s materiality policy that has been drawn up in accordance with regulation 61H(2)(b) of the CICR Regulations. Please choose one of: Yes; No; or Yes, in combination. 0075 Materiality Level Please use the drop-down list to indicate the level at which the step-in entity has been identified as material where ‘Yes’ or ‘Yes, in combination’ has been selected in column 0070. Please choose one of: Consolidated/Sub-consolidated basis and regulated firm basis; Consolidated/Sub-consolidated basis only; and regulated firm basis only. 0080 Material entity group code (where applicable) Please create a group code to indicate which step-in entities are included in a specific group of two or more entities that have been reported as being material in combination (i.e. where ‘Yes, in combination’ has been chosen in column 0070). Please create individual codes for each set of entities that have been identified as being material in combination. 0090 Explanation if ‘No’ in 0070: Please include an explanation as to why the step-in entity was not considered material. Please discuss how this relates to the internal materiality policies set out by the firm. SI 02.00 - Detailed reporting of material step-in entities (SI2): Column number Detailed instruction General Please report in template SI2 each material step-in entity that has been identified in SI1. 0010 Code: The code as part of a row identifier must be unique for each reported entity. For institutions and insurance undertakings, the code shall be the LEI code. For other entities the code shall be the LEI code, or if not available, a national code. The code shall be unique and used consistently across the templates and across time. The code shall always have a value. 0020 Type of code Please indicate the type of code – LEI code or national code – that has been used in column 0010 using the drop-down menu. This code type should match that reported in SI1 column 0020. 0025 Name of entity Please include the name of the material step-in entity being reported. 0030 Entity type

Gibraltar Financial Services Commission Guidance Note – Step-in risk 25 Please select an entity type from the drop-down list by choosing one of the following: • RMBS/CMBS issuer • Covered bonds issuer • CDOs/CLOs issuer • TOBs issuer • ABCP issuer • Securities arbitrage conduit • Structured investment vehicle • Repackaging vehicle • REIT • Mutual fund • Hedge fund • Private equity fund • Finance company • Securities firm • Other Descriptions of these entity types are set out in Annex 1 to this Guidance Note. 0035 Material entity group code (where applicable) Please report the group code relating to the material step-in entity where it has been identified as being material in combination with other entities. This code should match that was reported in SI1 column 0080. 0040 Purpose and design Please include a description of the purpose and design of the material step-in entity, including at least a description of: • the activities carried out and administered by the material step-in entity; and • how decisions about the material step-in entity’s activities are made. 0050 Total asset size of the entity Please include the total asset size of the material step-in entity being reported. 0060 Methodology used to estimate potential impact Please describe the methodology used to estimate the potential impact of the material step-in entity on the firm. 0070 Type of support anticipated Please indicate whether the firm anticipates providing support in the form of capital, liquidity or both using the drop-down menu. 0080 Size of support anticipated (nominal) Please include the full value of the anticipated support in the reporting currency 0090- 0120 Step-in risk estimates The estimates for these columns should be based on the size of support anticipated reported in 0080. A firm may opt not to complete these columns where it has

Gibraltar Financial Services Commission Guidance Note – Step-in risk 26 indicated that step-in risk is not significant for that entity or entities in combination in column 0290 (i.e. it has replied ‘no’ in that column). 0130- 0160 Nature of relationship: Fill in the columns that apply with a detailed description of the relationship. At least one of these columns must be completed. 0170- 0295 Risk indicator analysis: 0170-0285: fill in the columns that are relevant to the material step-in entity with a detailed discussion and analysis of the risk. Detailed descriptions of the risk indicators are set out in this Guidance Note. For any risk indicators which the firm has determined are not applicable, enter N/A. Please include a description of any other indicator that has been used to identify step-in risk in column 0285. 0290: based on the analysis conducted in 0170-0285, and having regard to the purpose and design of the material step-in entity, please report whether you consider the overall step-in risk to be significant by using the drop-down list. Please choose one of: Yes; No; or Yes, in combination (where step-in risk is significant for a material step-in entity that is material as part of a group of entities in combination). 0295: include a brief description as to why the firm decided that step-in risk was significant or insignificant for this material step-in entity. 0300- 0320 Risk Management: Only complete these columns for a material step-in entity where step-in risk is significant, as reported in column 0290. 0300- 0310 Risk mitigation: 300: please describe what mitigants, if any, were used to address significant step￾in risk, referring to the mitigants described in this Guidance Note as appropriate. 0310: if any, please provide the reference to the section in which this material step￾in entity has been mentioned in an existing ICAAP/ILAAP. 0320 Next steps: Please describe what next steps will be considered to continue managing the risk identified.

www.gfsc.gi Published by: Gibraltar Financial Services Commission PO Box 940 Suite 3, Ground Floor Atlantic Suites Europort Avenue Gibraltar www.gfsc.gi © 2026 Gibraltar Financial Services Commission