Guidelines on the implementation, validation and assessment of Advanced Measurement (AMA) and Internal Ratings Based (IRB) Approaches

4 April 2006
Guidelines on the implementation, validation and assessment of Advanced Measurement (AMA) and Internal Ratings Based (IRB) Approaches
Executive summary.......................................................................... 4

Introduction ................................................................................ 7
1.1. Why guidelines at all and why now?........................................... 7
1.2. What is covered and what not? ................................................. 8
1.3. Addressees/Scope of application ............................................... 9
1.4. The contents.........................................................................10
Cooperation procedures, approval and post approval process .............12
2.1. Cooperation procedures between supervisory authorities under
Article 129..................................................................................12
2.2. Approval and postapproval process .........................................15
2.2.1. Application......................................................................15
2.2.1.1. Minimum Content.......................................................15
2.2.1.2. Language and signatory ..............................................20
2.2.1.3. The starting of the sixmonth period .............................20
2.2.2. Supervisor’s Assessment...................................................21
2.2.3. Decision and permission....................................................24
2.2.4. Change of consolidating supervisor .....................................26
2.2.5. Post approval process.......................................................26
2.2.6. Transition period..............................................................27
ANNEXES I and II ...........................................................................29
Supervisor’s assessment of the application concerning the minimum
requirements of the CRD – Credit Risk ...............................................36
3.1. Permanent Partial use and rollout ...........................................36
3.1.1. Rollout..........................................................................36
3.1.2. Permanent partial use.......................................................38
3.2. Use test...............................................................................41
3.3. Methodology and documentation..............................................45
3.3.1. Assignment to exposure classes .........................................45
3.3.1.1. Retail exposure class ..................................................45
3.3.1.1.1. Individual persons and SMEs ..................................45
3.3.1.1.2. Qualifying revolving retail exposures........................48
3.3.1.1.3. Retail exposures secured by real estate collateral ......49
3.3.1.2. Corporate Exposure class ............................................49
3.3.1.2.1. SMEs in the corporate exposure class ......................49
3.3.1.2.2. Specialised lending ...............................................50

3.3.1.3. Securitisation exposure class........................................52
3.3.1.3.1 Definition of securitisation exposure class ..................52
3.3.1.4. Equity exposure class .................................................55
3.3.1.5. Purchased receivables.................................................59
3.3.2. Definition of loss and default..............................................62
3.3.2.1. Definition of default....................................................62
3.3.2.2. Definition of loss ........................................................64
3.3.3. Rating systems and Risk quantification................................67
3.3.3.1. Probability of Default (PD) ...........................................67
3.3.3.2. Loss Given Default (LGD) ............................................69
3.3.3.3. Conversion Factors .....................................................76
3.3.4. Quality of internal documentation.......................................81
3.3.5. External vendor models ....................................................83
3.4. Data....................................................................................85
3.4.1. Data accuracy, completeness and appropriateness ................86
3.4.2. Data quality standards and consistency with accounting data..87
3.4.3. Representativeness of data used for model development and
validation ................................................................................88
3.4.4. Data sources and definition of default..................................91
3.5. Quantitative and qualitative validation and its assessment ...........91
3.5.1. High level principles on validation.......................................92
3.5.2. Validation tools: Benchmarking and Backtesting ...................98
3.5.3. Low default portfolios ..................................................... 100
3.6. Internal governance............................................................. 102
3.6.1. Role of the management body and senior management ....... 104
3.6.2. Independent Credit Risk Control unit................................. 106
3.6.3. Role of internal audit...................................................... 109
3.6.4. Independence/conflict of interests in rating assignment ....... 109
3.6.5. Reliance on the work of external auditors in the review process
........................................................................................... 111
4. Supervisor’s assessment of the application concerning the minimum
requirements of the CRD – Operational Risk...................................... 112
4.1. Partial use combinations ....................................................... 112
4.2. Simpler approaches (BIA/TSA/ASA)........................................ 114
4.2.1. Entry criteria and use of TSA and ASA............................... 114
4.2.2. General and specific conditions for the use of ASA............... 115
4.2.3. Relevant indicator: Three years average............................ 116
4.3. AMA .................................................................................. 116
4.3.1. Rollout........................................................................ 116
4.3.2. Use test ....................................................................... 118
4.3.3. Data ............................................................................ 119
4.3.4. Guidelines for AMA Quantitative issues, Internal Validation, Risk
transfer mechanisms and allocation ........................................... 121
4.3.4.1. AMA four elements ................................................... 122
4.3.4.2. Consistency of the risk measurement system................ 127
4.3.4.3. Expected losses, correlation, Insurance and other risk
transfer mechanisms ............................................................ 129

4.3.4.4. Internal validation of risk measurement and management
processes ........................................................................... 132
4.3.4.5. Allocation methodology for AMA institutions on a group wide
basis.................................................................................. 134
4.3.5. Internal governance ....................................................... 134
ANNEXES III to V.......................................................................... 140
List of acronyms:
AIG Accord Implementation Group
AMA Advanced Measurement Approach
ASA Alternative Standardised Approach
BCBS Basel Committee on Banking Supervision BE Business Environment BIA Basic Indicator Approach BL Business Line CEBS Committee of European Banking Supervisors CF Conversion Factors CRCF Credit Risk Control Function CRCU Credit Risk Control Unit CRD Capital Requirements Directive EL Expected Loss ECAI External Credit Assessment Institution HVCRE High Volatility Commercial Real Estate ICF Internal control factors IRB Approach Internal Ratings Based Approach KRI Key risk indicators LDA Loss distribution approach LGD Loss Given Default LTV Loantovalue ORMF Operational Risk Management Function PD Probability of Default RDS Reference Data Set SBA Scenario based approach SL Specialised Lending SME Small and Medium Sized Entities TSA The Standardised Approach UL Unexpected Loss

Executive summary
1. These guidelines reflect a common understanding among European
supervisory authorities on the procedures to be used in processing, assessing, and making decisions on the application of an institution to use an Advanced Measurement (AMA) or an Internal Ratings Based (IRB) approach for regulatory purposes. It also sets out guidance, again based on a common understanding among the supervisory authorities, on the meaning and the implementation of the minimum requirements for using these approaches, as set out in the recast Capital Requirements Directive (CRD) 1 . 2. The CRD requires an explicit approval process for the use of AMA and IRB approaches for regulatory purposes. Approval to use an IRB approach can be given only if the competent authority is satisfied that the institution's systems for managing and rating credit risk exposures are sound and implemented with integrity and, in particular, that they meet the requirements listed in Article 84 in accordance with Annex VII, Part 4 of the CRD. Similarly, approval to use an AMA under Article 105 can be given only when institutions satisfy their competent authorities that they meet the qualifying criteria set out in Annex X, Part 3 of the CRD.
3. One of the greatest challenges for supervisors in implementing the
CRD is defining under what conditions they will be satisfied with these systems. Supervisors would like these conditions to be convergent across the EU member states, in order to make the playing field as level as possible for institutions using AMA and IRB approaches.
4. These guidelines represent CEBS’ current thinking on the
implementation, validation, and assessment of the AMA and IRB approaches, based on supervisory experience and expectations for these approaches as of the beginning of 2006. The guidelines cover a wide range of topics, including the definition of loss and default; requirements for rating obligors and exposures; the estimation and validation of internal risk parameters, including 'downturn LGDs'; corporate governance matters; data issues; technical aspects of AMA (including expected loss); allocation mechanisms; and the application, assessment, and decision processes. Evolving industry practices and the practical application of these guidelines will enlarge supervisors’ experience. As supervisors will gain experience in the course of their examination and decision processes, it could turn out that certain elements of the guidelines may not stand the test of time (e.g. unexpected side effects). Supervisors may reflect such additional information for the interpretation of these guidelines. They will be subject to review following implementation of the CRD, when 1 Except where noted otherwise, all references to Articles of the CRD are references to the recast Directive 2000/12/EC.

and where necessary ('maintenance'). For example, both industry and regulators are still developing their thinking on how insurance and other risk transfer mechanisms should be taken into account in an AMA framework. Accordingly, for the time being, CEBS has not provided much guidance on this issue. However, CEBS expects that dialogue on the use of insurance and other risk transfer mechanisms will continue.
5. These guidelines are drafted as guidance to supervisors, elaborating
on the CRD Articles and Annexes. However, since the guidelines express CEBS’ expectations of how national supervisory authorities should deal with the implementation and assessment of AMA and IRB approaches, they clearly also affect the institutions that intend to use these approaches. In interpreting the guidelines, institutions have to distinguish between two types of cases. In cases where the guidelines reflect a common understanding among national supervisors on what they should expect from their institutions, the text discusses what institutions "should" do. In all other cases (apart from direct quotes of the CRD) – e.g., institutions "could," "may," etc. – the guidelines simply provide examples illustrating underlying principles, meaning that institutions are free to use other solutions that meet or exceed the supervisors’ requirements, unless national supervisors have issued specific guidance to the contrary. In cases where the CRD is quoted, the text of these guidelines uses “shall.”
6. The guidelines will be a helpful tool for national supervisors (onsite
examiners and offsite inspectors), both in assessing applications to use an AMA or IRB approach, and in subsequent examinations or inspections of the approaches applied. The guidelines will also reduce the burden on the industry. In particular, they will streamline the application and decision process under Article 129(2) of the CRD. To assist in assessing whether an application is complete, the supervisors have agreed on a minimum set of documents to be included in applications, while still leaving each authority the right to require additional documents. Similarly, the guidelines contain a list of areas that the assessment of applications would concentrate on. The guidelines should therefore simplify and speed up the approval process.
7. These guidelines do not cover ‘explicit’ national discretions: that is,
areas where the CRD presents the competent supervisory authority with an explicit choice of alternatives to apply. This topic has already been addressed by CEBS in the ‘national discretions’ exercise. For example, no guidance has been given on how supervisory authorities should make use of the explicit discretion on the number of days past due for retail and Public Sector Entities exposures. 2 2 The national supervisory authorities will disclose how they make use of the discretions granted to them by the CRD and what guidance they give on the implementation, validation, and assessment of the AMA and IRB approaches. (For more detailed information on this point, see CEBS Final Guidelines on the Common Supervisory Disclosure Framework.)

8. The guidelines cover a broader concept of validation than that used
by the Validation SubGroup of the Basel Committee’s Accord Implementation Group (AIG), since assessing the institution’s validation of its internal rating systems (IRB) and its operational risk measurement systems (AMA) is only part of the much broader concept of a supervisor’s assessment. This difference in focus does not, however, imply any inconsistency with the work of the AIG. To the contrary, consistency with the work of the AIG subgroups on validation and data issues and the AIG SubGroup on Operational Risk was one of the prior goals in drafting these guidelines. Indeed, these guidelines adopt the HighLevel Principles on Validation of the AIG SubGroup on Validation and use them as the basis for elaborating further guidance on this subject. Similarly, the guidance provided on downturn LGDs is based on the Basel Committee’s “Guidance on Paragraph 468 of the Framework document” and the paragraphs on expected loss in section 4.3.4.4. reflect the work done by the AIG SubGroup on Operational Risk.
9. In general, the good faith of institutions that have developed
systems and procedures prior to the publication of CP10 on the basis of a dialogue with their national supervisors should be respected. Thus supervisors may refrain from applying certain provisions of sections 3 and 4 of these guidelines for a limited and appropriate period of time, in order to allow these institutions to change their systems and plan future enhancements in an orderly way. This also applies to crossborder groups and/or their subsidiaries.
10. These Guidelines have been unanimously endorsed by CEBS
Members in the spirit of further converging supervisory practices within the EU and in accordance with CEBS statement on the character of its publications. In developing the guidelines, CEBS has benefited from ongoing dialogue and meetings with industry experts and the guidelines went through two rounds of public consultation. The comments received from the industry have been published on the CEBS website unless the respondents requested otherwise. CEBS Feedback on the industry responses received has been published in a separate document respectively (see http://www.cebs.org/pdfs/CP10_feedback.pdf and www.cebs.org/pdfs/CP10r_feedback.pdf )

1. Introduction
1.1. Why guidelines at all, and why now?
11. The New Basel Accord 3 (Basel II) adopted by the Basel Committee
on Banking Supervision (BCBS) in June 2004, and the Capital Requirements Directive (CRD), allow institutions to calculate their capital requirements for credit risk and operational risk using methods that are significantly more risksensitive than those set forth in the original 1988 Basel Accord (Basel I). The most sophisticated approaches permitted in the new texts – the Internal Ratings Based (IRB) Approach for credit risk and the Advanced Measurement Approach (AMA) for operational risk – allow institutions to use their own estimates of risk parameters such as the probability of default (PD) of an obligor. IRB parameters are inserted into supervisory formulas which are used to calculate the institution’s capital requirements, while AMA parameters are fed into models developed by the institution itself.
12. The adequacy of the resulting capital requirements depends critically
on the adequacy of the estimated risk parameters and – in the case of the AMA – on the soundness of the AMA models used.
13. Accordingly, the CRD requires explicit supervisory approval for the
use of the AMA and IRB approaches for regulatory purposes. The relevant principles and more technical requirements are set out in the CRD Articles and Annexes respectively. Approval to use the IRB approach can be given only if the competent authority is satisfied that the institution's systems for managing and rating credit risk exposures are sound, are implemented with integrity, and meet the requirements listed in Article 84 and Annex VII, Part 4 of the CRD. Approval to use the AMA approach can be given only if the competent authority is satisfied that the institution’s systems for measuring operational risk meet the qualifying criteria in Annex X, Part 3 of the CRD.
14. One of the greatest challenges for supervisors in implementing the
CRD is defining the conditions under which they will be satisfied with these systems. Ideally, the conditions should be convergent across EU member states, in order to make the playing field as level as possible for institutions using the AMA and IRB approaches.
15. CEBS chose to publish the first version of these guidelines for
consultation while the European institutions were still debating the final form and details of the CRD. In the meantime, both the European Parliament and the EU Council have adopted the CRD. 3 International Convergence of Capital Measurement and Capital Standards – A Revised Framework, Basel Committee on Banking Supervision, June 2004 (as updated in November 2005, now containing also the Committee's 18 July 2005 paper on the application of Basel II to trading activities and the treatment of double default effects)

Some amendments on technical details made it necessary to change the text of CP10. However, given the short amount of time remaining for national implementation, any further delay in the first consultation would have made it impossible for CEBS to influence national implementation, which is one of CEBS' key tasks. CEBS’ goal is to reduce inconsistency in implementation and supervisory practices that are within the competence of the supervisory authorities, while respecting the need for flexibility and supervisory judgement and respecting national diversity. By promoting a consistent approach to supervision across the EU, and by promulgating best practices in banking supervision and risk management, CEBS will contribute to enhancing the effectiveness and efficiency of bank supervision, ensuring a level playing field, and promoting the competitive standing of the EU banking sector. The new capital regime offers an unprecedented opportunity to make progress in these areas, because it implies a new approach to supervision for all EU supervisory authorities.
16. In general, the good faith of institutions that have developed
systems and procedures prior to the publication of CP10 on the basis of a dialogue with their national supervisors should be respected. Thus supervisors may refrain from applying certain provisions of sections 3 and 4 of these guidelines for a limited and appropriate period of time in order to allow these institutions to change their systems and plan future enhancements in an orderly way. This also applies to crossborder groups and/or their subsidiaries.
17. These guidelines reflect supervisory experience and expectations for
the AMA and IRB approaches as of the beginning of 2006. Since evolving industry practices and the practical application of these guidelines will enlarge supervisors’ experience, in particular with respect to the AMA, these guidelines will be subject to review an appropriate period of time after CRD implementation and application ('maintenance').
1.2. What is covered and what is not?
18. The guidelines are intended to support the work of national
supervisors when dealing with a model application. They cover a considerable range of topics concerning the application, decision, and especially the assessment process, sometimes in a considerable detail.
19. The guidelines do not make any reference to possible arrangements
between EU and nonEU supervisors. If future negotiations between EU and nonEU countries on banking supervision make this possible, CEBS would extend the guidelines correspondingly. If requested, CEBS could contribute to these discussions.
20. The guidelines relate primarily to the AMA and IRB Approaches. They
do not provide any guidance on the Standardised Approach for Credit

Risk. They do, however, provide some guidance on the Basic Indicator Approach and The Standardised Approaches for operational risk.
21. The guidelines do not contain detailed requirements relating to IT
systems architecture, contingency plans, data integrity, or physical security. The relevance of these topics goes well beyond the calculation of regulatory capital requirements. It was not considered necessary to address these issues in detail in guidelines that focus specifically on AMA and IRB matters. While the guidelines do contain some references to basic principles in these areas, it is expected that supervisors will consider them as part of their broader assessment of the institution's overall control structure.
1.3. Addressees/Scope of application
22. These guidelines are drafted as guidance to supervisors, elaborating
on the CRD Articles and Annexes. However, since the guidelines express CEBS' expectations on how national supervisory authorities should deal with the implementation and assessment of AMA and IRB approaches, they clearly also affect the institutions using these approaches.
23. In interpreting the guidelines, institutions have to distinguish
between two types of cases. In cases where the guidelines reflect a common understanding among the national supervisors on what they should expect from their institutions, the text discusses what institutions "should" do. In all other cases (apart from direct quotes of the CRD) – e.g., institutions "could," "may," etc. – the guidelines simply provide illustrative examples, meaning that institutions are free to use other solutions that meet or exceed supervisors’ requirements, unless national supervisors have issued specific guidance to the contrary. In cases where the CRD is quoted, the text of these guidelines uses “shall.”
24. Article 20 of recast Directive 93/6/EEC – like the current version of
93/6/EEC – extends the credit risk and operational risk capital requirements of Directive 2000/12/EC to investment firms. While the requirements for credit institutions and investment firms are not completely identical (for operational risk, there are significant modifications to take account of the specific features of the investment firm sector, with an option to continue the ‘Expenditure Based Requirement’ for investment firms falling into the low, medium, and medium/highrisk categories), such differences are the exception rather than the rule. Accordingly, the guidelines use the term ‘institutions’ (referring to both credit institutions and investment firms) rather than ‘credit institutions,’ although the latter is the official term used in the recast Directive 2000/12/EC.
25. In order to maintain a level playing field, these guidelines apply not
only to large crossborder groups, but also to all other institutions. It

is expected, however, that national supervisory authorities will take the principle of proportionality (proportional to the nature, size, scale, and complexity of the institution) into account. Supervisors should bear in mind, however, that even smaller and less complex institutions that have chosen to apply for the use of the AMA or IRB approaches for regulatory purposes have, by doing so, made the choice of complying with the minimum requirements for these approaches. In assessing compliance, supervisors should use the principle of proportionality in the sense that they would expect institutions to have risk measurement and management systems whose complexity is commensurate with the complexity of their operations/business.
26. These guidelines are neutral on the extent to which supervisors
perform their own assessments. This choice will reflect the different approaches of individual national authorities regarding the use of external auditors or internal inspectors for onsite missions or offsite assessments.
27. In line with CEBS’ mandate and reflecting the nature of its
consensusbased tools for promoting convergence, these guidelines reflect a common understanding among European supervisory authorities on the procedures to be used in processing, assessing, and making decisions on the application of an institution to use an AMA or an IRB approach for regulatory purposes. They also set out guidance, again based on a common understanding among the supervisory authorities, on the meaning and the implementation of the minimum requirements for using these approaches, as set out in the CRD.
28. These guidelines are neither comprehensive nor exhaustive. Supervisors may impose stronger or more detailed requirements
than those listed in the guidelines. This reflects the nature of the document on which guidance is being given: the Capital Requirements Directive (not regulation). In transposing a Directive, member states are free to impose stricter requirements than those set out in the Directive. No institution should therefore conclude that national supervisors are prohibited from imposing additional requirements in a given area simply because it is not covered by the CEBS guidelines.
29. Although supervisory authorities could encourage institutions to
move to advanced approaches for calculating all their capital requirements, there is no specific requirement in the CRD for the synchronised use of AMA and IRB Approaches. An institution that adopts an advanced approach for credit risk is not obliged to move to an advanced approach for operational risk, or vice versa. This is ultimately a decision for the institution to make on the basis of specific operational or credit risk elements and variables.
1.4. Contents of the guidelines

The first part of the guidelines (section 2 of this paper) describes the
supervisory cooperation process and sets out minimum requirements governing the application to use an AMA or an IRB approach, the supervisor’s assessment of the application, and the supervisor’s decision.
The second part of the guidelines (section 3 of this paper) expands
on the minimum requirements of the CRD, which institutions must fulfil in order to use an IRB approach for regulatory purposes. These minimum requirements relate to:

The methodology used for assigning ratings, estimating risk
parameters, and documenting them internally.
The data used for estimation.
Quantitative and qualitative validation of the estimated risk
parameters. · Internal governance.

Special attention is devoted to definitions (definition of default,
definition of loss), and to the estimation and validation of the risk parameters – Probability of Default (PD), Loss Given Default (LGD) and Conversion Factors (CF) – that are used in the supervisory formula to calculate an institution’s riskweighted exposure amount for credit risk and thus for the calculation of its regulatory capital requirements.
In general, this part of the guidelines follows a typical assessment
process. The assessment provides comfort to the supervisor that the methodology used in the institution’s models, the data used as inputs for the models, and the qualitative risk measurement and control procedures in which the models are embedded, yield risk parameters that adequately reflect the institution’s risk profile.
The guidelines do not distinguish between a ‘Foundation IRB
Approach’ (FIRB) and an ‘Advanced IRB Approach’ (AIRB).
Although these terms are still commonly used by market participants and supervisors, the CRD no longer refers to Foundation and Advanced approaches and there is no distinction between a Foundation and an Advanced approach in the Retail exposure class. An institution can start using the IRB approach (including own estimates of LGD and conversion factors) for the retail exposure class as early as the beginning of 2007. As stated in Article 157(2), for exposure classes other than retail, the use of own estimates of LGD and conversion factors will not be available until 1 January 2008.
The third part of the guidelines (section 4 of this paper) covers
operational risk. This part focuses mainly on the AMA, but also deals to some extent with the simpler approaches for operational risk. Although some topics already discussed in the IRB section seem at

first glance to be repeated here (for example, internal governance and data adequacy), differences in the details of their application to the AMA and IRB approaches make it necessary to discuss them separately. This is not the case for cooperation procedures, approval, and the postapproval process. The procedures described in section 2 of this paper apply equally to the AMA and IRB approaches.
2. Cooperation procedures, approval and postapproval process
2.1. Cooperation procedures between supervisory authorities under
Article 129
36. Article 129(2) of the CRD introduces a specific requirement that
supervisors must work together to determine whether or not to grant permission to a group to use its internal rating systems (IRB) or operational risk measurement systems (AMA) for regulatory purposes, when the group has submitted a single application covering both the consolidated and solo requirements of the group4 .
37. In view of this legal requirement, this specific section on the pre application (see below), approval, and postapproval process (see
section 2.2.) has been added to the CEBS General guidelines for
cooperation between consolidating supervisors and host supervisors. It elaborates upon the general guidance given in the following areas:

The specific steps in the approval process. · The explicit requirement for a formal consultative process.
Time limits in which this process should lead to a common
decision.
The specific role of the consolidating supervisor in this
consultation period.

The new legal requirements relating to the approval process neither
justify nor require any departure from the general guidance for supervisory cooperation on a crossborder basis. The general principles set out in the Guidelines for cooperation between consolidating supervisors and host supervisors therefore remain valid and relevant for supervisory cooperation on the approval process.
To facilitate a common decision within the sixmonth period specified
in Article 129(2) of the CRD, supervisors have agreed on a common understanding on the preapplication, approval, and postapproval phases (see section 2.2.). An illustration of the steps in the pre application and approval process and the cooperative interaction in this process is provided in Annexes I and II of these guidelines. 4 Article 129(2) of the CRD governs not only applications to use the IRB and AMA estimates but also applications to use own estimates of Effective Expected Potential Exposure (EEPE) for measuring counterparty exposure on OTC derivative contracts and securities financing transactions. Moreover, according to the recast CAD (Article 37(2) of Directive 93/6/EEC), Article 129(2) of the CRD also applies to institutions applying for the use of Value at Risk (VaR) models for market risk. These guidelines discuss Article 129(2) of the CRD as it concerns IRB and AMA applications but not EEPE or Market risk model applications.
A group may enter into exploratory discussions with the
consolidating or host supervisors about the use of internal models for all or parts of its business. While there is no formal requirement to do so, supervisors are expected to communicate the outcome of these discussions to other relevant supervisors, and to inform the group of the nature of the approval framework and of the fact that applications will be coordinated through the consolidating supervisor.
However, as soon as a group expresses a clear intention to move
towards the advanced approaches, even before an application is made, it is essential that the preapplication process be centralised with the consolidating supervisor, acting as the coordinator and the central point of contact for the group.
Supervisors have a relatively tight timeframe of six months after
receipt of a complete formal application in which to reach a decision on the approval. The preapplication period thus becomes an important step in ensuring that the approval process for both the group and its supervisors is conducted in an efficient, coordinated, and effective manner.
During this preapplication period it is essential that:

Supervisors understand the extent and nature of the intended use
of internal rating and operational risk management systems (for example, which risks, entities, and exposures are to be covered, how internal models are being rolled out across the group, governance and risk management arrangements, data collection and management, and testing). · All supervisors concerned be consulted to establish a cooperative and consultative framework. This framework needs to encompass the following.
Which supervisors are to be involved, their respective roles
and responsibilities, and the allocation of specific tasks;
A communication strategy and escalation process; and
Procedures to ensure that a consensus can be reached among
supervisors.
Supervisors develop an overall supervisory plan of action that
covers each of the steps in the approval process and that includes priority issues and a timetable. · The group familiarises itself with the approval framework and the requirements and standards concerning the information that it will need to submit.5
There is early identification and communication of any specific
group or local concerns or issues that need to be factored into the process.
Supervisors seek to identify potential areas of disagreement. · Supervisors agree, after due consultation with the group, on the
format and timescale for the submission of the formal application 5 See Section 2.2.1. for more details on the information to be submitted.

and the planning of the assessment to be undertaken by supervisors. 6

Supervisors agree on the way that the eventual implementation
of the rating and operational risk measurement systems will be structured and monitored. 7

Responsibility for organising and coordinating these preapplication
tasks, and more generally for the overall approval process, shall reside with the consolidating supervisor. This responsibility cannot be delegated to another supervisor, although certain tasks – including practical coordinating aspects – may be allocated to other supervisors involved. Thus, for example, while it is expected that the consolidating supervisor will lead the assessment of centrally developed models and the assessment of the group's governance and centralised risk management functions, host supervisors could lead the assessment of locally developed models and local implementation of centrally developed models. The effective coordination of practical work on specific models (e.g. for certain business lines) can, under the responsibility of the consolidating supervisor, be entrusted to the supervisor best placed to ensure the efficient running of the process. This can also apply to centrally developed aspects of the models (see also Annex I of these guidelines).
Consolidating supervisors should liaise with host branch supervisors
of systemically relevant branches to determine the extent to which the latter can contribute to the efficiency of the process. For example, by virtue of their proximity, host branch supervisors can offer valuable insights into the impact of local market conditions on models, or can assist in the assessment of data. This is not intended to add additional responsibilities for branch supervisors, but rather to ensure that the process takes maximum advantage of local knowledge.
Special attention should be given to ensuring that information is
exchanged upon receipt of a formal application, and to coordinating work on assessing the completeness of the application.
Upon reaching a decision, the consolidating supervisor shall
coordinate the drafting of a communication in which the supervisory decision is, duly documented in accordance with Article 129(2) of the CRD. The consolidating supervisor should seek an appropriate procedure for formalizing the adherence of all concerned supervisors to the decision. 8
The CRD specifies that the consolidating supervisor shall make the
final determination in the event that supervisors cannot reach a 6 See Section 2.2. for details on format and timeframe of applications. Additional information on the assessment of applications can be found in Section 2.2.2. 7 Section 2.2.5. provides details on the postapproval process. 8 For more details concerning the decision see Section 2.2.3.

consensus. This is regarded as an exceptional circumstance. Supervisors should try to avoid this outcome by identifying potential areas of disagreement early in the process and prioritising them for early discussion.
49. Supervisors will also ensure adequate communication with the
banking group through an ongoing dialogue (see also Annex I of these guidelines).
2.2. Approval and postapproval process
50. The CRD requires both institutions and supervisors to manage
complex procedures when an IRB or AMA approach is to be used for regulatory purposes. Before an application is made, there will usually be preliminary contacts between the institution and its supervisor. In the case of a crossborder group wanting to use its systems not only in the homecountry but also in host countries, there will also be preliminary contacts between the consolidating and host supervisors. After the application has been submitted, it has to be assessed by the supervisor(s), a decision has to be taken on it (these three steps – application, assessment, and decision – together constitute the approval process), and – if the application is approved – the rollout plan and any terms and conditions on which the approval was conditioned have to be monitored (postapproval process). To streamline these complex tasks, CEBS has agreed on the following common understanding with regard to the approval and post approval process.
51. In most cases, the formal application will follow on from a pre application phase. In these cases, supervisors will seek to avoid
unnecessary duplication of work, for both the institution and themselves. Both the consolidating supervisor and the host supervisors will already have cooperated in the preapplication phase in the spirit of Article 129, thereby facilitating the whole process.
2.2.1. Application
2.2.1.1. Minimum Content
52. To decide on an application, the supervisor needs an overview of the
models that the institution uses or plans to use and how they will be implemented in the institution’s policies and procedures, and detailed information on the construction and calibration of the models, the database, the technological environment, and related policies and procedures, including the institution’s control environment.
53. An institution or group applies for the general use of internal rating
systems to calculate minimum capital requirement for credit risk, or for the use of operational risk measurement systems to calculate the minimum capital requirements for operational risk, or both. The required minimum documentation for such an application is divided into five parts:

a. Cover letter requesting approval. b. Documentation of used or planned rating systems and operational risk measurement systems (including models used).
c. Control environment of the rating systems and operational risk
measurement system, implementation procedures, and IT infrastructure. d. Implementation plan (including RollOut) and details on permanent partial use. e. Selfassessment.
54. If any of these documents are not provided by the institution, or if
they do not meet the standards set out in the guidelines below or in more detailed standards imposed by the competent supervisor, the application will not be considered complete. Documents (b) through (e) are considered to be supporting material. Unless otherwise indicated, the supporting material should be general information about the implementation of the chosen risk measurement approach.
55. The supporting material provides a summary of the institution's
current or planned practices in sufficient depth to enable the supervisor to make an initial supervisory assessment of the application, and to develop a riskbased plan for a more thorough assessment. Cover letter
56. The cover letter should state that the members of the EU group
jointly apply for the permissions referred to in Articles 84(1), 87(9) and/or 105 of the CRD, subject to the details provided in the attached documentation. The letter should also confirm that the material attached to the application is a true and fair summary of the topics covered. ‘True and fair summary’ means that the document provides only a summary of the topic in question, ‘true’ means that the information contained in the summary is not false or misleading, and ‘fair’ means that the information presents a reasonable overall summary, without omitting material facts. Documentation of rating systems and operational risk measurement systems
57. For an application to use the IRB Approach, it is essential that the
documentation of rating systems include at least:

A list of all internal documents held by the applicant that it
considers relevant to the application, including a brief description of their contents.
A map of the models that the institution will use for each of its
portfolios. For IRB, a ‘map of models’ means a statement that

explains which exposures, legal entities, and geographical locations are covered (or will be covered) by each rating system.

A general description of each of the models. This can include a
description of the types of data used, the definitions, classifications and the methodologies used, and some quantitative and qualitative assessments.

For an AMA application, it is essential that the documentation of
operational risk measurement systems include at least:

A list of all internal documents held by the applicant that it
considers relevant to the application, including a brief description of their contents.
A map of the models to be used. For AMA, this means a
statement that explains which operations and/or operational risks are covered by each model.
A general description of all the models. This can include a
description of the types of data, including the four elements (see paragraph 514 of these Guidelines), the definitions, classifications, and methodologies used, and some quantitative and qualitative assessments.
The allocation of operational risk capital between different
entities within the group, and the use of diversification effects.
If the institution uses capitalrelief tools, documentation should
be provided on the coverage and measurement of expected loss, the institution’s operational risk insurance policy or other risk transfer mechanisms, and the use of correlations.

The list of documents referred to above is intended to be a
comprehensive list of all the institution's internal documentation underlying its validation process (including documentation on external vendor models, if used) that the institution judges to be relevant to its application.
Supervisors may request more detailed information, either in the
initial application or at a later stage, to allow an effective assessment of the application. These documents, like all internal documentation, have to be made available to supervisors upon request. For example, additional documentation requested for IRB applications may include, but is not limited to, the information listed in Annex VII, Part 4, Paragraphs 32 to 36 (documentation of rating systems) and Annex VII, Part 4, Paragraphs 109 to 113 (validation of internal estimates) of the CRD, covering the following areas:

Design and operational details. · Major changes in the risk rating process. · Definitions of default and loss. · Use of models obtained from thirdparty vendors. · Differences, if any, between the parameters used for the calculation of
regulatory capital requirements and those used for internal purposes. · Validation of rating systems. · Model assessment processes.

Control Environment
61. The documentation of the control environment, implementation
procedures, and the IT infrastructure should include, as a minimum:

An overview of the internal governance of the institution (i.e., the
role and responsibilities of management, the functions of committees involved in governance, and the role of Internal Audit).
The planned use of the different rating systems and operational
risk measurement systems (how, in practical terms, institutions plan to use different models in the operating activity).
For IRB, the process of rating assignment.
The responsibilities of the parties involved in modelling.
An overview of the validation process.
General information on the institution’s IT structure, as far as IRB
and AMA approaches are concerned. · Internal Audit reports (if applicable). As with other types of documents, more detailed information about the implementation of the rating systems and operational risk measurement systems can be provided later upon request. Implementation plan

Institutions intending to move to an AMA or IRB approach are
expected to prepare a meaningful implementation plan (including rollout), and to submit it to the supervisor as part of the application pack. The implementation plan is a commitment on the part of the institution to implement the AMA or IRB approaches on the specified dates for all of the rating systems and operations for which it is seeking approval to use the AMA or IRB approaches. It is an essential part of the application. The terms ‘implementation plan’ and ‘rollout plan’ are sometimes used synonymously by the industry and supervisors. However, Article 85 refers only to ‘implementation,’ and there is a common understanding among supervisors that there is a difference in terms of the time period covered. ‘Rollout plan’ refers to the time after the initial approval has been granted, whereas ‘implementation plan’ also covers the time prior to approval. The roll out period is thus shorter than, but entirely a subset of the implementation period.
The implementation plan (including rollout) for IRB should be
broken down at least by supervisory exposure classes, business units, and, if applicable, any IRB parameters that need to be estimated. Internal rules with detailed provisions regarding time and content should be laid down for combinations of the above, in particular for the following:

Development of the rating methodology.
Preparation of the technical concept for IT implementation of the
rating methodology.
IT implementation.
Training of staff, including management staff. · Transition from the existing rating system to the new system on
the basis of current business, if a transition is made. · Formal internal acceptance of the new rating system and implementation as ‘the’ rating system of the institution.

In addition, a list of all portfolios which are to be permanently
exempted from the IRB Approach is to be provided. The exempted portfolios should be quantified comprehensively (e.g., number of material counterparties, credit aggregates in the exposure value, and RiskWeighted Exposure Amounts).
As far as the implementation plan (including rollout) for AMA is
concerned, internal rules with detailed provisions regarding time and content are to be laid out for the following:
o Development of operational risk management processes, in particular for data collection. o Development of the measurement methodology. o Implementation of the IT infrastructure which is used for operational risk management and measurement purposes. o Training of staff, including management staff. o The ‘use test.’ Self assessment
The institution should carry out a selfassessment of its state of
readiness based on the standards and minimum requirements set out in the CRD. It should develop an action plan to fill identified gaps and deficiencies, and a schedule for achieving compliance.
The selfassessment should begin with a global assessment, from a
consolidated perspective, of how the various models fit together within the institution or the group. This global assessment should cover the suitability of the organizational structure in terms of internal governance, the adequacy of resources devoted to the rating system or operational risk measurement system, comparability across the group with respect to data and methodology, and consistency in IT organization.
The selfassessment should also cover all the aspects of the rating
system or operational risk measurement system: methodology, quality of data, quantitative and qualitative validation procedures, internal governance, and technological environment. The self assessment could be conducted by staff from an independent risk assessment function with the support, if necessary, of auditors or inspectors teams or a combination of all the resources including also the participation of external auditors and consultants.

2.2.1.2. Language and signatory
69. The application should be signed by an executive member of the
management body referred to in Article 11 of the CRD 9 who has the authority to commit the institution. It is not possible in these guidelines to identify that person more precisely, since his or her identity will depend on national legal systems and some supervisors may require more than one signatory. Therefore, the consolidating supervisor should identify the exact person or persons who should sign the application, at least one of whom should be an executive from the management body.
70. The signatory signs the application on behalf of all the legal entities
making the joint application. The signatory also confirms that the material attached to the application is a true and fair summary of the subjects covered. Depending on the national legal system, supervisors may ask a member of the management body of each legal entity affected to sign the joint application.
71. The cover letter should be in an official language of the consolidating
supervisor or another language acceptable to the consolidating supervisor. The other documentation in the application should be in a language or languages agreed between the institution, the consolidating supervisor, and the host supervisors. Communication between supervisors should be in a language of mutual understanding, chosen on a bilateral basis. If documents need to be translated, supervisors will organise this in cooperation with the institutions.
2.2.1.3. The starting of the sixmonth period
72. The sixmonth period for making a determination on an application
shall begin on the date that a complete application is received by the competent authority referred to in Article 129(1). Specifically, the clock starts as soon as the supervisor has received an application that is complete with respect to the signatory, format, content, and minimum requirements set out by its consolidating supervisor, which will take into account the requirements set out in Section 2.2 of this paper.
73. The supervisors involved perform a preliminary assessment of the
entire application immediately upon receipt. If the application is complete in all essential aspects and does not raise any significant doubt or nonsatisfaction in this regard or with respect to the requirements mentioned above, the clock starts upon receipt. If the application lacks essential parts or is otherwise deemed incomplete, 9 Hereafter, any reference to the management body will have the meaning of management body as referred to in Article 11 of the CRD.

the supervisor will communicate this to the institution. Depending on the seriousness of the deficiencies, the applicant is either allowed to supplement the application or is asked to provide a new application at a later date. When the application is complete, the clock starts.
74. There is no provision under Article 129(2) to stop the clock once a
complete application has been received. However, a pause in the six month period may be acceptable if the applicant no longer meets the requirements for a complete application. If during its examination the supervisor discovers essential deficiencies concerning the completeness of the application, it may offer to suspend further examination of the application until the deficiencies of the application are corrected, as an alternative to rejecting the application.
75. The operation of the clock is the responsibility of the consolidating
supervisor. This includes promptly making any change in the status of the clock known to all involved parties, including the applicant. The timetables for the approval process should be planned and coordinated by the consolidating supervisor and agreed on by all the supervisors involved. Consolidating and host supervisors should aim at agreeing on plans which accommodate the needs for flexibility for all supervisors involved. This holds special importance where an entity in a host country is significant for the applicant or is considered of systemic importance by the host supervisor.
2.2.2. Supervisor’s Assessment
76. The supervisor has to assess whether or not he is satisfied that the
institution’s systems meet the standards listed in Article 84 in accordance with the requirements of Annex VII, Part 4 of the CRD and/or the qualifying criteria set out in Annex X, Part 3 of the CRD. This assessment does not necessarily have to begin only when an official application has been submitted, but could start in the pre application phase.
77. Before entering into the assessment of the details of the rating or
operational risk measurement systems, it is necessary for the supervisor(s) to form an opinion of the overall picture. The issues that should be analysed include, among others:

The suitability of the organizational structure, in terms of the
responsibilities and functions assigned to the different areas involved in managing, measuring, and controlling risks.
The sufficiency of the human and material resources assigned. · The practicality and feasibility of the implementation plan for
institutions adopting a phased rollout.
The group structure, including the legal entities within the group
(data, methodology, controls, etc.) and regulatory capital requirements.

78. In order for the IRB approach to be recognised for regulatory
purposes, it must be validated by the institution. The term ‘validation’ encompasses a range of processes and activities. For the IRB, this includes whether ratings adequately differentiate risk and whether estimates of risk components (such as PD, LGD, or CF) appropriately characterise the relevant aspects of risk. For the AMA, it includes the quality and soundness of the operational risk management processes and measurement systems. Validation has to be performed by the institution, and needs to take into account the specific purpose or purposes for which a rating system or an operational risk measurement system is being used. Supervisors use their own methods to assess the validation process, or certain parts of it. These methods may include offsite analysis or onsite missions, conducted by their own or external staff. When using the latter, supervisors should take care that no confidentiality issues /conflicts of interest will arise. Supervisors will pay special attention to the validation for regulatory capital purposes.
79. The institution’s validation consists of examining and reviewing all
the elements in the rating or operational risk measurement systems and controls, for every portfolio to which the IRB approach is applied and all operations relevant to the AMA, in order to verify that they:

Satisfy the use test.
Produce outputs suitable for all intended purposes, including
regulatory capital requirements.
Are suitable for the specific circumstances in which the models
are used (e.g., countries, size, and complexity of portfolios in the case of IRB, and business lines in the case of AMA).
Meet all other minimum regulatory requirements, insofar as
applicable.
80. The issues that supervisors are expected to assess can be broken
down into five phases: 10
1. Methodology and documentation.
2. Data quality. 3. Quantitative procedures.
4. Qualitative procedures.
5. Technological environment.
81. In assessing IRB applications, the issues are:
1. Methodology and documentation: Supervisors will examine and
assess the rating system methodology and the quality of internal documentation supporting the rating system. 10 The phases are numbered, suggesting a certain logical order, although in practice some phases will probably overlap.

2. Data quality: Supervisors will assess the quality of data and
databases being used for the development of the rating systems, in the rating assignment process, and in the estimation of risk parameters, along with any other databases needed to calculate minimum regulatory capital. This is to ensure the soundness of calibration and of the capital calculation. (The latter holds true also for the other four items mentioned here.)
3. Quantitative procedures: Supervisors will assess the quantitative
information provided by the applicant relating to performance, validation, and monitoring of rating systems. Supervisors may ask applicants to undertake additional analyses and may undertake quantitative procedures of their own.
4. Qualitative procedures: This phase has two objectives. The first is
to perform an overall assessment of the quality of the internal model. This involves integrating all the information generated in the previous phases and discussing with the applicant the appropriate interpretation of the data with respect of the quality of the rating system. The second objective is to assess compliance with the qualitative minimum regulatory requirements. Supervisors will assess the use test, internal governance, the role of senior management, the adequacy of internal controls, and other areas in order to assess the qualitative aspects of the rating system that have a bearing on the approval and to check for compliance with the minimum qualitative requirements.
5. Technological environment: Supervisors will evaluate the
reliability and integration of systems, the functionality of the model, and the quality of information provided by systems.
82. In assessing AMA applications, the issues are:
1. Methodology and documentation: Supervisors will examine and
assess the risk measurement methodology and the quality of internal documentation supporting the methodology.
2. Data quality: Supervisors will assess the quality of data and
databases being used in the risk measurement system, including the four AMA elements (see paragraph 514 of these Guidelines). This is to ensure the soundness of the data set used for estimation and also the correctness of the capital calculation.
3. Quantitative procedures: Supervisors will assess the
reasonableness and robustness of the assumptions and techniques used to model internal data, integrate internal and external data, generate scenario data, and incorporate business environment and internal control factors into the operational risk measurement system. Supervisors will also assess some of the issues linked to parameter estimation and validation. Supervisors will discuss with applicants the appropriate interpretation of the

data with respect of the quality of the risk measurement system. Supervisors may ask applicants to undertake additional analyses and may undertake quantitative procedures of their own.
4. Qualitative procedures: Supervisors will assess the use test,
internal governance, the role of senior management, the adequacy of internal controls, and other areas in order to assess the operational risk management processes and the qualitative aspects of the risk measurement system that have a bearing on the approval.
5. Technological environment: supervisors will evaluate the
reliability and integration of systems, the functionality of the model, and the quality of information provided by systems.
83. To make the supervisor’s assessment more efficient, the
supervisor(s) may also rely on work undertaken by the institution's own resources (Internal Audit, the unit responsible for internal validation of models, model users) or external resources (e.g. external auditors) to facilitate some tasks, or even some phases. Without a previous validation carried out by the institution, supervisors cannot perform an assessment that approves the use of the AMA or IRB approaches with a reasonably acceptable supervisory risk. For this reason, validation by the institution becomes a prerequisite for assessment by supervisors.
2.2.3. Decision and permission
84. After the supervisors have made their assessment, a decision has to
be made whether or not to approve the use of the IRB or AMA approach for regulatory purposes. Article 129(2) of the CRD provides that when an application for the permissions referred to in Articles 84(1), 87(9) and 105 is submitted by an EU parent institution and its subsidiaries, or jointly by the subsidiaries of an EU parent financial holding company, the competent authorities shall work together, in full consultation, to decide whether or not to grant the permission sought and to determine the terms and conditions, if any, to which the permission should be subject. Furthermore, within six months, the competent authorities shall do everything within their power to reach a joint decision on the application. This joint decision shall be set out in a document containing the fully reasoned decision.
85. It is important to distinguish between ‘decision’ and ‘permission.’ The
decision is the final act in the approval process, as a result of the consultation between the competent authorities. The permission is the legal form by which this decision, determinative and legally binding on the competent authorities, comes into force in their respective legislation. The permission is the transposition of the full content of the decision under the standing legal provisions of each country.

A joint decision could contain groupspecific or nationspecific terms
and conditions. Another type of joint decision could be the dismissal of the application. It is also possible for permission to be granted without any terms and conditions. The final responsibility for the decisionmaking process rests with the consolidating supervisor. The procedural law of the consolidating supervisor’s legislation determines the proceeding and the legal form of the decision which shall be provided to the applicant.
The CRD requires the document to contain the fully reasoned
decision. If the decision is made subject to certain terms and conditions, these need to be clearly articulated in the document. It may also cover recommendations for the possible improvement of any deficiencies revealed during the assessment process.
The justification of the decision should contain references to both the
legal framework, which generally stipulates the supervisor’s assessment, and the application document, which effectively triggers the approval process in specific cases. Although not explicitly required by the CRD, certain issues will naturally form part of the decision document. These might include (but are not limited to) the following:
a. Commentary on the application, with particular regard to the scope of the application and the scope of the models themselves. b. Assessment of the application, in particular, with reference to the assessment against the CRD’s requirements.
c. Milestones and recommended or mandatory remedial action,
possibly expressed as terms and conditions to the decision, as well as suggestions for the possible improvement of any deficiencies.
The transposition of the decision will take place in accordance with
the national provisions in each country and should take place shortly after the decision has been taken. In reaching a decision, the consolidating supervisor has the responsibility for coordinating a timeframe for implementing the decision, based on information on national transpositions provided by the supervisors.
In accordance with Article 129(2), supervisors are required to
implement the decision, and they carry full responsibility for doing so within the agreed time frame. The agreed time frame should be included in the decision document. The same holds true for the agreed arrangements for dealing with portfolios as they are rolled out, including the requirements with respect to the use test (see sections 3.1.1., 3.2. and 4.3.1. and especially paragraphs 111 and 490 of these Guidelines).
The single document decision shall be transposed in a fully binding
manner by national permissions. The decision is legally binding for the competent authorities involved. The Article 129(2) process ends when the decision and permission are provided to the applicant.
2.2.4. Change in the consolidating supervisor
Crossborder mergers and acquisitions and other structural changes
may have an impact on planning the approval process, or even on an approval process that is already underway. In the latter case, such changes could imply a change in the responsible consolidating supervisor. In such cases:

It is essential that the consolidating supervisor has all relevant
information on possible structural changes of the group at the beginning of the approval process. Information on mergers and acquisitions and other structural changes is typically exchanged during the ongoing homehost supervisory process, but it is useful to update this information at the beginning of the approval process.
In a changing environment, effective consultation with all relevant
supervisors at a very early stage is important before detailed stepbystep planning of the approval process.
In assessing the application, supervisors shall identify anticipated
changes in the consolidating supervisor and/or host supervisors which will impact on the approval process.
If it is foreseeable that a change of the consolidating supervisor
will take place during the approval process, the relevant supervisors shall take these changes into account when planning the assessment process (i.e., communication, allocation of tasks, etc.).
A new approval process shall not be started after a change in
consolidating supervisor. However, crossborder mergers and acquisitions of institutions, in particular, may justify modifying the approval process (see also sections 3.1.1. and 4.3.1.).
A fully reasoned decision to implement IRB or AMA approaches
shall remain valid even after a change in consolidating supervisor. · The legal responsibilities and duties of competent authorities laid down in Article 129 shall not be altered in the event of structural changes in crossborder groups. Furthermore, the guidelines for cooperation between home and host supervisors shall be implemented, even in such a changing environment.
2.2.5. Postapproval process

Once the approval process has ended, supervisors have to monitor
the rollout plan and any terms and conditions to which the approval was subject. If, after the approval, a new decision (but not necessarily a new approval process) should become necessary due to the fulfilment of or changes in the rollout plan, national authorities

will cooperate in the spirit of Article 129(2). The same holds true for the monitoring of terms and conditions associated with the approval.
94. After the rollout period, the fulfilment of terms and conditions
attached to the permission shall be monitored in consultation between consolidating and host supervisors in line with the Guidelines for Cooperation between Home and Host Supervisors.
95. A proposal to revoke an Article 129(2) decision can be made by the
consolidating supervisor, a host supervisor, or the institution itself. The Article 129(2) decision can be revoked by joint agreement of the consolidating supervisor and the host supervisors, or, in the absence of an agreement, by the consolidating supervisor alone. A host supervisor cannot revoke an Article 129(2) decision acting on its own.
2.2.6. Transition period
96. At the date of publication of this paper, the CRD has not yet come
into force. Therefore, formal applications (in the sense that they refer to a legal basis that has already been implemented in national legislation) are not yet possible. However, in order to smooth the application process and to allow substantive early consideration of applications in order to make it easier for institutions to meet the requirements to use the IRB approach from 1 January 2007 (in the interest of both the industry and the supervisory authority), some countries have introduced arrangements under which preliminary (also called early or informal) applications can be made, prior to the CRD being transposed into national legislation. Such preliminary applications cannot be considered formal applications at any time prior to the transposition of the CRD; nor can decisions reached on them be considered formal decisions.
97. Other countries do not accept preliminary applications, due to
national legal restrictions. However, as mentioned in section 2.1. of this paper, there will be an intense preapplication period in all countries to ensure an efficient process once the CRD is transposed into national legislation.
98. The same standards for supervisory cooperation and the same
minimum requirements for applications, assessments, and decisions will be applied during the transition period as for later formal applications. For example, early applications should meet the minimum content, signatory, and language guidance described above.
99. Supervisors accepting preliminary applications before the provisions
of the CRD enter into force will voluntarily operate according to most of the elements of Article 129(2) for processing these applications. Specifically:

They will accept joint applications as described in Article 129(2).
They will do everything within their power to reach agreement on
the decision.
A fully reasoned decision will be provided to the applicant.

Other guidelines relating to the approval process will be observed. For example, early applications should meet the minimum content,
signatory, and language guidance described above.
Once the CRD comes into force, institutions that have made
preliminary applications may be asked to submit a formal application under Article 129(2). In that case, supervisors will accept the cover letter by itself as an application, with cross references to the supporting material submitted previously in connection with the informal application. Where a decision has already been reached on an early application, and there is no new information that would lead supervisors to reconsider their decision, the decision reached previously will be treated as determinative and binding on supervisors.

ANNEXES I and II
ANNEX I
Practical framework: model approval
Step 1 – Preapplication
Crossborder implications Tasks or considerations for the consolidating supervisor Tasks or considerations for the host supervisor

The group has
exploratory discussions with individual supervisors about the use of models. ÿ There is no formal requirement that other supervisors need be informed at this stage. However, supervisors are advised to communicate the outcomes of their exploratory discussions. ÿ There is no expectation that other supervisors need be informed at this stage, although, at a minimum, informal contact with the consolidating supervisor would be advisable.
The group expresses a
clear intention to move towards the advanced approaches.
ÿ The consolidating supervisors should advise the relevant host supervisors. ÿ Inform the consolidating supervisor that local institutions are contemplating the use of internal models.
Consultative framework ÿ Plan and organise a consultative framework to
include:
A communication strategy for all supervisors, and A mechanism enhancing a common agreement among supervisors.
Understanding the extent
and nature of the group's intentions
ÿ Discuss with the group the intentions to implement an internal models approach. ÿ Produce a preliminary assessment of the group’s proposals, including:
The readiness of the group, and
The adequacy of plans. ÿ Communicate the salient features to the supervisors likely to be affected by the group’s intentions, and inform other supervisors of the group’s plans in accordance with the general communication strategy. ÿ Collate the concerns and issues of other supervisors with the proposed approach and produce a summary of the principal issues. ÿ Communicate concerns and issues with the proposed approach. ÿ Need to identify potential disagreements so that supervisors can have an early plan to address.
Supervisory plan of
action
ÿ Draw up the supervisory plan in consultation with other relevant supervisors and in cooperation with the group. The plan should include:
Identification of significant models and proposed rollout plans; The allocation of workload with respect to the significant models; and Priority issues;

A timetable;
Standards for judging the completeness and accuracy of the application; Standards for reaching agreement on a final decision; ÿ Communicate the salient points of the supervisory plan to the group. Step 2 – Formal application Crossborder implications Tasks or considerations for the consolidating supervisor Tasks or considerations for the host supervisor

Formal application
submitted
ÿ Determine promptly if the application is obviously incomplete (e.g., significant omissions of specified information). If so:
Communicate to the group that the application is incomplete, setting out the reasons why and what further information the group may need to submit. Inform the other supervisors that an application has been received, that it is incomplete, and that the group has been asked to provide further information.

ÿ If not, inform the other supervisors promptly that an application has been received and distribute the application form, in whole or part, as previously agreed. ÿ Assess the completeness and accuracy of the application against preagreed standards, and in consultation with the host supervisors with respect to local models. ÿ Communicate the final results of the assessment to the group and to other supervisors. If the application is found to be incomplete, communicate that finding to the group, setting out the reasons why and what further information the group may need to submit. If the application is complete, inform the other supervisors that the sixmonth period has started, and initiate the next step in the process. ÿ Assess those aspects of the application that the host is best able to comment on (e.g., relating to locally developed models) and communicate the results of the assessment to the consolidating supervisor. Step 3 – Model assessment Crossborder implications Tasks or considerations for the consolidating supervisor Tasks or considerations for the host supervisor

Performing the work ÿ Lead the assessment of centralised models and
some local models (where agreed), the governance of the group, the role of the Board and Senior ÿ Lead the assessment of local models (where agreed), the governance of the local entities, and

Management, and centralised risk management functions. ÿ Assess compliance with the Use Test. ÿ Assess selfassessment. ÿ Assess the rollout plan, if applicable local risk management functions. ÿ Assess compliance with the Use test with respect to local models

Reporting the results of
work performed
ÿ Collate progress reports and assess the overall level of progress. ÿ Assess whether the supervisory plans need to be revised. ÿ Report overall progress to host supervisors in accordance with the agreed supervisory plan. ÿ Provide the consolidating supervisor with progress reports on the work in accordance with the agreed supervisory plan. ÿ Inform the consolidating supervisor immediately in the event of:
Significant failings identified in the model application process. If there is a risk that deadlines will not be met. Step 4 – Decision Crossborder implications Tasks or considerations for the consolidating supervisor Tasks or considerations for the host supervisor
Agreement of decision ÿ Agree on decisions. ÿ Agree on any terms and conditions to be attached to
ÿ Agree on decisions. ÿ Agree on any terms and conditions to be attached to

the decision. ÿ Agree on the process for handling rollout. ÿ Agree on the timeframe for implementing the decision. the decision. ÿ Agree on the process for handling rollout. ÿ Agree on the timeframe for implementing the decision.

Communication of
decision
ÿ Draw up a fully reasoned decision document in accordance with agreed principles for convergence. Step 5 – Implementation Crossborder implications Tasks or considerations for the consolidating supervisor Tasks or considerations for the host supervisor
Implementation of
decision
ÿ Implement the decision in accordance with national legislation. ÿ Implement the decision in accordance with national legislation.
Planning, assessing, and
reporting
Follow similar procedures to step 3. Follow similar procedures to step 3. Step 6 – On going review
The ongoing review of the continuing appropriateness of the models in use shall be conducted within the Pillar 2 framework. The
framework for supervisory cooperation should follow the steps outlined above.

1.1.
Rollout (post approval phase)
Discuss and communicate intentions and standards for use of advanced approaches Preliminary contact (pre application phase) Formal application Assessment of application Decision 6 months (approval) Group Consolidating supervisor Host supervisor

Preliminary assessment of adequacy
and completeness of proposals · Develop communication and consultation strategies
Develop approaches for internal
models
Responsible for overall
coordination of assessment · Assess central models and risk management functions
Assess local models and risk
management functions
Submit application
Communicate application details
Communicate decision
Consultation assessment and feedback of findings Ongoing dialogue Agree decision
Draft final
decision documentation
Facilitate assessment
Ongoing dialogue
Ongoing review as part of pillar 2
Develop consultation process, work plan and standards Consultation assessment and feedback of findings
Assess
completeness and accuracy
Annex II

3. Supervisor’s assessment of the application concerning the minimum
requirements of the CRD – Credit Risk
3.1. Permanent Partial use and rollout
102. Although, according to the CRD, once an institution decides to apply the
IRB approach, all exposures should be covered by this approach, in practice two facts are taken into account:

Institutions may not be ready to apply the IRB approach at the time
the CRD is legally adopted. · The extension of rating systems to some parts of their business may be unduly burdensome and may not create value.
3.1.1. Rollout
103. Article 85 of the CRD gives institutions the possibility of implementing the
IRB Approach sequentially across different exposure classes, while Article 89 permits them to exempt certain exposure classes permanently. However, supervisors would expect institutions already to be using the IRB approach for at least a portion of their business when they apply for approval to use the IRB approach for regulatory purposes.
104. As a general principle, the rating systems used should cover all exposure
classes (Article 85(1)). However, it is likely that only some exposure classes will be covered when the formal application is submitted or after the initial approval to use the IRB has been granted. Supervisors will examine the institution's implementation plan to ensure that it is credible and feasible with regard to initial coverage and the pace of rollout.
105. Supervisors may decide to adopt quantitative or qualitative rules. Under a
quantitative rule, a certain percentage of an institution’s riskweighted exposure amounts and/or exposure value would have to be covered in order to start the approval process. Under a qualitative rule, exposure classes or portfolios that represent the core business of the institution should be covered. Although supervisors will apply different approaches (qualitative or quantitative) and use different thresholds, it can be stated as a common rule that the lower the threshold, the shorter the time frame for the rollout in order to achieve a sufficient degree of representativeness.
106. The institution’s rollout policy should indicate at least the time horizon
and the rollout sequence. The rollout plan should have a definite time horizon. Article 85(2) requires that IRB implementation “shall be carried out within a reasonable period of time.” This period should reflect the institution’s realistic ability to convert to the IRB Approach and the supervisors’ expectations that the institution’s core business and main credit risk drivers will be covered by the IRB Approach as quickly as possible.

107. The time horizon should be short enough to avoid prolonging IRB
applications unduly, and long enough to ensure the quality of data, methodology, and output. Since supervisors must retain discretion to take account of certain special features of the institutions in their member state, the setting of a common, EUwide maximum time frame does not appear useful.
108. The sequence of exposure classes in the rollout of the IRB approach can
be chosen by the institution or set according to a rule specified by supervisors. In general, the sequence should be the institution’s choice, relying on the institution's best efforts. If the sequence is determined by supervisors, the more important portfolios (i.e., portfolios that represent the institution’s core businesses) should be rolled out first. In any case, institutions are expected to take the importance of the exposure classes into account, and this will be part of the supervisors’ decisionmaking.
109. Since the application, if accepted, contains a complete rollout plan, no
further Article 129 application will be needed as each portfolio is rolled out, with the possible exception of a merger or acquisition (see below). (See also section 2.2.5. on the postapproval process.)
110. Recognising that it is the responsibility of institutions to meet the
minimum requirements, institutions should carry out a selfassessment against the requirements of the CRD before rolling out exposure classes. National supervisors will monitor an institution’s progress in implementing its approved rollout plan. Supervisors may wish to take additional steps to satisfy themselves that the minimum requirements are met before each step of the rollout can be implemented and used for the calculation of the capital requirements.
111. As stated in paragraph 109 of these Guidelines, where an institution
makes use of the rollout, there will be no need for a fresh Article 129 process as portfolios are rolled out. During the rollout period, supervisors will continue to cooperate in the spirit of Article 129, as stated in paragraph 89. Some supervisors may also introduce supplementary binding milestones during the rollout period (for example, a certain IRB coverage ratio must have been achieved after the first half of the rollout period). In order to satisfy themselves that minimum standards continue to be met as portfolios are rolled out, supervisors envisage three available options, and will specify which option or which mixture of options is being used in the decision document; conditions may need to be attached to the decision in order to give effect to the option or options selected. The three options are:
1. Relying on normal supervisory activity to verify that minimum
standards are met. Although formal exante notification requirements other than the rollout plan will not be introduced, institutions will be expected to keep supervisors informed of plans and developments in their risk measurement and management practices. Although an ex ante assessment by supervisors will not be a formal requirement, supervisors may nevertheless choose to undertake an assessment of the rating system in the period before the institution starts to use it for regulatory capital purposes.

2. Asking institutions to notify supervisors on a timely basis when they
are ready to use a rating system for the calculation of the regulatory capital requirements for an additional exposure class or business unit as stated in the rollout plan. As with (a), although an exante assessment by supervisors will not be a formal requirement, supervisors may nevertheless choose to undertake an assessment of the rating system in the period before the institution starts to use it for regulatory capital purposes. Or,
3. Asking institutions to notify supervisors on a timely basis of their
intention to roll out to an exposure class. Supervisors may additionally require institutions to receive explicit permission before starting to use the rating system for this exposure class. In this case an exante assessment by supervisors may be required prior to permission being granted.
112. Changes in the rollout plan could be allowed when significant business
environment changes take place, but should be well justified by the institution. Two examples that could justify altering an institution’s partial use or rollout policy are changes in strategy and mergers and acquisitions. A change in strategy could result from changes in shareholders or management, or from a new business orientation. In either case, the time horizon for rollout should remain the same unless there is good reason for delay, but the rollout sequence can change. 113. A merger or an acquisition is considered an important event that is likely to call for modifying the institution’s partial use and rollout policies. Two merger or acquisition situations can be distinguished: first, where an IRB institution acquires a nonIRB institution, and second, where a nonIRB institution acquires an IRB institution. In the first case, the IRB institution may be asked to submit a new Article 129 application with a new partial use and rollout policy, or it may be asked to submit a plan for bringing the entire institution into compliance with the CRD. The second case is more difficult, since the acquiring institution does not have IRB permission, and some requirements, such as senior management understanding, may not be met. The acquiring institution would normally be asked to make a new Article 129 application.
114. The rules and criteria for rollout plans apply to any step towards the IRB
Approach. In practice, this means that an institution planning to roll out the IRB approach in two steps for any of the exposure classes mentioned in Article 87(9) (central governments and central banks, institutions, and corporates) – i.e., moving first from the Standardised Approach to supervisory estimates of LGDs and CFs, and subsequently from supervisory estimates of these parameters to own estimates – can use the whole rollout package for each step. Such an institution would, for example, have a double timeframe for moving to the IRB approach that includes the use of own estimates of LGDs and Conversion factors. However, it is expected that the quantitative aspects in such a twostep rollout would be reduced due to potential increased skills or gains of scale within institutions.
3.1.2. Permanent partial use

115. Article 89(1)(a) and (b) provides that institutions that are permitted to use
the IRB Approach may be permanently exempted from applying it to the ‘institutions’ and/or ‘central governments and central banks’ exposure classes – i.e., they apply the Standardised Approach to these exposure classes instead – if the number of material counterparties in these exposure classes is limited and it would be unduly burdensome for the institution to implement a rating system for these counterparties. Exemptions are subject to the approval of the competent authorities; the riskier the institution’s exposure classes, the more supervisors should encourage and expect it to adopt the IRB approach.
116. It is the institution’s responsibility to justify permanent exemptions. The
justification should explain why the institution feels it unduly burdensome to implement a rating system, how the exposures fit its business and strategy, and whether the exposures fit the scope of its core activities.
117. The absence of default data is clearly a key determinant of whether the
IRB approach can be adopted, but does not by itself prove that it would be unduly burdensome to implement a rating system (see section 3.5.3. on lowdefault portfolios and 3.4.4. on external data) Undue burden could be (but does not necessarily have to be) evidenced by comparison with the business and strategy of the institution.
118. Article 89(1)(c) provides that exposures in nonsignificant business units
and exposure classes that are immaterial in terms of size and perceived risk profile can also be permanently exempted from the IRB approach. The term ‘business unit’ may refer to separate organizational or legal entities, business lines, or delimitable homogeneous groups of exposures within a group (these may often be identified separately in the institution’s internal management information systems), or to other types of entities. Geographical location can also be a criterion: a foreign subsidiary or branch or a business conducted in a specific region can sometimes (but not always) be considered a separate business unit. In borderline cases, the goal of this rule should be kept in mind: to allow units to stay in the Standardised Approach if they are technically, geographically, or organisationally separate from other parts of the institution (or group), and implementation for them would be disproportionately costly, or they are small and have customers for which the rating systems of the group are not meaningful, own rating systems cannot be developed, or for which the implementation of own rating systems is too expensive.. An example of a delimitable group of exposures is the following. A business unit may be welldefined by a certain type of facilities. Those facilities form a certain type of exposures. Consequently, if a subportfolio is welldefined as a business unit formed by a certain type of facilities that form a certain type of exposures and that are homogeneously managed, partial use for this subportfolio is possible insofar as an institution can demonstrate that this subportfolio is not significant.
119. ‘Immaterial’ should refer to both the size and the perceived risk profile of
the exposure classes. Exposure value could be used as the indicator of size, and riskweighted exposure amounts for credit risk (calculated according to Basel II 11 ) as the indicator of risk profile. Alternatively, 11 For those exposures that should remain in the Standardised Approach, the capital requirement is calculated according to the Standardised Approach.

supervisors may accept a single measure of both the size and the perceived risk profile.
120. The basis of the calculation is total on and offbalance sheet assets. The
threshold should be applied at the level of the institution or group that applies for IRB. No further restrictions should apply to individual institutions or subgroups within a group.
121. Materiality can be measured:

at the aggregate level, · at the level of the individual portfolio or business unit, or
at both levels.

The aggregate measurement is mandatory, to ensure that the sum of all
exposures in immaterial exposure classes and nonsignificant business units does not lead to unacceptably high levels of risk and size in the part remaining in the Standardised Approach. An additional measurement at the individual level can be regarded as appropriate by national supervisors if the aggregate threshold would allow a single business unit to account for the entire amount of exposures remaining in the Standardised Approach due to immateriality.
Some supervisors may find it useful to set minimum levels of coverage of
IRB portfolios. For others, the qualitative assessment is crucial, meaning that the reasons for permanent exemption should be fully set out and credible. National supervisors should take into account the interdependence between minimum thresholds and the granularity of the definition of business unit.
Competent authorities will pay particular attention to preventing
institutions from exploiting this rule in order to exempt highrisk exposures from the IRB approach.
The institution or group which is applying the IRB approach is responsible
for monitoring compliance with the materiality criterion. Institutions should have systems and procedures in place that monitor materiality issues in a timely and appropriate manner. If materiality thresholds (if any) are exceeded, the institution should notify the supervisor and present an appropriate remedial action plan over a reasonably short timeframe to be agreed with supervisors. Particular concern should be given to cases where materiality thresholds are breached deliberately (for example, following a strategic decision to expand in a particular sector). In such cases, a roll out policy prior to actual expansion should be in place.
Exposures for which the institution plans to use permanent partial use
according to Article 89(1) for reasons other than immateriality (Article 89(1)(c)) are exempt from the calculation of the materiality threshold (i.e., they are excluded from both the numerator and the denominator of the threshold). This applies mainly to the following exposure classes.

Institutions (limited number of material counterparties).
Central governments and central banks (limited number of material
counterparties).
Equity exposures exempted from the requirement to use IRB.

Institutions intending to use the Slotting Approach for the Specialised
Lending subexposure class are allowed to add these exposures to the part of their portfolio which is treated according to the most demanding IRB approach for the purpose of calculating their IRB coverage ratio.
3.2. Use test
A fundamental requirement for an institution to qualify for the IRB
approach is that it demonstrates to its supervisors that the information used in or produced by its rating system to determine regulatory capital requirements is also used in the course of conducting its regular business, particularly in risk management.
Specifically, Article 84(2)(b) states that the internal ratings and default
and loss estimates used in calculating capital requirements, and the associated systems and processes, should play an essential role in the institution’s risk management and decisionmaking process, and in its credit approval, internal capital allocation, and corporate governance functions.
Article 84(3) states that an institution applying for the use of the IRB
Approach shall demonstrate that it has been using rating systems, for the IRB exposure classes in question, that are broadly in line with the minimum requirements for internal risk measurement and management purposes, for at least three years prior to its qualification to use the IRB Approach. Similarly, Article 84(4) states that an institution applying for the use of own estimates of LGDs and/or conversion factors shall demonstrate that it has been estimating and employing own estimates of LGDs and/or conversion factors in a manner that is broadly consistent with the minimum requirements for use of own estimates for at least three years prior to qualifying to use own estimates of LGDs and/or conversion factors for regulatory purposes (see also paragraph 151 of these Guidelines).
For institutions applying for the use of the IRB Approach before 2010, the
threeyear use requirement prescribed in Article 84(3) may, until 31 December 2009, be reduced to a period not shorter than one year, subject to the approval of competent authorities. Similarly, for institutions applying for the use of own estimates of LGDs and/or conversion factors, the threeyear use requirement prescribed in Article 84(4) may, until 31 December 2008, be reduced to two years.
Article 84(2)(b) implies that rating systems, ratings, and default and loss
estimates designed and set up with the exclusive aim of qualifying for the IRB, and used only to produce the data necessary for the IRB approach, are not allowed. While ratings and default and loss estimates must play an essential role in the relevant processes of the institution, this does not mean that they must in every case be the exclusive information or the final parameters used for internal purposes such as pricing. Nevertheless,

institutions should be required to demonstrate that those ratings and estimates play an essential role in the processes and functions listed in
Article 84(2)(b), and they should indicate where different final parameters
are used internally. If institutions use different estimates for the calculation of risk weights and internal purposes, this shall be documented and their reasonableness shall be demonstrated to the competent authority (Annex VII, Part 4, Paragraph 55 of the CRD).
133. Supervisors should distinguish between two aspects of the use test when
assessing an institution’s compliance with Article 84(2)(b):

scope
use of data for internal purposes
Scope

An institution’s rating systems and processes and its internal ratings and
default and loss estimates should be an integral part of its business and risk management culture.
Institutions should make effective use of internal ratings and the resulting
risk parameters. Ratings and risk parameter estimates used in calculating capital requirements must play an essential role in the riskmanagement and decisionmaking process, and in the credit approval, internal capital allocation, and corporate governance functions of the institution. If not all these processes and functions are based solely on ratings and risk parameter estimates used in calculating capital requirements, at least an effective and material part of them should be, so that the ratings and risk parameter estimates used in calculating capital requirements have a substantial influence on the institution’s decisionmaking and actions. Institutions will ensure that the use of these data is not marginal, and will assess the validity of differences, e.g., between a pricing PD and the rating PD. Supervisors can stress that risk management elements such as ratings or internal reporting need to be strongly linked with ratings and risk parameter estimates used in the calculation of capital requirements, while for some other functions (such as pricing) they could be less strongly linked.
‘Playing an essential role’ does not mean that the data/parameters used in
calculating capital requirements need to be identical to, or a linear and homothetic function of the data used for credit management. It means that there is a strong relationship between the data/parameters used in calculating capital requirements and the data used for credit management. If institutions use different estimates for the calculation of risk weights and internal purposes, this shall be documented and their reasonableness shall be demonstrated to the competent authority (Annex VII, Part 4, Paragraph 55 of the CRD).
Institutions should identify and describe the use they make of internal
ratings, relevant risk parameters, and all related systems and processes. They should provide such documentation to their supervisor so that the impact on the institution’s operations can be assessed. Such documentation should be updated regularly by (for example) the credit

risk control function, and reviewed by internal audit or another comparable independent audit unit.
138. Prior to granting permission for the use of the IRB approach, supervisors
should check the total capital requirements calculated based on all the approaches/methods/rating systems that the institution intends to use at the time of the initial permission to use the IRB approach. An analogous check should be performed prior to granting permission to use additional approaches, methods, or rating systems, subsequent to the initial permission to use the IRB approach. The purpose of these checks is to ensure that the institution's systems for managing and rating credit risk exposures are sound and implemented with integrity. Institutions will be required to report their total capital requirements to supervisors in order to obtain the respective permission. Some supervisors might retain a limited reporting but would be keen on checking its accuracy, others would prefer a more extended running of reporting lines. Use of data for internal purposes
139. It is not always necessary that data used in calculating capital
requirements serve directly as the only information or the final parameters for all internal purposes. However, any differences should be assessed carefully by supervisors. The use for internal purposes of the data used in calculating capital requirements should be as comprehensive as necessary to ensure that those data play an essential role in the processes and functions listed in Article 84(2)(b).
140. Data categories should be distinguished. Inputs in the form of data
published in financial statements, for example, have to be distinguished from estimated data which result from the institution’s calculations. All of the institution’s estimates of risk parameters should start with inputs, and those inputs should be essentially the same whether used for credit management purposes or for regulatory calculation purposes.
141. The rating systems used for rating obligors and exposures and for
estimating risk parameters used in the calculation of capital requirements must also play an essential role in the relevant processes and functions of the institution. Moreover, the structure and design of the rating systems and capital calculation systems should not be fundamentally different, whatever the purpose, internal or regulatory.
142. Any differences between the ratings and risk parameter estimates used in
calculating capital requirements and the final parameters used internally should rely on a well documented rationale. There should be a robust audit trail, adhering to a specified internal policy. The purpose of this policy should be to assess the materiality of differences and whether they lead to conservatism or relaxation in capital adequacy. When pricing margins are calculated using nonIRB data, it would be useful for the institution to sort out both types of margins calculations and include conservatism in the calculation of the regulatory capital requirements. The more numerous the differences between the regulatory and the internal systems, the higher the internal governance standards should be.

For the purpose of the use test, institutions using economic capital models
should provide explanations about differences in the data and parameters used in the economic capital model and those used to calculate regulatory capital requirements.
In areas relating to the credit risk assessment process (ratings, etc.) the
final parameters used for internal purposes and the data used in calculating capital requirements are expected to be in line. On the other hand, some flexibility is seen as possible for pricing and internal capital allocation. No internally used final default or loss estimate should render the estimate used in the calculation of capital requirements implausible.
Inputs identified as major for credit risk selection, estimation, and/or
management for internal purposes should not be set aside for assigning ratings and estimating risk parameters used in the calculation of capital requirements. The source of information and related analysis should not be missing from the criteria used for regulatory rating and PD estimation purposes.
Special attention will be given to LGDs and CFs. These parameters must
have been estimated and used in a broadly consistent manner for three years prior to permission being granted. This period may be reduced to no less than two years until 31 December 2008, during the experience test (see below), and during the use test in a fully consistent manner for a period appropriate to ensure accuracy and consistency of those estimates according to Article 84(2) (b) before their usage for calculation of regulatory capital requirements can be validated.
The model(s) should be consistent with the institution's strategy and
technology plans. Risk parameter estimates and modelling should be as accurate as possible, reflecting the different types of exposures in portfolios and subportfolios. The institution may have to develop various rating systems, and in such cases the use test should be applied accordingly.
Many institutions use master scales for internal risk management. While
supervisors recognise their usefulness for this purpose (ensuring equivalent risk categories across portfolios), the correct calibration of each individual rating system is more important than their link to the common master scale, as the capital requirements depend on the correctness of this calibration.
Strategic plans should provide for extensive training to help the
institution’s personnel, including senior management, understand the institution’s rating model(s). The complexity of the model(s), the internal and external processes used by the institution to operate the model(s), and how the ratings produced should be used need to be well understood. Efforts made to implement the CRD are to be assessed from this perspective, particularly when institutions use statistical models to assign ratings and estimate risk parameters. The effective operation of models has significant human resource and technology implications which should

be coordinated by a strategic plan that takes into account the impact of the model on the various functional areas of the institution. Experience test
150. Article 84(3) and (4) of the CRD requires at least three years prior use of
rating systems that are broadly in line with the minimum requirements of the CRD before regulatory use is authorised (experience test).
151. Until 31 December 2009, the threeyear period can be reduced to no less
than one year for institutions applying for the use of an IRB approach before 2010. This provision applies to the experience test for rating systems; it also refers to the retail exposure class. For institutions applying for the use of own estimates of LGDs and conversion factors for the central governments and central banks, institutions, and corporate exposure classes, this period can, until 31 December 2008, be reduced to no less than two years (experience test with own estimates for LGDs and conversion factors for nonretail exposures).
152. The experience test under Article 84(3) and (4) has a more restrictive
scope than the use test. It only refers to processes and functions relating to risk measurement and management purposes and requires rating systems only to be broadly in line, and estimates only to be broadly compliant with the minimum requirements. The use test covers more processes and functions, and ultimately requires the complete rating system to be used for the IRB approach. In the experience test, the length of prior use is considered key, because it takes some time for an appropriate and homogenous use to be reached.
153. Supervisors will expect a good mix between scope, experience test, and
internal use of data. This usetest tradeoff is to be reached prior to implementation of an IRB approach for a particular type of exposure.
3.3. Methodology and documentation
3.3.1. Assignment to exposure classes
154. The CRD accords preferential capital treatment to certain types of
exposures, especially the Retail (including the Qualifying Revolving Retail) exposure class. To avoid regulatory arbitrage, supervisors will therefore carefully assess institutions’ assignment of their exposures to the respective exposure classes.
3.3.1.1. Retail exposure class
3.3.1.1.1. Individual persons and SMEs
155. The retail exposure class includes exposures to individual persons and
small and medium sized entities (SMEs). It is important to distinguish between SMEs in the retail exposure class and SMEs in the corporate exposure class. Within the retail exposure class, individual persons need to be distinguished from SMEs, as in the latter case the exposure must not

exceed EUR 1 million in order to be able to be assigned to the retail exposure class. The institution should take reasonable steps to verify that the EUR 1 million criterion is met.
156. Article 86(4) of the CRD lists four criteria, all of which must be met in
order to assign an exposure to the retail exposure class:
(a) they shall be either to an individual person or persons, or to a small or medium sized entity, provided in the latter case that the total amount owed to the credit institution and parent undertakings and its subsidiaries, including any past due exposure, by the obligor client or group of connected clients, but excluding claims or contingent claims secured on residential real estate collateral, must not, to the knowledge of the credit institution, which must have taken reasonable steps to confirm the situation, exceed EUR 1 million; (b) they are treated by the credit institution in its risk management consistently over time and in a similar manner; (c) they are not managed just as individually as exposures in the corporate exposure class; (d) they each represent one of a significant number of similarly managed exposures.
157. To comply with Article 86(4)(a) of the CRD, institutions should have
internal criteria for distinguishing individual persons from SMEs. If an entity is separately incorporated, this should be seen as strong evidence that the entity is to be regarded as an SME. Other criteria could depend on how the institution manages its loans. For example:
a. If the institution manages its retail exposures on a transaction basis, the criterion should be the purpose of the loan. In this case, only loans to natural persons for noncommercial purposes should be regarded as exposures to individual persons. b. If the institution manages its retail exposures on an obligor basis, it needs a consistent rule on how to distinguish clients. One option could be to classify a client as an SME if the majority of his or her income is generated by selfemployment. Another possibility is to treat any entity that is not incorporated as an individual person.
158. To a certain extent, the EUR 1 million threshold can be handled flexibly. In
particular, institutions should distinguish between temporary and permanent violations. a. Temporary violations: This refers to situations where the threshold is exceeded only temporarily due to shortterm variations in exposures, and the violation is immaterial. ‘Immaterial’ refers in this context to the number and size of individual violations relative to the EUR 1 million threshold. In any case, institutions need clearly defined internal rules specifying the circumstances in which clients may remain in the retail exposure class despite the fact that their exposure exceeds the EUR 1 million limit. That limit should be monitored and documented.

These exposures can remain in the rating system for retail exposures. For calculating the capital requirement, there are two possibilities. One is to use the retail risk weight curve. However, as a prudential measure, the use of retail rating systems but the corporate risk weight curve is recommended. b. Permanent violations: In this case, the exposure should be moved to the corporate exposure class and the corporate curve should be used to calculate the capital requirement. If the rating system applied to the retail exposure class fulfils the requirements for rating systems in the corporate exposure class, no change in the rating system is required. Otherwise, the rating system for corporate exposures should be applied.
159. The EUR 1 million threshold for SMEs should be applied both at the level of
the EU parent institution on a consolidated basis, and at the subsidiary level for the application of solo requirements. Supervisors will expect institutions to be able to identify and consolidate groups of connected clients and to aggregate relevant exposures of each group of connected clients. This identification and aggregation of amounts owed by an obligor client or by a group of connected clients need to be performed with justifiable efforts across all entities of the banking group, unless explicitly excluded by Article 86 (4) of the CRD.
160. Consultation with the industry indicates that at the beginning of 2006 not
all institutions are capable of satisfying this requirement. Institutions should take reasonable steps to identify and aggregate exposures. Minimum thresholds on individual exposures could be introduced, meaning that only if an individual exposure is above a certain minimum amount should the institution actually check whether the aggregate exposure to the group of connected clients exceeds the EUR 1 million threshold.
161. When the total amount owed is reduced (e.g. amortised) and is less than
EUR 1 million, no automatic assignment to the retail exposure class should be applied. In this case, the requirements of Article 86(4)(b) to (d) of the CRD become paramount.
162. If a parent institution has subsidiaries that are direct creditors to a group
of connected clients, a process should be in place that will allow proper assignment of these connected clients to the retail or to the corporate exposure class, based on the aggregate exposure.
163. Institutions shall demonstrate that exposures in the retail exposure class
are treated differently – meaning less individually – than exposures in the corporate exposure class (see Article 86(4)(c) of the CRD). For this purpose, the credit process can be divided into the following components:
marketing and sales activities, rating process, rating system, credit decision, Credit Risk Mitigation methods, monitoring, early warning systems, and workout/recovery process. As long as an institution can demonstrate that any of these components differ clearly, this requirement can be regarded as met.

Differences in the rating systems and in the recovery process used by the
institution can provide strong evidence that the criterion is fulfilled. Syndicated loans should not be treated as retail, as the syndication of a loan is itself a strong form of ‘individual’ loan management.
However, this should not give institutions an incentive to adapt their risk
management processes to a lower standard in order to fulfil this criterion. The institution should not change the treatment of an exposure in preparation for the IRB approach.
If the rating system is the same as for corporate exposures, it should be
possible to validate the rating system for exposures ‘treated as retail’ on a standalone basis. The parameter estimates and capital requirement calculations for retail may also be derived on a pooled basis and not only on the individual parameter estimates for individual obligors in the corporate exposure class. The fact that a retail customer is assigned an individual rating should not by itself exclude classification of that exposure as belonging to the retail sector.
3.3.1.1.2. Qualifying revolving retail exposures
Annex VII, Part 1, Paragraph 11 of the CRD lists five conditions (indents
(a) to (e)), which exposures must meet in order to be assigned to the qualifying revolving retail (QRR) exposure class.
The term ‘individuals’ used in indent (a) is equivalent to ‘individual
persons’ in Article 86(4)(a) of the CRD. The term ‘revolving’ used in indent (b) is explained sufficiently in the indent.
Indent (b) provides that loans must generally be unsecured in order to be
included in the QRR exposure class. However, loans in this exposure class may be secured by a general lien that is contractually part of various exposures on the same obligor, as long as the individual exposure is treated as unsecured for capital calculation purposes (i.e., recoveries from collateral may not be taken into account in estimating LGD). The phrase “if the terms permit the credit institution to cancel them [the undrawn commitments] to the full extent allowable under consumer protection and related legislation“ should be interpreted as follows: an undrawn credit line is considered 'immediately cancellable' even if consumer protection or related legislation prohibit the institution from cancelling it immediately or set minimum cancellation periods. Compliance with consumer protection regulation should not prevent institutions from classifying exposures that comply with all other criteria as qualifying revolving retail exposures.
The threshold in indent (c) may be applied at the level of the institution.
Subclasses within this exposure class should be differentiated if their loss rates differ significantly. Examples are credit cards, overdrafts, and others.
The demonstration of the low volatility of loss rates mentioned in indent
(d) should be made at least in the course of the IRB approval process, and afterwards at any time on request. The benchmark level for assessing the

volatility of loss rates of the QRR portfolio or sub portfolios relative to the average level of loss rates should in general be the relative volatility of loss rates of other sub portfolios in the socalled ‘other retail’ exposure sub class, in which the institution holds exposures. In this case, institutions should provide data on the mean and standard deviation of the loss rates for all those subportfolios. When no ‘other retail’ exposure subclass is available in the institution or should this subclass not be appropriate as a benchmark level, the QRR portfolios of peer institutions, mortgage portfolios, or corporate portfolios may serve as possible alternative reference portfolios. An example of a suitable measure of volatility could be the coefficient of variation (the standard deviation divided by the mean), as it normalises the standard deviation by the mean. Loss rate could be defined as the realised loss within a fixed period of time, measured as percentage of the exposure class value. For the purpose of this test, institutions should use the definition of loss provided in paragraphs 198 and 199 of these guidelines. However, if such definition is too burdensome to be used (for example, for losses incurred before implementation of the CRD), supervisors may allow for the purposes of paragraph 167 the use of a different definition of loss not strictly in accordance with that used in IRB calculation, provided it is applied on a consistent basis.
3.3.1.1.3. Retail exposures secured by real estate collateral
172. Annex VII, Part 1, Paragraph 10 of the CRD states that for retail exposures
secured by real estate collateral, a correlation (R) of 0.15 shall replace the
figure produced by the correlation formula in Paragraph 9. Any retail
exposure to which the institution assigns real estate collateral for its internal risk measurement purposes should be classified as an exposure secured by real estate collateral. For retail exposures to which no real estate collateral has been assigned, potential proceeds from the value of real estate must not be considered for LGD estimation.
3.3.1.2. Corporate Exposure class
3.3.1.2.1. SMEs in the corporate exposure class
173. In Annex VII, Part 1, Paragraph 4 of the CRD, which requires institutions
to substitute total assets for total sales in the modified correlation formula for SME exposures when total assets is a more meaningful indicator of firm size, the term ‘sales’ can be defined as total gross revenue received by a firm from selling goods and services in the normal course of business. For some industries, ‘sales’ needs to be defined more exactly. For example, insurance companies’ sales should be defined as gross premium income. It is not necessary to come up with uniform definitions, as country specificities may be important.
174. The CRD requires substituting assets for sales when this is a more
meaningful indicator. Substitution on a voluntary basis may be possible when the institution can present evidence that this is at least an equivalently conservative approach and is applied consistently over time and laid down in its internal rules.

3.3.1.2.2. Specialised Lending
175. Specialised Lending (SL) exposures form a subclass of the corporate
exposure class. These exposures are characterised by a strong linkage between pledged assets and the payments that service the loan.
176. Specialised Lending exposures within the corporate exposure class possess
the following characteristics, according to Article 86(6) of the CRD:
(a) The exposure is to an entity which was created specifically to finance and/or operate physical assets. (b) The contractual arrangements give the lender a substantial degree of control over the assets and the income that they generate. (c) The primary source of repayment of the obligation is the income generated by the assets being financed, rather than the independent capacity of a broader commercial enterprise.
177. Not all of these requirements necessarily have to be met to the same full
extent. Individual elements of the definition could be somewhat relaxed in order to capture different kinds of exposures. However, all three elements of the Specialised Lending definition should be fulfilled in one way or another, at least in substance. The most critical criterion for SL classification is the criterion that the primary source of repayment is the income generated by the assets.
178. The institution should pay special attention to the definition of Specialised
Lending in borderline cases between Specialised Lending and the securitisation framework. Certain items might be classified both as Specialised Lending and as a securitised position. The institution should classify such positions consistently over time.
179. The typical counterparty in a Specialised Lending arrangement is a special
purpose entity which takes its own legal form and whose payments are segregated from other entities or from the group. There should be a legal contract between the entity and the assets as regards the income that is generated.
180. The number of assets involved in an arrangement is not important in
defining Specialised Lending. What is important is whether or not the pledged assets are the source of repayment of the loan. Similarly, it should not be considered important for the definition whether or not the entity has entered into some kind of longterm lease that contractually cannot be terminated. Although such arrangements represent a transfer of risk, this does not alter the fact that payments are originating from the same object that is being financed and serves as security. Demonstration of fulfilment of requirements
181. According to Annex VII, Part 1, Paragraph 5 of the CRD, institutions can
use PD estimates for their Specialised Lending exposures only if they meet the minimum requirements for the IRB approach. In order to reduce opportunities for regulatory arbitrage, it was considered necessary to

apply these minimum requirements at the level of certain defined sub classes of Specialised Lending, rather than at the level of individual exposures. One possible solution is to use the subclasses of Specialised Lending defined in the Basel II framework. The Basel Committee specified five subclasses. 12 It is suggested that Specialised Lending be divided into the four main Basel II subclasses. The introduction of the fifth subclass, HighVolatility Commercial Real Estate (HVCRE), shall remain a national option for supervisors. Exceptions from the Basel II subclasses can be allowed and will be handled flexibly. Application of SL risk weights
182. Article 87(5) of the CRD requires that the risk weighted exposure amount
is calculated in either of two different ways.
183. “Notwithstanding Paragraph 3 [referring to the calculation of risk weights
for ordinary corporate exposures], the calculation of risk weighted exposure amounts for credit risk for Specialised Lending exposures may be calculated in accordance with Annex VII, Part 1, Paragraph 5 [referring to the alternative method for Specialised Lending exposures]. Competent authorities shall publish guidance on how credit institutions should assign risk weights to Specialised Lending exposures under Annex VII, Part 1, Paragraph 5 and shall approve institutions assignment methodologies”.
184. The best way of providing such guidance would be to apply the approach
of the Basel II framework. The Basel Committee has already developed ‘Supervisory Slotting Criteria’ for riskweighting Specialised Lending exposures. 13 These criteria should be used as the primary guidance for European institutions.
185. Risk weights for Specialised Lending exposures are available only to IRB
institutions. Institutions that use the Standardised Approach for credit risk are not allowed to use the SL risk weights. Furthermore, the use of the Basel II Supervisory Slotting Criteria requires that the institution has also applied the Basel Framework SL subclasses, as mentioned above.
186. An institution specialising in certain areas could well wish to refine
elements of the provided guidance. This should be allowed as long as the refinements introduce additional elements, but do not replace the elements of the guidance. Application of preferential risk weights
187. The CRD states that competent authorities may authorise a institution to
assign preferential risk weights to highlyrated (categories 1 and 2) SL exposures with remaining maturities of less than 2.5 years, provided the institution’s underwriting characteristics and other risk characteristics are 12 The five Basel II subclasses are Project Finance, Object Finance, Commodities Finance, and Income Producing Real Estate (these are the main subclasses), and HighVolatility Commercial Real Estate. 13 Supervisory Slotting Criteria for Specialised Lending, International Convergence of Capital Measurement and Capital Standards, Annex 4.

substantially strong for the relevant category. In exercising this discretion, supervisors should rely on institutions to demonstrate that the specified requirements are fulfilled and that their rating systems are stricter than the standards.
188. Especially when faced with scarcity of data for the estimation of key risk
factors, institutions could be encouraged to apply additional techniques such as various kinds of simulation. However, the institution should collect its own default and loss data, as well as external data when they are representative.
189. The different aspects of Specialised Lending should be reviewed at least
annually. This includes the ratings, but also the categorisation of exposures as Specialised Lending and the demonstration that exposures can or cannot be treated within the general IRB framework.
3.3.1.3. Securitisation exposure class
3.3.1.3.1. Definition of securitisation exposure class
190. Article 86(1)(f) of the CRD identifies securitisation positions as one of the
exposure classes of the IRB approach. The provisions for calculating risk weighted exposure amounts for the securitisation positions exposure class are set out in Articles 94 to 101 of the CRD and Annex IX, Part 4, Paragraphs 1 to 5 (general provisions) and 36 to 74 (IRB approach) of the CRD. The IRB approach for securitisation positions provides for a Ratings Based Approach and a Supervisory Formula Method (Kirb), the Internal Assessment Approach (IAA) and the fallback approach for eligible liquidity facilities, for which neither the Ratings based approach, nor the IAA nor the Supervisory Formula Method are appropriate to determine a risk weight.
191. A 'securitisation position' is defined in Article 4(40) of the CRD as an
exposure to a securitisation, which Article 4(36) defines as a transaction or scheme whereby the credit risk associated with an exposure or pool of exposures is tranched, having the following characteristics: (a) payments in the transaction or scheme depend on the performance of the exposure or pool of exposures; (b) the subordination of tranches determines the distribution of losses during the ongoing life of the transaction or scheme.
192. Thus the securitisation exposure class is characterised by three key
elements:
a) 'Tranching' of credit risk. Tranching is central to the nature of a securitisation. In order to fall within the scope of the securitisation framework, the risk transfer should occur through a structure in which the underlying credit risk of the exposures should be sliced and repackaged into at least two tranches at the inception of the transaction reflecting different degrees of credit risk. Any firstloss positions have to be counted as tranches, regardless of whether they are carried on the books as assets. For example, residual payment claims resulting from a refundable purchase discount that may or

may not be accounted for initially as 'loss on sale' have to be counted as tranches. Using the terminology of the Basel II framework, a securitisation is a structure in which the cash flow from an underlying pool of credit risk exposures is used to service at least two different stratified risk positions or tranches reflecting different degrees of credit risk. b) Payments to the investors depend on the performance of the underlying credit risk exposures ('credit link' or 'limited recourse'). This element differentiates securitisations from structures in which the payments are derived from an unconditional obligation of the originating entity, where the 'underlying' exposures serve only to collateralise the borrower’s unconditional payment obligation rather than as a means of determining the extent of the obligation. c) Subordination determines the distribution of losses over the entire lifetime of the transaction. Subordination differentiates securitisation from structures funded with ordinary senior/subordinated debt instruments, for which the priority of rights is set only in the liquidation process. (I.e., senior and subordinated debt both default at the same time, and only the liquidation proceeds are distributed unevenly, while with securitisations, the default of individual tranches might occur at different points in time over the lifetime of the transaction.)
193. Due to the complex nature of securitisations, the preceding criteria may
not resolve all boundary issues. In general, classification as a securitisation should be linked to the economic substance of the transaction rather than to its legal form. If uncertainty remains as to whether or not a transaction is to be considered a securitisation, institutions should consult their national supervisors. In the current state of the securitisation market, a few boundary cases have been identified by institutions, some of which are elaborated upon in more detail in Annex III of these guidelines.
3.3.1.3.2. 'Significant risk transfer'
194. Securitisation positions can be exposures that an institution holds as an
investor, a sponsor or exposures that it holds as an originator. In the latter case the rules for calculating the riskweighted exposure amounts are described in Article 95 of the CRD. According to Article 95(1) of the CRD, where significant credit risk associated with securitised exposures has been transferred from the originator credit institution in accordance with the terms of Annex IX, Part 2, that credit institution may:
(a) in the case of a traditional securitisation, exclude from its calculation of riskweighted exposure amounts, and, as relevant, expected loss amounts, the exposures which it has securitised; (b) in the case of a synthetic securitisation, calculate riskweighted exposure amounts, and, as relevant, expected loss amounts, in

respect of the securitised exposures in accordance with Annex IX, part 2.
195. According to Article 95(2) of the CRD, where significant credit risk has
been transferred from the originator institution, that institution shall calculate the riskweighted exposure amounts prescribed in Annex IX for the positions that it may hold in the securitisation. Where the originator credit institution fails to transfer significant credit risk in accordance with
Article 95(1), it need not calculate riskweighted exposure amounts for
any positions it may have in the securitisation in question, but the originator will have to calculate riskweighted exposure amounts for the securitised assets according to the rules for the respective exposure class.
196. The requirement for significance of risk transfer has to be clearly
separated from the requirement for effective risk transfer. The latter refers primarily to the legal validity and enforceability of the contractual arrangements of the transaction and to the absence of contractual arrangements undermining the risk transfer, and differentiates between 'traditional' and 'synthetic' securitisations. The requirement for significant risk transfer applies to both kinds of securitisation transactions (although it may have to take into account aspects specific to one kind of securitisation transaction, such as the volume of reserve account to be built up from excess spread, trapped at SPV level, and carried as an asset by the originating institution in traditional securitisation transactions).
197. Annex IX, Part 2 of the CRD provides the qualitative criteria that have to
be fulfilled by a securitisation transaction. However, even if a transaction can meet the securitisation definition established in the CRD, it may not be granted the securitisation treatment in Article 95(1) of the CRD if the originator institution has not transferred a significant amount of risk to third parties. Assessing the significance of this transfer could involve other criteria than the ones refered to in Annex IX, Part 2.
198. Accounting derecognition of the securitised credit risk exposures is neither
a prerequisite for nor evidence of the effectiveness or significance of credit risk transfer for regulatory purposes. Quantitative evaluation remains necessary.
199. Supervisors will verify that a significant portion of the credit risk of the
pool has been transferred to at least one independent third party at inception and on an ongoing basis. It is difficult at this stage to provide quantitative thresholds for the amount or percentage of credit risk retained, because of the highly specific nature of these transactions. Most supervisors will therefore use a casebycase approach. However, a quantitative threshold could be based on the percentage of losses (EL plus UL) retained by the originator in the form of a firstloss tranche (or equivalent). Since the originator typically retains (at least economically) the expected losses that are estimated to occur over the expected lifetime of the transaction, supervisors would expect at least a significant transfer of the unexpected loss. Some supervisors could pay special attention to the transfer of mezzanine tranches (defined, for example, by external ratings) with significant probabilities of loss, while the retention of supersenior tranches with extremely

low probabilities of default would not in itself jeopardise compliance with the significant risk transfer requirement. The criteria for expected and unexpected loss transfer could be summarised by the regulatory requirements for these tranches (i.e. Kirb), or – for institutions applying internal economic capital models – on the requirement that those tranches, accounting for most of the institution's internal (economic) capital requirement for the overall structure (for more sophisticated institutions), need to be transferred. For less sophisticated institutions that do not use economic capital models, significant risk transfer could be measured by the portion of RiskWeighted Exposure Amounts (or any other suitable measurement) represented by retained mezzanine tranches in relation to all mezzanine tranches (this portion should be small).
200. Even if a securitisation structure is not recognised as a securitisation for
the originator (for example, because the risk transfer is not significant), the transferred pieces will be treated as securitisation on the investor’s side.
3.3.1.4. Equity exposure class
Nature of Equity exposures
201. Equity exposures are defined on the basis of the economic substance of the
instrument. They include both direct and indirect ownership interests, whether voting or nonvoting, in the assets and income of a commercial enterprise or a financial institution. Indirect equity interests include holdings of derivative instruments tied to equity interests, and holdings in corporations, partnerships, limited liability companies, or other types of enterprises that issue ownership interests and are engaged principally in the business of investing in equity instruments. An indirect holding in the form of a subsidiary of a corporate need not be taken into account separately, as far as the subsidiary is taken into account when calculating the riskweighted exposure amount for the direct equity exposure to the corporate. However, this assertion does not imply an exemption with respect to the treatment of CIUs according to Art. 87 (11) and (12) of the CRD, which always requires a lookthroughapproach. Assignment of exposures to the Equity exposure class
202. This section provides guidance on typical instruments that should usually
be included in the Equity exposure class. This guidance does not claim to be comprehensive. Supervisors acknowledge that there might be specific structures that, while fulfilling some or almost all of the following characteristics, might in substance be debt and should be classified as such.
203. Amplifying on Article 86(5) of the CRD and based on the Basel framework
provisions relating to the definition of an equity exposure, an instrument should be assigned to the equity exposure class if it meets all of the following three criteria. · It is irredeemable in the sense that the return of invested funds can be achieved only by the sale of the investment, the sale of the rights to the investment, or the liquidation of the issuer;

It does not embody an obligation on the part of the issuer; and
It conveys a residual claim on the assets or income of the issuer. As a failsafe, if a debt instrument is structured, subordinated, and
managed as an equity, it should be included in the Equity exposure class.

Additionally, the following instruments should be categorised as Equity
exposures:

An instrument with the same structure as an instrument listed in
Article 57 a) to c) of the CRD
An instrument that embodies an obligation on the part of the issuer
and that meets any of the following criteria:
(1) The issuer may defer indefinitely the settlement of the obligation. (2) The obligation requires (or permits at the issuer’s discretion) settlement by issuance of a fixed number of the issuer’s equity shares. (3) The obligation requires (or permits at the issuer’s discretion) settlement by issuance of a variable number of the issuer’s equity shares and (all other things equal) any change in the value of the obligation is attributable to, comparable to, and in the same direction as, the change in the value of a fixed number of the issuer’s equity shares. For certain obligations that require or permit settlement by issuance of a variable number of the issuer’s equity shares, the change in the monetary value of the obligation is equal to the change in the fair value of a fixed number of equity shares multiplied by a specified factor. Such obligations satisfy this condition if both the factor and the referenced number of shares are fixed. For example, an issuer may be required to settle an obligation by issuing shares with a value equal to three times the appreciation in the fair value of 1,000 equity shares. That obligation is considered to be the same as an obligation that requires settlement by issuance of shares equal to the appreciation in the fair value of 3,000 equity shares. (4) The holder has the option to require that the obligation be settled in equity shares, unless either (i) in the case of a traded instrument, the supervisor is satisfied that the institution has demonstrated that the instrument trades more like the debt of the issuer than like its equity, or (ii) in the case of nontraded instruments, the supervisor is satisfied that the institution has demonstrated that the instrument should be treated as a debt position. In cases (i) and (ii), the institution may decompose the risks for regulatory purposes, with the consent of the supervisor.

Debt obligations and other securities, partnerships, derivatives, or other
vehicles structured with the intent of conveying the economic substance of equity ownership are considered equity holdings.
Equities that are recorded as a loan but arise from a debt/equity swap
made as part of the orderly realisation or restructuring of the debt are included in the definition of equity holdings. However, these instruments may not attract a lower capital charge than would apply if the holdings

remained in the debt portfolio. This includes liabilities whose return is linked to that of equities. Supervisors may decide not to require that such liabilities be included if they are directly hedged by an equity holding, such that the net position does not involve material risk.
207. Conversely, equity investments that are structured with the intent of
conveying the economic substance of debt holdings or securitization exposures would not be considered equity holdings. Supervisors have the discretion to recharacterise debt holdings as equities for regulatory purposes and otherwise to ensure the proper treatment of holdings under Pillar 2. As an example, bonds with hybrid features may not be considered as Equity to the extent that they receive a fixed share of profits and therefore do not satisfy the second criterion in paragraph 187u. Convertible bonds need to be considered in terms of criteria 2 and 4 of paragraph 187u. For convertible bonds and other such instruments at least the equity part should be captured by assigning it to the equity exposure class. Approaches for calculating riskweighted exposure amounts for equity exposures
208. Instruments considered as equity exposures are to be included in the
Equity exposure class unless they are consolidated or deducted. Where some member countries retain their existing treatment as an exception to the deduction approach, as a national option offered in the Directive, such equity investments by IRB institutions are to be considered eligible for inclusion in their IRB equity portfolios.
209. Investments in significant minority and majorityowned and controlled
commercial entities below the materiality levels retained for deduction following Article 120 of the CRD will be riskweighted in accordance with the methodology for equities, and no less than 100 percent after Credit Risk Mitigation techniques have been applied. Equity exposures in the trading book are subject to the market risk capital rules.
210. According to Annex VII, Part 1, Paragraphs 15 to 24 of the CRD,
institutions can use three different approaches to calculate the risk weighted exposure amounts for equity exposures or a combination of them: the internal models approach, the PD/LGD approach, or the simple risk weight approach.
211. When an institution uses more than one approach, Annex VII, Part 1,
Paragraph 15 of the CRD requires it to demonstrate that this choice is made consistently. Those different approaches should be considered as consistent through the use of different tools and processes reflecting the internal management processes. Different approaches for the calculation of capital requirements alone are not a sufficient criterion for consistency.
212. If the internal models approach is used, this model should be integrated
into the risk management process as required by Annex VII part 4 paragraph 115 of the CRD. For example, the output of the model should

be used by the institution for its investment policy, for setting limits, and for managing exposures
213. The simple risk weight approach (Annex VII, Part 1, Paragraph 17 of the
CRD) allows a reduced risk weight for private equity exposures in sufficiently diversified portfolios. Institutions might demonstrate sufficient diversification by making reference to the number of investment funds, the number of investments which compose the portfolio and the related funds, or specific indexes to assess diversification, if available. Alternatively, supervisors may choose to set explicit limits on the number of investments in a portfolio for it to be included in the private equity exposure class. Loss history could also be an indication of a sufficiently diversified portfolio for demonstrating that the simple risk weight approach could be applied to the private equity exposure. Permanent exemptions of equity exposures from the IRB treatment
214. According to Article 85(3) of the CRD, institutions using the IRB approach
for any exposure class shall at the same time use the IRB approach for the equity exposure class. However, Article 89 provides some exceptions to this rule.
215. Certain equitylike investments can remain outside the IRB treatment. These are:
(a) Equity exposures to entities whose credit obligations qualify for a zero risk weight under the Standardised Approach, including those publicly sponsored entities where a zero risk weight can be applied (Article 89 (1)(f)). (b) Equity exposures incurred under legislated programmes to promote specified sectors of the economy that provide significant subsidies for the investment to the institution and involve some form of government oversight and restrictions on the equity investments (Article 89(1)(g)). The restrictions referred to in Article 89(1)(g) could involve the size or type of firms, the amounts which can be invested, geographical location, or other factors potentially limiting the risk of the investment.
216. Article 89(1)(g) limits the aggregate amount of equity exposures incurred
under legislated programmes which are permanently exempted from an IRB approach to 10 percent of the institutions’ own funds as defined in
Article 57 of the CRD. This ratio should be calculated according to the
method mentioned in paragraph 188i of these guidelines. This limit applies at the level of the minimum own funds requirement, in application of
Chapter 2, Section 2, Subsection 1 of the CRD.
217. The entire equity exposure class can be permanently exempted from an
IRB approach, if it is immaterial in terms of size and perceived risk profile (Article 89(1)(c) of the CRD). According to Article 89(2) of the CRD, for the purposes of point (c) of Article 89(1), the equity exposure class of a credit institution shall be considered material if their aggregate value, excluding equity exposures incurred under legislative programmes as referred to in point (g), exceeds, on average over the preceding year, 10% of the credit institution’s own funds. If the number of those equity exposures is less than 10 individual holdings, that threshold shall be 5% of

the credit institution’s own funds. Materiality should be measured after the exclusions mentioned in points (a) and (b) of Paragraph 188f. The threshold should be managed on an ongoing basis, and should in any case be checked by the institution at least once a year.
3.3.1.5. Purchased receivables
Introduction
218. Receivables can be treated under three different types of approaches:

The exposure is treated as an exposure on the seller and the
receivables are treated as collateral, whose eligibility needs to be checked under Annex VIII, Part 2 of the CRD. · The exposure is treated as an exposure on the obligor and it is not unduly burdensome for the institution to assess the risks of each exposure as if the institution had originated the exposure. The seller may or may not act as guarantor. · The exposure is treated as an exposure on the obligor, and it would be unduly burdensome for the institution to assess the risks of each exposure as if the institution had originated the exposure. This may, in particular, be the case when the institution has to rely to a large extent on information provided by a third party. At times, the institution may not even know each individual obligor. Again, the seller may or may not act as guarantor. The receivables treatment is designed to address the particularities of this third case.

Receivables do not constitute an exposure class in itself, but reflect a type
of financing. Receivables transactions may occur within the corporate or retail exposure classes. There are typically three types of financing:
factoring, sale of claims over which the institution has legal ownership, and securitised exposures which are not themselves securitization positions. The CRD does not provide a precise definition of purchased receivables. However, purchased receivables transactions involve a 'triangular' relationship between the participants. Factoring, for example, involves an institution, a seller, and an obligor:
sale of claims (2) payment of claims (4) financing (3) claims arising from supply of goods, services (1) payment of claims (4) Purchaser (CI) Seller Obligor
The regulatory treatment of purchased receivables is aimed at taking into
account, on one hand, the dilution risk that is generally present, and on the other hand, the institution's inability to apply the risk quantification standards for corporate exposures in some cases.

Definition
221.Since the CRD does not provide a precise definition of purchased receivables, supervisors will rely on an economic definition based on the characteristics of the transaction. As noted above, purchased receivables do not constitute an exposure class in itself; they represent a type of financing, common to more than one asset class, usually arising from the sale of goods and services linked to a commercial transaction. The purchased receivable rules are intended primarily for receivables which are purchased as part of factoring or invoice discounting, or which are included in (or to be included in) assetbacked transactions. They do not apply to transactions in which loans originated by one firm are subsequently bought by another in order to add obligors to the purchaser’s nonsecuritization business. Necessary conditions for the treatment of purchased corporate receivables according to the IRB minimum requirements for the retail exposure class
222. The general IRB minimum requirements set different standards for banks’
internal rating systems for corporate exposures compared to retail exposures. While the minimum requirements for rating corporate exposures require detailed information, the requirements for retail can also be met with pooled data. If the standards for corporate exposures were applied to eligible purchased corporate receivables, it would be very difficult for an institution to satisfy the minimum requirements when the obligor is not its customer, let alone when the obligor is not known to the institution. Consequently, even institutions which follow best industry practice with respect to their eligible purchased corporate receivables would find themselves out of compliance with the IRB minimum requirements. To avoid this outcome, the general IRB minimum requirements on rating systems for retail exposures are extended to eligible purchased corporate receivables under the IRB rules for eligible purchased receivables.
223. Annex VII, Part 1, Paragraph 6 of the CRD provides that the risk
quantification standards for retail exposures (as set out in Annex VII, Part 4 of the CRD) may be used for purchased corporate receivables that comply with the minimum requirements in Annex VII, Part 4, Paragraphs 104 to 108 and Annex VII, Part 1, Paragraph 12 if it would be unduly burdensome for an institution to use the risk quantification standards for corporate exposures as set out in Part 4 of Annex VII. In order to qualify for this treatment, the burden is on the institution to demonstrate that it fulfils the eligibility criteria defined in the CRD. The meaning of some of those criteria is specified below:

The exposure that the institution has purchased has not been directly
or indirectly originated by the institution itself.
There should be an arm’s length relationship between the seller and
the buying institution: i.e., both parties should interact as independent agents in the financial market. Neither of the agents must be in a position to influence the internal decisionmaking

process of the other agent. The requirement for an arm’s length relationship between the seller and the buying institution is intended to prevent institutions from bypassing the general IRB minimum requirements on corporate exposures. Institutions that want to treat exposures as eligible purchased receivables should make sure, at a minimum, that:
1. There is no material contagion risk of default between the seller
and the institution; and
2. The receivables have been granted in fully competitive conditions
on a level playing field: i.e., at market price and under market conditions.

The portfolio needs to be sufficiently diversified.
One way to implement this requirement could be in terms of the number of obligors. A concentration limit could be set in the form of an absolute limit (exposure size per counterparty) or a relative limit (percentage of the total pool).
224. If a corporate purchased receivable does not meet all of the above
conditions, it will be subject to the general IRB minimum requirements for corporate exposures.
225. 'Unduly burdensome' in the sense of Annex VII, Part 1, Paragraph 6 of the
CRD means that the underlying obligors are so numerous that the institution would not be in a position to rate them using its normal rating system. It could also mean that the obligors are not the institution's usual, direct obligors, and thus the institution’s data systems do not contain any specific information on them. A maximum exposure size could be a complementary requirement. When institutions collect enough data to be able to assess obligors at an individual basis, they should abandon the topdown approach for purchased corporate receivables and use the bottomup approach instead. Estimating EL for purchased corporate receivables
226. Institutions may estimate ELs for purchased corporate receivables by EL
grade from longrun averages of loss rates. Institutions using this approach should have a distinct EL rating scale which would enable them to assign obligors or pools of obligors to EL grades. Dilution risk
227. Under the IRB approach, dilution risk has to be covered even when the
institution treats the exposure as if the obligor were a customer to the institution.
228. Article 4(24) of the CRD defines 'dilution risk' as the risk that an amount
receivable is reduced through cash or noncash credits of the obligor. Dilution risk therefore refers to the possibility that the potential amount of receivables bought and financed by the institution may be reduced at the

initiative of the seller or the obligor, and that the contractual amounts payable by the receivables obligors may be reduced through cash or noncash credits to these obligors. Examples include offsets or allowances arising from return of goods sold, disputes regarding product quality, possible debts of the obligor to a seller, and any payment or promotional discounts offered by the seller, such as a credit for cash payments within 30 days.
229. In the cases where institutions are in doubt as to whether a particular
event should be treated as dilution risk or not, they should treat it as dilution risk. This includes situations where an institution cannot clearly allocate events to operational risk. For AssetBacked Commercial Paper, dilution risk on the underlying will be assessed prorata.
230. According to Annex VII, Part 1, Paragraph 26 of the CRD, a special risk
weight needs to be applied for dilution risk. Only when the dilution risk is immaterial (under normal circumstances, immateriality would be assumed for purchased bonds) does it not need to be recognised. Materiality in this respect could be assessed at the pool level using a specific expected loss examination. In that case, a materiality threshold for expected loss should be set by the institution. This threshold should be conservative, as dilution risk is a true risk driver in this type of financing and institutions should always be prepared to manage it, even if they currently have difficulty in quantifying it.
231. According to Annex VII, Part 2, Paragraph 7 of the CRD, the regulatory EL
for dilution risk of purchased corporate receivables can be derived in various ways (e.g., estimation of EL itself and not of PDs or LGDs). The following table summarises the different possibilities under Annex VII, Part 2, Paragraphs 7 and 8(g) of the CRD:
Own estimates PD and LGD to be used in the formula PD LGD PD LGD yes yes Own estimates own estimates yes No Own estimates 75% no No estimate of EL 100%
3.3.2. Definition of loss and default
3.3.2.1. Definition of default
232. The definition of default provided by the CRD focuses on two types of
events: "unlikeliness to pay" and "past due status for more than 90 days on a material credit obligation."
233. Annex VII, Part 4, Paragraph 44 of the CRD states that a ‘default’ shall be
considered to have occurred with regard to a particular obligor when either or both of the two following events has taken place:
(a) The institution considers that the obligor is unlikely to pay its credit obligations to the institution, the parent undertaking or any of its

subsidiaries in full, without recourse by the institution to actions such as realising security (if held). (b) The obligor is past due more than 90 days on any material credit obligation to the institution, the parent undertaking or any of its subsidiaries.
234. In addition, Annex VII, Part 4, Paragraph 44 of the CRD states that in all
cases the past due exposure shall be above a threshold defined by the competent authorities and which reflects a reasonable level of risk.
235. Annex VII, Part 4, Paragraph 45 of the CRD lists the main elements to be
taken as indications of ‘unlikeliness to pay’:
(a) The credit institution puts the credit obligation on nonaccrued status. (b) The credit institution makes a value adjustment resulting from a significant perceived decline in credit quality subsequent to the credit institution taking on the exposure. (c) The credit institution sells the credit obligation at a material credit related economic loss. (d) The credit institution consents to a distressed restructuring of the credit obligation where this is likely to result in a diminished financial obligation caused by the material forgiveness, or postponement, of principal, interest or (where relevant) fees. This includes in the case of equity exposures assessed under a PD/LGD Approach, distressed restructuring of the equity itself. (e) The credit institution has filed for the obligor’s bankruptcy or a similar order in respect of an obligor’s credit obligation to the credit institution, the parent undertaking or any of its subsidiaries. (f) The obligor has sought or has been placed in bankruptcy or similar protection where this would avoid or delay repayment of a credit obligation to the credit institution, the parent undertaking or any of its subsidiaries.
236. The definition of default used to estimate risk parameters should be the
same, regardless of the parameter for which it is used (PD, CF, LGD, or EL). However, the specific requirements of the CRD for the adoption of a compliant definition of default apply only for the purpose of risk quantification. Definition of default within the same country
237. The definition of default adopted by different institutions within the same
country shall be based on the regulatory definition of default. At a minimum, the institution should implement, in addition to the objective criteria based on the number of days past due, a definition of default based on the indications of unlikeliness to pay listed above that are applicable under the country’s legal regimes. The institution should interpret the indicators and their relevance in accordance with its own practices and market characteristics.

Institutions should also take into account other indications of unlikeliness
to pay that are suited to their obligors and facilities or the specificities of their market. These indications should be used in addition to the ones listed above, not as substitutes. Additional criteria could be necessary to make the full set of criteria more specific and detailed. They should be formalised and well documented in institutions’ internal guidelines, in order to allow third parties (such as Internal Audit or supervisors) to carry out checks on the number of defaults identified. To prevent arbitrage and/or gaming possibilities, supervisors should carefully assess the definition of default adopted by each institution, evaluating those criteria with respect to the institution’s internal practices.
For guidance on the use of external data sets that are based on different
definitions of default, see section 3.4.3. below on ‘representativeness of data used for model development and validation.’ Past due exposures, materiality of credit obligations when past due
The materiality concept referred to in the ‘past due’ criterion is interpreted
as a way to avoid counting obligors as defaulted when they are past due merely for technical reasons or the amount in past due status is negligible. The materiality thresholds defined by the supervisors provide a minimum criterion for institutions, with the aim of obtaining a minimum definition of default that will be algorithmically describable. Thresholds may be set by the competent authorities for all the institutions in their jurisdiction (‘one sizefitsall’ rule), or on a casebycase basis, supported, if necessary, by a qualitative assessment.
In addition to the threshold set by the supervisors, institutions might take
into account other indications for the materiality of past due amounts that are suited to their obligors and facilities or the specificities of their market. However, such indications should be used in addition to the ones mentioned above, not as substitutes. When setting internal materiality thresholds, an assessment of the ‘cure rate’ – i.e., the fraction of past due obligors that return to a nondefaulted status without the intervention of the institution – should be carried out by the institution, in order to avoid counting obligors as defaulted that are in past due status merely for technical reasons and hence generating artificially low LGDs. Default of individual entities vs. default of groups
As a general rule, the rating assignment process and the definition of
default adopted should be consistent. Contagion of default between linked parties should be carefully assessed. For example, if a rating is assigned to the entire group to which the individual borrowing entity belongs (e.g., if it is based on the consolidated balance sheet, and the ‘rated entity’ is thus the group), then the default status should be triggered accordingly (i.e., for the whole group as a single rating object), unless the institution can demonstrate that default at the subsidiary level does not have material consequences for the stability of the group as a whole. In these cases, however, supervisors might question whether a group rating was appropriate.
3.3.2.2. Definition of loss
For the purpose of determining minimum capital requirements for credit
risk, the CRD defines loss and Loss Given Default (LGD) in Article 4(26) and (27) of the CRD, and dedicates a specific section to the requirements specific to own LGD estimates. The definitions are based on the concept of economic loss (Article 4(26) of the CRD), which includes material discount effects and material direct and indirect costs associated with collecting on the instrument. Data for economic loss
The Loss Given Default (LGD) is the ratio of the loss on an exposure due
to the default of a counterparty to the amount outstanding at default (Article 4(27) of the CRD). The data used to calculate the realised LGD of an exposure (see also the definition provided in paragraph 262 of these guidelines) should include all relevant information. This could include, depending on the type of the exposure:

The outstanding amount of the exposure14 at the time of default (including principal
plus unpaid but capitalised interest and fees). · Recoveries, including the income and sources of recoveries (e.g., cash flows from sale of collateral and guarantee proceeds or realised income after the sale of defaulted loans). · Workout costs, including material direct and indirect costs associated with workout collection. Such workout costs could stem from the cost of running the institution’s workout department, the costs of outsourced collection services directly attributable to recoveries such as legal costs, and also an appropriate percentage of other ongoing costs such as corporate overheads. · As far as needed for calculating material discount effects, the dates and the amounts of the various cash flows that were incurred (‘timing of the recovery process’).

Institutions should collect and store data to assess LGDs, including
recovery and workout costs. This information should be collected at the level of each defaulted exposure or each pool (when necessary in the retail exposure class). Over time, institutions should collect workout costs at as granular level as possible. If institutions only have data at an aggregate level, they should develop a proper allocation methodology. Use of external data of economic loss
The less internal information the institution has for estimating LGDs (also
in terms of representativeness of the defaulted portfolio), the more important is the use of external data (including pooled data) and multiple data sources (e.g., the combination of external and internal data) for improving the robustness of LGD parameter estimation. In particular, appropriate external benchmarks, if available, should be considered by the institution. The institution should carefully evaluate all relevant external data and benchmarks, as some data on components of loss are typically countryspecific (for example, the potential inability to gain control over collateral depends on national legal frameworks) or institutionspecific (for example, collection processes leading to variations in workout costs, other direct costs, and indirect costs). In other cases, some components of 14 For the different possibilities for calculating exposure values, see Annex VII, Part 3 of the CRD.

economic loss might not be included in the external data. The institutions should analyze the loss components of the external data and the comparability of external data with respect to its lending practices and internal processes, and should take into account the results of these analyses during the estimation process. (See also section 3.4.4. on data sources.) Discount rate
247. The discount rates used by institutions to incorporate material discount
effects into economic loss may vary depending on the respective market, the kind of facility, or the institution’s workout practices for defaulted facilities.
248. The measures of recovery rates used in estimating LGDs should reflect the
cost 15 of holding defaulted assets over the workout period, including an appropriate risk premium. When recovery streams are uncertain and involve risk that cannot be diversified away, net present value calculations should reflect the time value of money and an appropriate risk premium for the undiversifiable risk. In establishing appropriate risk premiums for the estimation of LGDs consistent with economic downturn conditions, the institution should focus on the uncertainties in recovery cash flows associated with defaults that arise during an economic downturn. When there is no uncertainty in recovery streams (e.g., recoveries are derived from cash collateral), net present value calculations need only reflect the time value of money, and a riskfree discount rate is appropriate.
249. Measures of recovery rates can be computed in several ways.
For example,

By discounting the stream of recoveries and the stream of workout costs by a riskadjusted discount rate which is the sum of the riskfree rate and a spread
appropriate for the risk of the recovery and workout cost cash flows, · By converting the stream of recoveries and the stream of workout costs to certainty equivalent cash flows 16 and discounting these by the riskfree rate, or · By a combination of adjustments to the discount rate and adjustments to the streams of recoveries and workout costs that is consistent with this principle. 17 The process for arriving at a discount rate should be consistent for all exposures of the same kind. Institutions should justify this point carefully, to ensure the absence of any arbitrage caused by manipulating discount factors. Whenever they apply a riskfree rate, they should demonstrate to their supervisors that any remaining risk is covered elsewhere in the calculation. 15 The concept of cost referred to here must be consistent with the concept of economic loss as described in paragraph 243. 16 A certaintyequivalent cash flow is defined as the cash payment required to make a risk averse investor indifferent between receiving the cash payment with certainty at the payment date and receiving an asset yielding an uncertain payout whose distribution at the payment date is equal to that of the uncertain cash flow. 17 An institution may use an 'effective interest rate' as the discount rate in accordance with IAS 39, but in that case it should adjust the stream of net recoveries in a way that is consistent with this principle.

Allocation of direct and indirect costs
250. Workout and collection costs should include the costs of running the
institution’s collection and workout department, the costs of outsourced services, and an appropriate percentage of other ongoing costs, unless an institution can demonstrate that these costs are not material.
251. An institution should demonstrate that it collects in its databases all
information required to calculate material direct and indirect costs. The costallocation process should be based on the same principles and techniques that institutions use in their own cost accounting systems. These might include (among others) methods based on broad averages, or statistical methods based on appropriately chosen samples within a population of defaulted obligors. Institutions should demonstrate that the costallocation process is sufficiently relevant and rigorous. Institutions should also define ‘materiality’ and document the cost elements in a consistent way over time.
3.3.3. Rating systems and risk quantification
3.3.3.1. Probability of Default (PD)
252. The first parameter used in the supervisory formula for calculating
regulatory capital requirements for credit risk is the Probability of Default. According to the CRD, IRB institutions are expected to have rating systems which:

Assign obligor/exposure risk ratings and validate the accuracy of those
ratings (Annex VII, Part 4, Paragraphs 5 to 31 of the CRD).
Translate risk ratings into IRB parameters, specifically for estimating
probabilities of default (Annex VII, Part 4, Paragraphs 31 and 49 to 72 of the CRD). Rating Assignment methodology

The supervisors will assess institutions’ processes for validating their
rating assignment methodologies and the adequacy of those validation processes.
This assessment will cover the institution’s understanding and analysis of
the rating assignment methodologies, the obligor rating system, its logic, and its ability to provide meaningful differentiation of risk. In practice, institutions use a variety of different rating assignment methodologies to assign obligor grades. Institutions can combine various methodologies for assigning obligor grades (for example, they can combine statistical models with expert judgement systems.) Institutions should present the assumptions underlying their models or methods, and justify them to the supervisors.
Statistical methods may be used to quantify compliance with Annex VII, Part 4, Paragraph 31 of the CRD. Regardless of the methodology used to

assign obligor grades, institutions shall demonstrate to supervisors that rating assignments and ratings systems for obligor default risk comply with the minimum requirements in Annex VII, Part 4 of the CRD. 256. The supervisors’ assessment of the institution’s rating assignment methodology shall focus on the following issues:

The part of the rating system structure within which the rating
assignment methodology is being used (Annex VII, Part 4, Paragraphs 4 to 19 of the CRD).
The underlying rationale/theory (e.g., main assumptions, rating
philosophy) used in developing the rating assignment methodology.
If multiple methodologies are used for a single class of exposures or a
single portfolio, the boundaryeffects analysis that is applied (i.e., how a borrower would be rated by another ‘neighbouring‘ rating model, particularly if its assignment to the first rating model was a close decision, and its assignment to the ‘neighbouring’ model would have been a close decision, too).
The institution’s regular process for validating the performance of the
assignment methodology.
Detection of any deficiencies in the rating system for obligor default
risk that need to be corrected by the institution.
PD estimation methodology

The supervisor will assess institutions’ processes for validating their PD
estimation methodologies and the adequacy of those validation processes.
This assessment will cover the institution’s understanding and analysis of
the logic of PD estimation, and its accuracy. If institutions use direct estimation methods (see Annex VII, Part 4, Paragraph 4 of the CRD), there may be some overlap between the assignment of obligors to rating grades and the estimation of PDs for the respective rating grades. In this case, all of the requirements for the rating assignment methodology apply to PD estimation as well. Institutions may use different estimation methods (and different data sources) to estimate PDs for obligor rating grades or pools, including mapping internal rating grades to the scale used by an ECAI in order to attribute the default rates observed by this ECAI to internal rating grades, statistical default prediction models, or other estimation methods or combinations of methods.
Regardless of the type of estimation method used, institutions should
demonstrate to supervisors that the estimation of PD complies with the minimum requirements set out in the CRD. The supervisors’ assessment of the institution’s estimation methodology shall focus on the following issues:

The methods used for estimating PD.
The compliance of the definitions of default used in calibrating PD with
the regulatory definition of default.
The institution’s process for validating the accuracy and predictive
ability of estimated PDs.
Detection of any deficiencies in the estimation system that will need to
be corrected by the institution.
In the case of direct estimates (Annex VII, Part 4, Paragraph 4 of the
CRD), all of the issues related to the assessment of assignment methodology apply.
3.3.3.2. Loss Given Default (LGD)

The second parameter used in the supervisory formula for calculating
regulatory capital requirements for credit risk is Loss Given Default. The CRD refers to LGD estimation at various points. The overall requirements for IRB approaches of which LGD forms a part are set out in Article 84(2) of the CRD. The relevant requirements for the assignment methodology are laid down in Annex VII, Part 4 of the CRD, Paragraphs 1 to 4, 9, 11 to 12, 14 to 19, and 31. The general requirements for the estimation methodology are laid down in Annex VII, Part 4, Paragraphs 49 to 52 and 54 of the CRD. The requirements for estimation methodology that are specific to LGD are laid down in Annex VII, Part 4, Paragraphs 73 to 80 and 82 to 83. Definitions
The LGD calculation should be based on the definitions of default and
economic loss used by the institution, which should be consistent with the provisions contained in the CRD (see also section 3.3.2.2.).
It is important to distinguish between realised LGDs and estimated LGDs.
Realised LGDs are the total observed losses discounted to the time of default for each defaulted exposure in the data set. The raw data for calculating loss originate in the collection department (for example, recoveries, realisation of collateral, and all cash flows), the accounting department (unpaid but capitalised interest, amount outstanding at the time of default), or other departments. Many institutions using an Internal Rating Based approach record these raw data in a financial data warehouse. All information needed to calculate economic loss should be collected. No filters should be applied at this stage. The data warehouse may feed a database of observed cashflows which is used to calculate economic loss. Realised LGDs are expost values that can be applied to a facility grade or pool.
The institution assigns estimated LGDs to its current facilities (both
defaulted and nondefaulted) and uses them to calculate the capital requirements for its exposures. Estimated LGDs are based on the realised LGDs for the applicable Reference Data Set (RDS). However, estimated LGDs are likely to differ from the average realised LGDs in the RDS because the former needs to incorporate expectations of future recovery rates. This involves calculating a longrun forwardlooking recovery rate for the facility grade or pool, taking both current and future economic circumstances into account. The institution should produce an LGD estimate appropriate for an economic downturn (‘downturn LGD’) if this is more conservative than the longrun average. Other adjustments may also be necessary. If an institution adjusts a realised LGD, it needs to demonstrate that this adjustment is appropriate and is adequately taken into consideration in its backtesting procedures.

264. According to Annex VII, Part 1, Paragraph 28 and Annex VII Part 4,
Paragraph 79 of the CRD, an institution must also produce a best estimate of expected loss for defaulted exposures given current economic circumstances and exposure status. The difference between this amount and the estimated LGD derived from the RDS stems from the possibility of additional losses during the recovery period, and represents the Unexpected Loss capital requirement for the defaulted exposure. 265. According to Annex VII, Part 4, Paragraph 73 of the CRD, institutions shall use LGD estimates that are appropriate for an economic downturn if those are more conservative than the longrun average. The potential for realised recovery rates to be lower than average during times of high default rates may be a material source of unexpected credit losses for some exposures or portfolios. Failing to account for this possibility risks understating the capital required to cover unexpected losses (for details of assessing the effects, if any, of downturn conditions on recovery rates see paragraph 287).
266. Accordingly, in order to deal with possible adverse dependencies between
PD and LGD, LGD parameters need to embed forwardlooking recovery rates on exposures that default during conditions where credit losses are expected to be substantially higher than average. Under such conditions default rates are expected to be high, so that if recovery rates are negatively related to default rates, LGD parameters must embed forecasts of future recovery rates that are lower than those expected during more neutral conditions. In those cases where future recovery rates are expected to be independent of future default rates, there is no supervisory expectation that the forwardlooking forecasts of recovery rates embedded in LGD parameters will differ from those expected during more neutral conditions. Basic principles
267. LGD estimates should reflect the experience and practices of the individual
institution as well as the external environment in which it operates. One consequence of this is that institutions cannot rely on industrywide estimates without adjusting them to reflect their own position where necessary.
268. Since a given percentage variation in LGD estimates results in an equal
percentage change in capital charges, any approximation and/or shortcut that the institution decides to adopt should form an important aspect of validation and assessment. Data
269. A key step in estimating any IRB parameter is preparing the Reference
Data Set (RDS) for that parameter. This involves a variety of challenges, including choosing the sample size, the length of time series, reliance on external data, the treatment of defaulted positions that have generated no loss, and the length of recovery processes (incomplete workout). The institution could need to update some information contained in the RDS. The RDS for LGD should contain at least the following elements:

Unlike the RDS for PD estimation, it should include only exposures to
defaulted obligors.
It should include factors that can be used to group the defaulted
facilities in meaningful ways.

Ideally, it should:

Cover a period that is sufficiently long to include at least one business
cycle. · Contain all defaults that have occurred within the considered time frame.
Contain data for calculating realised LGDs.
Include all relevant information needed to estimate the risk
parameters. · Include data on the relevant drivers of loss.

The institution should ensure that the RDS remains representative of its
current portfolios.
Some defaulted positions may generate no loss, or may even have positive
outcomes in the recovery process. The treatment of these events should take into account the following:

A clear distinction must be made between realised LGDs and estimated
LGDs as a parameter for calculating risk weighted exposure amounts. The realised LGD might be zero: if an exposure is cured with no material direct or indirect cost associated with collecting on the instrument, and no loss caused by material discount effects (for example, if the default was caused solely by the 90 day past due criterion, and payment obligations were subsequently completely fulfilled), no loss might occur.
In cases of low or zero estimated LGD, institutions should demonstrate
that their estimation processes are pertinent and accurate. In particular, they should be able to provide concrete evidence of all factors taken into account in the quantification process that gave rise to the low estimates, such as the discount rate, the estimated value of the collateral, the structure of the cash flows, etc.
Even if positive outcomes in the recovery processes have been
observed and can be explained, the estimated LGD used to calculate capital requirements must not be less than zero. It may be zero in exceptional cases. Institutions should demonstrate that they monitor and record positive outcomes of recovery processes to make sure that no systematic errors have been made.
The treatment of zeroloss facilities should be examined to ensure that
it does not result in any distortions. For example, a significant number of zeroloss facilities may indicate, that the institution uses an inappropriately early definition of default or that the RDS contains some facilities which are not true defaults (for example, technical defaults such as small outstanding charges on repaid loans). Risk drivers

273. While there might be significant differences in LGD estimation methods
across institutions and across portfolios, a common set of risk drivers that institutions should take into account in the estimation process can be identified (see Annex VII, Part 4, Paragraph 49 of the CRD). These drivers can be grouped in the following five categories (This list is neither prescriptive nor comprehensive, and cannot reflect the specific features of the business of individual institutions or the environment in which they operate):
1. Transactionrelated, including facility type, collateral, guarantees from third parties, seniority, time in default, seasoning, LoantoValue (LTV), and recovery procedures;
2. Borrowerrelated, including borrower size (as it relates to transaction characteristics),
exposure size, firmspecific capital structure (as it relates to the firm’s ability to satisfy the claims of its creditors in the event that it defaults), geographic region, industrial sector, and line of business;
3. Institutionrelated, including internal organisation and internal governance, relevant
events such as mergers, and specific entities within the group dedicated to recoveries such as ‘bad credit institutions’;
4. External, including interest rates and legal framework (and, as a consequence, the
length of the recovery process); and
5. Other risk factors.
274. Each institution is responsible for identifying and investigating additional
risk drivers that are relevant to its specific circumstances. Institutions should collect data on what they consider to be the main drivers of loss for a given group of facilities, and should include the most material drivers in their LGD estimation process. The institution’s judgements as to which risk drivers are most material should be appropriately documented and should be discussed with supervisors. Estimation methodologies
275. In principle, supervisors do not require any specific technique for LGD
estimation (or for estimating other IRB parameters). However, institutions will have to demonstrate that the methods they choose are appropriate to the institution’s activities and the portfolios to which they apply. The theoretical assumptions underlying the models should also be justified. The CRD does not permit the use of estimates based purely on judgemental considerations.
276. An institution should choose a technique or a combination of techniques
for quantifying estimated LGD.
The four main alternatives are Workout LGD, Market LGD, Implied Market LGD, and Implied Historical LGD. The latter two techniques are considered implicit because they are not based directly on the realised LGD of defaulted facilities. The analysis of methods provided below does not relieve institutions of their responsibility to conduct their own analysis of which of the methods (if any) best fits their business, or whether some other method might be more appropriate.
277. In the Workout LGD technique, the cash flows resulting from the workout
and/or collections process, properly discounted, are calculated. Calculations for the exposures that are currently held by the institution

have to be based on actual recovery data in order to produce a forward looking estimate. The calculation should not be based solely on the market value of collateral; appropriate adjustments should be applied.
278. The calculation of defaultweighted average of realised LGDs (Annex VII
Part 4 Paragraph 73 of the CRD) requires the use of all observed defaults
in the data sources. Observed defaults include incomplete workout cases, although they will not have values for the final realisation of LGD because the recovery process has not ended.
279. Institutions should incorporate the results of incomplete workouts (as
data/information) into their LGD estimates, unless they can demonstrate that the incomplete workouts are not relevant. The assessment of relevance should take into account market specifics and should show that the exclusion of incomplete workouts does not lead to underestimation of LGD and has no material impact on LGD estimations.
280. When institutions include incomplete workouts in the calculation of the
defaultweighted average of realised LGDs, they should document and demonstrate the pertinence of their approaches, including, in particular, their choice of observation period and their methodologies for estimating additional costs and recoveries beyond this period and, if necessary, within this period.
281. The Workout LGD technique can be applied using either direct estimates or
a twostep approach. When direct estimates are used, a quantitative estimate is derived for each individual exposure based on its specific characteristics. In a twostep approach, an average LGD is estimated for all exposures covered by the same facility grade or pool. If a pooling approach is used in the Retail exposure class, individual direct estimates must be averaged to produce an LGD for the pool, because it is necessary to produce an aggregated LGD for all exposures in a pool. However, the CRD proposal also allows Retail estimates to be derived using grades, in a similar way to those for Corporate, Institution, and Sovereign exposures. Where this method is used, there is no need to aggregate LGD estimates for Retail exposures.
282. A direct estimation procedure allows the automatic calculation of each of
the discrete elements that make up LGD, based on the experience of each of the corresponding elements in an RDS which is relevant for the element in question (e.g., real estate recovery values, or discount rates). One example of a direct estimation procedure is a statistical model which uses risk drivers as explanatory variables. Under a twostep procedure, an overall adjustment to the LGD would instead be applied to the grade or pool as a whole, to reflect the extent to which the average LGD for the requisite RDS is not representative of the forwardlooking longrun defaultweighted average (or economic downturn estimate).
283. Market information may be used in a number of different ways in LGD
estimation. Historical market prices realised on collateral or in exchange for some or all of the claim on the obligor will inform estimates in the RDS when the Workout LGD technique is being used. Current market prices of collateral on current exposures will probably influence their estimated LGD. As an alternative to Workout LGD, the RDS may instead be derived

from the observation of market prices on defaulted bonds or marketable loans soon after default or upon their emergence from bankruptcy. If an institution uses market information as an alternative to workout LGD (for example, in the case of scarce data), the market data should conform to the general requirements for the use of external data (see section 3.4.4. on data sources). An institution may derive the best estimate of expected loss for its defaulted exposures directly from their market prices where these exist. LGD estimates based on the market prices of defaulted obligations are known as Market LGDs. It is also possible to derive estimated LGDs from the market prices of nondefaulted loans or bonds or credit default instruments. These are referred to as Implied Market LGDs.
284. LGD estimates based on an institution’s own loss and recovery experience
should in principle be superior to other types of estimates, all other things being equal, as they are likely to be most representative of future outcomes. However, such estimates may be improved by the careful use of relevant external information such as market prices on defaulted exposures; this should be the case where internal data are scarce. It is challenging to derive a CRDcompliant LGD element from the credit spreads on performing exposures. Nevertheless, implied Market LGDs may be used where no other data are available to produce reliable estimates, and if validation results show that these estimates are reliable.
285. In practice, the market and implied market LGD techniques can currently
be used only in limited circumstances. They may be suitable where capital markets are deep and liquid. It is unlikely that any use of market LGD can be made for the bulk of the loan portfolio.
286. The implied historical LGD technique is allowed only for the Retail
exposure class. LGD estimates for Retail exposures may be derived from realised losses on exposures within the grade or pool and from appropriate estimates of PDs. The ‘realised loss’ for such Retail exposures is the total loss divided by the total number of exposures in the grade or pool, while the ‘average realised LGD’ is the same total loss divided by the number of defaulted exposures in the grade or pool. (See Annex VII, Part 4, Paragraphs 73, 74, and 82 of the CRD). The estimation of implied historical LGD is accepted in cases where institutions can estimate the expected loss for every facility rating grade or pool of exposures, but only if all the minimum requirements for estimation of PD are met. The estimation of PD should cover all the qualitative and quantitative requirements of validation. The estimation of EL (in lieu of LGD) seems to bring additional challenges. Downturn LGD
287. According to Annex VII, Part 4, Paragraphs 73 and 74 of the CRD,
institutions shall estimate LGDs by facility grade or pool that are appropriate for an economic downturn where this would be more conservative than the longrun average. Producing such estimates presents challenges, given the limited data that institutions are likely to have available. Institutions should nevertheless establish a rigorous and welldocumented process for assessing the effects, if any, of economic

downturn conditions on recovery rates and for producing LGD estimates consistent with downturn conditions. The process will involve three tasks, which could be addressed in an integrated manner. (1) Identifying appropriate downturn conditions for each supervisory exposure class within each jurisdiction. Appropriate downturn conditions are those in which the relevant drivers of default rates are consistent with conditions in which credit losses for the supervisory exposure class are expected to be substantially higher than average. Institutions may identify such conditions at a more granular level if such an approach adds to risk sensitivity. However, as a general rule, where recovery rates are sensitive to local conditions, institutions should, at a minimum, consider each exposure class and each jurisdiction separately, unless they can justify the combination of exposure classes and/or jurisdictions on the grounds that exposures in the same exposure classes in different jurisdictions exhibit strong covariance in recovery rates. While institutions are building better data sets and developing more experience in estimating downturn LGDs, supervisors may choose to direct them to focus their efforts on types of exposures for which they believe the downturn effect is of special concern. (2) Identifying adverse dependencies, if any, between default rates and recovery rates. Adverse dependencies between default rates and recovery rates might be identified directly by statistical analysis, where data are available; or indirectly by examining the relationships between the drivers of default and recoveries. The indirect approach might include analysis of the behaviour of collateral values where collateral has a significant influence on recoveries. (3) Incorporating any adverse dependencies that have been identified between default rates and recovery rates, in order to generate LGD parameters for the institution's exposures that are consistent with identified downturn conditions. This might be achieved, for example, by analysing recovery rates during periods of economic downturn or by using forecasts based on the modification of appropriate risk drivers in a manner consistent with downturn conditions. If no material adverse dependencies between default rates and recovery rates have been identified through analysis consistent with (2), the LGD estimates may be based on longrun defaultweighted averages of observed loss rates or they may be derived from forecasts that do not involve stressing appropriate risk drivers.
288. Annex VII, Part 4, Paragraph 74 of the CRD requires institutions to ensure
that downturn LGDs used to calculate riskweighted exposure amounts and expected loss amounts are not less conservative than the longrun average LGD. Institutions that cannot demonstrate in other ways that LGD estimates are not lower than their longtime average LGD estimates should be prepared to provide an estimate of the longrun default weighted average loss rate given default to supervisors if requested. The

downturn LGD may in some circumstances be the same as the longrun average LGD, but it may not be less conservative.
289. Institutions are likely to calculate a variety of LGDs, conditional on
different economic assumptions, for different reporting and management purposes. The rationale for using different LGDs and the specific reasons for the differences should, however, be explained and documented in accordance with the requirement of Annex VII, Part 4, Paragraph 55 of the CRD.
290. There is no expectation that the stress tests referred to in Paragraph 41 or
42 of Annex VII, Part 4 of the CRD will necessarily produce an LGD that is either lower or higher than the LGD estimated according to Annex VII, Part 4, Paragraph 74. To the extent that the identification of downturn periods under Paragraph 74 coincides with the stress tests in Paragraph 41 or 42, the calculation might turn out to be similar. More generally, some stress test calculations under Paragraph 41 or 42 may function as one tool for assessing the robustness of the LGD estimation under paragraph 74. 18 LGD for Expected Loss
291. Institutions that provide their own estimates of LGD should use LGD
estimates appropriate for an economic downturn both in calculating risk weighted exposure amounts and in calculating expected loss for exposures that are not in default, if this is more conservative than the longrun average. However, for defaulted exposures, the CRD requires the use of an estimate of expected loss (ELBE ) that should be the best estimate of expected loss, given current economic circumstances. (See Annex VII, Part 1, Paragraphs 3, 9 (for retail exposures), and 28, and Part 4, Paragraph 79 of the CRD). In such cases, LGD is defined according to Paragraph 79 of Annex VII, Part 4 of the CRD as the sum of ELBE and a measure reflecting possible additional unexpected losses during the recovery period. If downturn conditions are relevant to a certain type of exposures, then this should be taken into account in measuring the possibility of additional unexpected losses during the workout period. This treatment does not apply to exposures under the double default treatment, since, by definition, EL for these exposures is set at zero.
3.3.3.3. Conversion Factors
292. The third parameter used in the supervisory formula for calculating
regulatory capital requirements is Exposure Value. However, the CRD requires that the parameter to be estimated is the Conversion Factor (CF).
293. Article 87(9) of the CRD allows institutions to use own estimates of
Conversion Factors. However, industry practice in this area is still at an early stage. In particular, the basic definitions and main principles that underlie the CF estimation process need to be clarified. A large proportion of this section is therefore devoted to definitions. It is envisaged that with 18 Paragraphs 41 and 42 of Annex VII, Part 4 of the CRD will be dealt with in the broader context of stress testing in a forthcoming paper of CEBS on this subject.

time, as industry practice develops, more detailed guidelines on CF estimation and validation methodologies will be produced. Basic principles
294. CF estimates should reflect the experience and practices of the institution
as well as the external environment in which it operates. CF, even more than PD and LGD, depends on how the relationship between institution and client evolves in adverse circumstances, when the client may decide to draw unused commitments. Careful consideration of these aspects should therefore be an integral part of the CF estimation and validation processes.
295. Any use that institutions might make of data gathered from external
sources or across different time periods should be performed with care (see section 3.3.5. on external vendor models and section 3.4.4. on data sources). 296 Since a given percentage variation in exposure values results in an equal percentage change in capital charges, any approximation and/or shortcut in estimating exposure values that the institution decides to adopt should form an important aspect of validation and assessment. Definitions
297. Although not explicitly stated, the CRD treats the exposure value as
consisting of two positions: the amount currently drawn and an estimate of future drawdowns of committed but untapped credit. The potential future drawdowns are described in terms of the proportion of the undrawn amount.
298. The definition of Conversion Factor is given in Article 4(28) of the CRD, which states that 'conversion factor' means the ratio of the currently
undrawn amount of a commitment that will be drawn and outstanding at default to the currently undrawn amount of the commitment. The definition can be analysed by examining its components:

CFs shall be estimated for current commitments. Institutions are
required to hold capital for commitments that they have currently taken on.
The CF shall be expressed as a percentage of the undrawn amount of
the commitment.

Some institutions plan to use rating systems that estimate a ratio
expressed as a percentage of the total commitment (totallimit ratio), rather than as a percentage of the undrawn amount of the commitment. Using a totallimit ratio is not compliant with the requirements of the CRD. Thus, the momentum approach (see Paragraph 305 of these Guidelines), in its simplest form, does not comply with the requirements of the CRD. However, institutions might apply to receive approval for CFs derived from the momentum approach if they take into account the measures highlighted below.

The CF shall be zero or higher.
300. Even though it is not explicitly stated in the CRD, it is clear from the
definition that CFs shall be zero or higher. This implies that the exposure value for any facility shall be no less than the exposure value as defined in
Annex VII, Part 3, Paragraphs 1 to 10 of the CRD. If additional drawings
after the time of default are not reflected in the LGD estimation, they have to be taken into account in the estimation of CF, whatever the method chosen. Time horizon
301. The above definition of Conversion Factor requires institutions to estimate
how much of the currently undrawn amount will be drawn by the time of default. Calculating the Conversion Factor thus involves observing and comparing (at least) two points in time: the present time and the time of default. Estimated Conversion Factors are derived from realised Conversion Factors for defaulted exposures in the RDS. The time of default and the drawn amount at default of the exposures in the RDS can be observed directly.
302. The following paragraphs provide a very brief outline of four different
approaches to measuring realised CFs.
This list is not meant to be exhaustive and does not preclude any other approach. Institutions are encouraged to develop approaches that best fit their specific business. In particular, the following descriptions do not relieve institutions of their responsibility to conduct their own analysis of which (if any) of the approaches described below best fits their business, or whether other approaches might be more appropriate. Similarly, they do not restrict the views of supervisory bodies concerning other methods, nor are they intended to hinder the development of more advanced methods of CF estimation.
303. Institutions should ensure that the points in time chosen for the calculation
of realised CF in the RDS are appropriate for a oneyear horizon for estimating CFs. This might require considering sets of different time intervals preceding the time of default. ß Cohort approach. The observation period is subdivided into time windows. For the purpose of realised CF calculations, the drawn amount at default is related to the drawn/undrawn amount at the beginning of the time window.
304. When using this approach, the institution shall use a cohort period of one
year unless it can demonstrate that a different period would be more conservative and more appropriate.
Fixedhorizon approach. The drawn amount at default is related to the
drawn/undrawn amount at a fixed time prior to default. This approach implies the simplifying assumption that all exposures that will default during the chosen horizon will default at the same point in time: the end of the fixed horizon.

305. When using this approach, the institution shall use a fixed horizon of one
year unless it can demonstrate that another period would be more conservative and more appropriate.

Variablehorizon approach. This is a generalisation of the fixed time
horizon. It consists of using several reference times within the chosen time horizon rather than one (for example, comparing the drawn amount at default with the drawn amounts at one month, two months, three months, etc. before default)
Momentum approach. Some institutions have traditionally expressed
Conversion Factors in their internal systems as a percentage of the total outstanding limit (totallimit ratio), and not of the undrawn amount. Institutions that use this approach have no intrinsic need to decide on a reference point in time prior to default, since the drawn amount at the time of default is compared only to the total limit at the time of default.
306. In its simplest form, the momentum approach does not fulfil the
requirements of the CRD, because it estimates the totallimit ratio rather than the CRDcompliant conversion factor defined as a percentage of the undrawn amount. This has the consequence that the currently drawn amount is not considered. However, this method could be a starting point, if the institution addressed this weakness by recalculating the totallimit ratio as a CRDcompliant Conversion Factor using relevant information from the CF grade assignment process. The use of this method can only be a transitory solution, subject to reconsideration by the supervisory authorities.
307. At this stage, and until more detailed empirical evidence is gathered, supervisors are not ruling out any of the above approaches. Institutions
are encouraged to develop more sophisticated rating and estimation systems for Conversion Factors. Regardless of the approach chosen, supervisors expect institutions to:
Analyse and discuss their reasons for adopting a given approach,
justify their choices, and assess the impact that the use of a different timeframe would have. · Identify the possible weaknesses of the chosen approach and propose methods to address or compensate for them.
Evaluate the impact of the chosen approach on final CF grades and
estimates by investigating dynamic effects such as interactions with timetodefault and credit quality.
308. A sound approach to model development and an effective validation
challenge should take these and other considerations into account. The documentation should provide clear information about these (and other) issues. Supervisory conversion factors versus own estimates

309. Article 87(7) of the CRD requires institutions to provide own estimates of
conversion factors for exposures belonging to exposure class (d) of Article 86(1), i.e. retail exposures. For exposures belonging to the exposure classes referred to in points (a) to (c) of Article 86(1), according to Article 87(8), institutions shall apply the conversion factors set out in Annex VII, Part 3, Paragraph 11 points (a) to (c) of the CRD. The conversion factors for the instruments mentioned in Paragraph 11 have a fixed value (supervisory conversion factors).
310. However, according to Article 87(9) of the CRD, the competent authorities
may permit institutions to use own estimates of conversion factors for the exposures mentioned above, in accordance with Article 84 and Annex VII, Part 4, for the instruments listed in Annex VII, Part 3, Paragraph 11 of the CRD.
311. The permission to use own estimates of conversion factors, if granted by
the competent authority, will require the institution to apply its own estimates of conversion factors to all exposures indicated in Annex VII, Part 3, Paragraph 11 of the CRD (subject to the provisions on rollout).
312. Annex VII, Part 3, Paragraph 13 of the CRD stipulates that: For all other
offbalance sheet items than mentioned in Paragraphs 1 to 11, the exposure value shall be the following percentage of its value: 100% if it is a full risk item, […]. For these purposes the offbalance sheet items shall be assigned to risk categories as indicated in Annex II.
313. Notwithstanding this provision, for the purpose of permitting the
application of own estimates of conversion factors (as defined in Article 4(28) of the CRD), supervisors will interpret ‘credit line’ (as indicated in
Annex VII, Part 3, Paragraph 11(c) of the CRD) as being sufficiently broad
to cover each type of offbalance sheet exposure mentioned in Annex II of the CRD that is not identified as a fullrisk item and that is not already explicitly mentioned elsewhere in Annex VII, Part 3, Paragraph 11(a) to (c). On an exceptional basis, institutions could use the supervisory Conversion Factors for some kinds of exposures, subject to the relevant supervisory authority’s approval, if they can demonstrate that it’s impossible to develop a relevant approach in order to estimate the CFs for those exposures
19. Fullrisk items will remain subsumed under Paragraph
13 of Annex VII, Part 3 of the CRD and receive an exposure value of 100 percent of their value. Data
314. The Reference Data Set for CF/Exposure Value should contain at least the
following elements:

As with the RDS for LGD, and unlike the RDS for PD estimation, only
exposures to defaulting obligors should be included;
The drawn and undrawn amount at default;
19 In order to avoid cherry picking in this respect supervisors will monitor evolving market practices concerning the estimation of conversion factors
The drawn and undrawn amount at a time (or times) prior to default;
and
Factors must be available to group the defaulted facilities in meaningful
ways.

Ideally, it should:

Cover a period that is sufficiently long to include at least one business
cycle;
Contain all defaults that have occurred within the considered time
frame;
Include all relevant information needed to estimate the risk
parameters;
Include data on the relevant drivers of CF.
316. The institution should ensure that the RDS remains representative of its
current portfolios. The RDS should therefore be updated when necessary (see Annex VII, Part 4, Paragraph 50 of the CRD). Risk Drivers
317. The CRD states that Conversion Factor estimates shall be based on
material drivers of risk. Annex VII, Part 4, Paragraph 49 of the CRD states some of the CRD’s overall requirements for estimation.
318. Institutions need to consider and analyse all material risk drivers.
Materiality should be judged on the basis of the specific characteristics of their portfolios and practices.
319. Industry practice has not yet developed in this area, and providing a
minimum list of factors would be particularly difficult and controversial. However, some areas should be explored when investigating the potential drivers of the Conversion Factor parameter (This list should not be considered exhaustive, nor does the list prescribe how each specific driver should be used in the estimation approach.):
The institution’s strategies and policies with respect to account monitoring (Annex VII,
Part 4, Paragraph 89 of the CRD); · The institution’s ability and willingness to prevent further drawings short of payment
default (Paragraph 89); · Factors influencing the borrower’s demand for funding/facilities; · Factors influencing the institution’s willingness to supply funding/facilities; · The attitude of third parties (such as other financial institutions, trade creditors, and owners) whose presence as alternative sources of supply may increase or reduce the demand for funding/facilities for an individual institution; and
The nature of the particular facility and the features built into it (such as covenant
protection).
320. Institutions are encouraged to develop approaches which take account of a
broader and more tailored set of drivers.
3.3.4. Quality of internal documentation

321. Annex VII, Part 4, Paragraphs 31 to 40 of the CRD set minimum
requirements regarding documentation and data maintenance.
322. Supervisors should assess the institution‘s development, validation, and
operation of rating systems used. As part of this process, a competent authority may itself replicate all or part of the institution‘s validation, or have a third party do so. The institution should document all its development and validation steps in such a way that a third party would be able to understand the reasoning and procedures underlying the development and validation. This also holds true for the documentation of the institution’s operations.
323. At a minimum, the documentation of the development and validation of
the institution’s rating system should include detailed descriptions of the development methodologies, the assignment and classification processes, calibration, and the internal procedures, processes, and tests used by the institution to validate the rating system.
324. An institution should ensure that its rating systems are valid on an
ongoing basis. Since rating systems and their operations are subject to constant improvements, validation should be an iterative process. After material changes in the rating system or processes, institutions should ensure that their documentation is up to date. The documentation of development and validation should record the iterations and the processes used to validate them.
325. The documentation should also reflect the fact that different rating
systems can be used for different portfolios. Supervisors would expect institutions to maintain different sets of documentation on development, validation, and operations of each rating system or combination of rating systems used and of the portfolios to which they are applied. 326. All documentation relating to an institution’s rating systems should be made available to the competent authority upon request, and to a third party acting as its agent.
327. Section 3.3.4. applies to all documentation regarding model development
and validation, including rating systems and PD, LGD, and CF estimation.
328. The documentation of statistical models and other mechanical methods
could cover at least the following areas:
1. Documentation of model design:

Delineation criteria for the rating segment. · Description of the rating method, the type of model used, and the
architecture of the model. · Model architecture and fundamental assumptions, including the definitions of default, the rationale for and analysis supporting the choice of rating criteria, typical circumstances under which the model does not work effectively, and the general strength and weaknesses of the model. · The reason for selecting a specific model type.
Documentation of all model functions.
Description of the rating process.
Duties and responsibilities with regard to the rating model. · Model change policy.
2. Documentation of development and analyses
Relevance of the criteria used in the model. · Dataset used in model development. · Quality assurance for the dataset.
Model development procedure. · Selection of model input factors and assessment of model
parameters. · Quality assurance/validation during model development, including at least outoftime and/or outofsample performance tests.
In the case of models for estimating risk parameters, calibration of
risk parameters per grade or pool
Procedure for validation/regular review. · Use of human judgement to complement the model.
329. Tests for quality assurance/validation should be performed only if the data
needed to set aside for them do not unduly reduce the data set for model development. In cases of scarce data, it might be more advisable in some circumstances not to set aside an outofsample data set, but rather to wait until the following year and the respective new rating assignments, and use them as an outoftime sample.
3.3.5. External vendor models
330. Annex VII, Part 4, Paragraph 36 of the CRD states that the use of a model
obtained from a thirdparty vendor that claims proprietary technology is not a justification for exemption from documentation or any other of the requirements for rating systems. Thus these models generally have to fulfil the same requirements as models produced inhouse.
331. In particular, Annex VII, Part 4, Paragraph 31 of the CRD requires
institutions to prove that all models used (including external models) have good predictive power, that the data used to build the model is representative of the actual portfolio of the institution, and that a regular cycle of model validation is in place. The burden is on the institution to satisfy competent authorities that it complies with these requirements. In other words, supervisors will not validate external vendors.
332. Under the IRB approach, institutions can use statistical models in the
rating process and/or to estimate the risk parameters required for the approach. Although it should be emphasised that the rating process in total should be an internal rating process, it is not necessary that all parts of the process be developed internally. Most institutions use externally developed statistical models to some extent in their rating process.
333. In the context of these guidelines, an external vendor model is a model or
parts of a model used by an institution and developed by an independent

external third party that uses certain inputs to assign exposures to certain rating grades or to estimate certain risk parameters.
334. In addition to the general requirements mentioned above, the
transparency of the vendor model and of its linkage to the internal information used in the rating process will be examined closely by supervisors. Transparency of the vendor model
335. To fulfil the CRD’s requirements regarding internal governance (Annex VII, Part 4, Paragraphs 123 to 126) and the requirements regarding the
responsibilities of the Credit Risk control unit (Paragraphs 127 to 129) and the Internal Audit unit (Paragraph 130) for external vendor models, the institution has to prove that it understands the external model in all its aspects. The supervisor’s assessment of the institution’s use of external models will therefore place special emphasis on the inhouse knowledge concerning the development and the appropriate use of external vendors’ models.
336. This means, for example, that external vendors have to document the
development and fundamentals of the validation process of their models in a way that permits third parties to gain a detailed understanding of the methodology applied and to assess whether the model is still performing adequately on their own customer bases. Moreover, the institution has to prove that the inhouse knowledge to do this is available. In particular, institutions should be aware of all the limitations of the model and the circumstances in which the model does not perform as expected.
337. The institution has to ensure that users will be adequately trained in the
use of the model, and that inhouse instructors will be available. The institution also has to present plans for guaranteeing the validation and, if necessary, further development of the model in the future. Institutions have to ensure that the performance of the model can be assessed, and adjusted if necessary, even in the event that the vendor discontinues support, or similar events. Linkage to internal information used in the rating process
338. The institution has to know what information (data) is processed in the
external model and how this information is linked to information that is processed inhouse: for example, if the vendor’s definition of input factors such as sales and debt are consistent with those used inhouse. The institution has to make sure that the aggregation of the different parts of the model does not result in an inconsistent rating method, particularly in cases where parts of the model developed externally are used simultaneously with parts developed inhouse. It may also be necessary to check whether there is ’double counting’ of information in the internal and external parts of the rating model. Finally, the combination of separately developed parts of a rating system requires an extra riskquantification exercise: i.e., the risk parameters have to be estimated on an appropriate data set as in the case of a purely internally developed rating system.

An example:
339. Institution A estimates the rating class for corporate customers with a
model that consists of two separately developed parts. Part A uses balance sheet data to estimate the probability of default with a statistical model purchased from an external vendor. Part B, using soft facts, was developed inhouse, and also uses statistical methods.
340. The institution has to prove that the data used to build the external model
is representative of the actual portfolio. If the model is used only for assigning exposures (i.e., for ranking borrowers in relative terms) the proof of consistency with the CRD’s definition of default (Annex VII, Part 4, Paragraph 44) can be omitted.
341. If the institution also uses the model for PD estimation of rating classes
(i.e., the PDs from model A are used as inputs in PD estimations for the entire model), the institution also has to prove that the default definition used in Part A is the same as the one used for Part B, and that both are consistent with the definition in the CRD. If this is not the case, the institution has to prove that it is able to map the default definition of Part A into Part B, and both definitions to the definition used in the CRD.
342. Furthermore, the institution has to be aware of how different information
is processed in Part A. For validation purposes, the institution has to treat the combined outcome of the two parts of the model like the outcome of a single internally developed model. The institution should also compare the predictive power of the combined model with the predictive powers of the individual parts. In this way, the institution could determine if one of the two parts is no longer predictive, or if the combination of the two parts is the cause for a decline in predictive power.
3.4. Data
343. The CRD requires data to be held and stored for several different
purposes.
344. Institutions’ physical databases need not be built to address each of these
purposes separately, but may contain data relating to a mix of purposes.
345. There may also be different sources of data:

For creating the model for assignments: Internal, external, and pooled
data might be used to determine the weight of the input variables.
For calibrating the model for estimates: Internal, external, and pooled
data (Annex VII, Part 4, Paragraphs 46, 66, 69, 71, 81 and 85 of the CRD) (external and pooled data with restrictions (Annex VII, Part 4, Paragraphs 57, 58, 64, 69, 111, 120, 129 and 130 of the CRD)).
For outcome and performance data: Internal data generated during
model development and use. · For calculating the current minimum capital requirements: Internal data.

3.4.1. Data accuracy, completeness and appropriateness
346. Annex VII, Part 4, Paragraph 31 of the CRD requires the data used as
inputs into the model to be accurate, complete, and appropriate. This refers to the use of a statistical model and other methods to assign exposures to obligors or facilities grades or pools. Within this context, these terms should be interpreted to have the following meaning:
347. ‘Accurate’ refers to the degree of confidence that can be placed in the data
inputs. Data should be sufficiently accurate to avoid material distortion of the outcome.
348. ‘Complete’ means that databases provide comprehensive information for
the institution (i.e., data for all relevant business lines and all relevant variables). While missing data for some fields or records may be inevitable, institutions should attempt to minimise their occurrence and aim to reduce them over time.
349. ‘Appropriate’ means that data do not contain biases which make them
unfitforpurpose.
IT systems for IRB calculation
350. A sound IT infrastructure is essential for the integrity of the capital
calculation. This soundness will be considered as part of a wider assessment by the supervisor. Databases that are used to replicate calculations need to be adequately archived and backed up. Institutions should document workflows, procedures, and systems related to data collection and data storage.
351. Institutions should have IT systems that ensure:

Continuous availability and maintenance of all relevant databases.
Replicability of databases and of the outputs of the rating systems for
validation purposes.

These IT systems should be included in the institution’s general
contingency plans, in order to guarantee the recovery of the information. Established controls should prevent access by unauthorised people.
The information used in credit risk modelling is usually complex and
extensive. Institutions should assign enough resources to allow for the possibility of expanding databases without the risk of losing information. Institutions should aim to reduce the risk of human error by increasing the automation of all material procedures used in the quantification of the capital requirement. However, sufficient IT support of IRB data should not be interpreted to mean that institutions have to store their complete data history ’online‘ and have all input data available at the push of a button, but rather that all data should be stored in a suitable way and should be ready to access within an appropriate time frame.

Audit review
354. Reviews of data quality by Internal Audit or another comparable
independent auditing unit should include at least the following: an annual review of controls, periodic sampling of data, and review of system reconciliations. For external data and pooled data, this work should be done to the fullest extent possible.
3.4.2. Data quality standards and consistency with accounting data
355. Institutions should define their own standards for ensuring data quality
and should strive to improve these standards over time. They should measure their performance against these standards. Institutions should work on an ongoing basis to ensure that their data is of high enough quality to support their risk management processes and the calculation of their capital requirements. This could include reviewing the structure of input data to identify outliers or implausible values, changes from previous periods, and the amount of missing data. The review should also indicate whether the integrity of data is being maintained.
356. Regular reconciliation against accounting data could provide an additional
quality check. Institutions need to identify and explain material divergences that come to light in the reconciliation. Full reconciliation may not be possible, as risk data may differ from accounting data for good reasons (for example, ‘Conversion Factor’ has no equivalent in accounting), but should be performed when possible. In any case, institutions should perform consistency checks that include an audit trail of data sources, total and record count checks when data move between systems, recording of data that are excluded or introduced at different stages of data manipulation, etc. Significant discrepancies should be investigated.
357. Data should be subject to appropriate quality controls, according to their
criticality. There should be minimum checks, including a periodic independent review to confirm that data are accurate, complete, and appropriate. For example, data quality could be reviewed by replicating the preparation of data (including collection and transformation) and the outputs of models, using the same databases and algorithms used by the institution. This could be done on a sample basis. Supervisors could assess specific parts of this process to verify the conclusions reached by the independent reviewer.
358. Institutions’ rating assignment systems should include a welljustified
policy on their tolerance for gaps in the data for an obligor and on conservative approaches to treating missing data, for example by substituting values They should seek to minimise the amount of missing data over time.
359. In order to facilitate the dialogue between institutions and supervisors on
data quality standards, institutions should provide their supervisors with

an adequate set of documentation. The following can be regarded as good practice:

Data policy and statement of responsibility: Institutions should
establish an explicit data policy, which could be part of a general data policy. They are responsible for ensuring the quality of their data and should be able to convince supervisors that they meet fitforpurpose standards.
Data directory: Institutions should have clear data directories
(dictionaries) that provide definitions of data items.
Database descriptions: Documentation for databases should allow
institutions to provide supervisors with the information needed to determine the soundness of the databases. For example: A general description of the databases (for example, information on the relational database model, including tables, keys, triggers, stored procedures; performance data such as overall maximal size; security information such as owner, users with readandwrite access, and maintenance responsibilities). The source of the data. The processes used to obtain and load the data. The filters used to create and debug the database (e.g., maximum and minimum values and treatment of missing values). Controls on access, consistency, etc. A specific description of the variables included.

Institutions should prepare a global map of all the data and IT systems
weaknesses found during the internal review process (for example, lack of automation) with an assessment of their impact on the final calculation. Institutions should also state how they plan to correct the weaknesses.
3.4.3. Representativeness of data used for model development and
validation
The CRD’s requirements for data samples used in the development of
rating systems are different from those for samples used in estimating risk parameters (PD, LGD, and CF). The text refers variously to ‘representativeness,’ ‘strong link,’ and ‘comparability,’ depending on the purpose for which the data are used (assigning exposures to obligors or facilities, grades or pools, risk parameter estimation) and on the data sources (external, internal, pooled data). In certain cases, the CRD requires ‘broad equivalence’ between the definitions of default and loss used in the data sets and the supervisory definition given in Annex VII, Part 4, Paragraphs 44 and 45. Data requirements
In fulfilling the requirements on data quality, any uncertainties – if they
are admissible at all – should be accompanied by some degree of greater conservatism in the estimates or in the assignment processes, as required

in Annex VII, Part 4, Paragraphs 19 and 54 of the CRD. However, institutions should not treat the application of conservatism as a substitute for fully meeting the requirements. Where conservatism is applied, it should be based on the institution’s internal practices. Data requirements for the observation period (Annex VII, Part 4, Paragraphs 66, 71, 85, and 94 and the possible relaxation mentioned in Article 154 of the CRD) should be satisfied fully, without the option of compensating shorter observation periods with applied conservatism. Data sets used for risk parameter estimation (comparability)
363. Institutions have to demonstrate the comparability of data sets used for
estimation to the institution’s current portfolio (Annex VII, Part 4, Paragraph 52 of the CRD). This applies equally to internal, external, and pooled data and to the combination of such data sources. The interpretation of ‘comparability’ should include at least the following points:

Comparability should be based on analyses of the relevant
characteristics, e.g. the population of exposures represented in the data used for estimation, the lending standards used when the data was generated, and other relevant characteristics, in comparison to the corresponding properties of the institution’s current portfolio. Other relevant characteristics could include, for example, the distribution of the obligors across industries, the size distribution of the exposures, and similarity in the geographic distribution of the exposures, to the extent that these apply to the respective data sets.
In analysing the comparability of populations, key characteristics
(quantitative and qualitative obligor and facility characteristics) that could relate to default (for PD estimation) or loss (for LGD estimation) should be taken into account. The analysis should be based on these characteristics or on a mapping from one set of characteristics to the other. For example, the analysis could consider the distribution of the population according to the key characteristics and the level and range of these key characteristics. In all cases, and especially for external and crossborder samples, any differences in the meaning of the key characteristics should be documented and considered in the model building or risk quantification. It is expected that the distribution of the population and the level and range of these key characteristics should approximate those of the corresponding institution’s current portfolio. Although it is unrealistic to expect a perfect match in every case, the institution should nevertheless ensure that the distributions are reasonably close.
Material observed differences in the key characteristics used for
estimation are relevant information in the sense of Annex VII, Part 4, Paragraph 49 of the CRD, and should be taken into account in estimations by making appropriate adjustments. If adjustments are difficult to quantify, the institution should consider the use of other data sets.
Statistical tools may be used to quantify and ensure the evidence.

Data used for developing models for exposure assignment or risk parameter estimation (representativeness)
364. The representativeness requirement of Annex VII, Part 4, Paragraph 31(c)
of the CRD applies both to models and other mechanical methods used to assign exposures to grades or pools, and to statistical default prediction models generating defaultprobability estimates for individual obligors (see
Annex VII, Part 4, Paragraph 65 of the CRD). The interpretation of
‘representative’ includes the following points (the first, third, and fourth points are also valid for the estimation of risk parameters):

Representativeness in the sense of Paragraph 31(c) of the CRD
should be interpreted similarly, regardless of the source of the data:
internal, external, or pooled data sets, or a combination of these. · Representativeness for the assignment of obligors does not require that the proportion of defaulted and nondefaulted exposures in the data set be equal to the proportion of defaulted and nondefaulted exposures in the institution’s respective portfolio.
For analysing the representativeness of the sample with respect to
the population of the institution, all key characteristics (quantitative and qualitative obligor and facility characteristics) that could relate to default (for PD estimation), loss (for LGD estimation), or additional drawings (for CF estimation) should be taken into account. The analysis should be based on these characteristics or on a mapping from one set of characteristics to the other. For instance, the analysis could include considering the distribution of the population according to the key characteristics and the level and range of these key characteristics. Material observed differences in the key characteristics should be avoided, for example by using another sample. · Where applicable, the use of statistical methodologies (such as cluster analysis or related techniques) to demonstrate representativeness should be recommended. · The CRD does not contain requirements on the definitions of default and loss used in building the model for assignments of obligors or exposures to grades or pools. Institutions are allowed to use their own definitions provided they document them and apply them consistently, and as long as the CRD’s requirement for good predictive power (Annex VII, Part 4, Paragraph 31(a)) is fulfilled. Pooled data sets

Annex VII, Part 4, Paragraph 57(b) of the CRD requires that “the pool shall
be representative for the portfolio for which the pooled data is used.” The interpretation of ‘representative’ in the context of data pools includes the following points:

Representativeness should be demonstrated according to plausible
criteria that have been set in advance in a general policy.
These criteria could include the comparability of populations of
exposures in the relevant parts of the pool.
In the case of pooled data, the default definition used by an institution
for any part of the pool should be similar to the default definition used for that part by the other institutions in the pool. Any underestimation of risk that might result from applying similar default definitions should be avoided. Institutions should particularly avoid curtailing their use of ‘unlikeliness to pay’ indicators in order to achieve this similarity in default definitions.
Where applicable, the use of appropriate statistical methods to
demonstrate representativeness should be recommended. Use of data histories

Annex VII, Part 4, Paragraph 50 of the CRD requires institutions to
demonstrate that their estimates of the risk parameters are representative of longrun experience. Representativeness, in the context of Paragraph 50, means that the estimates based a future time horizon of one year nevertheless reflect at least the relevant events experienced by the institution in the past over a longer time period.
3.4.4. Data sources and definition of default
If institutions use external data sets for risk parameter estimation, they
should apply appropriate adjustments to their estimates in order to achieve broad equivalence to the reference definition in the CRD. In the case of pooled data, the definition of default used by the institution for any
part of the pool/data set should be similar to the default definition used for
that part by the other institutions in the pool, as required by Annex VII, Part 4, Paragraph 57(a) of the CRD.
Special considerations for default definitions of pooled data sets: for data
sets collected from the same market, the similarity of the definition of default could be checked by examining the wording of the definition and the internal use of the definition, or by looking at the practical usage of the definition for that market.
For cross borderdata sets, the broad scope of the CRD’s definition of
default could result in countryspecific definitions. Two cases should be distinguished here (see also section 3.3.2.1. on the definition of default):

Due to the strong link of the CRD’s definition of default to accounting
and bankruptcy laws, the same wording of the definition of default could have different meanings or be interpreted differently across jurisdictions. An example of this is the meaning of ‘nonaccrued status.’
An institution might identify additional indicators of unlikeliness to pay
that are typical for a given country. In this case, the definitions of default will not have the same wording, but the meaning of default could be the same.

In either case, the institution should demonstrate that the definitions of
default used by the institutions that participate in the pool are similar.
3.5. Quantitative and qualitative validation and its assessment

3.5.1. High level principles on validation
371. CEBS endorses the definition of validation and the six general principles
for validation described in the Basel Committee’s Newsletter of January 2005 (“Update on the work of the Accord Implementation Group related to validation under the Basel II Framework”). In this section, CEBS provides additional guidance on validation. This additional guidance is shown in italics in order to distinguish it from the rest of this section, which is drawn directly from the general principles in the Basel newsletter.
372. One of the greatest challenges posed by the revised capital framework, for
both institutions and supervisors, is validating the systems used to generate the parameters that serve as inputs to the internal ratingsbased (IRB) approach to credit risk. The IRB framework requires institutions to assess the ability of a borrower to perform in adverse economic conditions. Thus, when considering the appropriateness of any rating system as the basis for determining capital, there will always be a need to ensure objectivity, accuracy, stability, and an appropriate level of conservatism.
373. Internal ratings and default and loss estimates must play an essential role
in the credit approval, risk management, internal capital allocation, and corporate governance functions of institutions using the IRB approach. The CRD recognises that the management of institutions continues to bear responsibility for validating the inputs to the IRB approach. Supervisors have the responsibility for assessing the compliance of institutions’ validation of their rating systems and inputs with the IRB framework’s minimum standards. Supervisors must ensure that these requirements are met, both as qualifying criteria and on a continuing basis. Validation is thus a fundamental aspect of the IRB approach. What is meant by ‘validation’?
374. In the context of rating systems, the term ‘validation’ encompasses a
range of processes and activities that contribute to an assessment of whether ratings adequately differentiate risk and whether estimates of risk components (such as PD, LGD, or CF) appropriately characterise the relevant aspects of risk. Rating systems and their outputs are typically used by credit institutions for a range of different purposes. As a general rule – and without prejudice to the more general requirements of the use test, which requires institutions to justify differences between measures used for regulatory risk parameters and internal purposes – validation by institutions needs to take into account the specific purpose or purposes for which a rating system is being used, including whether appropriate amendments have been made for each purpose. Supervisors will pay special attention to the validation of IRB systems for regulatory capital purposes.
375. There are several general principles that underlie the concept of validation.
They can be summarised as follows:

Principle 1: Validation is fundamentally about assessing the predictive ability of an institution’s risk estimates and the use of ratings in credit processes
376. An institution’s IRB estimates are intended to be predictive. While
grounded in historical experience, they should also be forwardlooking. Rating systems should effectively discriminate risk (i.e., credits with lower ratings should have a higher risk of loss) and calibrate risk (i.e., they should accurately quantify the risk of loss). Rating systems should also be consistent. If the processes that are used in assigning risk estimates are not accurate, then the risk estimates may fail to be sufficiently predictive and may under or overstate required regulatory capital. Consequently, validation should focus on assessing the forwardlooking accuracy of the institution’s risk estimates, the processes for assigning those estimates, and the oversight and control procedures that are in place to ensure that the forwardlooking accuracy of these estimates is preserved going forward. As a general rule, the validation process should prompt a reassessment of the IRB parameters when actual outcomes diverge materially from expected results.

In order to ensure the predictive accuracy of its risk estimates as well
as the effective discrimination and calibration of risk, an institution will first need to assess the general appropriateness of each of its rating systems. This assessment will cover at least:
o Verification that each rating system is characterised by an appropriate balance of objectivity, accuracy, stability and conservatism.
Objectivity requires the adoption of policies and standards that
ensure that ratings and estimates are applied consistently to borrowers and facilities with similar characteristics and posing similar levels of risk. Judgement is a necessary part of any overall rating system. It plays an important role in the development of the system and in the assignment of individual ratings and estimates, including overrides. However, institutions must be able to verify how the use of judgement is managed in order to achieve consistent outcomes. (For the purposes of comparing outcomes against expected performance, institutions should be able to identify how their estimates have been adjusted from the most likely outcome.)
Accuracy requires the adoption of policies and standards
relating to the expected performance of the rating system (outcomes versus predictions) and to the integrity of inputs into the rating system and their conversion into outputs.
Stability requires the adoption of policies and standards that
ensure that ratings and estimates are broadly unchanged when the underlying risk has not changed. This should not preclude

changes that are intrinsic to the rating philosophy of the system.

Conservatism requires the adoption of polices and standards
that identify the sources and range of uncertainty in ratings and estimates, and the degree of conservatism. In particular, the policies should identify where and explain how the institution applies conservatism in accordance with the relevant requirements of the CRD. o The appropriateness of the philosophy of each rating system
The philosophy of a rating system can be characterised by two
components: the philosophy underlying the grade or pool assignment (i.e.,: how institutions assign exposures, obligors or facilities to ’risk buckets’ (according to appropriate risk drivers) and the method used to quantify the risk parameters associated with each grade or pool.
The CRD does not prescribe the philosophy that must underlie
the grade or pool assignment in a rating system. Each philosophy results in a specific dynamics of ratings. The philosophy underlying the grade or pool assignment could be characterised by the extent to which a change in economic conditions is expected to result in a net migration of a large number of exposures, borrowers, or facilities to other grades or pools (if the institution were to take no compensating policy actions), as opposed to migration of some exposures, borrowers, or facilities to other grades or pools due only to their individual characteristics while leaving the number of exposures, borrowers or facilities in each grades or pools substantially unchanged, or a hybrid between these two extremes.

In order to assess the appropriateness of the philosophy of a rating
system, the institution should:

Understand the philosophy underlying the grade or pool assignment,
and specifically the risk drivers, and whether they create homogeneous buckets with respect to the targeted estimator. (An example for the PD dimension is whether the buckets are homogeneous with respect to the likelihood that each obligor in each risk bucket will default over the next year given all currentlyavailable information, including obligor and economic information; or, alternatively, with respect to the likelihood that each obligor in each risk bucket will default over the next year given all available information and hypothetical stressscenario economic conditions.)
Assess whether the method used to quantify the risk parameter is
adequate for the philosophy underlying the grade or pool assignment.
Understand the characteristics, including the dynamics, of its ratings
and of its risk parameter estimates.
Assess the adequacy of the resulting characteristics, including the
dynamics, of the ratings and risk parameter estimates with regard to their different uses.
Understand the impact of the characteristics, including the dynamics, of the ratings and risk parameters estimates on the dynamics and
volatility of capital requirements.

For example, the institution should at least adopt and document policies
which explain the philosophy of each rating system and how grades and risk parameters are expected to vary with movements in the general economic cycle or more specific cycles relevant to each risk parameter. These should include descriptions of how, if at all, rating assignments and risk parameter estimates are impacted by the application of conservatism.
When an institution uses different rating systems characterised by
different philosophies, care should be taken in the use of information, either for rating assignments or estimates, from another (internal or external) rating system that has a different rating philosophy. An example is the use of rating information or default experience obtained from rating agencies.

When an institution uses different rating systems with different
characteristics (for example, different philosophies, levels of objectivity, accuracy, stability, or conservatism) it should ensure that they have an appropriate level of consistency and/or that the differences between them are well understood. This understanding should at least enable the institution to define an appropriate way to combine/aggregate the information produced by the different rating systems when this is necessary. The assumptions and potential inaccuracies arising from such a combination/aggregation should be fully understood.

For example, the institution should at least describe how the combination
of information from rating systems characterised by different philosophies impacts the dynamics and volatility of capital requirements.
Historical data are an important source of information for constructing
estimates of future default frequencies and losses, but they are only a starting point and should be adjusted with care. The minimum data periods (five or seven years) determine how much (minimum) historical experience is needed as an input to the forwardlooking estimates, and are not meant to imply that an average of actual experience is a sufficient measure for the forwardlooking estimates. Nevertheless, where an institution can demonstrate that the historical experience is likely to be an accurate estimate of the forwardlooking estimate, little or no adjustment may be needed.
Forwardlooking estimates can be lower than actual historical experience. This may be because of small sample size, because the historical
experience contains a disproportionate number of extremely bad years, or because practices have changed. However, a high burden of proof would

be placed on any institution that sought to ignore or significantly underweight some of the available data.
383. PD estimates must be based on the longrun average of default rates in
each grade or pool. This implies that the historical experience needs to include a representative mix of good and bad years for the economy as a whole, as well as addressing more specific (e.g., industry) cycles that are material to the level and volatility of defaults in exposures covered by the rating system. Institutions must demonstrate that the estimates they are using are representative of likely longrun rates. Where (internal or external) statistical prediction models are used, this may require an adjustment to the calibration of those models.
384. Similar considerations apply to estimates of LGD and CF based on default
weighted averages. These averages will naturally be oriented towards the losses expected to be incurred (or the appropriate CF) under conditions when defaults for the exposures in question are expected to be high, as opposed to more normal market conditions. This should encourage more stable estimates, although institutions should ensure that those estimates are at least conservative enough to represent economic downturn conditions, if this is more conservative than the longrun average.
385. Institutions should have policies and standards covering the levels of
accuracy (and, where relevant, discriminative power), the acceptable levels of divergence from the expected performance, and the action to be taken when these acceptable levels are breached. They should also have clear policies for the circumstances in which these standards may be changed. Principle 2: The credit institution has primary responsibility for validation
386. Supervisors do not have the primary responsibility for validating credit
institutions' rating systems. Rather, a credit institution has the primary role, and consequently must validate its own rating systems to demonstrate how it arrived at its risk estimates and confirm that its processes for assigning risk estimates are likely to work as intended and continue to perform as expected. Supervisors, on the other hand, should assess the credit institution’s validation processes and outcomes and may rely upon additional processes of its own design, or even those of third parties, in order to have the required level of supervisory comfort or assurance. Principle 3: Validation is an iterative process
387. Validation is likely to be an ongoing, iterative process in which institutions
and supervisors periodically refine validation tools in response to changing market and operating conditions. Institutions and supervisors will need to engage in an iterative dialogue on the strengths and weaknesses of particular rating systems.

Institutions will need to adjust and improve their validation
techniques in response to changing practices in the industry and as more data becomes available. Principle 4: There is no single validation method

While some validation tools (e.g., backtesting, benchmarking, replication,
etc.) may prove especially useful, there is no universal quantitative or qualitative tool that can be used for all portfolios in all institutions. Backtesting, for example, may prove difficult for portfolios where there is a low level of historical defaults. Validation techniques may converge over time, but in practice there will likely be differences in validation techniques across portfolios (e.g., retail vs. wholesale credit) and across markets. In addition, the underlying philosophy of the rating system must be well understood and properly taken into account when determining which validation tools and techniques should be applied. This applies both to the choice of validation methods for assessing the accuracy and stability of a rating system, and to the choice of methods for assessing the appropriateness of the stress tests applied to that system.

A validation process needs to contain a mix of developmental
evidence (assessing the logic of the approach, its conceptual soundness, statistical testing performed prior to use), benchmarking and process verification (comparisons to relevant alternatives, verification that the process is being applied as intended), and outcomes analysis (backtesting).
The balance in the required use of these tools will vary between
rating systems, depending for example on the extent to which outcomes analysis is reliable. Principle 5: Validation should encompass both quantitative and qualitative elements

While validation can be thought of as a purely technical/ mathematical
exercise in which outcomes are compared to estimates using statistical techniques – and such technical tools may indeed play a critical role in such assessments in some circumstances – focussing solely on comparisons between predictions and outcomes is likely to be insufficient. In assessing the overall performance of a rating system, it is also important to assess the components of the rating system (data, models, etc.) as well as the structures and processes underlying the rating system. This should include an assessment of controls (including independence), documentation, internal use, and other relevant qualitative factors.

Outcomes analysis is not a sufficient technique for validating all or
part of a rating system. To the extent that outcomes analysis does
provide strong support for the estimates, there will be less need to rely on other elements. However, even in these cases, institutions should focus on the possibility of future changes in the economic environment, borrower composition, the institution’s practices, etc., which result in those estimates no longer proving valid in the future. Where outcomes analysis is less reliable, more emphasis will need to

be placed on how the rating system is implemented and used in practice, the reasonableness of other validation procedures used and how they are monitored, and the existence of an appropriate control and technology environment.

Institutions should be able to bring sufficient experience and
judgement to the development, adjustment, interpretation, and validation of rating systems and estimates, to supplement purely quantitative techniques.
The qualitative phase of the institution’s assessment should focus on
how the various information is interpreted to produce final assignments of the grades or pools and parameter estimates. Principle 6: Validation processes and outcomes should be subject to independent review

It is important that a credit institution’s validation processes and results
should be reviewed for integrity by parties within its organisation that are independent of those responsible for the design and implementation of the validation process. This independent review may be accomplished using a variety of structural forms. The activities of the review process may be distributed across multiple units or housed within one unit, depending on the management and oversight framework of the institutions. Regardless of the credit institution's control structure, Internal Audit has an oversight responsibility to ensure that validation processes are implemented as designed (see also Paragraph 389 of these Guidelines).
3.5.2. Validation tools: Benchmarking and Backtesting
Annex VII, Part 4, Paragraphs 109 to 113 of the CRD require the
institution’s estimation to be accurate and consistent (Paragraph 109), regular backtesting and benchmarking of their IRB risk quantification for each grade (Paragraphs 110 and 111), ensuring the consistency of methods and data through time and documenting changes in methods and data (Paragraph 112), and taking account of unexpected changes in economic conditions (Paragraph 113). The following part of these guidelines elaborates on these requirements and fleshes out general principles 4 and 5 discussed above.
Institutions are expected to provide sound, robust, and accurate predictive
and forwardlooking estimates of risk parameters (PD, LGD and CF). They shall have a system of risk segmentation which accurately differentiates risk, and a quantification process which accurately estimates those parameters. The institution’s validation process has to ensure that these requirements are met on an ongoing basis.
Common quantitative validation tools include backtesting and
benchmarking of the internal rating system outputs. The CRD explicitly requires institutions to use both tools in their validation process (Annex VII, Part 4, Paragraphs 110 and 111). Backtesting consists of checking the performance of the risk rating systems estimates by comparing realised risk parameters with estimated risk parameters. Benchmarking consists of

comparing the outputs of the reviewed risk rating systems with relevant external data sources provided that those data are appropriate to the portfolio (according to Annex VII, Part 4, Paragraph 111 of the CRD). In cases where a lack of internal or external data prevents the proper use of these techniques, institutions should apply an appropriate margin of conservatism in their estimations. However, if the lack of data is caused by the efforts of the institution to use only data that was collected under economic downturn conditions, the use of an additional layer of conservatism should be carefully assessed. Backtesting against internal data ratings system
394. Backtesting generally involves comparing realised (expost) values with
estimated (exante) parameters for a comparable and homogeneous data set (for example, comparing realised default frequencies with estimated PDs). The following guidance focuses on backtesting estimates of risk parameters in each grading grade against their realised values.
395. Backtesting is expected to compare realised default rates, loss severities,
and exposureatdefault experience in each rating grade with the PD, LGD, and CF values that have been estimated using an internal IRB model. This can be accomplished by using statistical methods to implement statistical tests for defining acceptable levels of the potential discrepancy between exante expectations and expost realisations.
396. At a minimum, the assessment of backtesting results should focus on the
following issues:

The underlying rating philosophy used in developing rating systems
(e.g., are PDs derived from pointintime or throughthecycle ratings?). Institutions that use different rating systems will need to take into account any differences in their rating philosophies when backtesting estimates of risk parameters. Failing to do so would lead to erroneously assigning differences in rating philosophies to inaccuracies in reported estimates;
Institutions should have a policy that outlines remedial actions, for
example, whenever back testing results breach internal tolerance thresholds for validation, if such thresholds are used;
When backtesting is hindered by lack of data or insufficient
quantitative information, institutions will need to rely more heavily on additional qualitative elements such as quality control tests, benchmarking with external information, etc. This might be particularly relevant in the case of estimates that relate to rarely observed economic downturn conditions;
The identification of the specific reasons for discrepancies between
predicted values and observed outcomes (e.g., variations through time that might affect institutions’ risk analysis and consequently their backtesting results);
At a minimum, institutions should adopt and document policies which
explain the objectives and logic underlying their backtesting exercises.

Benchmarking the outputs of internal ratings systems against external data
397. Benchmarking involves assessing the consistency of the estimated
parameters with those obtained by other estimation techniques (such as other rating systems), and potentially using other data sources (such as other institutions or ECAIs). It helps to assess whether institutions have quantified the risk parameters accurately by comparing them with a set of ‘reference data’ consisting of alternative PD, LGD and CF estimates from internal and external sources.
398. When performing benchmarking risk estimates against other sources,
institutions are expected to investigate the sources of substantial discrepancies between the values of risk parameters resulting from their internal risk rating system and those obtained from the other sources.
399. Regardless of the benchmarking method used, institutions shall
demonstrate to supervisors that their rating systems are performing in compliance with the minimum requirements in Annex VII, Part 4 of the CRD.
400. At a minimum, the assessment of benchmarking results should focus on
the five points listed in paragraph 340 of this paper. Specifically, institutions should consider:

The underlying rating philosophy used in developing rating systems
(e.g., are PDs derived from pointintime or throughthecycle ratings?). Institutions that use different rating systems will need to take into account any differences in their rating philosophies when backtesting estimates of risk parameters. Failing to do so would lead to erroneously assigning differences in rating philosophies to inaccuracies in reported estimates;
The procedure for establishing tolerance thresholds for validation, and
the list (at least in broad terms) of the types of possible responses when thresholds are breached;
The additional qualitative elements of their implementation of
benchmarking;
The identification of unanticipated changes over time that might
affect benchmarking results;
At a minimum, institutions should adopt and document policies which
explain the objectives and logic underlying their benchmarking exercises.
3.5.3. Lowdefault portfolios

The CRD applies certain conditions to PD estimations (for example, the
institution must estimate longrun, forwardlooking expected default rates for each rating grade, with an appropriate margin of conservatism). Certain conditions also apply to their validation. Some institutions have raised concerns that they may not be permitted to apply IRB approaches

to portfolios with a low number of defaults due to the lack of sufficient default or loss data to satisfy the CRD requirements for validation.
402. Lowdefault portfolios are portfolios with few or no defaults observed. Lowdefault portfolios can arise under different circumstances, and can be
categorised as follows:

Longterm, due to highquality borrowers (e.g., institutions) or a
small number of borrowers (e.g., sovereigns), versus shortterm (e.g., new entrants into a market); or · Systemic (data unavailable for all institutions), versus institution specific (data unavailable for the institution in question, perhaps due to insufficient effort to enhance its database with suitable external data).

The following principles are aimed at systemic lowdefault portfolios, and
do not generally apply to institutionspecific lowdefault portfolios.
Exposures in lowdefault portfolios should not necessarily be excluded
from the IRB approach simply because of the absence of sufficient data to validate PD, LGD and CF estimates on a statistical basis. Such exposures may be included if institutions can demonstrate that the methods and techniques applied to estimate and validate PD, LGD and CF constitute a sound and effective riskmanagement process and are employed in a consistent way. Institutions will be required to use appropriate conservatism in risk parameter estimation.
The institution’s process for estimating PD, LGD, and CF in lowdefault
portfolios should be supported by appropriate methodologies. Even in the absence of defaults, additional information (ratings, prices, etc.) might be available that can be used in the estimation process. Wherever possible, institutions should take such additional information into account in their estimation process. The validation process for lowdefault portfolios should not be completely different from the validation process for nonlowdefault portfolios, and institutions should ensure compliance with the minimum requirements laid down in applicable regulations, in particular regarding adequate margins of conservatism.
Institutions should pay particular attention to implementation and use, and
to ensuring that control and technology environments and internal validation procedures are appropriate.
Institutions should reinforce qualitative validation of lowdefault portfolios,
relative to nonlowdefault portfolios. The design of rating models, the quality of the data used in developing and deploying the model, and the internal use of the rating system should be key areas of the validation process for lowdefault portfolios. A high level of compliance with the use test is an important indicator of an institution’s confidence in its estimates, and will therefore be viewed as a necessary part of meeting the minimum requirements. However, meeting the use test is not in itself a sufficient condition, and should in any event be treated with particular caution for lowdefault portfolios, given the inherent difficulty in proving the accuracy

of the estimates of PD, LGD, and CF. As is the case with nonlowdefault portfolios, standardised procedures should be applied for assigning ratings in lowdefault portfolios. These procedures can be based on expert judgement and/or on external data. In any case, it is necessary to monitor the quality, objectivity and credibility of the data sources, and to strengthen the transparency and completeness of documentation. Quantitative Validation:
408. Limitations in the dataset should not exempt institutions from performing
a quantitative validation on lowdefault portfolios. Whenever few or no defaults are observed, a quantitative validation could be approximated (e.g. by assessing rating migrations, using credit spreads where appropriate etc.). Adequate and consistent methods should be used to ensure a sound and effective assessment and measurement of risk. The criteria to be reviewed in quantitative validation should include at least calibration, discriminative power, and stability.
409. The approach for calibration is likely to be based more on expert
judgement, utilising the extensive internal and/or external experience with the particular type of business.
410. Institutions could use a variety of quantitative and qualitative analyses to
provide confidence in, and an indication of, the discriminative power of the models. Depending on the amount of data, different techniques can be used:

Internal benchmarking.
Comparison with other ratings and models.
Comparison with other external information.
3.6. Internal governance

Annex VII, Part 4, Paragraphs 123 to 130 of the CRD set out minimum
requirements regarding corporate governance and oversight, including a brief description of the roles of the management body and senior management. This section of the guidelines elaborates further on those minimum requirements.
Paragraphs 362 to 364 of these Guidelines provide an example of the
general approach applied in this section. The aim is not to lay down a ‘onesizefitsall’ approach to assessing an institution’s organisational structure, internal governance, and internal control systems. Supervisors should tailor their assessment to the characteristics of respective institutions, taking into account their size and the complexity and nature of their business (‘proportionality principle’). This could include a 'comply or explain' approach, in which an institution that has come to a different solution from the one set out by the supervisors has the opportunity to explain why it has chosen that solution and to convince the supervisors that it is at least as good as the solution suggested by the supervisors .
Annex VII, Part 4, Paragraphs 123 to 126 of the CRD place requirements
on the ‘management body’ and ‘senior management’ for understanding

and approving rating systems. ‘Management body’ is defined in Article 11 of the CRD, and should be understood to embrace different structures, such as unitary and dual board structures. In keeping with CEBS' revised consultation paper on Application of the Supervisory Review Process under Pillar II (CP03rev), the use of these terms does not advocate any particular board structure. The management body represents the top management level of an institution, and senior management (which is not defined in the CRD) should be understood to represent the level of management below the management body.
414. According to CP03rev, there are two key functions that must be fulfilled in
any institution: supervision and management. Most Member States use one of two corporate governance structures: a unitary or a dual board structure. In a unitary board structure, one body (e.g. the 'board of directors') performs both the supervisory and management functions. In a dual board structure, the two functions are performed by different bodies. When CP03rev identifies a function of the management body, it specifies whether the reference is to the supervisory function, the management function, or both.
415. For the purpose of the present guidelines, it is not appropriate for CEBS to
seek to define the responsibilities of the supervisory and management functions of the management body, because of the high degree of granularity in the CRD with regard to the IRB (and AMA – see section 4.3.5.) approaches, and the different traditions and legal frameworks. Therefore, it is up to each national authority to define which function of the management body is responsible for the tasks and responsibilities listed in the internal governance sections below, and which internal body of the institution represents the supervisory and which the management function.
416. Annex VII, Part 4, Paragraph 127 of the CRD refers to the ‘Credit Risk
Control Unit’ (CRCU). It is useful at this point to distinguish between the organisational part and the functional part (the Credit Risk Control function) of this term. As part of the internal control function, the Credit Risk Control function should be independent from the business lines it monitors and controls. It is designed and implemented to address the risks that the institution identifies through the risk assessment process.
417. Large and complex institutions should establish a risk control unit to
monitor each of the material risks (within material business lines) to which the institution is exposed. The risk control unit should report to senior management and other relevant staff.
418. Although in most cases the organisational part of the CRCU and the CRC
function would be identical (and consequently the CRCU would encompass only people responsible for fulfilling the Credit Risk Control function), the CRCU could, as an organisational unit, encompass both the people responsible for the design of the model and the people responsible for the independent review of the model.
419. As far as the design of the rating models is concerned, the CRD affirms
that the CRCU “shall be responsible for the design or selection,

implementation, oversight and performance of the rating systems” (Annex VII, Part 4, Paragraph 127). It thus appears that the two broad functions of model review and model development and selection could be performed by the same unit. A rationale for this structure could be found in the skills and experience of the people who design or select models, which sometimes make them the only ones able to review and validate models. Furthermore, the separation of the two units could be burdensome, especially in smaller institutions.
420. The coexistence of both functions in the same unit should not be seen as
an obstacle; any potential for lack of objectivity should be offset with controls, administered by the Internal audit or another comparable independent audit unit, to prevent bias from affecting the rating process.
3.6.1. Role of the management body and senior management
Hierarchy of responsibility, management body and senior management
421. Sound internal governance requires that the decisionmaking process be
clearly stated within each institution, in terms of hierarchy and level of responsibility. In order to improve understanding of the rating system among the members of the management body, and to improve efficiency, the management body may, where appropriate, establish specific Risk Committees and delegate certain aspects of this framework to these committees or to senior management. Senior management itself may also delegate certain tasks. However, such delegations do neither relieve the management body and senior management from their obligation to have a general awareness of the IRB framework used by their institution, nor do they relieve the management body from its ultimate responsibility for the IRB framework and senior management from its responsibility for developing and implementing it.
422. In accordance with Annex VII, Part 4, Paragraph 123 of the CRD, all
material aspects of the rating and estimation processes shall be approved by the institution’s management body (or a designated committee thereof) and senior management. These parties shall possess a general understanding of the institution’s rating systems and detailed comprehension of its associated management reports. The material aspects of the rating and estimation processes include among others:

Risk management strategies and policies regarding the internal rating
system (including all material aspects of the rating assignment and risk parameter estimation processes);
The organisational structure of the control functions;
Specifying acceptable risk (using IRB results to define the credit risk
profile of the institution).

Both the management body and senior management are responsible for
making formal decisions on the implementation of the IRB approach. This includes the overall approval of the project, the specification of goals, and the appointment of the organisational structures responsible for implementation. A schedule of the necessary steps should be provided with the project approval. Both functions are ultimately responsible for

sound governance of the IRB framework, and the further governance described below should flow from them.
424. The management body has to exercise effective oversight. Therefore, as
stated in Paragraph 124 of Annex VII, Part IV of the CRD, senior management shall notify the management body, or a designated committee thereof, of material changes or exceptions from established policies that will materially impact the operations of the institution’s rating systems. The management body should be involved, on an ongoing basis, in the oversight of the control procedures of Internal Audit.
425. Senior management should ensure, on an ongoing basis, that the control
mechanisms and measurement systems adopted by the credit risk control unit are adequate and that the overall IRB system remains effective over time. Senior management shall have a good understanding of the rating systems designs and operations. Furthermore, it should have a good understanding of credit policies, underwriting standards, lending practices, and collection and recovery practices, and should understand how these factors affect the estimation of relevant risk parameters. It should ensure that the following tasks are being addressed:

Ensuring the soundness of risktaking processes, even in a rapidly
changing environment;
Determining how internal ratings are used in the risktaking processes;
Identifying and assessing the main risk drivers, based on the
information provided by the Credit Risk Control Unit;
Defining the tasks of the risk control unit and evaluating the adequacy
of its professional skills;
Monitoring and managing all sources of potential conflicts of interest;
Establishing effective communication channels in order to ensure that
all staff are aware of relevant policies and procedures;
Defining the minimum content of reporting to the management body or
to bodies to which it has delegated responsibilities (e.g., the Risk Committee), and
Examining reports from Internal Audit or another comparable
independent audit unit.

Senior management should also check, on a regular basis, that the control
procedures and measurement systems adopted by the credit risk control unit and Internal Audit (or another comparable independent audit unit) are adequate and that the overall IRB system remains effective over time.
The credit risk control unit is responsible for proper functioning of the
rating systems; it submits rating systems for approval. 428. The Internal Audit or another comparable independent auditing unit should provide an assessment of the overall adequacy of the internal control system and of the credit risk control function. Internal reporting

429. Internal ratingsbased analysis of the institution's credit risk profile should
be an essential part of the internal reporting system. The recipients of the reporting should include not only the management body and senior management, but also all of the internal functions responsible for originating and monitoring credit risks. The frequency and content of reporting should be formally approved by both the management body and senior management. 430. The frequency and scope of reporting should be set according to the nature of the recipient and the level of risk. The level of risk could depend, for example, on the ratings or the size of exposures
431. Reporting to senior management should enable it to monitor the evolution
of credit risk in the overall portfolio. The scope of information (e.g., rating classes, PD bands) to be included in the internal reporting may vary according to the nature, size, and degree of complexity of the business and the institution.
432. The minimum requirements of the CRD relating to reporting are specified
in Annex VII, Part 4, Paragraph 126. Good practice in satisfying these requirements could include providing the following information:

A description of the rated portfolios (amounts, number of obligors, PDs
per grade, percentage of coverage with ratings with respect to the total portfolio, breakdown by entities, sectors, subportfolios, and business units);
The distribution of the overall portfolio according to rating grades, PD
bands, and LGD grades, and a comparison with the previous year;
A comparison of realised default rates (and loss given default and
credit Conversion Factors for institutions on advanced approaches) against expectations;
The results of stress tests;
An estimate of regulatory capital requirements and economic capital;
and
The portfolio’s migration across rating grades.
433. In addition to the reporting mentioned above, the Credit Risk Control Unit
should address specific reports to senior management relating to the rating system review process. It is the responsibility of the CRCU to provide coherent reporting that is clearly related to target variables.
3.6.2. Independent Credit Risk Control Unit
Goal/Scope of activity
434. The main goal of the Credit Risk Control Unit (Annex VII, Part IV, Paragraphs 127 to 129 of the CRD) is to ensure, on a regular basis, that
the rating system and all of its components – rating assignments, parameter estimation, data collection, and oversight – are functioning as intended. The Credit Risk Control Unit should perform the following tasks, among others:
Design of the rating system (perform or review);
Ongoing review of the rating criteria and model development;
Verification of the accuracy of all riskrating grades;
Assessment of consistency across industries, portfolios, and
geographical regions;
Assessment of model use;
Analysis of the reasons for overrides and exceptions;
Quantification process (perform or review);
Backtesting;
Analysis of actual and predicted ratings transitions; and
Benchmarking against thirdparty data sources.

The results of the CRCU’s review should be reported to senior
management at least twice annually.
Proportionality
Establishing a specific unit responsible for developing and designing the
rating system, and a separate unit that contains only the CRC function, could be burdensome, especially for smaller and less sophisticated institutions. Implementing the minimum requirements of the CRD could, in practice, impose some redundancies from an organisational point of view (e.g., a Credit Risk Control Unit composed of only a handful of officers).
In these cases, national supervisors can decide to make specific
adjustments to these guidelines, taking into account the nature, size, and level of complexity of the business performed by the institutions applying for the use of the IRB approach. For example, in some small institutions, the Credit Risk Control function is also responsible for the rating assignment process for specific obligors. This may be due to staff scarcity, or because staff in the CRC function who are directly involved in model building and review are more skilled in the assignment of ratings, especially to counterparties whose creditworthiness is difficult to assess (e.g., Specialised Lending, large and complex groups).
However, such adjustments should not undermine the principle of
independence of the CRC function or the overall soundness of the control environment.
In this case, a lack of objectivity may arise because the model builder may
have an excessive degree of confidence in the model output, and may become more tolerant towards potential failures or biases. Therefore, depending on the circumstances, the coexistence of the two tasks may be regarded either as an exceptional (permanent) or a transitional solution, in the latter case to be overcome as soon as possible. The coexistence should be made transparent in any case. Location of CRC function within the organisational structure
Any attempt to specify where in the organisational structure of an
institution the CRC function should be located could be to some extent counterproductive, for the following reasons:

The activities of the CRC function span multiple areas or business units.
Institutions will choose a structure that fits their management and
oversight frameworks.

A minimum requirement, however, could be to make the CRC function
depend directly on senior management, wherever the unit is located within the organisation. Part of the duties of Internal Audit should be to review whether the location of the CRC function could reduce its independence. 442. The CRC function should always have high standing within the organisation, and should be staffed by individuals possessing the requisite stature, skills, and experience. Independence of the CRC function from the functions responsible for originating or renewing exposures
Lack of independence of the Credit Risk Control function and pressures
from relationship managers could seriously undermine the effectiveness and soundness of the IRB system. The problem is how to ensure and enforce independence. A control function can generally be regarded as independent if the following conditions are met:

The staff of the control function should not have any tasks to perform
that fall within the scope of the activities that the control function is assigned to monitor and control.
The control function should be organisationally separate from the
activities it is assigned to monitor and control. The head of the control function should be subordinated to a person who has no responsibility for managing the activities that are being monitored and controlled (in this case these activities would be originating and renewing exposures).
The head of the control function should report directly to both the
management body and senior management and/or the audit committee.
The remuneration of the control function staff should not be linked to
the performance of the activities that the control function is assigned to monitor and control.

There is no single way to achieve independence, but rather different
options.
One option is to make the CRCU depend directly on senior management. Another option could be to maintain a separation between the control functions and the commercial area/relationship managers, up to the level of the responsible member of senior management.
Whatever option is adopted by the institution, part of the duties of Internal
Audit should be to determine the ‘real’ degree of independence of the CRC function.
A strict separation between the commercial function and the CRC unit (but
not the CRC function) could have undesirable effects. For example, models developed by risk managers without the contribution of relationship managers could be rejected by the latter, or staff from the commercial

lines could be tempted to force some of the model’s inputs (especially qualitative inputs) in order to ‘adjust’ the model’s outcome to their assessments (affecting the use test). Consequently, staff from the credit risk control unit and commercial department should cooperate actively in the development of the model. In order to ensure the desired independence after model development is complete, the exchange of information could best be through committees.
3.6.3. Role of Internal Audit
447. The Internal Audit function reviews whether the institution’s control
systems for internal ratings and related parameters are robust (Annex VII, Part 4, Paragraph 130 of the CRD). It should therefore have an appropriate understanding of all the processes of the rating systems, including those processes which generate the estimates of risk parameters. As part of its review of control mechanisms, Internal Audit will evaluate the depth, scope, and quality of the Credit Risk Control function’s work. Internal Audit may also conduct tests to ensure that Credit Risk Control function’s conclusions are wellfounded. Internal Audit should also review the adequacy of the IT infrastructure and data maintenance. For institutions using statistical models, Internal Audit should conduct tests (for example, on specific business units) in order to check data input processes.
448. Internal Audit or another comparable independent audit unit should report
at least annually to both the management body and senior management on the institution’s compliance with the IRB requirements.
449. In order to strengthen its independence, Internal Audit should not be
directly involved in model design/selection. Although not directly related to independence (but rather to credibility), Internal Audit units should always have a high standing within the organisation and should be staffed by individuals possessing the requisite stature, skills, and experience. 450. Notwithstanding the need for independence, some cooperation between Internal Audit and the CRC function can be desirable, for example in order to address potential weaknesses or biases in the rating system. For instance, information on overrides detected by the CRC function in a specific portfolio or business unit should be passed on to Internal Audit so that it can assess whether the overrides stem from model biases (for example, because the model is unfit to produce ratings for specific businesses) or from a lack of independence of relationship managers. Nevertheless, it should be clear that the CRC function has sole responsibility for the rating systems’ performance. The audit function should not be involved in daytoday operations such as reviewing each individual rating assignment.
3.6.4. Independence/conflict of interests in rating assignment
451. Independence in the rating assignment process depends on how an
institution is organised and on how it conducts its lending activities. Although rating processes may vary by institution or portfolio, they generally involve an ‘assignor’ and an ‘approver,’ whose tasks and

responsibilities could differ. (Their tasks and responsibilities may vary also by portfolio.) Some of the most common situations are:
Rating assignment made by relationship managers
452. Some institutions have adopted ‘judgemental approaches’ for assigning
ratings to counterparties. Such approaches entail some responsibilities for relationship managers, who are called upon to assess the creditworthiness of the obligors based on qualitative questionnaires or specific templates.
453. As relationship managers are primarily responsible for marketing the
institution’s products and services, and their compensation is usually tied to the volume of business they generate, giving them responsibilities for assigning and approving ratings would give rise to an inherent conflict of interest. Credit quality and the ability to produce accurate risk ratings are generally not major factors in a relationship manager’s compensation. Relationship managers may also become too close to the borrower to maintain their objectivity and remain unbiased. 454. For nonretail business institutions should not delegate rating responsibility (assignment or review) entirely to relationship managers. Relationship managers should only play a partial role in the rating assignment process, carrying out preliminary credit assessment to be validated afterwards by other ‘independent’ officers (see paragraphs 460 and 461 of this paper, on “Rating assignment based on mixed approach”). In this case, institutions should offset the potential lack of independence with controls to prevent the bias from affecting the rating process. Such controls should operate in practice and would include, at a minimum, a comprehensive, independent review of ratings by risk control functions (for example, offsite monitoring by the credit controllers, analysis of rating performances by the CRCU, and onsite review by Internal Audit or another comparable independent audit unit). An additional way to enforce the independence of the rating assignment is to link the compensation of the relationship manager to riskadjusted performance measures (such as RAROC) based on the outputs of the IRB system. Rating assignment by models whose outcome cannot be modified by the users. 455. This solution is typically adopted for retail and consumer banking, where the large number of loans in small amounts make it essential to minimise the cost of rating assignment. In this case, the assessment of creditworthiness is basically made by the model itself.
456. Biases in modelbased rating assignments could stem only from errors or
fraud in the input of relevant data. Consequently, independent vetting of input data becomes crucial. The CRC function should verify on an ongoing basis that the model remains predictive of risk, by means of specific validation sessions based, for example, on backtesting or benchmarking of model outcomes. Rating assignment by independent credit officers/rating committees
457. Some institutions assign sole responsibility for assigning and approving
ratings to credit officers or rating committees that report to an independent credit function. This solution is aimed at separating the people who ‘own’ the relationship and propose new credit applications from the people who are ultimately responsible for the rating assignment.

In addition to assigning and approving ratings, credit officers regularly monitor the condition of obligors and refresh ratings as necessary.
458. In this approach, the relationship between relationship managers and
credit officers, and the organisational structure of the institution, become crucial, essentially because the ‘true’ degree of independence of the credit officer/rating committee could be difficult to evaluate in practice, especially for the largest counterparties for which approval limits are set at the level of senior management or the management body. Another potential disadvantage of this structure is that credit officers may have limited access to borrower information. This could affect the discriminative and predictive power of ratings. 459. The role played by the CRC function therefore becomes crucial, especially with regard to the assessment of ratings’ performance and the ongoing review of the rating system. Rating assignment based on mixed approach
460. A mixed approach is sometimes used for exposures to Corporates or SMEs. The following example is illustrative.
The rating assignment is initially determined by statistical or judgemental models. If the relationship manager, who is responsible for data input, is satisfied with the model’s outcome, then the final rating will be the model’s rating. If, on the other hand, the relationship manager disagrees with the model’s outcome, he can propose an ‘override’ to a senior officer – or to a rating committee, according to the size of the exposure – which is ultimately responsible for confirming the model’s rating or changing it. For smaller clients (such as SMEs in retail portfolios), relationship managers are sometimes free to change the model’s rating within certain limits (they typically can upgrade only by a few notches, while they are free to downgrade as much as they want).
461. When a mixed approach is used, the features of the models combined with
the organisational structure of the institution become crucial. For example, if the rating model is not suited to a particular class of obligors or facilities, there will probably be a large number of overrides, and relationship managers may also be tempted to ‘cheat’ the model. Institutions should therefore ensure that all relevant information is considered in the rating assignment process, and should take the necessary steps to identify potential rating errors. In addition, controls are needed to ensure accuracy of data inputs. Finally, all ‘management overrides’ should be duly motivated by the relationship managers and all relevant decisions (both confirmations and rejections of proposed overrides) should be stored, in order to allow the CRC function to perform backtesting correctly.
3.6.5. Reliance on the work of external auditors in the review process
462. The CRD contains several references to tasks that should be performed by
an independent assessment unit. For example, Annex X, Part 3, Paragraph 6 states that “the operational risk management processes and measurement systems shall be subject to regular reviews performed by internal and/or external auditors.” These reviews could be performed either by the institution’s internal unit or by an external auditor. As the

external auditor may also be involved in performing the institution’s statutory audit, the question of independence arises.
463. Supervisors will seek to understand the scope of an external audit review,
and specifically whether particular subsidiaries are excluded from the review, perhaps on grounds of materiality. The purpose of this requirement is to ensure that the results of the external audit review are not incorrectly taken to apply to the subsidiaries.
464. The management of an institution (subsidiary or otherwise) is responsible
for, and has full, independent control over the review of the institution, regardless of whether that review is performed by an internal or external unit. The management of the institution should communicate directly with the assessment unit at all stages, and the assessment unit in turn should report directly to the management of the institution during the review.
465. The external auditor may perform an independent assessment of a
vendor’s technology only if there are no relationships (including commercial and/or marketing relationships) between any parts of the two companies that could compromise the independence of the assessment.
466. An institution using a vendor’s methodology should also perform a review
through its own Internal Audit or other internal assessment unit, to ensure a thorough understanding of the vendor’s methodologies. Such a review should be considered reliable only if it is performed by a unit (internal or external) that is sufficiently familiar with all aspects of the reviewed systems and methodologies.
4. Supervisor’s assessment of the application concerning the minimum
requirements of the CRD – Operational risk
4.1. Partial use combinations
467. The CRD allows a broad range of partial use possibilities, including the
combined use of the Basic Indicator Approach (BIA) and the Standardised Approach (TSA) (Annex X, Part 4, Section 2), and the use of the Advanced Measurement Approach (AMA) in combination with other approaches (Annex X, Part 4, Section 1). The question arises of how the different approaches can be aggregated to calculate the regulatory capital requirement.
468. The CRD text does not distinguish between group (consolidated) and legal entity (solo) calculations, creating a need for coherent interpretation.
Moreover, the CRD does not explicitly either allow or prohibit the practice specifically recognised in Paragraphs 682 and 683 of the Basel II text – of allowing institutions to include (on a permanent basis) the results of the AMA calculation of a subsidiary in the consolidated capital requirement of a parent company that otherwise uses a nonadvanced approach.
469. The following definitions are provided for clarification:

‘Partial use at consolidated level’ means that different operational risk
approaches are used simultaneously by the parent and its subsidiary, or by different subsidiaries/business lines within the group. · ‘Partial use at solo level’ means that different operational risk approaches are used simultaneously for different business lines or different branches within the same legal entity.

The issue in ‘partial use at consolidated level’ is not whether a
subsidiary/business line of a banking group is allowed to use a certain calculation method at its own level, but rather whether the parent undertaking is allowed to use the results of that subsidiary/business line in determining its overall consolidated operational risk capital requirement.
Similarly, the issue in ‘partial use at solo level’ is not whether an
institution is allowed to use a certain calculation method at the business line or branch level (for instance, for internal information purposes or in preparation for a future move to a more sophisticated approach), but rather whether the institution is allowed to use the results of that business line or branch calculation in determining its overall solo operational risk capital requirement.
Since the Alternative Standardised Approach (ASA) is a variant of the TSA, the possibilities for combining TSA with BIA or AMA offered in Annex X, Part 4 of the CRD are also available for combining ASA with BIA or AMA.
An institution using the BIA, TSA, or ASA for its consolidated capital
requirement calculation may be allowed to include the result of an AMA calculation at a subsidiary in its consolidated calculation.
An institution using the TSA or ASA for its consolidated capital requirement
calculation is allowed to include the result of a BIA calculation at a subsidiary in its consolidated calculations. This combination possibility can be used in the case of recent business acquisitions and in other exceptional circumstances.
Art 105(4) of the CRD states that where a credit institution and its
subsidiaries use an AMA at consolidated level, the competent authorities may allow the qualifying criteria set out in Annex X, Part 3 of the CRD to be met by the parent and its subsidiaries considered together. The subsidiaries/BLs which do not meet the qualifying criteria (not even together with the parent) should calculate their solo capital requirement according to one of the simpler approaches. This amount should also be the contribution to the AMA consolidated capital requirement (building block method)
Where a credit institution uses an AMA at solo level, the competent
authorities may allow the qualifying criteria set out in Annex X, Part 3 to be met by the main office and its business lines/branches considered together. Where a credit institution uses a TSA or ASA at consolidated (solo) level, the competent authorities may allow the qualifying criteria set out in Annex X, Part 2 to be met by the parent and its

subsidiaries/business lines (main office and its business lines/branches) considered together.
477. The tables below provide an overview of the different partial use
combinations on a groupwide and legalentity basis, indicating how consolidated and solo capital requirements should be computed.
Table 1
GROUP WIDE basis: Partial use combinations and “Consolidated capital requirement” Group level approach Subsidiary/Busine ss line level approach Group uses BIA Group uses TSA (or ASA)20 Group uses AMA21 Subsidiary locally uses BIA Partial use acceptable Partial use acceptable Subsidiary/business line locally uses TSA (or ASA) Partial use not acceptable Partial use acceptable Subsidiary/business line locally uses AMA Partial use acceptable Partial use acceptable
Table 2
LEGAL ENTITY basis: Partial use combinations and “Solo capital requirement” Legal entity level approach Business Line/Branch approach Legal entity uses BIA Legal entity uses TSA (or ASA) Legal entity uses AMA Branch uses BIA Partial use not acceptable Partial use acceptable Business Line/Branch uses TSA (or ASA) Partial use not acceptable Partial use acceptable Business Line/Branch uses AMA Partial use not acceptable Partial use not acceptable

4.2. The simpler approaches (BIA/TSA/ASA)
4.2.1. Entry criteria and use of TSA and ASA
478. The CRD offers several approaches for calculating regulatory capital
requirements for Operational risk:

The Basic Indicator Approach (BIA) (Article 103);
The Standardised Approach (TSA) (Article 104);
20 See also Annex X, Part 4 Paragraph 4 of the CRD 21 See also Annex X, Part 4 Paragraph 2 of the CRD and paragraph 488 of these guidelines. 22 See also Annex X, Part 4 Paragraph 2 of the CRD and paragraph 488 of these guidelines.
The Alternative Standardised Approach (ASA) (Article 104(3) and
Annex X, Part 2, Paragraphs 9 and 13); and
The Advanced Measurement Approach (AMA) (Article 105 and Annex
X, Part 3).

An institution wishing to use the ASA has to meet the qualifying criteria for
the TSA (Annex X, Part 3, Paragraph 17 of the CRD) as well as the specific conditions imposed for the ASA (Annex X, Part 3, Paragraphs 15 and 16).
An institution wishing to use the TSA has to inform its competent
authorities in advance of its intentions. They will make clear how this ex ante information can be provided (informally or by way of a formal notification). The institution has to hold supporting documentation related to the observance of the TSA qualifying criteria. It has to deliver a document certifying, based on a self assessment, that it meets the TSA qualifying criteria. The certification document based on a self assessment may not be required if the competent authorities perform their own assessment to determine whether the institution complies with the criteria set out in the CRD for the use of the TSA. The choice of how this process is organised (onsite versus offsite) is at the convenience of the competent authorities.
An institution wishing to use the ASA has to inform its competent
authorities of its intentions in advance and also has to receive a prior ex ante authorization from its competent authorities according to Article 104(3). It has to inform its competent authorities of its intention. They will make clear how this exante information can be provided (informally or by way of a formal notification). The institution has to hold supporting documentation related to the observance of the TSA qualifying criteria and the ASA conditions. It has to deliver a document certifying, based on a self assessment, that it meets these criteria and conditions. The certification document based on a self assessment may not be required if the competent authorities perform their own assessment. The choice of how this process is organised (onsite versus offsite) is at the convenience of the competent authorities.
4.2.2. General and specific conditions for the use of ASA
Annex X, Part 2, Paragraph 15 of the CRD sets a quantitative condition on
the relative size of retail and commercial banking activities for institutions opting for the ASA. In particular, the retail and/or commercial banking activities shall account for at least 90 percent of the institution’s income. In addition, Paragraph 16 requires that the institution must be able to demonstrate to the authorities that a significant proportion of its retail and/or commercial banking activities consists of loans associated with a high probability of default.
In order to provide institutions some stability in the choice of the ASA, a
certain degree of flexibility can be introduced in the practical application of the 90 percent condition. In particular, a oneyear window can be granted, meaning that even if the threeyear average drops below 90 percent, an institution using the ASA can be allowed to remain on the ASA if it can

convince the relevant authority that the three year average will again reach 90 percent the following year.
484. Institutions opting for the ASA are required to use robust and well documented demonstration methods, relating to both the charging of high
interest rate margins and the holding of a risky credit portfolio. National supervisors may allow nonIRB institutions opting for the ASA to use non PDbased approaches to demonstrate that a credit portfolio is risky.
4.2.3. Relevant indicator: threeyear average
485. The calculation of the capital charge for operational risk under the BIA, TSA, or ASA in accordance with Annex X, Part 2, Paragraph 1 of the CRD is
based on the threeyear average of the relevant indicator. The threeyear average, while designed to reduce the volatility of the capital charge, may, in exceptional circumstances, such as recent acquisitions or disposals of entities or activities, lead to an over or underestimation of operational risk.
486. If an institution can satisfy its competent authority that – due to
exceptional circumstances such as a major sale – using a threeyear average to calculating the relevant indicator would lead to a major overestimation of its current operational risk under Pillar I, the competent authority can allow the institutions to use a different calculation.
4.3. AMA
4.3.1. Rollout
487. The rollout issues for operational risk (Annex X, Part 4 of the CRD) are
significantly different from those for credit risk. Annex X, Part 4, Section 1 sets out the rollout conditions for institutions that apply the most advanced technique (AMA), and Annex X, Part 4, Section 2 sets out the conditions for institutions that apply the less sophisticated approaches (BIA/TSA/ASA). When applying for permission to use the AMA, institutions should be expected to fulfil not only the main requirements of the CRD (Annex X, Part 4, Paragraph 1), but also two additional conditions (of
Annex X, Part 4 Paragraph 2), which are discretions for the national
supervisory authorities:
a) On the date of implementation of an AMA, a significant part of the institution’s operational risks has to be captured by the AMA; and b) The institution makes a commitment to roll out the AMA across a material part of its operations within a time schedule agreed with its competent authorities.
488. Supervisory authorities are expected to apply these discretionary
conditions in most cases. There could be cases where these additional conditions might not be imposed, but these should be exceptional. Once the two discretionary conditions are imposed, the significance of the operational risks captured by AMA and the materiality of the part of the operations captured by AMA will need to be assessed. The methods used

to conduct this assessment can be quantitative, qualitative, or a combination of the two. Regardless of the methods used by competent authorities, all operations should be captured by one of the operational risk methodologies.
489. The rollout policy should address at least two different issues: the time
horizon and the rollout sequence.

The rollout plan should have a definite time horizon. It should be short
enough in order to avoid prolonging AMA applications unduly, and long enough to ensure the quality of governance, data, methodology, and output.
The sequence in which operations are included in the AMA can be
chosen by the institution, if agreed by the supervisor, starting, for example, with the riskier of the remaining operations.

Once a decision to grant AMA approval to a firm is taken, no further formal
Article 129 process will be required as a result of rollout of the AMA.
During the rollout period, however, supervisors will cooperate in the spirit of Article 129. As the AMA is rolled out, supervisors may want to satisfy themselves that the minimum standards of the CRD are being met with respect to the additional operations or additional operational risks covered by AMA rollout. To facilitate this process, institutions should complete a selfassessment against the minimum standards prior to rolling out the AMA to additional operations or additional risks. Supervisors will have three options, and will specify in the decision document which option or mixture of options is being used. Conditions may need to be attached to the decision in order to give effect to the option or options selected. The three options are:
Relying on normal supervisory activity to verify that minimum
standards are met. Although formal prior notification requirements will not be introduced, other than the rollout plan, institutions will be expected to keep supervisors informed of plans and developments in their risk measurement and management practices. Although an ex ante assessment by supervisors will not be a formal requirement, supervisors may nevertheless choose to undertake an assessment of the operational risk measurement system in the period before the institution starts to use it for regulatory capital purposes.
Asking institutions to notify supervisors on a timely basis of their
intention to roll out the AMA to additional operations or additional operational risks. As with (1), although an exante assessment by supervisors will not be a formal requirement, supervisors may nevertheless choose to undertake an assessment of the operational risk measurement system in the period before the institution starts to use it for regulatory capital purposes.
Asking institutions to notify supervisors on a timely basis of their
intention to roll out the AMA to additional operations or additional operational risks, and perhaps requiring institutions to receive explicit permission before extending the use of the AMA. In this case, a prior

assessment by supervisors may be required before permission is granted.
491. Institutions should have systems and procedures that monitor in a timely
and appropriate manner the consistency of the partial use combinations and the significance, materiality, and timeframe issues of the roll out plan.
492. Institutions should notify their competent supervisors in a timely fashion of
any relevant changes in the organisational or business environment, due to either normal or exceptional circumstances (for example, a major acquisition or disposal or a major change in shareholders, management, or organisation), that could significantly impact on the institutions’ initial partialuse or rollout plans. The institutions should discuss with their supervisor or supervisors any changes to the roll out plan that may be needed. 493. A merger or an acquisition is considered an important event that is likely to call for modifying the institution’s partial use and rollout policies. Two situations can be distinguished: first, where an AMA institution acquires a nonAMA institution, and second, where a nonAMA institution acquires an AMA institution. In the first case, the AMA institution may be asked to submit a new Article 129 application with a new partial use and rollout policy for the supervisor’s analysis, or it may be asked to submit a plan for bringing the entire institution into compliance with the CRD. The second case is more difficult, since the acquiring institution does not have AMA permission and some requirements, such as senior management understanding, may not be met. The institution would normally be asked to make a new Article 129 application.
4.3.2. Use test
494. Annex X, Part 3, Paragraph 2 of the CRD requires the institution's internal
operational risk measurement system to be closely integrated into its day today risk management process ('use test'). The use test for the AMA is not elaborated in the CRD to the same extent as the use test for the IRB approach.
495. The operational risk measurement system of an institution must have
certain key elements. These elements must include the use of internal data, external data, scenario analysis, and factors reflecting the business environment and internal control systems (Annex X, Part 3, Paragraph 9 of the CRD).
496. The following section establishes a framework of four broad principles
which industry would have to consider, at a minimum, in order to satisfy the use test. For each principle, typical examples of actions that could be undertaken are also provided. The examples illustrate ways to comply with the principles, and are not meant to be either binding or exhaustive.

Principles and examples
1. The purpose and use of the AMA should not be limited to regulatory
purposes.
Evidence of meeting the use test could include, but is not limited to:

Providing evidence that the risk measurement system is used to manage operational risk
exposures across different business lines within the organisation structure.
Providing evidence of how inputs, estimations, predictions, or outputs from the risk
measurement system are used in the decisionmaking process, for example as an element in strategic and tactical decisionmaking.
2. The AMA should evolve as the institution gains experience with risk
management techniques and solutions.
Evidence of meeting the use test could include, but is not limited to:
Providing evidence of how the institution ensures that the nature and balance of inputs into
the risk measurement system are relevant and fully reflect the nature of the business.
Providing evidence of how the risk measurement system becomes more responsive and
robust.
3. The AMA should support and enhance the management of operational
risk within the organisation.
Evidence of meeting the use test could include, but is not limited to:
Providing evidence how decisions for improving processes and controls are made.
Providing evidence that operational management objectives and activities are
communicated within the organisation.
4. The use of an AMA should provide benefits to the organisation in the
management and control of operational risk.
Evidence of meeting the use test could include, but is not limited to:
Providing evidence that senior management has considered action on its receipt of
information from the riskmeasurement system.
Providing evidence that the AMA increases transparency, risk awareness, and operationalrisk management expertise, and creates incentives to improve the management of
operational risk throughout the organisation.
4.3.3. Data
497. The CRD requires data to be held and stored for several different
purposes. Data to be used in the operational risk management and measurement systems are stored in one or more databases. These can contain data used for a single purpose or for a mix of purposes
498. Institutions should have an IT system that ensures:
Appropriate availability and maintenance of all relevant databases;
Appropriate modelling and computing capacity; and
Appropriate controls on the datacapture process.

These IT systems should be included in the institution’s general
contingency plans, in order to guarantee the recovery of the information. Established controls should prevent access by unauthorised persons and ensure the integrity of the data. Data quality standards
To ensure data quality, the independent review performed by the
institution should address at least the following:

a regular review of controls;
a review of the Systems by which the institution ensures data quality
standards.

Institutions should perform consistency checks that include an audit trail
of data sources. Significant discrepancies should be investigated.
Institutions should work on an ongoing basis to ensure that their data is of
good enough quality to support their risk management processes and to calculate their capital requirements.
Institutions should define their own standards for ensuring data quality
and should seek to develop and improve these over time. It is the institutions' responsibility to ensure the quality of their data. The institutions should be able to demonstrate that they achieve high standards in terms of comprehensiveness, appropriateness and accuracy of the data collected above the thresholds set. Examples of activities aiming to improve the data quality standards are: · the construction of decision trees to assign losses to event type and business lines; · the computation of average time between when loss events occurred and when they are captured; · the review of the structure of input data to identify outliers or implausible values and changes from previous periods; · periodic cross checking against material accounting data with institutions needing to identify and explain material divergences.
There should be minimum checks by an independent function to ensure
that internal data are comprehensive and external data are relevant. Supervisors could assess specific parts of this process to verify the conclusions reached by the independent function.
Institutions should have policies concerning their tolerance for any gaps in
their internal data. They should also be able to fully justify their approaches to adjusting values. Data documentation
In order to facilitate the dialogue between institutions and supervisors on
data quality standards, institutions should provide their supervisors with an adequate set of documentation. The following can be regarded as good practice:

Data policy and statement of responsibility: Institutions should
establish an explicit data policy, which could be part of a general data policy.
Institutions should document workflows, procedures, and systems
related to data collection and data storage.
Data directory: Institutions should have clear definitions of data items
that are made available for inspection by supervisors.
Database descriptions: Documentation for material databases should
be sufficient to allow institutions to provide supervisors with information needed to determine the soundness of the databases. For example:
A general description of databases (approximate size, date of
construction, owner, etc.);
The source of the data;
The processes used to obtain and load the data;
The filters used to create and debug the database (e.g., maximum
and minimum values);
Controls on transparency, access, consistency, etc.;
Statement of weaknesses: institutions should prepare a global map of
all the data and IT system weaknesses found during the internal validation and review process. Institutions should also state how they plan to correct or reduce the weaknesses.
4.3.4. Guidelines for AMA quantitative issues, internal validation, risk
transfer mechanisms and allocation

The following sections provide guidance and examples related to the
quantification standards for the Advanced Measurement Approach. The CRD grants institutions significant flexibility in the choice of operational risk measurement systems for generating operational risk figures for regulatory capital purposes. This generally reflects the nature of the operational risk measurement systems, as some AMA components are still evolving.
At the moment there is a wide variety of approaches to AMA modelling.
These include the Loss Distribution Approach (LDA) and the Scenario Based Approach (SBA). While LDA models tend to be built on actual loss data and SBA approaches usually rely on constructed (i.e. scenario generated) data, in practice the two methods usually overlap. Hybrid approaches are commonly found, with actual loss data often enriched by constructed data and vice versa. Thus, while some of the examples in the following paragraphs are more applicable to one approach than another (and this does not only mean LDA or SBA), the underlying principles are meant to be generally valid and should therefore be applicable to any AMA approach.
The following paragraphs are intended (among other objectives) to
promote a higher level of homogeneity and common understanding among competent authorities and to provide examples of the definitions and the interpretation of the most commonly used Operational Risk concepts. For this reason, wherever possible, definitions are provided and the terminology used is explained. Definitions and terminology should be considered as indicative for regulators and aiming at explaining common industry practice. General criteria on the AMA models
The term 'operational risk class' can be used to identify a category of
operational risk that is homogeneous in terms of the risks covered and the data available to analyse those risks. Examples of operational risk class could be an Event Type (ET) class, a Business Line (BL) class, a cell BL/ET class or an activity class, a legal entity class or a cause class.
In the CRD, the distribution of losses identified in each operational risk
class is referred to as 'operational risk estimate' (Annex X, Part 3, Paragraph 11). In the following sections, the terms 'distribution' and 'estimate' are used interchangeably. The same holds true for the terms ‘figures’ and ‘measures’ (see below).
The 'operational risk measure' is a single statistic or parameter extracted
from the operational risk estimate. Examples of measures are the Value at Risk or the Expected Shortfall. The institution’s overall operational risk capital figure is derived from the combination of the operational risk estimates calculated for all the operational risk classes.
The model should be applied in a consistent way to comparable
operational risk classes of the institution. The inputs and the way they are treated should be transparent and verifiable. The model should be robust in the sense that it includes all significant drivers of the institution’s operational risk profile and it should be sensitive to material changes in the institution’s operational risk profile.
4.3.4.1. AMA four elements
Combination of the four elements
The CRD requires operational risk measurement systems to have four key
elements. Annex X, Part 3, Paragraphs 9 and 13 to 24 require institutions using the AMA to use all four elements as inputs to their operational risk measurement system.
The responsibility for determining how the four elements are weighted and
combined rests with the institution. The processes for evaluating the availability of the four elements should be consistent with the institution’s general risk management framework.
The model should be documented in detail and the documentation should
be timely and uptodate. In particular:

Institutions should have internal documentation specifying in detail how
the four elements are combined and/or weighted. · The documentation should include a description of process modelling that illustrates the use of the four elements.

The minimum requirements for model documentation for an AMA
application are set out in Paragraph 51 of these guidelines. Annex IV of these guidelines provides additional general examples of an institutions' internal documentation. Qualitative inputs of the four elements
Some of the four elements – or parts of them – may contain qualitative
data (or data incorporating qualitative judgement). Qualitative data generally relate to:

An attribute, such as the quality of the control level on a trading floor, that can only be described qualitatively. Another example is the use of
alternative methods such as scorecards to determine capital requirements due to the unreliability or scarceness of statistical historical loss data.
A quantitative situation that can only be appraised qualitatively (a ‘low’ or ‘very low’ probability).
Internal data (the location of loss, the gender of a person committing
fraud, etc.).

The CRD allows qualitative data to play an important role in the AMA.
Despite their inherent limitations, institutions are allowed to use these data for calculating the regulatory capital requirements.
Institutions that use qualitative data should be able to provide evidence to
their supervisors that:

They are sufficiently skilled at handling qualitative data;
They have done everything possible to remove biases;
The qualitative data are relevant to precisely defined risk variables;
and
There is sufficient evidence that the qualitative data are relevant to the
intended risk objectives. For example, if a qualitative scorecard is used to track internal fraud, the institution should monitor the evolution of the correlation between the score and observed fraud losses over time.

Supervisors should assess the relevance and appropriateness of the
qualitative data used by institutions in computing their capital requirements. They should take into account the institution’s motivation for using qualitative data (e.g., whether it is to incorporate forward looking elements, to replace missing quantitative data, or to conduct scenario analysis, etc.).

Internal data
522. The term 'calculation data set' can be used to identify the part of the
institution’s internal operational risk data that is to be used for the generation of regulatory operational risk estimates and measures.
523. The term “rapidly recovered loss event” can be used to identify an
operational risk event that leads to a loss that is completely recovered in a short period..
524. The term 'nearmiss event’ can be used to identify an operational risk
event that does not lead to a loss.
525. The term 'operational risk gain event’ can be used to identify an operational
risk event that generates a gain.
526. The term 'multiple time losses' can be used to identify a group of
subsequent losses occurring in different periods of time, but relating to the same operational risk event. An example of multiple time losses is a large number of mispriced transactions arising from a single incorrect piece of reference data or from a scheme to defraud using many small transactions.
527. The term 'multipleeffect losses' can be used to identify a group of
associated losses affecting different entities or business lines, units, etc., but relating to the same root event. Loss event identification and classification
528. Institutions should have a policy that identifies when a loss or an event
recorded in the internal loss events database is also to be included in the calculation data set. This policy should provide a consistent treatment of loss data across the institution. Competent authorities should obtain relevant information from the institution on its policy for loss identification and classification.
529. Institutions should be able to separate operational risk events (e.g. loss,
recovery) related to existing insurance policies and other risk transfer mechanisms in the calculation data set. Supervisors could allow institutions to not include the “rapidly recovered loss events” in the calculation data set.
530. Multiple time losses should be aggregated into a single loss before
inclusion in the calculation data set. Multipleeffect losses should also be aggregated into a single loss before inclusion in the calculation data set; possible exceptions should be documented by institutions and properly addressed to prevent undue reduction of the capital figures.
531. The capture of near miss events, while not generally required to be
included in the calculation data set, could nevertheless be useful in increasing awareness of the institution's operational risk profile and

improving its operational risk management processes. Competent authorities could therefore encourage institutions to develop procedures that allow them to identify incidents or near misses. The capture of the operational risk gain events could also be useful for management purposes. The inclusion of the operational risk gain events in the calculation dataset should be appropriately addressed in order to avoid undue reduction of the capital figures.
532. Annex X, Part 3, Paragraph 17 of the CRD requires institutions to set
specific criteria for assigning loss data arising, among other sources, from events in a centralised function or activities that span more than one business line. The following are general examples of how this could be achieved:

Assignment of the entire loss to the business line for which the impact is the greatest
or, solely for management purposes, to a centralised function (for example 'Corporate Center'). · Proportional assignment of the losses to the affected business lines. In this case, a reference code should be used to label the individual business line loss amounts, so as to identify them for attribution to the originating specificloss event. In any case, the aggregated amounts, and not the prorated amounts, should be included in the calculation data set; possible exceptions should be documented by institutions and properly addressed to prevent undue reduction of the capital figures. Minimum loss thresholds

Annex X, Part 3, Paragraph 15 of the CRD requires institutions to define
appropriate minimum loss thresholds for the collection of internal loss data.
The institution is responsible for defining the threshold for an operational
risk class. This threshold is usually determined by the inherent risk and complexity of the class, as well as by the costbenefit analysis of collecting the data below the threshold. Nevertheless, setting the threshold requires accuracy, as it can influence the results of the model considerably. Competent authorities should pay particular attention to how institutions have set their thresholds.
Institutions should be able to provide evidence to competent authorities
that the threshold or thresholds selected for the operational risk classes are reasonable (for example by linking thresholds to risk tolerance), do not omit important operational loss event data, and do not adversely impact the credibility and accuracy of the operational risk measures.
Competent authorities should verify that the institution avoids potential
biases in the estimation of model parameters, explicitly taking into account the incompleteness of the calculation data set in the model due to the presence of threshold(s) (for example, by making use of appropriate distributions and suitable parameter estimation procedures). External data

537. Annex X, Part 3, Paragraph 19 of the CRD states that the institution’s
operational risk measurement system shall use relevant external data, especially when there is reason to believe that the institution is exposed to infrequent, yet potentially severe losses.
538. Consortia initiatives, which are generally set up by institutions, collect data
above low thresholds, usually very close to the thresholds established internally by those institutions.
539. Institutions that participate in consortia initiatives should provide data
which are classified in a homogeneous manner and contain information which is comprehensive and reliable. Information obtained from consortia initiatives which have the abovementioned characteristics can be considered an appropriate external data source for capital calculation purposes, particularly when institutions have limited internal loss data, e.g. on new businesses.
540. Where external data from consortia are insufficient for obtaining
information on severe tail events, especially on their causes, public sources could provide useful additional information.
541. Particular care must be taken when an institution uses only public data to
ensure that they are appropriate, unbiased, and relevant to the institution’s businesses and operational risk profile. 542. Differences in the size of institutions or other institutionspecific factors should be taken into account when incorporating external data in the measurement system, for example by making assumptions as to which external loss events are considered relevant and on the degree the data should be scaled or otherwise adjusted. Scenario analysis
543. Annex X, Part 3, Paragraph 20 of the CRD requires institutions to use
scenario analysis of expert opinion, in conjunction with external data, to evaluate their exposures to highseverity events.
544. The use of scenario analysis is not restricted to evaluating exposures to
highseverity events. In certain approaches, scenarios may be used to provide information on the institution’s overall operational risk exposure.
545. In order to generate credible and reliable data, institutions should ensure a
high level of repeatability of the process for generating scenario data, through consistent preparation and consistent application of the quantitative and qualitative results.
546. Institutions should ensure that the process by which the scenarios are
determined is designed to reduce as much as possible subjectivity and biases. In particular:

The assumptions used in the scenarios should be based as much as
possible on empirical evidence. Relevant internal and external data available should be used in building the scenario;
In choosing the number of scenario to apply, institutions should be able to
explain the rationale behind the level at which scenarios are studied and/or the units in which they are studied;
The assumptions for generating scenario analyses and the process by
which the scenario is built should be well documented.
Business Environment and Internal Control Factors (BE&ICFs)

By their nature, BE&ICFs should be forwardlooking and closely aligned
with the quality of the institution’s control and operating environment. These factors should reflect potential sources of operational risk such as rapid growth, the introduction of new products, employee turnover, and system downtime. BE&ICFs should provide information on how risk is mitigated or magnified by internal and/or external environment, and have to be appropriately captured in the risk measurement system. BE&ICFs can be incorporated into the AMA system in different ways and at different modeling stages. Key Risk indicators are one, but not the only example for BE&ICFs.
Annex X, Part 3, Paragraphs 2123 of the CRD require an institution’s firmwide risk assessment methodology to capture key business environment
and internal control factors (BE&ICFs) that can change its operational risk profile. Institutions should document where in their system they use BE&ICF and their rationale for doing so.
An institution’s risk measurement system should incorporate at least those
BE&ICFs that have a significant influence on its operational risk profile. However, when implementing the risk measurement system for the first time, it might not be possible to justify the appropriateness of the sensitivity of risk estimates because of a lack of empirical evidence on the relationship between the BE&ICFs and the operational risk exposure. In such cases, institutions should at least qualitatively justify the appropriateness of the methods used to incorporate BE&ICFs in their risk measurement system.
4.3.4.2. Consistency of the risk measurement system
Annex X, Part 3, Paragraph 12 of the CRD requires, among others things,
that the risk measurement system be internally consistent.
Institutions should adopt appropriate methods and procedures to
guarantee the consistency and quality of the input, execution, and output phases of the model. Model input, execution and output
Institutions should seek to identify operational risk classes within which
loss amounts are independent and identically distributed. Alternatively, institutions may wish to adjust their data for known drivers in order to simplify the modeling process, which needs to be justified. 553. Where modelling requires independence of loss events, the following tools and techniques may be used. The following are intended to be nonexhaustive and nonbinding examples:

Time plots and appropriate functions, which serve, respectively, to check the level of
stationarity of the data over time and to address the detected nonstationarity of the frequency and severity components. · Techniques that reduce the effects of data clustering and seasonality and that adjust the data for inflation. · Qualitative criteria (based, for example, on the qualitative information relating to the data) and/or quantitative tests to detect outliers and techniques to eliminate or mitigate their influence.

The execution of models for generating regulatory operational risk figures
should be supported by a transparent and consistent process.
Depending on the modelling methodology chosen, institutions could take the following steps which are to be intended neither exhaustive nor binding:
1. Preliminary identification of a set of probability distributions to be fitted to the data.
2. Appropriate techniques for estimating parameters.
3. Appropriate diagnostic tools for evaluating how well the distributions fit the data.
4. Sound methods for selecting distributions, when the results from point 3 do not
indicate a clear choice.
555. In order to determine an overall operational risk capital figure that is
credible and justifiable, the model should be built in a way that ensures the production of results that are as stable as possible. In addition, institutions should be able to evaluate the accuracy of the operational risk capital figures.
556. Some of the elements that institutions could take into consideration when
calculating operational risk capital figure are presented in Annex VII of these guidelines. Observation period
557. Annex X, Part 3, Paragraph 13 of the CRD requires institutions to base
their internally generated operational risk measures on a minimum historical observation period of five years (three years when an institution first moves to an AMA).
558. A lowfrequency operational risk class may need a historical observation
period longer than five years in order to collect sufficient data to generate reliable operational risk measures. General examples of methods that institutions could use to obtain a sufficient amount of data reflecting the current operational risk profile include the following: · Reducing the impact of oldest, least relevant internal data by appropriate weighting techniques (e.g. moving average); using quantitative indicators (e.g. inflation or business/structure risk drivers) or qualitative factors that reflect changes in the institution’s internal/external environment. · Supplementing the most recent years of internal data with the corresponding years of external data from similar institutions/peer groups, after appropriate adjustments to the external data. · Constructing data for operational losses in past years by means of scenario generated data or by scaling back more recent years of internal/external observations through appropriate techniques or indicators.
559. In the absence of sufficient data, institutions should make conservative
risk estimates.

Confidence level
560. Annex X, Part 3, Paragraph 8 of the CRD states that the regulatory
operational risk measure must capture potentially severe tail events, achieving a soundness standard comparable to a 99.9 percent confidence level.
561. In order to generate a regulatory operational risk measure at a soundness
standard comparable to a 99.9 percent confidence level, institutions can perform a direct calculation at the 99.9 percent confidence level, or they can calculate an initial measure at a lower confidence level, located in the right end of the loss distribution, and then scale it up to the 99.9 percent confidence level using appropriate methods.
562. The institution should be able to demonstrate that the scaling method
yields an output that is plausible and reliable. The confidence level used should not necessarily be interpreted as a boundary between the body and the tail of the distribution.
563. The confidence level at which the initial operational risk measure can be
computed should be located in the rightend of the distribution of the losses. The level should be appropriate.
564. If scaling is used, institutions should be able to demonstrate the
soundness, appropriateness, and reliability of the scaling technique and to analyse the overall accuracy of the scaling mechanism. The following are examples of techniques that can be used to scale an initial calculation at a confidence level below 99.9 percent to a level comparable to 99.9 percent: · Imposing a reasonable distribution for the highest percentiles of the data, based, for example, on information collected by peer groups or scenario analysis. · If an Extreme Value Theory approach is used, resorting to the stability property of the model (the socalled 'Peaks over Threshold' stability property) that makes it possible to compute the highest percentiles of the frequency and severity distributions from figures estimated at a lower level (usually at the threshold level).
4.3.4.3. Expected losses, correlation, Insurance and other Risk transfer
mechanisms
Expected losses
565. Annex X, Part 3, Paragraph 8 of the CRD states that institutions shall
calculate their capital requirement as comprising both expected loss (EL) and unexpected loss (UL), unless they can demonstrate that EL is adequately captured in their internal business practices.
566. CEBS endorses the following four general principles for the treatment of EL
by institutions using the AMA, as described in the Basel Committee’s Newsletter n. 7 of November 2005 (“The treatment of expected losses by banks using the AMA under the Basel II Framework”).

For EL to be measured to the satisfaction of national supervisors, the
institution’s estimate of EL should be consistent with the ELplusUL capital requirement calculated using the AMA model approved by

supervisors. For EL to be captured to the satisfaction of national supervisors by means other than holding capital or establishing provisions, the institution should be able to demonstrate that the corresponding losses are highly predictable and reasonably stable, and that the estimation process is consistent over time.
2. The maximum offset for EL should be bounded by the EL exposure
calculated by the institution’s AMA model approved by supervisors. While many supervisors may interpret this maximum offset as a statistical measure of expected loss over the entire loss distribution, some supervisors may choose a more restrictive maximum offset.
3. Allowable offsets for EL should be clear capital substitutes or
otherwise available to cover EL with a high degree of certainty over a oneyear time horizon. Where the offset is something other than provisions, its availability should be limited to those operations with highly predictable, routine losses. Because exceptional operational risk losses do not fall within EL, specific reserves for any such events that have already occurred will not qualify as allowable EL offsets.
4. The institution is expected to clearly document how its EL is
measured and captured, including how any EL offsets meet the conditions outlined above.
567. The principles articulated in this note are designed to be flexible enough to
allow for a range of sound practices and to encourage continued work in this area, while also clarifying CEBS’ expectations. Correlation
568. Annex X, Part 3, Paragraph 11 of the CRD states that correlations in
operational risk losses across individual operational risk estimates may be recognised only if credit institutions can demonstrate to the satisfaction of the competent authorities that their systems for measuring correlations are sound, implemented with integrity, and take into account the uncertainty surrounding such correlation estimates, particularly in periods of stress.
569. Institutions which explore and recognise “correlations” in their AMA models
should take into account of the considerations below (paragraphs 570 to 577). Institutions who do not explore “correlations” in their AMA models have to calculate the overall capital requirement as the sum of the individual operational risk measures arising from different operational risk losses.
570. As noted in paragraphs 552 and 553 of these Guidelines, each operational
risk estimate should be built on a set of loss events and loss amounts (actual or constructed) that are, to the maximum extent possible, independent. Thus, in the context of the CRD requirement mentioned in the preceding paragraph, the term 'correlation' should refer to the relationships between (actual or constructed) data belonging to different operational risk classes.
571. In operational risk, correlations may arise because of the presence of
common factors of different nature, either idiosyncratic (e.g. processes, systems, and people) or due to environmental elements that affect several

geographical, business, or legal units. These factors can influence the observed frequency or severity of losses in more than one operational risk class.
572. The term correlation, as used in the CRD, should be interpreted broadly to
mean any form of dependency (e.g. linear or nonlinear, relating to all the data or just to the body or the tail) across two or more operational risk classes, caused by internal and/or external factors. Model documentation should identify and justify assumptions relating to correlation, and should evaluate the model's sensitivity to those assumptions.
573. Lowfrequency, highseverity events are usually the main drivers of risk
estimates used in AMA models. Dependencies between such tail events should be studied with great care. Given the different nature of tail and body events, different quantitative and qualitative tools could be necessary to determine and estimate the impact that the underlying dependency structures will have on capital.
574. Dependencies, in both quantitative (e.g. LDA) and qualitative approaches
(e.g. SBA or others) should, to the maximum extent possible, be identified, and treated directly in the input information. Procedures to minimise the impact of such dependencies should be applied and documented as clearly as possible. In techniques based on loss data, this can be achieved, for example, through quality control or treatment of the loss databases 23; and in qualitative approaches, through appropriate selection of the scenario 24 or selfassessment questionnaires.
575. Annex X, part 3, paragraph 11 of the CRD also states that “The credit
institution must validate its correlation assumptions using appropriate quantitative and qualitative techniques'. 576. Validation with quantitative techniques developed for correlations between highfrequency, lowseverity events could be difficult to apply to dependencies between tail events.
577. In these cases, the soundness of dependency assumptions that have a
material impact on the overall AMA measure should be demonstrated by using, at a minimum, qualitative validation techniques; and, where possible, quantitative techniques and/or some form of stresstest analysis. Insurance and other Risk Transfer Mechanisms
578. Competent authorities would be expected to apply an appropriate level of
standards for the recognition of other risk transfer mechanisms.
579. Outsourced activities should not be considered part of other risk transfer
mechanisms.
23 For instance, integrating data which show strong cross dependencies into a single data point. 24 For instance, by considering uncorrelated, independent, causal factors.

580. Institutions should keep their use of insurance and other risk transfer
mechanisms under review and recalculate the operational risk capital charge if appropriate in the event that the nature of the insurance or the coverage of other risk transfer mechanisms changes significantly.
581. Institutions should notify competent authorities of material changes in the
coverage of insurance or other risk transfer mechanisms.
4.3.4.4. Internal validation of risk measurement and management
processes
582. This section examines the scope of AMA internal validation to be
undertaken by institutions, and provides guidance to competent authorities on the types of internal validation and assurance techniques that institutions could apply. It does not propose guidance for competent authorities on how they should conduct their own assessments.
583. The following highlevel principles apply to validation:
1. Internal validation is the responsibility of the institution. The
institution should make a 'best effort' to internally validate its AMA framework.
2. Institutions should establish a clear methodology for internal
validation. This methodology should be appropriate for the organisation and its AMA framework, and should be clearly documented. 3. There is no single validation method. Internal validation techniques should be proportionate and take into account changing market and operating conditions.
4. Internal validation should encompass both quantitative and
qualitative elements.
5. Internal validation processes and outcomes should be subject to
independent review to ensure that implementation is effective.
584. The frequency of internal validation will ultimately depend on what is being
validated and on its significance in the institution's risk measurement systems or risk management processes. Institutions should conduct a complete internal validation programme, including independent review of the internal validation processes and outcomes, before submitting the AMA application (i.e., at the model development stage).
585. Institutions should periodically analyse their internal validation
methodology to ensure that it remains appropriate. In particular, certain parts of the risk measurement systems and risk management processes should be revalidated, at least if there is a significant change in the institution’s operational risk profile and/or in the model's methodology/assumptions or management processes. Validation of Risk Measurement Systems
586. Validation of operational risk measurement systems presents major
challenges to institutions. Nevertheless, an institution has to have an

internal validation process. This should be proportionate and should take into account the specific purpose for which the operational risk measurement systems are used.
587. Institutions should ensure that information that is feeded into the risk
measurement systems is as accurate and complete as reasonably practicable.
588. There are many methods that can be used for validation; and, as
institutions gain experience, new validation techniques will emerge. An institution should consider a robust approach to validation and should be able to explain and justify its methodology. An institution's internal validation of its risk measurement systems should encompass both quantitative and qualitative elements and be clearly documented. This documentation should provide a detailed outline of the validation methodology (including frequency), and outline any identified weaknesses.
589. The following paragraphs describe the minimum validation requirements
that competent authorities should expect institutions to satisfy in the relevant areas of the risk measurement systems. Model input, methodology and output
590. The institution should have clear standards for the input of data into its
model, to which it must adhere (as already mentioned in other parts of these guidelines, e.g. section 4.3.3.).
591. All material data above the thresholds set must be validated to ensure that
they are comprehensive, appropriate, and accurate. Validation should cover all data types: actual data, constructed data, figures generated by scenario analysis, factors relating to business environments, and internal control factors. Particularly for constructed data, the validation should ensure that the assumptions are unbiased and the results are realistic.
592. The institution should ultimately be able to ensure the validity of the
model input on an ongoing basis.
593. Model validation should ensure that the relationship between the inputs
and outputs of the model are stable and that the techniques underlying the model are transparent and intuitive. The model should be logical: if controls are improved, then EL and/or UL should decrease; and hence, all other things remaining equal, there should be a corresponding reduction in regulatory capital.
594. The institution should be able to ensure the validity of the model
methodology at the development stage and following significant changes in methodology/assumptions, and it should be able to ensure the validity of the model output on an ongoing basis. Validation of Risk Management Processes

Institutions should have robust risk management processes for managing
operational risk throughout the business. Institutions will be expected, as
part of the internal validation process, to assess the appropriateness of
their risk management processes. This is to ensure that the framework remains 'fit for purpose' and operates as management would expect it to.
Validation of the risk management processes should be an ongoing
exercise. Institutions should be able to justify to competent authorities how they do this. Institutions can use a variety of validation techniques. These include verifying that:

Risk management documentation is complete.
Management information reporting procedures are followed.
Captured loss data meet the required data standards.
Followup actions are carried out in an effective and timely manner.
Procedures to review and update the operational risk management
framework are followed.
KRI's/loss data/compliance reports and risk estimates are in line with
the results of qualitative selfassessments.
4.3.4.5. Allocation methodology for AMA institutions on a groupwide
basis

When an EU parent institution and its subsidiaries, or the subsidiaries of
an EU parent financial holding company, intend to use the AMA to calculate operational risk capital requirements on a groupwide basis, their application shall include a description of the methodology that will be used to allocate operational risk capital between the different entities of the group (Annex X, Part 3, Paragraph 30 of the CRD). This methodology must allocate capital from the consolidated group level downwards to subsidiaries that are involved in the consolidated AMA calculation process. Institutions should demonstrate that they have sound and rational methodologies for allocation and that they are implemented consistently, fairly, and with integrity. Institutions are strongly encouraged to move towards allocation mechanisms that properly reflect the operational riskiness of the subsidiaries and their actual contribution to the consolidated capital charge. The allocation mechanism should be a significant component of the assessment of the application by the home supervisor and relevant host supervisors.
4.3.5. Internal governance
Operational risk management differs from credit risk management, reflecting fundamental conceptual differences between operational risk and
credit risk.
Operational risk is inherent in every activity performed by an institution
and in every part of its organisation, while credit risk is localised in portfolios. Credit risk is actively taken, in order to generate income, while

operational risk is inherent in every activity performed by an institution. The amount of credit risk that an institution wants to take on can be defined and controlled using a limit system, while it is difficult to set limits for operational risk (although it can be mitigated by insurance and/or internal controls).
600. Article 105(1) and (2) of the CRD provides that permission to calculate
operational risk capital requirement using the AMA can be given only if the competent authority is satisfied that the institution meets the qualifying criteria in Annex X, Part 3 of the CRD.
601. In particular, with regard to internal governance matters, the following
elements have to be taken into account:

Reporting: There should be a regular reporting on operational risk
exposures and loss experience. The institution shall have procedures for taking appropriate corrective action. (Annex X, Part 3, Paragraph 4 of the CRD).
Operational risk management function: The institution should have
an independent risk management function for operational risk. (Annex X, Part 3, Paragraph 3).
Internal Audit: The operational risk management processes and
measurement systems shall be subject to regular reviews performed by internal and/or external auditors (Annex X, Part 3, Paragraph 6). Hierarchy of responsibility, management body and senior management

Sound internal governance requires that the decisionmaking process be
clearly stated within each institution, in terms of hierarchy and level of responsibility. In order to improve understanding of the operational risk measurement system among the members of the management body, and to improve efficiency, the management body may, where appropriate, establish specific Risk Committees and delegate certain aspects of this framework to these committees or to senior management. Senior management itself may also delegate certain tasks. However, such delegations do neither relieve the management body and senior management from their obligation to have a general awareness of the AMA framework used by their institution, nor do they relieve the management body from its ultimate responsibility for the AMA framework and the senior management from its responsibility for developing and implementing it.
Both the management body and senior management should be responsible
for approving all material aspects of the overall operational risk framework. They should have a general understanding of the institution’s operational risk measurement systems and detailed comprehension of its associated management reports submitted to them and how operational risk affects the institution. The material aspects of the overall operational risk framework encompass:

Activities aimed at identifying, assessing and/or measuring,
monitoring, controlling, and mitigating operational risk
Proactive risk management strategies and policies;
The organisational structure of the control functions; and
Specifying levels of acceptable risk.

Both the management body and senior management are responsible for
making formal decisions on the implementation of the AMA approach. This includes the overall approval of the project, the specification of goals, and the appointment of the organisational structures responsible for implementation. A time schedule of the necessary steps and an estimation of related costs and benefits should be provided with the project approval.
The management body has to exercise effective oversight. Senior
management should therefore notify the management body, or a designated committee thereof, of material changes or exceptions from established policies that will materially impact the institution’s operational risk measurement systems and management processes.
Both the management body and senior management should be involved, on an ongoing basis, in the oversight of the control procedures and
measurement systems adopted by the operational risk management function, to ensure that they are adequate and that the overall operational risk management and measurement processes and systems remain effective over time. For the same reason the management body should be involved, on an ongoing basis, in the oversight of the control procedures of Internal Audit.
Senior management should ensure that the following tasks are being
addressed:

Ensuring the soundness of risk management processes;
Informing the management body – or a designated committee thereof – of material changes or exceptions from established policies that will
materially impact the operations and the operational risk profile of the institution;
Identifying and assessing the main risk drivers, based on information
provided by the operational risk management function;
Defining the tasks of the risk management unit and evaluating the
adequacy of its professional skills;
Monitoring and managing all sources of potential conflicts of interest;
Establishing effective communication channels in order to ensure that
all staff are aware of relevant policies and procedures;
Defining the content of reporting to the management body or to
different delegated bodies thereof (e.g., the Risk Committee);
Examining reports from Internal Audit on operational risk management
and measurement processes and systems; and
Adequately assessing operational risk inherent in new areas (products,
activities, processes, and systems) before they are introduced, and identifying risks tied to new product development and other significant changes in order to ensure that the risk profiles of product lines are updated regularly.

The operational risk management function designs, develops, implements,
and executes risk management and measurement processes and systems.
The Internal Audit should provide an assessment of the overall adequacy
of the operational risk framework, as well as of the operational risk management function. Internal reporting
Operational risk reporting should be an essential part of the internal
reporting system and should support the proactive management of operational risk. The recipients of the reporting should be the management body, senior management, Internal Audit, the Risk Committee and/or the Internal Control Committees (where established), and, where appropriate, the internal functions responsible for the identifying, assessing, monitoring, mitigating, and controlling operational risks. These internal functions could include, for example, business functions, central functions (such as IT, Plan and Management control, and accounting), and risk functions.
The frequency and content of reporting should be formally approved by
both the management body and senior management. Senior management should ensure the ongoing appropriateness of the reporting framework.
The frequency, content, and format of reporting should depend on the
recipient and on how the information will be used. Possible uses include strategic and financial planning, daytoday management, operational risk management and measurement, market disclosure, etc.
The scope of information included in internal reporting may vary according
to the nature, size, and degree of complexity of the business, as well as of the institution. As a general rule, the riskier the business, the more detailed the information to be provided. The frequency and format of the internal reporting should be consistent with the level of risk.
The design of the reporting framework is the responsibility of the
institution. However, reporting could include:

Estimates of regulatory and economic capital;
New or improved management policies, procedures, and practices
(e.g., changes in the business environment, business practices, and internal control factors);
Risk reduction and risk transfer strategies (e.g., the effect of any
expected loss deductions, costbenefit analysis of insurance policies, mitigation and corrective actions on the business line/event type exposure and/or losses, costbenefit analysis of the mitigation actions);
Operational risk exposure (e.g., description of key operational risk
events and drivers, and the distribution, trend, and migration of the operational risk exposure across business lines);
Internal and (where relevant) external loss experience (e.g., event
type loss analysis and comparison in term of trends, seasonality, geographical distribution, etc.);
Identification and assessment of vulnerability areas (e.g., risk
assessments, key risk indicators); and
Quality improvements in operational risk management and
measurement processes and systems.
Operational risk management function

The Operational risk management function (ORMF) should ensure, on a
regular basis, that the institution’s operational risk measurement processes and risk management systems and all of their components are functioning as intended. The ORMF should have sufficient resources and skills in operational risk management and measurement methods and knowledge of the processes of the institution.
The Operational risk management function should ensure that the
following tasks and areas (among others) are performed or covered on a ongoing basis:

The processes related to the definition, documentation, and collection
of the four AMA elements;
Measurement methodology;
Monitoring and reporting systems;
Verifying the fulfilment of the qualifying criteria, and, in particular, of
the use test;
Operational risk quantification and allocation processes, including the
calculation of any haircuts (EL, Dependence, Insurance), where sufficient data are available, backtesting and benchmarking, and the methodology for the allocation keys.

The CRD does not specify how and where the internal validation of the
AMA measurement models should take place. Ideally, the people responsible for the internal validation of measurement systems and management processes should not be the same as the people responsible for their design (see paragraph 418 of these Guidelines, which introduces a similar principle in the context of credit risk). However, on an exceptional or temporary basis, it can be acceptable that the role of validation of the AMA measurement systems and management processes is undertaken by the same function as the one involved in designing, developing, and implementing the operational risk framework.
Any potential lack of objectivity should be offset by an independent
review, as required by the fifth principle of paragraph 583 of these Guidelines. Institutions are encouraged to move to an independent internal validation process as soon as possible.
Any attempt to specify where in the organisational structure of an
institution the ORMF should be located could be to some extent counterproductive, for the following reasons:

The activities of the ORMF could span multiple areas and business
units;
Institutions will choose a structure that fits their management and
oversight frameworks.

Institutions generally have a central operational risk unit and some
operational risk staff in the local entities (units, businesses, etc.). Where this is the case, the institution should ensure that the local operational risk staff follows the guidelines set by the central operational risk unit. There should be clear responsibilities and reporting lines. The Internal Audit should perform specific examinations in order to assess the ‘real’ degree of independence of the ORMF. Internal Audit
The central role of Internal Audit’s review of the operational risk
management framework is to ensure the effectiveness of the institution’s operational risk management processes and measurement systems and the work of the ORMF, and to verify compliance with the AMA standards.
As part of its activities, Internal Audit should develop a programme for
reviewing the operational risk framework that covers all significant activities – including outsourced activities – that expose the institution to material operational risk. This programme should be regularly updated with regard to:

Development of internal processes for the identifying, assessing,
monitoring, controlling, and mitigating operational risk; and
Implementation of new products, processes, and systems which expose
the institution to material operational risk.

Internal Audit activity should also cover issues such as the adequacy of
the IT infrastructure, data collections, and data maintenance. Specific tests should be performed in order to check the data input process.
Internal Audit functions should be staffed by individuals possessing the
requisite skills and experience. It is important that they be familiar with the institution’s strategy and its processes for identifying, assessing, monitoring, controlling, and mitigating operational risk.
Some cooperation between Internal Audit and the ORMF is permissible, especially in some operational riskrelated activities and processes where
Internal Audit’s experience and skills are well developed (for example, analysis of processes, loss data collections, risk and control assessments, etc.). However, cooperation with the ORMF should not jeopardise the independence of Internal Audit. Whatever advice or information may be provided by Internal Audit, designing, implementing, and updating the operational risk framework remains the exclusive responsibility of the ORMF, and Internal Audit should not be involved in daytoday operational risk activities.

ANNEXES III to V
Annex III
1) “Passthrough” transactions. These are transactions that transfer risk
in a pattern different from the typical tranching of risk. In passthrough structures, all of the securities issued rank 'pari passu' (each holder is in the same position as if he held a proportional part of the underlying pool). They do not transfer different levels of risk to different investors, but simply 'pass through' some level of risk to all investors, and thus could be seen as a form of syndication rather than a securitisation. Examples of this type of transaction are US MBS structures and some covered bond structures. In some cases, the structure comes with a guarantee or other form of credit enhancement (e.g. over collateralisation) provided by the originator or by an agency that covers the first loss. Market participants view these transactions as securitisations. They fall under the regulatory securitisation treatment if their structure includes a firstloss position tranche or credit enhancement (guarantee, overcollateralisation etc) in addition to the bonds. In that case, the requirement that a securitisation include at least two tranches is satisfied. However, if there is no firstloss position, then the transaction does not fall under the securitisation framework for regulatory purposes.
2) Covered bonds. According to the current exposure class definitions,
covered bonds, within the meaning of Annex VI, Part 1, Paragraph 65 of the CRD, do not qualify as securitisations for regulatory purposes, because they do not include at least two different levels of risk, and because they are recourse obligations issued by a institution and not by a bankruptcyremote SPE. However, the funding purpose served by covered bonds may be similar to that of traditional securitisation, and, to a lesser extent, of synthetic securitisation, although their regulatory treatment is quite different. The difference in regulatory treatment could induce institutions to look for arbitrage opportunities. In some countries, securitisation positions and covered bonds are interlinked. For example, covered bonds collateralised by mortgage loans have been securitised, issued by the institutions, and bought by an instrumental firm that sells them to an SPV. The SPV issues two series of bonds (usually AAA and A). The structure also benefits from subordinated loans, usually from the institutions that originally held the mortgage loans. Institutions use this structure as a way of obtaining funding at lower cost than pure covered bonds, since it receives higher ratings. Such structures fall within the definition of securitisation, since there are at least two tranches of risk.
3) Tranched cover. This transaction provides partial protection to a loan. The institution buys funded protection (CreditLinked Notes) or unfunded
protection (guarantees or CreditDefault Swaps) to cover only part of the risk of a loan, but the protected and unprotected parts do not have the same seniority. Such transactions must be treated under securitisation rules since they create two different tranches of risk. In contrast, if the protected and unprotected parts have equal seniority, CRM rules for

partial cover must be applied. In the case of maximumvalue guarantees, if the borrower’s overall exposure to the institution exceeds the value of the guarantee, boundary issues could arise if the guarantee is drawn after workout.
4) Specialised lending (SL). The need for particular attention to the
boundary between securitisation and SL (specifically, Project Finance and IncomeProducing Real Estate) arises from the fact that the scope of application of the securitisation treatment does not depend on more than one underlying credit risk exposure being subject to a tranched transfer of credit risk. Seniorsubordinate financing structures are common in some parts of the specialised lending business, with the senior subordinate structure not necessarily limited to the priority of claims on liquidation proceeds upon default of the borrowing entity, but also encompassing contractual clauses on the deferral of payments to the creditor of the subordinated loan. Furthermore, it is quite common to vest the subordinate creditor with the right to initiate and control liquidation procedures or to require the senior loan creditor to assign the senior loan to the subordinated loan creditor. The supervisory rationale for providing a separate treatment for securitisation exposures was to preclude institutions using ownestimates of asset correlations at this time for regulatory purposes. From a risk assessment and management perspective, an institution involved in a seniorsubordinate SL financing may well be able to determine a borrower’s PD and a facility’s LGD (taking into account the claim of any more senior creditors on liquidation proceeds) without estimating asset correlations internally. A possible criterion could be: if the tranched instruments themselves generate the 'underlying' payment obligation of the counterparty, the entire transaction in which these tranched instruments are used is to be treated as nonsecuritisation; if the credit risk of an already existing payment obligation is transferred through tranched instruments, the entire transaction in which these tranched instruments are used is to be treated as securitisation. This assessment has to be made on a singletransaction basis. For example, assume Bank A and Bank B jointly provide financing to a project SPV through a senior loan (creditor: Bank A) and a junior loan (creditor: Bank B). As the tranched instruments (senior and junior loans) themselves generate the borrower’s payment obligation, the entire transaction, and thus both the senior loan and the junior loan, are treated as nonsecuritisation, i.e as SL or corporate exposures. If Bank A (senior loan creditor) were now to split the senior loan’s credit risk by transferring it through tranched instruments (e.g. 'single CMBS'), this second transaction would be treated as a securitisation. If Bank A (the senior loan creditor and originator with respect to the securitisation transaction) uses the IRB approach for the senior loan borrowers, it would be able to estimate PD and LGD/CF (if authorised to use own estimates of LGD/CF for that exposure class), or utilise the SLsimple risk weight, if applicable, for its exposure in
the form of the senior loan. If Bank A retained any of the tranches created in the second transaction, it would have to calculate riskweighted exposure amounts for these

retained securitisation positions according to the securitisation framework, provided that it decided to take the second transaction into account as risk reducing for regulatory purposes, and provided further that the second transaction complied with the minimum criteria for effective and significant risk transfer for traditional or synthetic (as the case may be) securitisations. Project Finance can include credit enhancements that in many cases can be considered to be tranched. The situation may be similar in Income Producing Real Estate, where the transaction can be done via an SPV or a REITlike structure. This raises the issue of whether all tranched transactions should be treated within the securitisation framework, or should some cases be treated under SL. The crucial difference between the two frameworks is that in SL, the investor is expected to have a substantial degree of control over the physical collateral that constitutes the underlying asset. This criterion is part of the SL definition (Article 86(6)(b) of the CRD), which states that one of the characteristics of SL exposures is that “the contractual arrangements give the lender a substantial degree of control over the assets and the income that they generate.” This would not be the case in a securitisation.
5) Whole loan transactions are those where the credit risk of a single
underlying risk exposure is transferred in tranches. Since the number of underlying exposures is not relevant in the securitisation definition, these transactions will be treated like any other securitisation. Similarly, bilateral securitisations (transactions that are not publicly issued to the market) will be also included in the securitisation framework.
ANNEX IV:
Additional elaboration of the institution’s internal documentation relating to the quantitative aspects of AMA

Assumptions implicit in the model. · How the operational risk classes have been determined. · How actual and constructed data are acquired and how they are used or
incorporated in the model. · The phases of input, execution, and output of the model. · How internal holding periods are identified and how the 'regulatory holding period' is derived from them.
How a soundness standard comparable to a 99.9 percent confidence
level has been achieved. · How expected and unexpected losses have been computed, and whether and how expected losses have been captured in internal business practices.
The aggregation methodology used to compute the institution’s overall
operational risk estimate (or measure) from the individual operational risk estimates (or measures). In particular, the documentation should detail whether and how the correlations across the individual operational risk estimates have been computed and how they have been validated. · Whether and how the impact of insurance has been recognised in the model.
The process adopted to validate the model, especially: decision criteria
and/or statistical tests for identifying situations where internal data are deemed sufficient/insufficient to compute operational risk measures. · The policy for updating the model.
ANNEX V: Elements to be considered for model output
The following is a nonexhaustive and nonbinding list of elements that may represent good practice of the model output:
If simulation methods (e.g. Monte Carlo) are used, an important variable
is the number of steps to be performed. Good modelling practice suggests that the number should be consistent with the shape of the distributions and with the confidence level to be achieved. In particular, where the distribution of losses is heavytailed and a measure at a high confidence level is to be computed, the number of steps should be sufficiently large to reduce sampling variability to an acceptable level. · If an Extreme Value Theory model is used, the number of data points above the threshold and the magnitude of the tail parameter usually drive the confidence level to which the operational risk measure can be computed. Institutions should pay particular attention to this area. · The capital figure should be supplemented with appropriately computed confidence bands that identify the potential variability of the point estimate. · Where the institution calculates both economic and regulatory operational risk capital, it should explain the reasons for any differences in the definitions, scope, methodologies, and results.

Lineage: No known changes

Similar documents from other regulators