Guidelines on large exposures breaches and time and measures to return to compliance

EBA/GL/2021/09
15 September 2021
Report
Final Guidelines specifying the criteria to assess the exceptional cases when institutions exceed the large exposure limits of Article 395(1) of Regulation (EU) No 575/2013 and the time and measures to return to compliance pursuant to Article 396(3) of Regulation (EU) No 575/2013

Executive Summary 3
Background and rationale 4
Guidelines 11
Accompanying documents 21

Executive Summary
In general, the large exposures framework acts as a backstop, safeguarding an institution from significant losses caused by the sudden default of a client or a group of connected clients due to the occurrence of an unforeseen event which could endanger the institution’s solvency. If in an exceptional case an institution breaches the limits set out in Article 395(1) of the Capital Requirements Ratio (CRR), the first subparagraph of Article 396(1) of the CRR requires the value of the exposure to be reported without delay to the competent authority, which may (where the circumstances warrant it) allow the institution a limited period of time in which to restore compliance with the limit.
Article 396(3) of the CRR2 mandates the EBA to issue guidelines, in accordance with Article 16 of
Regulation (EU) No 1093/2010, to specify how competent authorities may determine: (a) the exceptional cases referred to in paragraph 1 of Article 396 of the CRR; (b) the time considered appropriate for returning to compliance; and (c) the measures to be taken to ensure the timely return to compliance of the institution. The guidelines contain foursections: i) criteria to determine the exceptional cases referred to in Article 396(1) of the CRR; ii) information to be provided to the competent authority in case of a breach of the Large Exposure limits; iii) criteria to determine the appropriate time to return to compliance with the limits of Article 395(1) of the CRR; and iv) measures to be taken to ensure the timely return to compliance of the institution with the limits of Article 395(1) of the CRR. Current practices by competent authorities have constituted the starting point for the development of these guidelines. The guidelines have been developed with the following objectives: (i) provide guidance to competent authorities in their assessment of the breaches of the large exposure limits set out in Article 395(1) of the CRR; (ii) ensure a prudent and harmonised application of Article 396(3) of the CRR, while keeping the approach simple; and (iii) ensure a level playing field among institutions in the Union. These guidelines provide guidance from a going-concern perspective. Gone-concern situations in which an institution is in the process of restructuring or undergoes a similar crisis-induced scenario are consequently outside the scope of these guidelines. In such situations, measures are needed that go well beyond restoring compliance with the large exposures framework of the CRR. Next steps The guidelines will be translated into the official EU languages and published on the EBA website. The deadline for competent authorities to report whether they comply with the guidelines will be 2 months after the publication of the translations. The guidelines will apply from 01.01.2022. Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC. OJ L 331, 15.12.2010, p. 12–47.

In October 2016 the EBA issued an opinion in response to the European Commission’s call for
advice, where it set out its views on the review of the European large exposures regime. 2 In that opinion, the EBA called on the EU institutions to introduce some amendments with a view to (a) aligning Regulation (EU) No 575/2013 (the Capital Requirements Regulation, hereinafter the CRR) with the Basel standard on large exposures (LEX30); (b) removing some exemptions; and (c) improving some technical details.
As part of the Risk Reduction Measures (RRM) package adopted by EU legislators in May 2019, the
CRR was amended.
5 The amended CRR reflected some of the elements of the EBA’s opinion. For instance, the capital basis on which large exposure limits are calculated was restricted to Tier 1 capital, and a tighter limit of 15% of Tier 1 capital on exposures between global systemically important institutions (G-SIIs) was introduced. 6 In addition, a mandate was inserted for EBA Guidelines to specify the key aspects of the treatment of breaches of the large exposure limits, as recommended in the aforementioned opinion.
In general, the large exposures framework acts as a backstop, safeguarding an institution from
significant losses caused by the sudden default of a client or a group of connected clients due to the occurrence of an unforeseen event which could endanger the institution’s solvency. Legal mandate
Article 395(1) of the CRR defines the large exposure limits to a client or a group of connected
clients, after taking into account the effect of credit risk mitigation in accordance with Articles 399 to 403 of the CRR, as 25% of the institution’s Tier 1 capital (or 15% between G-SIIs). Furthermore, if the client is an institution or the group of connected clients includes one or more institutions, the limit shall be either 25% of the institution’s Tier 1 capital or EUR 150 million, whichever is higher. According to Article 395(3) of the CRR, institutions shall comply with these large exposure limits at all times. 2 The EBA’s response to the European Commission’s call for advice, EBA-OP-2016-17 of 24 October 2016. Regulation (EU) No 575/2013 of the European Parliament and of the Council, of 26 June 2013, on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012. LEX Large exposures LEX30 Exposure measurement. Regulation (EU) No 2019/876 of the European Parliament and of the Council of 20 May 2019 amending Regulation (EU) No 575/2013 as regards the leverage ratio, the net stable funding ratio, requirements for own funds and eligible liabilities, counterparty credit risk, market risk, exposures to central counterparties, exposures to collective investment undertakings, large exposures, reporting and disclosure requirements, and Regulation (EU) No 648/2012. OJ L 150, 7.6.2019, p. 1–225. These changes will enter into force as of 28 June 2021.

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE TIME AND MEASURES TO RETURN TO COMPLIANCE PURSUANT TO ARTICLE 396(3) OF REGULATION (EU) NO 575/2013
5. According to Article 393 of the CRR, institutions shall have sound administrative and accounting
procedures and adequate internal control mechanisms for the purposes of identifying, managing, monitoring, reporting and recording all large exposures and any subsequent changes to them, in accordance with the CRR.
6. If, in an exceptional case, an institution breaches the limits set out in Article 395(1) of the CRR
(hereinafter, the large exposure limits), the first subparagraph of Article 396(1) of the CRR requires the institution to ‘report the value of the exposure without delay to the competent authority, which may, where the circumstances warrant it, allow the institution a limited period of time in which to comply with the limits.’
7. Regulation (EU) No 2019/876 amending the CRR, published in the Official Journal (OJ) of the EU on
7 June 2019 (hereinafter, the CRR2), includes several mandates relating to the calculation and limitation of large exposures.Among them, a new third subparagraph was added in Article 396(1) of the CRR, stating that ‘where, in the exceptional cases referred to in the first and second subparagraph of this paragraph, a competent authority allows an institution to exceed the limit set out in Article 395(1) for a period longer than 3 months, the institution shall present a plan for a timely return to compliance with that limit to the satisfaction of the competent authority and shall carry out that plan within the period agreed with the competent authority. The competent authority shall monitor the implementation of the plan and shall require a more rapid return to compliance if appropriate’.
8. Article 396(3) of the CRR2 mandates the EBA to issue guidelines, in accordance with Article 16 of
Regulation (EU) No 1093/2010, to specify how competent authorities may determine:
a) the exceptional cases referred to in paragraph 1 of Article 396 of the CRR; b) the time considered appropriate for returning to compliance; and c) the measures to be taken to ensure the timely return to compliance of the institution.
9. These guidelines give effect to that mandate. Although the CRR does not establish a deadline to
publish the guidelines, the EBA roadmap on the Risk Reduction Measures (RRM) package of November 2019 foresees their publication by 31 December 2021. 9
10. The cases set out in Article 395(5) of the CRR, i.e. large exposure breaches stemming exclusively
from exposures on the institution’s trading book, fall outside the scope of these guidelines as long as the conditions laid down in that provision are fully met. 7 The second subparagraph of Art. 396(1) also establishes that ‘where the amount of EUR 150 million referred to in Article 395(1) is applicable, the competent authorities may allow the 100% limit in terms of the institution's Tier 1 capital to be exceeded on a case-by-case basis.’ Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC. OJ L 331, 15.12.2010, p. 12–47. 9 The EBA published on 21 November 2019 a roadmap on the Risk Reduction Measures (RRM) package with a planned timetable to deliver the regulatory deliverables according to the mandates given by the CRR2 to the EBA. (https://eba.europa.eu/eba-publishes-its-roadmap-risk-reduction-measures-package).

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE TIME AND MEASURES TO RETURN TO COMPLIANCE PURSUANT TO ARTICLE 396(3) OF REGULATION (EU) NO 575/2013 Rationale for the Guidelines
11. The purpose of these guidelines is to provide guiding principles based on pre-defined criteria to
help competent authorities to decide whether the exceptional circumstances leading to a breach of the large exposure limits would justify allowing an institution a limited period of time in which to comply with the limit.
12. The guidelines also provide criteria for competent authorities to determine the specific period of
time considered appropriate for an institution to return to compliance with the large exposure limits, and the measures to be taken to ensure the timely return to compliance of the institution.
13. These guidelines provide guidance from a going-concern perspective. Gone-concern situations in
which an institution is in the process of restructuring or undergoes a similar crisis-induced scenario are consequently outside the scope of these guidelines. In such situations, measures are needed that go well beyond restoring compliance with the large exposures framework of the CRR.
14. Current practices by competent authorities have constituted the starting point for the
development of these guidelines. Therefore, the guidelines have been developed with the following objectives:
i. Provide guidance to competent authorities in their assessment of the breaches of the
large exposure limits set in Article 395(1) of the CRR.
ii. Ensure a prudent and harmonised application of Article 396(3) of the CRR, while
keeping the approach simple.
iii. Ensure a level playing field among institutions in the Union.
Exceptional cases when institutions exceed the large exposure limits and criteria to assess a breach of the large exposure limits
15. Article 395(3) of the CRR establishes that institutions shall comply at all times with the large
exposure limits. Furthermore, Article 396(1) of the CRR requires that institutions have to report the value of the exposure without delay to their competent authorities if, in an exceptional case, exposures exceed the large exposure limits. The reading of these two legal provisions together make it clear that all breaches of the limits of Article 395(1) of the CRR (which are not covered by the specific rules on trading book exposures in paragraph 5 of the same Article) are to be considered ‘exceptional’. Article 396(3)(a) of the CRR requires the EBA to specify the exceptional cases of paragraph 1 of that Article.
16. When an institution exceeds the large exposure limits, the competent authority should investigate
the specific circumstances that have led to the breach. Such an assessment should always be performed on a case-by-case basis following a holistic approach.
17. In order to assess a breach of the large exposure limits and decide the time, if any, that the
institution should be granted to comply with the limits of Article 395(1) of the CRR, as a general rule, the following aspects should at least be considered:

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE TIME AND MEASURES TO RETURN TO COMPLIANCE PURSUANT TO ARTICLE 396(3) OF REGULATION (EU) NO 575/2013 o The breach should be a rare event. The guidelines include some non-binding quantitative criteria that competent authorities could consider when assessing this aspect. o Any large exposure breach that an institution applying a proper and effective risk management could have foreseen and thus prevented, should not qualify as an exceptional case. o The institution was not in a position to prevent the large exposure breach as it was beyond its control, i.e. the reason for the breach lay outside the institution’s control.
18. There might be cases which may seem to qualify as exceptional for the purposes of applying these
guidelines but, on a closer look, and considering all the information available to the competent authority, they should be treated differently, e.g. as a recurrent breach requiring further supervisory measures.
19. Where a competent authority concludes that the institution should remedy the breach within 3
months and has informed the institution to that end, the institution does not need to present a formal plan for a timely return to compliance (compliance plan). However, the institution should always discuss and agree with the competent authority a set of measures to restore compliance within a period shorter than 3 months. Information that should be provided to the competent authority in case of breach of the large exposure limits, including an institution’s preliminary actions to return to compliance with the large exposure limits
20. According to Article 396(1) of the CRR, when an exposure has exceeded the large exposure limits,
the institution shall report to its competent authority the value of the exposure.
21. Although not part of the mandate of Article 396(3) of the CRR, it is considered necessary that the
guidelines should further specify the content of the report of the breach to put the competent authority in a position to assess the situation and the further steps needed. Therefore, besidesthe elements of Article 396(1) of the CRR, these guidelines introduce a minimum set of information that the institution in breach should at least provide, namely: a) the name of the client concerned and, where applicable, the name of the group of connected clients concerned; b) the date of the occurrence of the breach; c) its magnitude in relation to Tier 1 capital; d) a description of the available collateral, both CRR eligible and ineligible, if any; e) the reasons for the breach; and f) the remedial actions (planned or already effected) and expected time needed to return to compliance with the large exposure limits.
22. Such information to be included in the report of the breach is without prejudice to the right of
competent authorities to request further information and explanations when the information provided by the institution lacks clarity or sufficient detail, or if any additional information is needed.

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE TIME AND MEASURES TO RETURN TO COMPLIANCE PURSUANT TO ARTICLE 396(3) OF REGULATION (EU) NO 575/2013 Criteria to determine the appropriate time to return to compliance with the large exposure limits
23. Article 396(3)(b) of the CRR requires the EBA to specify how competent authorities may determine
the time considered appropriate for returning to compliance.
24. Institutions shall have in place adequate internal control mechanisms and sound administrative
and accounting procedures to manage their large exposures. This should prevent the occurrence of breaches to the large exposure limits. Therefore, the occurrence of a breach should be considered as an exceptional case and the institution has to resolve the breach as soon as possible.
25. Notwithstanding the above, when an institution reports a breach of the large exposure limits, the
competent authority may determine the time considered appropriate for returning to compliance. The guidelines include a number of criteria that should help a competent authority make a decision: a) the institution’s record of breaches; b) the promptness of notifying about the breach or the remedial actions to return to compliance; c) the reasons, complexity and magnitude of the breach; d) the overall financial situation of the institution; e) the overall risk concentration in the banking book; f) the type of counterparty and its creditworthiness; and g) the measures already taken to address the breach.
26. A breach, which is repetitive in nature, due to the same cause, triggered by the same event or
concerning the same exposure, should not be considered as justified grounds to grant an institution more than 3 months to resolve the breach.
27. With respect to the overall financial situation of an institution, it might be the case that an
institution holding own funds well above the minimum level required should be in a better position to absorb the potential loss in the case of a default of the counterparty. Competent authorities should take into account the institution’s financial situation and consider on a case-by-case basis whether the time to implement certain measures to return to compliance should be adjusted upwards or downwards due to the potential impact on the financial situation of the institution. For example, an institution with a less favourable financial situation might need more time to implement certain measures to return to compliance or otherwise risk a worsening of the financial situation.
28. The same considerations apply when the assessment of the banking book reveals that an
institution is not highly exposed to concentration risk across different counterparties. Indeed, in this case competent authorities might feel more confident allowing a longer period to return to compliance since this could suggest that the institution has incorporated a diversified risk management strategy as an established practice to manage its exposures.
29. Although the large exposures framework and the own funds requirements for credit risk have
different objectives, they both operate under the assumption that a customer could default on its obligations. Specifically, the large exposures framework takes into account the risk of a counterparty when allowing certain exemptions (see e.g. the exemptions in Article 400(1) of the CRR for specific exposures that have a 0% risk weight under the standardised approach for credit risk). Competent authorities might thus feel more confident allowing a longer period to return to compliance when the counterparty of an exposure has a low-risk profile; conversely, they might

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE TIME AND MEASURES TO RETURN TO COMPLIANCE PURSUANT TO ARTICLE 396(3) OF REGULATION (EU) NO 575/2013 feel the need to ensure a more rapid return to compliance when the counterparty of an exposure has a high-risk profile. Consequently, the creditworthiness of a counterparty could be a variable that competent authorities should take into account when assessing the specific time that they allow an institution to return to compliance once a breach of the large exposure limits has occurred.
30. Based on the assessment performed on the basis of the criteria mentioned in this section, the
competent authority should be in a position to determine the time considered appropriate for returning to compliance. In particular, the competent authority should decide whether the breach should be resolved within 3 months, or whether it should grant the institution a period longer than 3 months to return to compliance. In the latter case, competent authorities should in principle not grant more than 1 year to return to compliance, although it is also acknowledged that there could be extraordinary cases that may warrant allowing a longer timeframe. These cases should however not be the norm and well justified. Set of measures to return to compliance
31. Article 396(3)(c) of the CRR requires the EBA to specify how competent authorities may determine
the measures to be taken to ensure the timely return to compliance of the institution.
32. It is incumbent upon the institution to present a set of measures to ensure the timely return to
compliance with the large exposure limits. Such measures should be to the satisfaction of the competent authority with due regard to the assessment performed of the breach of the large exposure limits. In assessing the appropriateness of the measures, the competent authority should consider whether they would assure that the specific exposure that is in breach would no longer be close to breaching the limit again in the near future.
33. When the institution is granted a period longer than 3 months to return to compliance, it shall
provide the competent authority with a plan to return to compliance in accordance with Article 396(1) subparagraph 3 of the CRR. As a general rule, the set of measures (the compliance plan) should include the following: a) arrangements to reduce the exposure; b) measures to increase the institution’s own funds, where necessary; c) arrangements to reinforce internal risk management and control processes; d) procedures to ensure the timely implementation of the measures; and e) a detailed timetable to implement the planned measures. In any case, the institution should always strive to identify and address any foreseeable risks or obstacles to the effective and timely execution of the measures.
34. Competent authorities should consider whether the institution should employ further strategies,
such as requesting collateral from the counterparty or any other client belonging to the same group of connected clients, acquiring eligible credit risk mitigation instruments, selling all or part of the exposure to another institution, syndicating parts of the loan, negotiating with the borrower an early repayment or even terminating the whole transaction.
35. With regard to the arrangements to increase the institution’s own funds, consideration should be
given to whether this could be achieved by means of the institution issuing new capital items or retaining profits.

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE TIME AND MEASURES TO RETURN TO COMPLIANCE PURSUANT TO ARTICLE 396(3) OF REGULATION (EU) NO 575/2013
36. In order to ensure the effective and timely return to compliance with the large exposure limits, the
competent authority should closely monitorthe implementation of the compliance plan or in cases for less than 3 months, the measures implemented by the institution with a frequency adapted to the cause and size of the breach, its potential impact on the institution and its specificities. Whenever necessary, the competent authority should be able to request additional information, and in case the measures do not progress as initially planned, an alternative course of action should be agreed.
37. When the breach fits into a lack of internal control and inadequate risk management processes,
which might lead for example to an incorrect grouping of connected clients, the competent authority should assess those processes and require specific measures to improve them, as well as encourage institutions to perform an internal or external audit regarding its internal control and risk management processes. Moreover, competent authorities could perform targeted on-site examinations.
38. In defining and implementing measures to restore the large exposure limits, institutions should
consider that Article 88(1) of Directive 2013/36/EU requires the management body of an institution to have ultimate and overall responsibility for the institution and should define, oversee and be accountable for the implementation of the governance arrangements within the institution to ensure its effective and prudent management. 10 Moreover, the EBA Guidelines on Internal Governance stipulate that the management body should set, approve and oversee the implementation of, amongst other things, an adequate and effective internal governance and internal control framework. 11 Furthermore, it is the role of the institution’s audit committee, where established, to monitor the effectiveness of the institution’s internal quality control and risk management systems and, where applicable, its internal audit function, with regard to the financial reporting of the audited institution, without breaching its independence.
39. Furthermore, the management body of an institution, in its supervisory function, should oversee
the implementation of a well-documented compliance policy, which should be communicated to all members of staff. Institutions should set up a process to regularly assess changes in the law and regulations applicable to its activities. The compliance function should advise the management body on measures to be taken to ensure compliance with applicable laws, rules, regulations and standards, and should assess the possible impact of any changes in the legal or regulatory environment on the institution’s activities and compliance framework. 10 Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC. OJ L 176, 27.6.2013, p. 338–436. 11 EBA Guidelines on Internal Governance EBA/GL/2021/05.

Compliance and reporting
obligations
Status of these guidelines
This document contains guidelines issued pursuant to Article 16 of Regulation (EU) No
1093/2010.
12 In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities and financial institutions must make every effort to comply with the guidelines.
Guidelines set the EBA’s view of appropriate supervisory practices within the European System
of Financial Supervision or of how Union law should be applied in a particular area. Competent authorities as defined in Article 4(2) of Regulation (EU) No 1093/2010 to whom guidelines apply should comply by incorporating them into their practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where guidelines are directed primarily at institutions. Reporting requirements
According to Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must notify
the EBA as to whether they comply or intend to comply with these guidelines, or otherwise with reasons for non-compliance, by ([dd.mm.yyyy]). In the absence of any notification by this deadline, competent authorities will be considered by the EBA to be non-compliant. Notifications should be sent by submitting the form available on the EBA website to compliance@eba.europa.eu with the reference EBA/GL/2021/09. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities. Any change in the status of compliance must also be reported to the EBA.
Notifications will be published on the EBA website, in line with Article 16(3) of Regulation (EU)
No 1093/2010.
12 Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC, (OJ L 331, 15.12.2010, p.12).

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE TIME AND MEASURES TO RETURN TO COMPLIANCE PURSUANT TO ARTICLE 396(3) OF REGULATION (EU) NO 575/2013 different causes or have been triggered by a different event, the competent authority may decide that any further breach (or breaches) though unrelated may not qualify as a rare event. Predictability of the breach
19. The competent authority should assess whether the breach would have been a foreseeable
event had the institution applied a proper and effective risk management in accordance with its obligations under Article 393 of Regulation (EU) No 575/2013 and the EBA Guidelines on Internal Governance.
20. The competent authority should also consider whether the institution could have been in a
position to anticipate the breach using available information.
21. In cases where identical or similar breaches of other institutions occur that could be attributed
to the same cause, the competent authority might conclude that the breach was caused by an unforeseeable event. Reasons beyond control of the institution to prevent the breach
22. The competent authority should assess whether the breach was caused by reasons beyond the
control of the institution. This could at least be assumed in the following cases:
a. An unexpected and substantial decrease of own funds of the institution, including due to the impact of major operational risk events, such as external fraud, natural disaster or pandemic, that are not linked to a failure of the institution’s internal control mechanisms. b. In cases where an exposure (fully or partially) exempted ceases to be eligible for such an exemption due to a decision of a third party that could not have been anticipated or prevented by the institution.
c. A court ruling or administrative decision that leads to a different interpretation of the
applicable large exposures regulatory framework where the institution has not had sufficient time to implement it such as to prevent a breach of the limits of Article 395(1) of Regulation (EU) No 575/2013. d. The merger of counterparties/clients or acquisitions between counterparties/clients, but only in cases when the institution did not have knowledge of or could not have anticipated this merger or acquisition to prevent a breach.
23. A breach caused by an inappropriate application or misinterpretation of the large exposures
framework should, in general, not qualify as a reason beyond the control of the institution.
24. In general, if the competent authority concludes that the breach does not fulfil the criteria
specified in this section, the competent authority should not grant a period longer than 3 months to restore compliance with the large exposure limits. 13 EBA Guidelines on Internal Governance EBA/GL/2021/05.

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE TIME AND MEASURES TO RETURN TO COMPLIANCE PURSUANT TO ARTICLE 396(3) OF REGULATION (EU) NO 575/2013
4.2 Information to be provided to the competent authority in case
of a breach of the large exposure limits
25. When reporting the exposure value in excess of the large exposure limits of Article 395(1) of
Regulation (EU) No 575/2013 in accordance with Article 396(1) of that Regulation, and in order to facilitate its assessment by the competent authority, the institution should, without delay, provide at least the following information:
a. the amount of the excess and magnitude of the breach in relation to Tier 1 capital; b. the name of the client concerned and, where applicable, the name of the group of connected clients concerned;
c. date of the occurrence of the breach;
d. description of available collateral (even if not eligible for credit risk mitigation), if any; e. a detailed explanation of the reasons for the breach; f. remedial actions already implemented or planned; and g. expected time needed to return to compliance with the large exposure limits.
26. The competent authority should request further information and explanations if it is not
satisfied that the information provided is sufficiently detailed to allow for a comprehensive assessment of the specific circumstances of the breach.
4.3 Criteria to determine the appropriate time to return to
compliance with the limits of Article 395(1) of Regulation (EU) No 575/2013
27. Following the assessment of the breach reported by the institution in accordance with Section
4.2 of these guidelines, the competent authority should decide the appropriate time to return
to compliance with the limits of Article 395(1) of Regulation (EU) No 575/2013.
28. A competent authority should not grant an institution a period longer than 3 months to resolve
a breach if it concludes that the breach was repetitive or when the magnitude of the breach has the potential to have a major impact on the financial situation of the institution.
29. In cases where a competent authority decides to allow an institution a period longer than 3
months to resolve a breach and return to compliance with the limits set out in Article 395(1) of Regulation (EU) No 575/2013, the time deemed appropriate by the competent authority should be commensurate with a rapid restoration of the limits.
30. In any case, the time to return to compliance should not be longer than 1 year. Exceptionally,
where the specific circumstances of the breach and the measures of the compliance plan referred to in Section 4.4 justify otherwise, the competent authority may grant a period longer than 1 year to resolve the breach. Such cases should however not be the norm.

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE TIME AND MEASURES TO RETURN TO COMPLIANCE PURSUANT TO ARTICLE 396(3) OF REGULATION (EU) NO 575/2013
31. In order to decide the appropriate time to return to compliance, the competent authority
should at least consider the following elements in its assessment:
a. the institution’s record of breaches; b. the promptness of notifying about the breach;
c. the reason(s) for the breach;
d. the systemic nature, complexity and magnitude of the breach; e. the possible impact on the overall financial situation of the institution; f. the overall risk concentration in the banking book of the institution across different counterparties; g. the type of client or group of connected clients and its creditworthiness; h. the measures already implemented to resolve the breach. The institution’s record of breaches
32. The competent authority should take into account any previous breaches by the institution and
the scope of measures adopted to return to compliance in those cases. The competent authority should in particular assess, in cases of repeated breaches, whether the new breach is due to the same cause as the ones identified in previous cases. The promptness to notify about the breach or the remedial actions to return to compliance
33. If an institution unduly delays the notification of a breach, the competent authority may
consider giving the institution a shorter timeframe to return to compliance. The reason(s), or repetitive nature, complexity and magnitude of the breach
34. The competent authority should assess the reasons for the breach and assess the point in time
and forward-looking materiality of the potential impact on the institution.
35. The competent authority might require and request additional information when the causes of
the breach are complex.
The overall financial situation of the institution
36. The competent authority should consider whether the institution’s compliance with the
regulatory capital requirements (CET 1 Ratio, Tier 1 Ratio, Total Capital Ratio) is well above the minimum level. The overall risk concentration in the banking book of the institution across different counterparties
37. The competent authority should consider the adequacy of the risk management practices of
the institution and its approach to diversification.
The type of client and its creditworthiness
38. The competent authority should take into account the type of counterparty and its
creditworthiness. Itshould assess whether the possible default of the concerned client or group

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE TIME AND MEASURES TO RETURN TO COMPLIANCE PURSUANT TO ARTICLE 396(3) OF REGULATION (EU) NO 575/2013 of connected clients, if available, and the consequent loss, has the potential to reduce the regulatory capital ratios below the minimum requirements. The measures already implemented to resolve the breach
39. The competent authority should consider the measures already implemented by the
institution, especially in view of the fact that some of those measures might eventually facilitate a rapid return to compliance.
4.4 Measures to be taken to ensure the timely return to
compliance of the institution with the limits of Article 395(1) of Regulation (EU) No 575/2013
40. When a competent authority has granted an institution a period longer than 3 months to return
to compliance with the limits of Article 395(1) of Regulation (EU) No 575/2013, the institution shall present a compliance plan for a timely return to compliance.
41. The compliance plan should at least encompass the following:
a. arrangements to reduce the concerned exposure(s); b. measures to increase the institution’s own funds, where necessary;
c. arrangements to reinforce internal risk management and control processes;
d. any necessary amendments to the institution’s compliance policy; e. appropriate procedures to ensure the timely implementation of the measures; and f. a detailed timetable to implement the measures, including the intended date of returning to compliance.
42. The measures proposed by an institution should include a description of any foreseeable risks
or obstacles to the effective and timely execution of the compliance plan.
43. The competent authority should assess the appropriateness, sufficiency and feasibility of the
measures to ensure a timely return to compliance on a stable and continuous basis, and that the detailed timeframe is appropriate and achievable.
44. If the competent authority has any material concerns with regard to the measures, it should
promptly inform the institution.
45. The institution should inform the competent authority immediately in case some of the
measures foreseen cannot be achieved as planned. The competent authority should closely monitor the implementation of the measures to ascertain the effective and timely return to compliance. In particular, it should monitor whether the different milestones are fully accomplished. If the institution fails to achieve any of those milestones, the competent authority should require the institution to address such failings appropriately.
46. The frequency and intensity of the competent authority’s monitoring should be adequate and
proportional to the cause and size of the breach, its potential impact on the institution and the

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE TIME AND MEASURES TO RETURN TO COMPLIANCE PURSUANT TO ARTICLE 396(3) OF REGULATION (EU) NO 575/2013
4. Accompanying documents
4.1 Cost-benefit analysis / impact assessment
Regulation (EU) 2019/876, amending the Capital Requirements Regulation (EU) No 575/2013, has added paragraph 3 to Article 396 whereby the EBA is mandated to develop guidelines to specify how the competent authorities may determine the exceptional cases referred to in Article 396(1) CRR; the time considered appropriate for returning to compliance; the measures to be taken to ensure the timely return to compliance of the institution. This analysis provides an overview of the findings as regards problem identification, possible options to remove problems and their potential impacts. Given the nature and the scope of the guidelines, and pursuant to the principle of ‘proportionate analysis’, this analysis is high level and qualitative in nature. Only a qualitative analysis is provided about the potential impact of the options; a quantitative analysis is presented with the aim to provide information about the materiality of the phenomena discussed here. The qualitative analysis presents the advantages and disadvantages of different options. Moreover, the quantitative analysis relies on information available through the Supervisory Reporting Templates (i.e. COREP) and, in particular, it leverages only on data provided in the EBA sample. This way, it is not necessary to collect information from National Competent Authorities (NCAs) or directly from the institutions. A. Problem identification and baseline scenario An excessive concentration of exposures towards a single client or a group of connected clients is a major threat for a bank’s financial stability. The large exposures framework acts as a backstop to significant losses caused by the possible default of a client or a group of connected clients.
Article 396(1) of the CRR deals with compliance aspects when the large exposure limits are
breached. This flexibility can be deemed necessary once it is recognised that institutions do not have complete control of the relationships with their customers: the behaviour of customers, the unexpected loss of a collateral that was used to reduce the exposure pursuant to the CRM rules; the impact of operational risk events, such as external fraud, are examples of phenomena that might shape unexpected variations of the exposure level or the capital level.
Article 396(1) of the CRR states that breaches should be exceptional and that institutions shall
promptly inform the competent authority and remedy the breach within the period indicated by the competent authority. This rule leaves room for interpretation in particular regarding the definition of the terms ‘exceptional’ and ‘limited period’ of time that the competent authority should grant to the institution to address the breach. In turn, this situation may lead to inconsistent 14 Making ad-hoc data collections is a costly and time-consuming process. For this reason it is preferable, whenever it is possible to exploit data that are readily available from statistical agencies and databases.

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE TIME AND MEASURES TO RETURN TO COMPLIANCE PURSUANT TO ARTICLE 396(3) OF REGULATION (EU) NO 575/2013 interpretations across EU institutions and non-harmonised application of the flexibility granted by
Article 396(1) of the CRR.
B. Policy objectives
The new Article 396(3) of the CRR mandates the EBA to define guidelines to specify how competent authorities may determine the exceptional cases and the time considered necessary for returning to compliance. The task of providing a definition of a concept like ‘exceptional case’ is challenging. The risk is to fall back on definitions leveraging on other unspecified concepts as ‘unpredictable’ or suggestions referring to very generic principles like using a ‘holistic approach’. However, it is clear that given the potential materiality of the phenomena under discussion, the level playing field among EU institutions could be endangered if no guidance were provided. To ensure a prudent and harmonised application of Article 396(1) of the CRR, ‘operational’ definitions are needed where the term operational applies to those definitions that allow for the reduction of a given concept not merely to sentences, which might have only an apparent meaning but that in practice leave room for heterogeneous interpretations, but to actual experiences, which are at least conceptually possible. Quantitative Analysis The following chart depicts information derived from COREP templates. In particular, pursuant to
Article 394 of the CRR, all exposures defined as a large exposures as per Article 392 CRR, including
those exempted from the application of the limits of Article 395(1) of the CRR, must be reported. The sample analysed consisted of approximately 120 banks (excluding subsidiaries) from 27 countries. Consolidated data was used. The chart shows the ratio between the sum of the amounts exceeding the large exposure limits and the Tier1 capital. In other terms, for each institution, the following ratio has been computed where N is the number of large exposures reported by the given institution:
∑ 𝒎𝒂𝒙(𝟎, 𝑬𝒙𝒑𝒐𝒔𝒖𝒓𝒆𝒊 − 𝑳𝒊𝒎𝒊𝒕)
𝑵
𝒊=𝟏
𝑻𝒊𝒆𝒓𝟏 𝑪𝒂𝒑𝒊𝒕𝒂𝒍
For each period, the weighted average over the entire sample and the maximum at single bank level are represented. Although, on aggregate level, the amount of exposures exceeding the Tier 1 capital is limited (0.24% in September 2020), at bank level in some cases this amount was considerable and even higher than the Tier 1 capital of the respective institution.

Baseline scenario (no or limited action).
Deduct from the institution’s own capital the amount of the exposure that exceeds the
large exposure limits.
Impose a fine for any breach.
As regards the first point, i.e. the typical ‘zero/no’ option, it should be taken into consideration whenever the costs of the proposed regulation is deemed higher than the benefit. In this specific case, where the potential damage shaped by the default of a large exposure is high even if infrequent, the materiality of the phenomena suggests that measures going in the direction of reducing the potential impact have a high expected benefit. Moreover, the guidelines do not impose structural costs, like additional reporting requirements, but set some common principles that help to increase the harmonisation among EU institutions. Finally, these guidelines introduce a form of flexibility, i.e. the possibility to grant a longer period to eliminate the eventual breach thereby clarifying Article 396(1) of the CRR. In this sense, the guidelines reduce the cost of the compliance with the regulation. These guidelines do not introduce any differentiation between smaller and larger institutions, as possible excessive concentration of the credit portfolio can affect equally both types of institutions, and the complexity of the relationships between a given institution and its borrowers is related to the level of sophistication of the products offered by the institution. In turn, this level should be in line with the ability of the institution’s management to deal with these facility types. In addition, it must be noticed that breaches stemming from the trading book are outside the scope of the guidelines. The second option, i.e. deducting from the institution’s own capital the amount of the exposure that exceed the large exposure limits, would automatically ensure that the limits are never

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE TIME AND MEASURES TO RETURN TO COMPLIANCE PURSUANT TO ARTICLE 396(3) OF REGULATION (EU) NO 575/2013 breached. It is easy to show that, if E is the amount of the exposure and K the amount of Tier 1 capital then, subtracting from both E and K the amount A computed as:
𝑨 = 𝐦𝐚𝐱 (𝟎,
𝟒𝑬 − 𝑲
) would ensure that the exposure never exceeds the limit of the 25% of the Tier 1 capital. This approach is simple but its main problem is the lack of flexibility. The reduction of the capital due to the deduction could lead to a breach of other prudential limits, like the capital ratio limits, but could also cause other exposures to breach the large exposure limits, thus triggering other deductions. This cascading effect could challenge the stability of the institution. Imposing a fine has an interesting theoretical appeal. As mentioned above, defining the exceptionality of a given situation is a difficult task. This is mainly so because it is difficult, if not impossible, for any external analyst to have complete knowledge of the information available to the institution. The fine would induce the institution to try limiting as much as possible the occurrence of the breaches so to minimise the amount of the fine. If a breach is observed, it could be considered as an event not foreseeable or that could not be prevented by the institution. The main practical problem of this approach is the calibration of the fine. If not adequate, the fine would not give the correct incentive, and if excessive, it could affect the stability of the institution. Preferred option These guidelines introduce quite a broad interpretation of the concept of ‘exceptional case’ referred to in Article 395(1). The rationale for this interpretation is that the breaches to large exposure limits, if not well monitored or promptly cured, could have a large impact on the solvency of the institutions. Considering both the possible materiality of losses stemming from large exposures and the need to ensure a harmonised application of the regulation across EU institutions, it is deemed that the benefits of the guidelines compensate for the costs and represent the better solution among the alternative options. Furthermore, without the indications provided by the guidelines, different interpretations across institutions and countries could be made about the above-mentioned points.
4.2 Feedback public consultation
In general, the overall feedback received from two associations on the consultation paper of 17 February 2021 was positive, however no specific credit institution provided input to the consultation. The consultation period lasted for 3 months and ended on 17 May 2021. The responses were published on the EBA website. This paper presents a summary of the key points and comments received during consultation, the analysis and discussion triggered by these comments and the actions taken to address them if deemed necessary.

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE Summary of responses to the consultation and the EBA analysis General comments Existing supervisory practices One respondent expresses the appreciation of the fact that the EBA’s approach in the guidelines is very much built on existing supervisory practices that are known and clear to institutions. The EBA welcomes the comment acknowledging the fact that the guidelines are built on existing supervisory practices that are known and clear to institutions. None. Streamlined compliance plan The same respondent appreciates that it is left to the competent authority to decide on the adequate timing for returning to compliance. In this sense, they would like to retain the approach providing that when an institution is not allowed more than 3 months to restore compliance, it might present a streamlined version of the compliance plan. The idea pointed out by the respondent is clearly reflected within the background and rationale part of the guidelines. First, paragraph 19 states that ‘where a competent authority concludes that the institution should remedy the breach within three months and has informed the institution to that end, the institution does not need to present a formal plan for a timely return to compliance (compliance plan). Furthermore, paragraph 36 establishes that when an institution is not allowed more than three months to restore compliance with the large exposure limits, it might present a streamlined version of the compliance plan.’ Meanwhile, paragraph 40 of the guidelines specifies that “when a competent authority has granted an institution a period longer than three months to return to compliance with the limits of Article 395(1) of Regulation (EU) No 575/2013, the institution shall present a compliance plan for a timely return to compliance.” From this assertion it can be understood that the guidelines make it clear that an institution Following the comments received, it was noted that the ideas expressed in paragraphs 19 and 36 within the background of the guidelines seem to be in contradiction. Consequently, taking into account that paragraph 40 within the guidelines establishes that ‘when a competent authority has granted an institution a period longer than three months to return to compliance… the

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE should only present a compliance plan when the competent authority grants a period longer than 3 months. institution shall present a compliance plan…’, paragraph 36 of the background was deleted. Implementation of the guidelines Overall, one respondent believes that the current draft is fit for purpose and could apply from Q2 2022. The EBA welcomes the comment acknowledging the fact that, overall, these guidelines are fit for purpose. None. Responses to questions in Consultation Paper EBA/CP/2021/03 Question 1. Do you agree with the three criteria developed in the Guidelines to assess a breach of the large exposure limits? One respondent expresses that the criteria to assess a breach as exceptional seem comprehensive and understandable. The EBA welcomes the comment acknowledging the fact that the three criteria to assess a breach as exceptional seem comprehensive and understandable. None. Question 2. Is there anything in particular that should be developed further in the guidelines to provide greater clarity on each of the three criteria? No answers. None. None. Question 3. What are your views on the quantitative criteria included No answers. None. None.

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE in paragraphs 16 and 17? Do you think that they can provide good guidance to competent authorities to assess a breach? Question 4. In particular on the criterion ‘reasons beyond control of the institution’, do you think that the cases included in the guidelines reflect accurately current practices? Another respondent states that even though the list in paragraph 22 is not meant to be limited, they believe it would be useful to clarify that a merger between counterparties/clients resulting in a breach of the large exposure limit is also deemed to be an event beyond the control of the institution and hence add it to the list. The EBA acknowledges that a merger of counterparties/clients or acquisitions between counterparties/clients is an event beyond the control of the institution and consequently should be considered by the competent authority in its assessment of the specific circumstances of the breach. But it is also true that a merger between large corporates – which is the likely case where a breach might occur (the amount of the exposures to SMEs that might be affected by a merger are not that high to cause a breach) – is usually announced publicly long before it actually takes effect, leaving the institution time enough to react to the eventuality of a breach. In this case, the specific circumstances of a breach might not fulfil the second criteria in the guidelines, the predictability of the breach. As paragraph 20 of the guidelines establishes, ‘the competent authority should also consider whether the institution could have been in a position to anticipate the breach using available information’. As suggested by the respondent, the list of circumstances that can be considered beyond the control of the institution in paragraph 22 of these guidelines is expanded to include the merger of counterparties/clien ts or acquisition between counterparties/clien ts, but limited to a situation in which the institution did not have information in advance that could have helped to anticipate and prevent the breach. Question 5. One of the respondents believes that the wording in paragraph 26 could be clarified to illustrate a need for The EBA welcomes the comment acknowledging the fact that the wording in paragraph 26 could be None.

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE Do you have any comments on the additional information that an institution should submit to the competent authority when a breach of the large exposure limits has occurred? further details on the elements listed in paragraph 25 rather than adding potential new items. clarified to illustrate a need for further details on the elements listed in paragraph 25 rather than adding potential new items. Nevertheless, the competent authority’s assessment of a breach should take into consideration every circumstance. If, in the process of its assessment, the competent authority considers that it needs more information. As part of its supervisory powers, it is entitled to request not only further details on the information already provided by the institution, but also any additional information that had not been provided by the institution in the first place. Question 6. Do you agree with the general principle that compliance with the large exposure limits should occur within 1 year? One respondent supports the possibility introduced in paragraph 30 of the guidelines allowing, in certain cases, a period longer than 1 year for returning to compliance. But at the same time, they do not see the legal basis or justification for a distinction of breaches shorter or longer than 1 year. Quite the opposite, they recommend that since a breach that seems continuously irresolvable should be monitored and reasoned more deeply as part of supervisory dialogue, there is no need for any additional specification. They defend the necessity of flexibility in these rules, in order to safeguard the financial stability that might be endangered in extraordinary situations like a systemic crisis or a general market failure caused by severe shocks to the economy due to, for example, a pandemic crisis. Consequently, they believe that an arbitrary time limit, i.e. 1 year, should not be imposed as a general principle. The EBA welcomes the comment acknowledging the fact that the guidelines allow, in certain cases, a period longer than 1 year for returning to compliance. It also acknowledges the fact that the 1-year period is arbitrary. Nevertheless, according to Article 395(3) of Regulation (EU) No 575/2013, institutions shall comply with the large exposure limits at all times. Consequently, the EBA considers, as a general rule, that a year should be time enough for an institution to resolve a breach. In spite of that, the EBA acknowledges that there might be exceptional circumstances that might warrant a longer period for institutions to resolve a breach. Hence the guidelines include that possibility, but this does not represent a legal statement distinguishing breaches that will be solved within 1 year and breaches that warrant a longer period to be resolved. None.

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE On the other hand, the EBA considers that there is no such thing as a ‘continuously irresolvable breach’; any breach is deemed to, and it should, be resolved. Question 7. What cases could justify a period longer than 1 year to return to compliance? One respondent points out that changes in legislation are captured under exceptional circumstances, should be dealt with according to the guidelines, and might warrant a time period well beyond 1 year. As an example, they highlight that changes to the exemptions from the large exposures limits included in Article 400 of the CRR could have a significant impact on public and promotional banks –publicly owned and guaranteed institutions that foster local economic development by funding SMEs, infrastructure, green and social projects, and also local and regional governments- across Europe. The EBA welcomes the comment acknowledging the fact that changes in legislation -that are captured in these guidelines under exceptional circumstances-, should be dealt with according to the guidelines, and might warrant a time period well beyond 1 year. The possibility requested by the respondent is already included in these guidelines. More specifically, paragraph 30 establishes that ‘exceptionally, where the specific circumstances of the breach and the measures of the compliance plan justify otherwise, the competent authority may grant a period longer than one year to resolve the breach’. According to this statement, it is up to the competent authority to decide whether or not granting a period longer than 1 year for an institution to resolve a breach of the large exposures limits. In any case, as paragraph 30 within the background of the guidelines reflect, ‘these cases should however not be the norm and well justified’. None. Question 8. Paragraph 30 lists a number of elements that a competent authority should consider when deciding the specific time to return to compliance with the large exposure limits. No answers. None. None.

GUIDELINES SPECIFYING THE CRITERIA TO ASSESS THE EXCEPTIONAL CASES WHEN INSTITUTIONS EXCEED THE LARGE EXPOSURE LIMITS OF ARTICLE 395(1) OF REGULATION (EU) NO 575/2013 AND THE Do you agree with them? Should the guidelines include further element/s? If your answer is yes, please elaborate. Question 9. Do you agree with the main content of the compliance plan as set out in paragraph 40 in order to ensure return to compliance or are some measures missing? Alternatively, do you think that some of the measures would not be necessary? Please elaborate further in either case. No answers. None. None. Question 10. Should the guidelines benefit from including further procedural details? No answers. None. None.

Guidelines on large exposures breaches and time and measures to return to compliance

Lineage: In force