Joint EBA and ESMA Guidelines on common procedures and methodologies for the supervisory review and evaluation process (SREP) under Directive (EU) 2019/2034

EBA/GL/2022/09 ESMA35-36-2621 20/07/2022 Final Report Joint EBA and ESMA Guidelines on common procedures and methodologies for the supervisory review and evaluation process (SREP) under Directive (EU) 2019/2034

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 2 Contents

1. Executive Summary 4
2. Background and rationale 6
3. Guidelines 17 Title 1 General provisions 19 Title 2 The common SREP 24 2.1 Overview of the common SREP framework 24 2.2 Scoring in the SREP 27 2.3 Organisational arrangements 29 2.4 Proportionality and supervisory engagement 30 Title 3 Monitoring of key indicators 34 Title 4 Business model analysis 36 4.1 General considerations 36 4.2 Preliminary assessment 37 4.3 Identifying the areas of focus for the BMA 38 4.4 Assessing the business environment 39 4.5 Analysis of the current business model 39 4.6 Analysis of the strategy 41 4.7 Assessing business model viability 41 4.8 Assessing the sustainability of the investment firm’s strategy 42 4.9 Identification of key vulnerabilities 42 4.10 Summary of findings and scoring 43 Title 5 Assessing internal governance and investment firm-wide controls 46 5.1 General considerations 46 5.2 Overall internal governance framework 48 5.3 Organisation and functioning of the management body 51 5.4 Remuneration policies and practices 51 5.5 Internal control framework and functions 52 5.6 Risk management framework 54 5.7 ML/TF risks and prudential concerns 58 5.8 Information and communication technologies 59 5.9 Business contingency and continuity planning 59 5.10 Application at the consolidated level and implications for group entities 60 5.11 Summary of findings and scoring 60 Title 6 Assessing risks to capital 63 6.1 General considerations 63 6.2 Assessment of orderly wind-down of the investment firm 65 6.3 Assessment of Risk-to-Client 67 6.4 Assessment of Risk-to-Market 72 6.5 Assessment of Risk-to-Firm 78 6.6 Assessment of other risks 84

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 3 Title 7 SREP capital assessment 90 7.1 General considerations 90 7.2 Determining additional own funds requirement 91 7.3 Articulation and justification of own funds requirements 95 7.4 Meeting requirements under cyclical economic fluctuations 96 7.5 Summary of findings and scoring 100 Title 8 Assessing risk to liquidity 103 8.1 General considerations 103 8.2 Assessing liquidity risk 104 8.3 Assessing liquidity risk management 108 8.4 Summary of findings and scoring 110 Title 9. Determination of the outcome of liquidity assessment 112 9.1 General considerations 112 9.2 Overall assessment of liquidity risk 112 9.3 Determining the need for specific liquidity requirements 113 9.4 Summary of findings and scoring 113 Title 10 Overall SREP assessment and application of supervisory measures 115 10.1 General considerations 115 10.2 Overall SREP assessment 116 10.3 Application of capital measures 119 10.4 Application of liquidity measures 120 10.5 Application of other supervisory measures 120 10.6 Supervisory reaction to a situation where Pillar 2 requirement is not met 127 10.7 Supervisory reaction to a situation where P2G is not met 128 10.8 Interaction between supervisory and early intervention measures 129 10.9 Interaction between supervisory and AML/CFT measures 129 Title 11 Application of SREP to investment firms groups 130 11.1 Application of the SREP to cross-border groups 130 11.2 SREP capital assessment and investment firm-specific prudential requirements 132 11.3 Application of other supervisory measures 132 4. Accompanying documents 134

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 4

1. Executive Summary Supervisory review and evaluation process (SREP) is one of the main tools for supervision, through which competent authorities form a comprehensive view on the business model and risk profile of the supervised entity, as well as its overall viability and sustainability. These guidelines, drawn up pursuant to subparagraph 4 of Article 45(2) of Directive (EU) 2019/2034 on the prudential supervision of investment firms, are addressed to competent authorities and intend to promote common practices for the SREP referred to in Article 36 of Directive (EU) 2019/2034. The common SREP framework introduced in these guidelines is built around the four main elements:  business model analysis;  assessment of internal governance and investment firm-wide control arrangements;  assessment of risks to capital and adequacy of capital to cover these risks; and  assessment of risks to liquidity and funding and adequacy of liquidity resources to cover these risks. The consistency and comparability of assessment is facilitated by the common scoring framework, differentiating between risks and viability scores. The scores of individual risks and SREP elements are brought together to form an overall SREP score, reflecting the assessment of the viability of the investment firm. The outcome of the assessment is the basis for taking any necessary supervisory measures to address specific risks and concerns. Therefore guidance is provided on the application of supervisory measures, including quantitative capital and liquidity measures as well as other qualitative measures as necessary. The guidelines specify common procedures and methodologies for SREP which are proportionate to the different sizes and business models of investment firms, and the nature, scale and complexity of their activities. In particular, investment firms are classified into four distinct categories, which translate into different frequency, depth and intensity of the assessments, and the engagement of the competent authority. Finally, these guidelines make a link between ongoing supervision, as addressed in Directive (EU) 2019/2034, and the gone-concern, by determining whether the investment firm is 'failing or likely to fail'. The link is made to resolution processes under Directive 2014/59/EU for those investment firms subject to it, while in other cases investment firms assessed as ‘failing or likely to fail’ are expected to undergo an orderly wind-down. Next steps The guidelines will be translated into the official EU languages and published on the EBA and ESMA websites. The deadline for competent authorities to report whether they comply with the

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 5 guidelines will be two months after the publication of the translations. The guidelines will apply from 19.06.2023.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 6 2. Background and rationale 2.1 Background

1. Supervisory review and evaluation process (SREP) is one of the main tools for supervision, through which competent authorities form a comprehensive view on the business model and risk profile of the supervised entity, as well as its overall viability and sustainability. As part of SREP, based on the comprehensive assessment, competent authorities set additional own funds requirement and apply other supervisory measures as necessary. The outcomes of SREP are provided individually to each supervised entity, ensuring that its specific circumstances and risk profile are duly taken into account, and that all material risks are adequately addressed through capital or other supervisory measures.
2. Article 45 of Directive (EU) 2019/2034 addresses the consistency of supervisory reviews, evaluation and supervisory measures, mandating the EBA and ESMA to issue guidelines for competent authorities to specify, in a manner that is appropriate to the size, structure and internal organisation of investment firms, and the nature, scope and complexity of their activities, the common procedures and methodologies for the SREP and for the assessment of the organisation and treatment of the risks referred to in Article 29 of that Directive.
3. In accordance with Article 16 of Regulation (EU) 1093/2010 and of Regulation (EU) No 1095/2010, the EBA and ESMA issue guidelines addressed to competent authorities, with a view to establishing consistent, efficient, and effective supervisory practices and ensuring that there is common, uniform, and consistent application of European Union law.
4. In line with the mandate, these guidelines cover common procedures and methodologies for the SREP as defined in Article 36 of Directive (EU) 2019/2034 including assessment of the organisation and treatment of risks. In particular, the guidelines cover overall risk management and governance arrangements, the risks to capital to which the investment firm is or may be exposed to, the business model of the investment firm, as well as the assessment of systemic risk of the investment firm.
5. Before entry into force of the regulatory package for investment firms, including Regulation (EU) 2019/2033 and Directive (EU) 2019/2034, some investment firms were subject to the provisions of the Directive 2013/36/EU, the Regulation (EU) 575/2013 and the SREP Guidelines for the assessment of credit institutions (EBA/GL/2014/13 and its further revisions). However, these provisions did not take into account the specificities of investment firms as compared to credit institutions. This led to a change of the regulatory framework by introducing the Directive (EU) 2019/2034 and the Regulation (EU) 2019/2033.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 7 6. As a consequence of these changes, class 1 investment firms as defined in Article 1(2) of Regulation (EU) 2019/2033 (i.e. systemically important investment firms or exposed to the same types of risks as credit institutions) are still subject to relevant provisions of Directive 2013/36/EU and Regulation (EU) No 575/2013 and therefore will be treated as credit institutions in terms of own funds requirements and supervisory review. Class 2 investment firms (those exceeding the threshold for not being classified as small and non-interconnected firms but not treated as class 1) and class 3 (the small and non-interconnected firms as defined in Article 12 of the Regulation (EU) 2019/2033) calculate own funds requirements in accordance with Regulation (EU) 2019/2033 and are subject to supervisory review in accordance with Directive (EU) 2019/2034. Therefore, these guidelines are addressed to competent authorities supervising class 2 and class 3 investment firms and specify the procedures and methodologies for the supervisory review and evaluation of these firms. Table 1. Investment firms outside the scope of these guidelines Class 1 firms Reference* Short description* Investment firms with assets above EUR 30 billion Article 62(3) IFR Included in the definition of credit institutions, through an amendment of Article 4(1) of CRR; as a result all requirements of the CRR and CRD apply. Investment firms with assets above EUR 15 billion Article 1(2) IFR Article 2(2) IFD Excluded from the scope of application of IFD Title IV (Prudential supervision) and Title V (Publication by competent authorities); instead they are subject to the requirements under Titles VII and VIII of CRD. Investment firms with assets above EUR 5 billion Article 1(2) IFR Article 2(2) IFD Article 5(1)-(3) IFD *IFR – Regulation (EU) 2019/2033 IFD – Directive (EU) 2019/2034 CRR – Regulation (EU) No 575/2013 CRD – Directive 2013/36/EU 7. The main objective of these guidelines is to ensure consistency in supervisory practices in the assessment of class 2 and class 3 investment firms and in the application of capital and other supervisory measures, and thus to contribute to level playing field for these investment firms across the EU. To achieve this objective, in addition to specifying SREP procedures and methodologies as required by Directive (EU) 2019/2034, these guidelines also provide guidance for subsequent supervisory measures that a competent authority should consider, including prudential measures as specified in Directive (EU) 2019/2034. 8. While the aim of the guidelines is to harmonise the SREP framework, they should be seen as guiding and not as restricting or limiting supervisory judgment as long as it is in line with applicable legislation. Competent authorities should, however, apply these guidelines in a way that will not compromise the intended harmonisation and convergence thereof, particularly ensuring that high supervisory standards are implemented across the EU. Additional procedures

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 8 or methodologies employed by competent authorities should not compromise the harmonised overall SREP framework as provided in these guidelines. These additional procedures and methodologies should satisfy the requirements of high supervisory quality and should not encourage regulatory arbitrage. 2.2 The common SREP framework 9. These guidelines set out the scope of application of the common SREP framework for the assessment of investment firms, taking into account the general framework and principles defined in Regulation (EU) 2019/2033 and Directive (EU) 2019/2034. Consistently with the SREP framework applicable to the assessment of credit institutions, the SREP framework introduced in these guidelines is built around the following major components (see also Figure 1): a) categorisation of the investment firm and periodic review of this categorisation; b) monitoring of key indicators; c) business model analysis; d) assessment of internal governance and firm-wide controls; e) assessment of risks to capital; f) assessment of risks to liquidity and funding; g) assessment of the adequacy of the investment firm’s own funds; h) assessment of the adequacy of the investment firm’s liquidity resources; i) the overall SREP assessment; and j) supervisory measures (and early intervention measures where necessary).

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 9 Figure 1. Overview of the common SREP framework • The categorisation of investment firms into four categories should be based on their size and risk profile, also taking into account the scope, nature and complexity of their activities. For the proportionate application of these guidelines, the frequency, intensity and granularity of SREP assessments and the level of engagement should depend on the firm’s category. • Regular monitoring of key financial and non-financial indicators supports the SREP. It should allow competent authorities to monitor changes in the financial conditions and risk profiles of investment firms. It should prompt updates to the assessment of SREP elements where it brings to light new material information outside of planned supervisory activities. • Without undermining the responsibility of the investment firm’s management body for organising and running its business, the focus of the business model analysis (BMA) should be the assessment of the viability of the investment firm’s current business model and the sustainability of its strategic plans. This analysis should also assist in revealing key vulnerabilities facing the investment firm that may not be revealed by other elements of the SREP. Competent authorities should score the risk to the viability of an investment firm stemming from its business model and strategy keeping in mind that the aim of the BMA is not to introduce supervisory rating of various business models. • The focus of the assessment of internal governance and firm-wide controls should be (i) to ensure that internal governance and firm-wide controls are adequate for the investment firm’s risk profile, business model, size and complexity, and (ii) to assess the degree to which the

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 10 investment firm adheres to the requirements and standards of good internal governance and risk controls arrangements. As part of the risk management framework under the internal governance and firm-wide controls assessment, where applicable, competent authorities should review the internal capital adequacy and risk-assessment process (ICARAP), and in particular the investment firm’s ability to implement risk strategies that are consistent with the risk appetite and sound capital and liquidity plans. Furthermore, as part of the internal governance and investment firm-wide controls assessment, competent authorities should also assess investment firms’ stress testing capabilities, programmes, and outcomes. Competent authorities should score the risk to the viability of an investment firm stemming from the deficiencies identified with regard to governance and control arrangements. • The focus of the assessment of risks to capital and risks to liquidity should be the assessment of the material risks the investment firm is or may be exposed to, including risks posed to its clients and markets. This is in terms of both the risk exposure and the quality of management and controls employed to mitigate the impact of the risks. Competent authorities should score the scale of the potential prudential impact posed by the risks. Liquidity risk for most of the investment firms that provide investment services such as reception and transmission of orders, execution of orders on behalf of clients, portfolio management, investment advice, placing of financial instruments, operating an MTF or an OTF arises from liquidity and funding risk when under stressed conditions (including decreased clients base), investment firms might not be able to match unexpected current and future cash inflows and outflows and collateral needs without affecting either daily operations or the financial conditions of the firm. Therefore, liquidity risk should be forward-looking and competent authorities should assess it under both normal and severe, but plausible conditions. For investment firms which deal on own account, funding risk arises from market activities that match different maturities of different traded instruments or from the types of contracts traded (including listed futures versus OTC contracts) and from margin calls. For these investment firms, the interaction between exposures to liquidity and funding risk from their market activities should be considered as more substantial. Investment firms engaging in market making activities play a crucial role in providing liquidity to markets within the Union and their clients depend on market makers ability to provide liquidity to the market. Since market makers may need to take short positions to perform that role and the relevant time frame for market makers is usually short term, market makers are vulnerable to liquidity risk, including intraday liquidity risk. However, investment firms engaging in matched principal trading may be less exposed to liquidity risk. • Since an investment firm may face risks that are not covered or not fully covered by the own funds in accordance with Article 9 of Regulation (EU) 2019/2033, through assessment of the

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 11 adequacy of the investment firm’s own funds, competent authorities should determine the amount of additional own funds required to cover such risks (‘Pillar 2 capital requirement’). Such requirements should be set in a legally binging way and investment firms should be expected to meet them at all times. As part of the assessment of capital adequacy, competent authorities should also determine whether applicable own funds requirements can be met in stressed conditions. Where the quantitative outcomes of relevant stress tests or sensitivity analysis suggest that an investment firm may not be able to meet the applicable own funds requirements in stressed conditions, or is excessively sensitive to plausible scenarios, competent authorities should take appropriate supervisory measures to ensure that the investment firm is adequately capitalised. These include communicating expectations to investment firms to have own funds over and above their overall capital requirements – ‘Pillar 2 capital guidance’ (P2G). In addition to the determination of total capital requirements and setting P2G, competent authorities should score the viability of the investment firm given the quantity and composition of own funds held. • Through assessment of the adequacy of the investment firm’s liquidity resources, competent authorities should determine whether the liquidity held by the investment firm ensures an appropriate coverage of risks to liquidity. Competent authorities should determine whether the imposition of specific liquidity requirements is necessary to capture risks to liquidity to which an investment firm is or may be exposed. • Having conducted the assessment of the above SREP elements, competent authorities should form a comprehensive view on the risk profile and viability of the investment firm — the overall SREP assessment — and summarise this view in the overall SREP assessment. This summary should reflect any supervisory findings made since the last supervisory review and any other developments that have led the competent authority to form its view of the investment firm's risks and viability. The outcome of the overall SREP assessment should be the basis for taking any necessary supervisory measures to address concerns. 10. To facilitate communication within the competent authorities and colleges of supervisors, fostering comparability and level playing field between investment firms as well as to prioritise supervisory resources and measures, in the assessment of SREP elements, competent authorities should score from a range of ‘1’ (low risk) to ‘4’ (high risk), to reflect the ‘supervisory view’ for each element as specified in the guidelines. These guidelines introduce two types of scores: (1) risk scores to be applied to individual risks to capital, liquidity and funding that indicate the likelihood that the risk will have a significant prudential impact on the investment firm (including potential loss), and (2) viability scores to be applied to the four SREP elements and overall SREP score that indicate the magnitude of risk to the investment firm’s viability stemming from a SREP element assessed (see also Figure 2). In order to facilitate supervisory processes and to foster comparability, the scoring system introduced in these guidelines for the

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 12 assessment of investment firms is similar to the one applicable when assessing credit institutions. Figure 2. Overview of the scoring framework 11. This guidance does not mean that the scoring is automatic: scores are assigned on the basis of supervisory judgment. Competent authorities should use the accompanying ‘considerations’ provided for guidance to support supervisory judgment. Competent authorities are not prohibited from applying more granular scoring on top of the base requirements specified in the guidelines if they believe it is useful for supervisory planning. Similarly, these guidelines do not define an automatic aggregation of the scores for the purpose of determining the overall SREP score. Competent authorities should determine the overall SREP score based on the specific considerations using their supervisory judgement. In doing so, they may define the weights assigned to each component taking into account the specificities of the investment firms using their supervisory judgement. 12. The guidelines also provide practical guidance on the application of the supervisory measures listed in Articles 39 to 42 of Directive (EU) 2019/2034, including the application of additional own funds requirement and investment firm-specific quantitative liquidity requirements. These guidelines do not suggest any automatic link between the scores and the level of supervisory response, nor do they link additional own funds requirement to the scores. 2.3 Interaction between SREP and other supervisory processes, including cooperation between authorities 13. Competent authorities should reflect in the SREP assessment available information and outcomes from all other supervisory activities, including but not limited to on-site inspections,

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 13 approvals and reviews of internal models, fit and proper assessments and other authorisation approvals, assessment of recovery plans, market conduct and investor protection activities, AML/CFT supervision. Likewise, the findings from the assessment of SREP elements, where relevant, should be shared with other relevant supervisors, including AML/CFT supervisors and competent authorities for the purpose of Directive 2014/65/EU (market authorities), as they may have an impact on other supervisory processes. Such mechanism of cooperation and exchange of information between relevant authorities allows for holistic risk analysis and supervision of investment firms enhancing overall supervisory view on investment firms, their viability and risks, as well as ensuring that identified deficiencies/vulnerabilities are adequately addressed by appropriate measures within the respective remit of each relevant authority. 14. An example of such synergies and complementarity of the analysis, is the interaction between SREP and the assessment of recovery plans, where these are required and/or available. The outcomes of the assessment of the recovery plans feed into the SREP assessment of investment firm’s internal governance and firm-wide controls, and information from the recovery plan itself would support supervisors in their business model analysis, assessment of internal governance and controls, as well as in determining additional own funds requirement to address the risk of unorderly wind-down as an additional source of information. On the other hand, findings from the assessment of SREP elements, including internal governance and firm-wide controls, business model analysis, capital and liquidity adequacy assessment, including setting additional own funds and liquidity requirements, should feed into the assessment of recovery plans. Such interaction between the SREP and recovery plan assessments also aligns with the principle that investment firms’ own recovery planning activities should be embedded into their risk management framework. 15. Competent authorities are expected to cooperate with the AML/CFT supervisors. The failure to address money laundering and terrorist financing (ML/TF) risks by investment firms can have detrimental effects on the financial soundness of these firms, the integrity of the internal market and financial stability as a whole. Therefore, prudential supervisors should consider, to the extent possible, ML/TF risks from a prudential perspective in the SREP and, in order to gather the necessary information, cooperate with the authorities and bodies responsible for ensuring compliance with AML/CFT requirements. For example, competent authorities should make use of AML/CFT colleges established in accordance with the ESAs AML/CFT Colleges Guidelines1 , where they exist. It should be stressed that prudential competent authorities are not expected to duplicate the work and mandate of AML/CFT supervisors, who are responsible for supervising compliance of investment firms with relevant requirements under Directive (EU) 2015/849 and perform ML/TF risk assessments. However, it is important that they seek input from AML/CFT supervisors into the SREP with regards to ML/TF risks and how effectively they are managed by investment firms. Conversely, where the assessment of any of the SREP elements reveals information related to increased exposure to ML/TF risks or deficiencies in the management of 1 The ESAs joint guidelines (JC 2019 81) on cooperation and information exchange for the purpose of Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions (‘The AML/CFT Colleges Guidelines’)

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 14 the ML/TF risk by investment firms, the relevant information should be shared with AML/CFT supervisors. In order to ensure the most effective and consistent supervisory response, any supervisory measures or sanctions in this area should be applied in coordination with the AML/CFT supervisors. 16. Similarly, to ensure a consistent investor protection across the financial services, it is expected that prudential supervisors cooperate with market authorities and, where relevant, consider the relevant information received from these authorities in the SREP. In particular, given the role of the market authorities in areas such as governance, in order to ensure consistent supervision and avoid duplication of work, it is advisable to exchange relevant information and coordinate the application of any supervisory measures in these areas between the competent prudential and market authorities. 2.4 Link between SREP, early intervention, and resolution 17. The assessment through the SREP of the viability of an investment firm and its ability to meet the requirements of Regulation (EU) 2019/2033 and Directive (EU) 2019/2034 allows for the use of the outcomes of the SREP assessment in taking appropriate supervisory actions if necessary. In particular, in the case of investment firms that are subject to the requirements of Directive 2014/59/EU, competent authorities may use SREP outcomes in setting triggers for early intervention measures, in accordance with Article 27 of that Directive. It also allows for the determination of whether an investment firm can be considered to be ‘failing or likely to fail’, which, where Directive 2014/59/EU is applicable, activates the formal interaction procedure with resolution authorities as provided in Article 32 of that Directive. Investment firms falling under the perimeter of these guidelines but not subject to the provisions laid down in Directive 2014/59/EU, if assessed as ‘failing or likely to fail’, are expected to be wound-down in an orderly fashion rather than go through the resolution process. In these cases an enhanced engagement of the competent authority may be needed to ensure an orderly wind-down. 18. This link between SREP and application of early intervention measures, where applicable, and the determination whether an investment firm is ‘failing or likely to fail’ is based on the viability focus of the overall SREP assessment and assessment of individual SREP elements as expressed by viability scores, and consideration that outcomes of all supervisory activities are taken into account in the SREP assessments as explained above. 19. In particular, the outcomes of the SREP assessment may lead competent authorities to take supervisory measures or decide on the application of early intervention measures. Rather than considering the overall SREP score as a prescriptive tool, competent authorities may use it as a guide when deciding to apply supervisory or early intervention measures. Furthermore, should the competent authorities assess as part of the SREP an investment firm as not being viable, competent authorities would consider that investment firm as ‘failing or likely to fail’ (as expressed in an overall SREP score ‘F’). The inability of an investment firm to comply with previous supervisory and/or early intervention measures may indicate that that particular

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 15 measure was exhausted and forms part of the argumentation for the competent authorities to consider the investment firm ‘failing or likely to fail’. 20. To this end, for the investment firms falling under the scope of Directive 2014/59/EU, these guidelines should be read together with the EBA Guidelines on triggers for use of early intervention measures and Guidelines on the interpretation of the different circumstances when an investment firm shall be considered as failing or likely to fail2 . 21. Furthermore, competent authorities are expected to cooperate with resolution authorities on an on-going basis, and not only in the context of investment firms failing or likely to fail. In particular, in accordance with Article 43 of Directive (EU) 2019/2034, they are required to notify the relevant resolution authorities of any additional own funds requirement or P2G. 2.5 Proportionality in SREP 22. Given that investment firms vary significantly in terms of their size, risk profile and scope of activities, ranging from simple one-person firms to large and complex international corporations, it is particularly important to appropriately reflect the principle of proportionality in supervisory processes. To some extent, this principle is already included in Directive (EU) 2019/2034 by specifying in Article 36(2) that small and non-interconnected investment firms as set out in Article 12(1) of Regulation (EU) 2019/2033 should be subject to SREP based on a case￾by-case decision of the competent authorities, only where this is deemed necessary due to the size, scale and complexity of the activities of those investment firms. In addition to that, these guidelines recognise the principle of proportionality by: a) categorising investment firms in four distinct categories: in this respect class 2 firms are divided in three categories based on their size and risk profile, whereas small and non￾interconnected investment firms as set out in Article 12(1) of Regulation (EU) 2019/2033 (i.e. class 3 firms) form a separate, distinct category; b) building a minimum supervisory engagement model, where the frequency, depth and intensity of the assessments vary depending on the category of the investment firm; c) recognising the possibility to adjust the granularity of the assessment depending on the size and business model of the investment firm, and the nature, scale and complexity of its activities; d) envisaging different depth of assessment of governance arrangements and firm-wide controls, considering that investment firms with a more complex organisation or with a larger scale are expected to have more sophisticated governance arrangements; 2 EBA Guidelines on the interpretation of the different circumstances when an institution shall be considered as failing or likely to fail (EBA/GL/2015/07)

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 16 e) setting proportionate expectations with regard to the arrangements, strategies and processes that investment firms are required to set in accordance with Article 24 of Directive (EU) 2019/2034 to assess and maintain on an ongoing basis the amounts, types and distribution of internal capital and liquid assets that they consider adequate to cover the nature and level of risks which they may pose to others and to which the investment firms themselves are or may be exposed (ICARAP). 23. Given that the focus of the guidelines is on the supervisory process and on interaction between the competent authorities and the investment firms for the SREP, these guidelines do not address questions of transparency and public disclosure of SREP outcomes and supervisory measures, particularly in relation to additional own funds requirement and Pillar 2 Guidance. 24. These guidelines do not introduce any additional reporting obligation and assume that the assessments specified in the guidelines are made on the basis of information already being collected by competent authorities as part of regular reporting, or to which competent authorities have access. However, where necessary, competent authorities should be able to request additional information from the investment firm.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 17 3. Guidelines

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 18 EBA/GL/2022/09 ESMA35-36-2621 20/07/2022 Guidelines on common procedures and methodologies for the supervisory review and evaluation process (SREP) under Directive (EU) 2019/2034

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 19 Title 1 General provisions 1.1 Compliance and reporting obligations Status of these guidelines

1. This document contains guidelines issued pursuant to Article 16 of Regulation (EU) No 1093/20103 and Regulation (EU) No 1095/20104 . In accordance with Article 16(3) of Regulation (EU) No 1093/2010 and Regulation (EU) No 1095/2010, competent authorities and investment firms must make every effort to comply with the guidelines.
2. Guidelines set the EBA and ESMA view of appropriate supervisory practices within the European System of Financial Supervision or of how Union law should be applied in a particular area. Competent authorities as defined in Article 4(2) of Regulation (EU) No 1093/2010 to whom guidelines apply should comply by incorporating them into their practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where guidelines are directed primarily at investment firms. Reporting requirements
3. According to Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must notify the EBA as to whether they comply or intend to comply with these guidelines, or otherwise with reasons for non-compliance, by 19.06.2023. In the absence of any notification by this deadline, competent authorities will be considered by the EBA to be non-compliant. Notifications should be sent by submitting the form available on the EBA website with the reference ‘EBA/GL/2022/09 – ESMA35-42-1470’. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities. Any change in the status of compliance must also be reported to EBA.
4. Notifications will be published on the EBA website, in line with Article 16(3). 3 Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC, (OJ L 331, 15.12.2010, p.12). 4 Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84–119).

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 20 1.2 Subject matter, scope and definitions Subject matter 5. These guidelines specify the common procedures and methodologies for the functioning of the supervisory review and evaluation process (SREP) referred to in Articles 36 and 45 of Directive (EU) 2019/20345 and processes and actions taken with reference to Articles 39, 40, 41 and 42 of that Directive. Scope of application 6. These guidelines apply in relation to the supervisory review and evaluation process (SREP) of the investment firms as defined in Articles 36 to 45 of Directive (EU) 2019/2034. 7. Competent authorities should apply these guidelines at the highest level of consolidation in accordance with the level of application of the requirements of Part One, Title II of Regulation (EU) 2019/2033. For parent undertakings and subsidiaries included in the consolidation, competent authorities should adjust the depth and the level of granularity of their assessments to correspond to the level of application. 8. Where an investment firm has a subsidiary in the same Member State a proportionate approach for the assessment of capital and liquidity adequacy may be applied by focusing on the assessment of allocation of capital and liquidity across the entities and potential impediments to the transferability of capital or liquidity within the group. 9. For investment firm groups, including groups with undertakings established in third countries, procedural requirements should be applied in a coordinated manner within the framework of colleges of supervisors established pursuant to Article 48 of Directive (EU) 2019/2034. Title 11 explains the details of how these guidelines apply to cross-border groups and their entities. Addressees 10. These guidelines are addressed to competent authorities as defined in Article 4(2), point (viii) of Regulation (EU) No 1093/2010. 5 Directive (EU) 2019/2034 of the European Parliament and of the Council of the 27 November 2019 on the prudential supervision of investment firms and amending Directives 2002/87/EC, 2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU (OJ L 314, 5.12.2019, p. 64).

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 21 Definitions 11. Unless otherwise specified, terms used and defined in Regulation (EU) 2019/20336 , Directive (EU) 2019/2034 or Directive 2014/59/EU7 have the same meaning in the guidelines. For the purposes of the guidelines, the following definitions apply: ‘AML/CFT supervisor’ means a competent authority responsible for the supervision of investment firms’ compliance with provisions of Directive (EU) 2015/849. ‘Conduct risk’ means the current or prospective risk of losses to an investment firm arising from cases of wilful or negligent misconduct, including inappropriate supply of financial services. ‘Internal capital adequacy assessment process and internal risk-assessment process (ICARAP)’ means the arrangements, strategies and processes referred to in Article 24 of Directive (EU) 2019/2034, which can be further split into: ‘Internal capital adequacy assessment process (ICAAP)’ meaning arrangements, strategies and processes to assess and maintain on an ongoing basis the amounts, types and distribution of internal capital that the investment firms consider adequate to cover the nature and level of risks which they may pose to others and to which the investment firms themselves are or may be exposed; and ‘Internal liquidity adequacy assessment process (ILAAP)’ meaning arrangements, strategies and processes to assess and maintain on an ongoing basis the amounts, types and distribution of liquid assets that the investment firms consider adequate to cover the nature and level of risks which they may pose to others and to which the investment firms themselves are or may be exposed. ‘Interest rate risk’ (IRR) means the current or prospective risk to the investment firm’s earnings and own funds arising from adverse movements in interest rates. ‘Intraday liquidity’ means the funds that can be accessed during the business day to enable the investment firm to make payments in real time. ‘Intraday liquidity risk’ means the current or prospective risk that the investment firm will fail to manage its intraday liquidity needs effectively. ‘Information and communication technology (ICT) risk’ means the risk of loss due to breach of confidentiality, failure of integrity of systems and data, inappropriateness or 6 Regulation (EU) 2019/2033 of the European Parliament and of the Council of the 27 November 2019 on the prudential requirements of investment firms and amending Regulations (EU) No 1093/2010, (EU) No 575/2013, (EU) No 600/2014 and (EU) No 806/2014 (OJ L 314 5.12.2019, p. 1). 7 Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012, of the European Parliament and of the Council (OJ L 173 12.6.2014, p. 190).

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 22 unavailability of systems and data, or inability to change IT within a reasonable time and costs when the environment or business requirements change (i.e. agility). ‘Macro-prudential requirement’ or ‘measure’ means a requirement or measure imposed by a competent or designated authority to address macro-prudential or systemic risk. ‘Market supervisor’ means a competent authority responsible for the supervision of investment firms’ compliance with provisions of Directive 2014/65/EU8 . ‘Money laundering and terrorist financing (ML/TF) risk’ means the risk as defined in the EBA Guidelines on the ML/TF risk factors9 . ‘Overall SREP assessment’ means the up-to-date assessment of the overall viability of an investment firm based on the assessment of the SREP elements. ‘Overall SREP score’ means the numerical indicator of the overall risk to the viability of the investment firm based on the overall SREP assessment. ‘Pillar 2 guidance (P2G)’ means the level and quality of own funds the investment firm is expected to hold in excess of its own funds requirements, determined in accordance with Article 41 of Directive (EU) 2019/2034. ‘Pillar 2 requirement (P2R)’ or ‘additional own funds requirement’ means the additional own funds requirement imposed in accordance with Article 40 of Directive (EU) 2019/2034. ‘Reputational risk’ means the current or prospective risk to the investment firm’s earnings, own funds or liquidity arising from damage to the investment firm’s reputation. ‘Risk appetite’ means the aggregate level and types of risk the investment firm is willing to assume within its risk capacity, in line with its business model, to achieve its strategic objectives. ‘Risk score’ means the numerical expression summarising the supervisory assessment of an individual risk to capital, liquidity and funding representing the likelihood that a risk will have a significant prudential impact on the investment firm after considering risk management and controls and before consideration of the investment firm’s ability to mitigate the risk through available capital or liquidity resources. ’Risks to capital’ means distinct risks that, should they materialise, will have a significant prudential impact on the investment firm’s own funds over the next 12 months. These include but are not limited to risks covered by Articles 29 and 36 of Directive (EU) 2019/2034. 8 Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173 12.6.2014, p. 349). 9 EBA Guidelines on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions (‘The ML/TF Risk Factors Guidelines’) under Articles 17 and 18(4) of Directive (EU) 2015/849 (EBA/GL/2021/02)

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 23 ‘Risks to liquidity and funding’ means distinct risks that, should they materialise, will have a significant prudential impact on the investment firm’s liquidity over different time horizons. ‘SREP element’ means one of the following: business model analysis, assessment of internal governance and firm-wide risk controls, assessment of risks to capital, SREP capital assessment, assessment of risks to liquidity and funding, or SREP liquidity assessment. ‘Supervisory benchmarks’ means risk-specific quantitative tools developed by the competent authority to provide an estimation of the own funds required to cover risks or elements of risks not covered by Regulation (EU) 2019/2033. ‘Viability score’ means the numerical expression summarising the supervisory assessment of a SREP element and representing an indication of the risk to the investment firm’s viability stemming from the SREP element assessed. 1.3 Implementation Date of application 12. These guidelines apply from 19.06.2023. 13. These guidelines are immediately applicable to the SREP exercises initiated in 2023.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 24 Title 2 The common SREP 2.1 Overview of the common SREP framework 14. Competent authorities should ensure that the SREP of an investment firm covers the following components: a. categorisation of the investment firm and periodic review of this categorisation; b. monitoring of key indicators; c. business model analysis (BMA); d. assessment of internal governance and firm-wide controls; e. assessment of risks to capital; f. assessment of risks to liquidity; g. assessment of the adequacy of the investment firm’s own funds; h. assessment of the adequacy of the investment firm’s liquidity resources; i. overall SREP assessment; and j. supervisory measures (and early intervention measures, where necessary). 2.1.1 Categorisation of investment firms 15. Competent authorities should categorise each investment firm for which the supervisory review and evaluation referred to in Article 36 of Directive (EU) 2019/2034 is to be carried out into one of the following categories: • Category 1 – investment firms meeting at least one of the following criteria: i. their value of the total assets and off-balance sheet exposures is equal to or exceeds EUR 1 billion; or ii. their value of the total assets and off-balance sheet exposures is equal to or exceeds EUR 250 million and they perform activities referred to in point (3) or (6) of Section A of Annex I to Directive 2014/65/EU10; or iii. they are considered significant based on supervisory judgement of the competent authority. • Category 2 – investment firms whose value of the total assets and off-balance sheet exposures is below EUR 1 billion and is equal to or exceeds EUR 250 million, and 10 Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173 12.6.2014, p. 349).

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 25 that perform neither of activitiesreferred to in point (3) or (6) of Section A of Annex I to Directive 2014/65/EU. • Category 3 – investment firms whose value of the total assets and off-balance sheet exposures is below EUR 250 million and that do not meet the conditions for qualifying as a small and non‐interconnected investment firm set out in Article 12(1) of Regulation (EU) 2019/2033. • Small and non-interconnected investment firms as set out in Article 12(1) of Regulation (EU) 2019/2033. 16. The categorisation should be used by competent authorities as a basis for applying the principle of proportionality, as specified in Section 2.4, and not as a means to reflect the quality of an investment firm. 17. Among categories 1 to 3, competent authorities may categorise an investment firm on a case￾by-case basis in a category one notch higher or lower in the list than according to the criteria listed in paragraph 15. For this purpose, competent authorities should consider aspects such as the scale and complexity of operations, scale of trading activities, amount of client money held, the risk profile of the investment firm, and any other relevant aspects. Where such reclassification is carried out, competent authorities should aim at ensuring sufficient homogeneity and comparability between investment firms of the same category. 18. Competent authorities should base the categorisation on supervisory reporting data and on information derived from the preliminary business model analysis (see Section 4.2). The categorisation should be reviewed yearly or in the event of a significant change in activities. In case of a change of category for an investment firm the last year of a full completed SREP cycle should be taken into account in determining the timeline for the next assessment of the SREP elements. 2.1.2 Continuous assessment of risks 19. Competent authorities should continuously assess the risks to which the investment firm is or may be exposed through the following activities: a. monitoring of key indicators as specified in Title 3; b. business model analysis as specified in Title 4; c. assessment of internal governance and firm-wide controls as specified in Title 5; d. assessment of risks to capital as specified in Title 6; and e. assessment of risks to liquidity as specified in Title 8. 20. The assessments should be conducted in accordance with the proportionality criteria specified in Section 2.4. The assessments should be reviewed in light of new information. 21. Competent authorities should ensure that the outcomes of the assessments outlined above: a. are clearly documented in a summary of findings;

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 26 b. are reflected in a score assigned in accordance with the specific guidance provided in the element-specific title of these guidelines; c. support the assessments of other elements or prompt an in-depth investigation into inconsistencies between the assessments of these elements; d. contribute to the overall SREP assessment and score; and e. result in supervisory measures, where appropriate, and inform the decisions taken for these measures. 2.1.3 Periodic assessment of capital and liquidity adequacy 22. Competent authorities should periodically review the adequacy of the investment firm’s own funds and liquidity to provide sound coverage of the risks to which the investment firm is or may be exposed through the following assessments: a. SREP capital assessment as specified in Title 7; and b. SREP liquidity assessment as specified in Title 9. 23. Competent authorities should perform periodic assessments taking into account the minimum engagement and proportionality criteria specified in Section 2.4. Competent authorities may perform more frequent assessments. Competent authorities should review the assessment in light of material new findings from the risk assessment where competent authorities determine that the findings may have a material impact on the investment firm’s own funds and/or liquidity resources. 24. Competent authorities should ensure that the outcomes of the assessments: a. are clearly documented in a summary; b. are reflected in the score assigned to the investment firm’s capital adequacy and liquidity adequacy, in accordance with the guidance provided in the element￾specific title; c. contribute to the overall SREP assessment and score; and d. take into account and inform the supervisory requirement for the investment firm to hold own funds and/or liquidity resources in excess of the minimum requirements specified in Regulation (EU) 2019/2033, as appropriate. 2.1.4 Overall SREP assessment 25. Competent authorities should continuously assess the risk profile of the investment firm and its viability through the overall SREP assessment as specified in Title 10. Through the overall SREP assessment, competent authorities should determine the potential for risks to cause the failure of the investment firm given the adequacy of its own funds and liquidity resources, internal governance, controls and/or business model or strategy, and from this, the need to take early intervention measures, where applicable, and/or determine whether the investment firm can be considered to be failing or likely to fail.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 27 26. The assessment should be continuously reviewed in light of findings from the risk assessments or the outcome of the SREP capital and SREP liquidity assessments. 27. Competent authorities should ensure that the outcomes of the assessment: a. are reflected in the score assigned to the investment firm’s overall viability, in accordance with the guidance provided in Title 10; b. are clearly documented in a summary of the overall SREP assessment that includes the SREP scores assigned (overall and for individual elements) and any supervisory findings made since the last assessment; and c. form the basis for the supervisory determination of whether the investment firm can be considered to be ‘failing or likely to fail’; for investment firms subject to Directive 2014/59/EU this determination should be performed in accordance with Article 32 of that Directive, also having regard to the EBA Guidelines on ‘failing or likely to fail’ 11. 2.1.5 Dialogue with investment firms, application of supervisory measures and communicating findings 28. Following the minimum engagement model, as specified in Section 2.4, competent authorities should engage in dialogue with investment firms to assess individual SREP elements, as provided in the element-specific titles. 29. Based on the overall SREP assessment and building on assessments of the individual SREP elements, competent authorities should take supervisory measures as specified in Title 10. 30. Where findings from the monitoring of key indicators, assessment of SREP elements or any other supervisory activity necessitate the application of supervisory measures to address immediate concerns, competent authorities should not wait for the completion of the assessment of all SREP elements and update of the overall SREP assessment, but decide on the measures required to rectify the situation assessed, and then proceed with updating the overall SREP assessment. 31. As outlined in Section 2.4, competent authorities should also engage in dialogue based on the outcomes of the overall SREP assessment, alongside associated supervisory measures, and inform the investment firm at the end of the process about the capital and liquidity requirements as well as supervisory measures with which it is obliged to comply. 2.2 Scoring in the SREP 32. Competent authorities should assign risk and viability scores to summarise the outcomes of the assessment of various risk categories and elements in the SREP framework. 33. In the assessment of the individual risk categories and SREP elements, competent authorities should use a range of scores - 1 (low risk), 2 (medium-low risk), 3 (medium-high risk), and 4 11 EBA Guidelines on the interpretation of the different circumstances when an institution shall be considered as failing or likely to fail under Article 32(6) of Directive 2014/59/EU (EBA/GL/2015/07)

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 28 (high risk) - reflecting the supervisory view based on the relevant scoring tables in each element-specific title. Competent authorities should use the accompanying ‘considerations’ provided in these tables for guidance to support supervisory judgment (i.e. it is not necessary for the investment firm to fulfil all the ‘considerations’ linked to a score of ‘1’ to achieve a score of ’1’), and/or further develop them or add additional considerations. Competent authorities should assign a score of ‘4’ to reflect the worst possible assessment (i.e. even if the investment firm’s position is worse than that envisaged by the ‘considerations’ for a score of ‘4’, a score of ‘4’ should still be assigned). 34. In their implementation of the guidelines, competent authorities may introduce more granular scoring for their internal purposes, such as planning of resources, provided that the overall scoring framework set out in these guidelines is respected. 35. Competent authorities should ensure that all scores are regularly reviewed, at least with the frequency defined in Section 2.4 and without undue delay based on material new findings or developments. 2.2.1 Risk scores 36. Competent authorities should assign risk scores to individual risks to capital in accordance with the criteria specified in Title 6, and scores to risks to liquidity and funding in accordance with the criteria specified in Title 8. These scores represent the likelihood that a risk will have a significant prudential impact on the investment firm, after considering the quality of risk controls to mitigate this impact (i.e. residual risk), but before consideration of the investment firm’s ability to mitigate the risk through available capital or liquidity resources. 37. Competent authorities should determine the risk score predominantly through an assessment of inherent risk, but they should also reflect considerations about risk management and controls. In particular, the adequacy of management and controls may reduce or – in some cases – increase the risk of significant prudential impact (i.e. considerations relating to inherent risk may underestimate or overestimate the level of risk depending on the adequacy of management and controls). 38. In implementing these guidelines, competent authorities may evaluate inherent risk levels and the quality of risk management and controls separately (resulting in intermediate and net scores) or in aggregate (resulting in net risk scores only). Competent authorities may also introduce aggregation methodologies for aggregating individual risks to capital and liquidity and funding scores. 2.2.2 Viability scores 39. Competent authorities should separately assign scores to summarise the level of risk posed to the viability of the investment firm based on the outcomes of the assessment of the four SREP elements: a. business model and strategy, in accordance with the criteria specified in Title 4; b. internal governance and firm-wide controls, in accordance with the criteria specified in Title 5;

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 29 c. capital adequacy, in accordance with the criteria specified in Title 7; and d. liquidity adequacy, in accordance with the criteria specified in Title 9. 40. For capital adequacy and liquidity adequacy, these scores represent the supervisory view of the capacity of the investment firm’s capital and liquidity resources to mitigate/cover individual risks to capital and liquidity, as set out in Titles 6 and 8. 41. Competent authorities should also assign an overall SREP score in accordance with the criteria specified in Title 10. This score should be assigned based on supervisory judgement and should represent the supervisory view of the overall viability of the investment firm. 42. Competent authorities should ensure that the scoring of the business model, internal governance and controls, capital adequacy, liquidity adequacy, and the overall SREP score achieves the following objectives: a. indicating the likelihood that supervisory measures may need to be taken to address concerns in accordance with the criteria specified in Title 10; b. acting as a trigger for the decision on whether to apply, where applicable, early intervention measures in accordance with the EBA Guidelines on triggers for use of early intervention measures; and c. helping with the prioritisation and planning of supervisory resources and the setting of priorities. 43. Competent authorities should ensure that the overall SREP score assigned based on the aggregate view of the threats from the SREP elements provides an indication of the investment firm’s overall viability, including whether the investment firm is ‘failing or likely to fail’; 44. When the outcome of the overall SREP assessment suggests that an investment firm can be considered to be ‘failing or likely to fail’, competent authorities should apply a score of ‘F’ and, where applicable, follow the process of engaging with resolution authorities as specified in Article 32 of Directive 2014/59/EU. 2.3 Organisational arrangements 45. Competent authorities should ensure that, for conducting the SREP, their organisational arrangements include at least the following: a. a description of the roles and responsibilities of their supervisory staff with respect to performing the SREP, as well as the relevant reporting lines, in both normal and emergency situations; b. arrangements for engaging with other relevant supervisors to seek their views and relevant inputs on specific matters that may have an impact on the SREP findings or scoresto avoid duplication of work and to ensure consistency of assessment and of related supervisory measures; c. procedures for documenting and recording findings and supervisory judgments;

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 30 d. arrangements for the approval of the findings and scores, as well as escalation procedures where there are dissenting views within the competent authority, in both normal and emergency situations; e. arrangements for organising dialogue with the investment firm following the model of minimum engagement as stipulated in Section 2.4 to assess individual SREP elements; and f. arrangements for consultations with an investment firm and communicating the outcomes of the SREP to the investment firm. 46. When defining arrangements for dialogue with investment firms, competent authorities should consider potential implications of providing the scores to the investment firms in terms of their disclosure obligations pursuant to the requirements of Regulation (EU) No 596/201412 and Directives 2014/57/EU13 and 2004/109/EC14. 2.4 Proportionality and supervisory engagement 47. Competent authorities should apply the principle of proportionality in the scope, frequency and intensity of supervisory engagement and dialogue with an investment firm, and supervisory expectations of the standards the investment firm should meet, in accordance with the category of the investment firm as outlined in Table 2 below. 48. For the frequency of the supervisory engagement aspect of proportionality, when planning SREP activities, competent authorities should adhere to a minimum level of engagement model, as follows in the next subchapters and in Table 2. 49. Where competent authorities determine that investment firms have similar risk profiles, they may conduct thematic SREP assessments on multiple investment firms as a single assessment (notably BMA may be conducted on all small investment firms that receive and transmit orders on a few classes of assets, given that it is likely to identify the same business viability issues for all these investment firms). Competent authorities may also use tailored methodologies for the application of the SREP for investment firms with similar risk profiles. 50. For investment firms with an overall SREP score 4 and, where necessary, for investment firms with an overall SREP score 3, based on the findings from previous assessments of SREP elements, competent authorities should determine an additional level of engagement, whereby more extensive supervisory resources and a higher frequency of assessment should be required (at least on a temporary basis), regardless of the category of the investment firm. Having regard to minimum frequency of the assessment of all SREP elements specified in the 12 Regulation (EU) No 596/2014 of the European Parliament and of the Council of 16 April 2014 on market abuse (market abuse regulation) and repealing Directive 2003/6/EC of the European Parliament and of the Council and Commission Directives 2003/124/EC, 2003/125/EC and 2004/72/EC (OJ L 173, 12.6.2014, p. 1). 13 Directive 2014/57/EU of the European Parliament and of the Council of 16 April 2014 on criminal sanctions for market abuse (market abuse directive) (OJ L 173, 12.6.2014, p. 179). 14 Directive 2004/109/EC of the European Parliament and of the Council of 15 December 2004 on the harmonisation of transparency requirements in relation to information about issuers whose securities are admitted to trading on a regulated market and amending Directive 2001/34/EC (OJ L 390, 31.12.2004, p. 38).

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 31 next subchapters and in Table 2, the more frequent assessments may cover specific SREP elements where particular attention is needed due to higher risk, or the full SREP assessment. 51. Regardless of the time since the last SREP, competent authorities should perform a new assessment if at least one of the following situations occurred: a. in the monitoring of key indicators, a significant change is observed as compared to the reference date of the last assessment of all SREP elements; b. there is negative public information about the investment firm indicating potential significant risk (in the context of reputational risk, conduct risk, IT security); c. competent authorities have other reasons to believe that the business model or risk profile of the investment firm has significantly changed since the reference date of the last assessment of all SREP elements. 52. When planning SREP activities, competent authorities should pay special attention to coordinating activities with other parties directly or indirectly involved in the assessment, in particular when input is required from the investment firm and/or other competent authorities involved in the supervision of cross-border groups as specified in Title 11. 53. For the scope of proportionality, when conducting the SREP by applying these guidelines, competent authorities should recognise that different elements, methodological aspects and assessment components as provided in Titles 4, 5, 6 and 8 do not have the same relevance for all investment firms. Competent authorities should, where relevant, apply different degrees of granularity to the assessment depending on the category to which the investment firm is assigned and to the extent appropriate for the size and business model of the investment firm, and the nature, scale and complexity of its activities. 54. At the end of every assessment of all SREP elements, competent authorities may inform the investment firm of the outcome of the overall SREP assessment and they should provide: a. a statement on the quantity and composition of the own funds the investment firm is required to hold in excess of the requirements specified in Part Two, Three and Four of Regulation (EU) 2019/2033 in accordance with Article 39(2)(a) of Directive (EU) 2019/2034; b. a statement on the quantity and composition of the own funds the investment firm is guided to hold in accordance with Article 41 of Directive (EU) 2019/2034; c. a statement on the liquidity held and any specific liquidity requirements set by the competent authorities in accordance with Article 42 of Directive (EU) 2019/2034; d. a statement on other supervisory measures that the competent authority intends to take. 2.4.1 Category 1 investment firms 55. In order to ensure appropriate frequency of supervisory activities related to SREP for category 1 investment firms, competent authorities should: a. monitor key indicators on a quarterly basis;

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 32 b. update the assessments of all individual SREP elements at least once every 2 years; c. have ongoing engagement and dialogue with the investment firm’s management body and senior management. 2.4.2 Category 2 investment firms 56. In order to ensure appropriate frequency of supervisory activities related to SREP for category 2 investment firms, competent authorities should: a. monitor key indicators on a quarterly basis; b. update the assessments of all individual SREP elements at least every 3 years; c. have engagement with the investment firm’s management body and senior management at least with the same frequency as the assessment of all SREP elements. 2.4.3 Category 3 investment firms 57. In order to ensure appropriate frequency of supervisory activities related to SREP for category 3 investment firms, competent authorities should: a. monitor key indicators on a quarterly basis; b. perform the assessment of all SREP elements in light of material new information emerging on the risk posed, with the scope and depth of the review tailored to the specific risk profile of the investment firm; c. have engagement with the investment firm’s management body and senior management at least with the same frequency as the assessment of all SREP elements. Where considered appropriate, competent authorities may define regular minimum frequencies for the assessment of all SREP elements for all or a subset of category 3 investment firms. 2.4.4 Small and non-interconnected investment firms 58. For small and non-interconnected investment firms meeting the criteria of Article 12(1) of Regulation (EU) 2019/2033, competent authorities should: a. monitor key indicators at least on an annual basis; b. perform the assessment of all SREP elements in light of material new information emerging on the risk posed, with the scope and depth of the review tailored to the specific risk profile of the investment firm; c. have engagement and dialogue with the investment firm’s management body and senior management when considered necessary and in particular in the context of the assessment of SREP elements where performed.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 33 Table 2. Application of SREP to different categories of investment firms Category Monitoring of key indicators Assessment of all SREP elements Minimum level of engagement / dialogue 1 Quarterly 2 years Ongoing dialogue with the management body and senior management. 2 Quarterly 3 years Event-based engagement with the management body and senior management, at least with the frequency of SREP assessment. 3 Quarterly Event-based (with the scope and depth of the review tailored to the specific risk profile of the investment firm) Event-based engagement with the management body and senior management, at least with the frequency of SREP assessment. Small and non￾interconnected investment firms as set out in Article 12(1) of Regulation (EU) 2019/2033 Yearly Event-based (with the scope and depth of the review tailored to the specific risk profile of the investment firm) Event-based engagement with the management body and senior management, at least with the frequency of SREP assessment.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 34 Title 3 Monitoring of key indicators 59. Competent authorities should engage in regular monitoring of key financial and non-financial indicators to monitor changes in the financial conditions and risk profiles of investment firms. Competent authorities should also use this monitoring to identify the need for updates to the assessment of SREP elements in light of new material information outside of planned supervisory activities. Where monitoring reveals a material change in the risk profile of the investment firm, or any anomalies in the indicators, competent authorities should investigate the causes, and, where relevant, review the assessment of the relevant SREP element in light of the new information. 60. Competent authorities should monitor key financial indicators in alignment with the frequency of reporting for the investment firm. The monitoring of non-financial indicators should be adapted to the nature and volatility of the specific non-financial indicator, but should be conducted at least on a yearly basis. 61. Competent authorities should establish monitoring systems and patterns allowing for the identification of material changes and anomalies in the behaviour of indicators, and should set thresholds, where relevant. Competent authorities should also ensure that for all relevant indicators (or combinations of indicators) covered by the monitoring any anomalies and material changes are investigated. Competent authorities should thus determine the cause and assess the materiality of the potential prudential impact on the investment firm and the possible consequences for the firm’s categorisation. 62. Competent authorities should tailor the set of indicators and their thresholds to the specific features of individual investment firms or groups of investment firms with similar characteristics (peer groups). The framework of indicators, monitoring patterns and thresholds should reflect the investment firm’s size, complexity, business model and risk profile and should cover geographies, sectors and markets where the investment firm operates. 63. Competent authorities should identify the indicators to be tracked through regular monitoring primarily from regular supervisory reporting and using definitions from common reporting standards. 64. The framework of indicators established and the outcomes of the monitoring of key indicators should also be used as input for the assessment of risks to capital and risks to liquidity and funding under the respective SREP elements. 65. Indicators used for monitoring should include at least the following firm-specific indicators: a. financial and non-financial indicators addressing the risk categories covered by these guidelines applicable to the specific category of investment firm (see Titles 6 and 8); b. all the ratios derived from the application of Regulation (EU) No 2019/2033 and from the national law implementing Directive (EU) No 2019/2034;

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 35 c. where applicable, the minimum requirements for own funds and eligible liabilities (MREL) as specified by Directive 2014/59/EU; d. where available, recovery indicators used in the firm’s own recovery plans. 66. Competent authorities should include non-financial indicators such as, for example, the scope of authorisation, the number of employees, the number of complaints or other non-financial relevant indicators, and they may define additional indicators as deemed appropriate. 67. Competent authorities should accompany firm-specific indicators with relevant macro￾economic indicators, where available, in the geographies, sectors and markets where the investment firm operates. 68. Competent authorities should also consider supplementing the regular monitoring of key financial and non-financial indicators with review of independent market research and analysis, where this is available.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 36 Title 4 Business model analysis 4.1 General considerations 69. This title specifies the criteria for the assessment of the business model and strategy of the investment firm. Competent authorities should apply this assessment to an investment firm at the same level as the overall SREP assessment, but can also apply it for a specific activity, at business-line level, or on a thematic basis. 70. Without undermining the responsibility of the investment firm’s management body for running and organising the business, or indicating preferences for specific business models, competent authorities should conduct business model analysis (BMA) to assess business and strategic risks and determine: a. the viability of the investment firm’s current business model on the basis of its ability to generate acceptable returns over the following 12 months; and b. the sustainability of the investment firm’s strategy over a forward-looking period of at least 3 years. 71. Competent authorities should use the outcome of the BMA to support the assessment of all other elements of the SREP. Competent authorities may assess specific aspects of the BMA, in particular the quantitative assessment of the business model, as part of the assessment of other SREP elements. 72. Competent authorities should also use the BMA to support the identification of the investment firm’s key vulnerabilities, which are most likely to have a material impact on the investment firm or lead to its failure in the future. 73. In addition, competent authorities should use the BMA to assess prudential implications of ML/TF risks known to them, linked to the business model of the investment firm. In this respect, competent authorities should use the input received from AML/CFT supervisors, in particular their assessments of ML/TF risks and any findings relating to material weaknesses in an investment firm’s AML/CFT controls, to complement their findings from ongoing supervision, and evaluate whether they give rise to prudential concerns related to ML/TF risks. Where the assessment indicates the business model of the investment firm gives rise to prudential concerns related to ML/TF risks, competent authorities should share the outcome of the prudential assessment of the business model with the AML/CFT supervisors. 74. Competent authorities should undertake the following steps as part of the BMA in a proportionate manner, i.e. adjusting the level of detail of the analysis to the specific situation of the investment firm, the perceived risk, as well as the scale and complexity of its activities: a. preliminary assessment; b. identification of the areas of focus;

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 37 c. assessment of the business environment; d. quantitative analysis of the current business model; e. qualitative analysis of the current business model; f. analysis of the forward-looking strategy (including planned changes to the business model); g. assessment of business model viability over the following 12 months; h. assessment of sustainability of the strategy; i. identification of key vulnerabilities to which the investment firm’s business model and strategy expose it or may expose it; and j. summarising of the findings and scoring. 75. For category 3 investment firms, where the scale and complexity of an investment firm’s activities are lower, competent authorities may perform the BMA and assign the relevant score in a simplified manner. In these cases, they should at least assess the viability of the business model and sustainability of the investment firms’ strategy, taking into account its business environment, and they should identify the key vulnerabilities. For class 3 investment firms, competent authorities should decide on a case-by-case basis whether and in which form to perform the BMA, at least forming a comprehensive view on how such investment firms generate returns and identifying the vulnerabilities they are exposed to that may affect their ability to generate such returns. 76. To conduct the BMA, competent authorities may use the following sources of quantitative and qualitative information, if available: a. where sufficiently reliable, investment firm’s strategic plan(s) with current-year and forward-looking forecasts, and underlying economic assumptions; b. financial reporting (including profit and loss (P&L), balance sheet disclosures); c. regulatory reporting; d. internal reporting (management information, capital planning, liquidity reporting, internal risk reports); e. where applicable, recovery and resolution plans; f. third-party reports including audit reports, reports by equity/credit analysts; and g. other relevant studies/surveys including from the International Monetary Fund (IMF), macro-prudential authorities and institutions, and European institutions. 4.2 Preliminary assessment

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 38 77. Competent authorities should analyse the investment firm’s main activities, geographies and market positions to identify, at the highest level of consolidation in the jurisdiction, the investment firm’s: a. major geographies; b. major subsidiaries/branches; and c. main activities and, where relevant, business lines or product lines. 78. For this purpose, competent authorities should consider a range of relevant metrics at the point of assessment and their changes over time. These metrics should include: a. contribution to overall revenues/costs; b. share of assets; c. contribution to own funds requirements; and d. market position. 79. Competent authorities should use this preliminary assessment to: a. determine the materiality of business activities: competent authorities should determine which geographies, subsidiaries/branches, activities, and where relevant business lines or product lines are the most material based on profit contribution (notably based on P&L), risk (including K-factors or other measures of risk) and/or organisational priorities. Competent authorities should use this information as a basis for identifying what the BMA should focus on (as covered further in Section 4.3; b. identify the peer group: competent authorities may determine (i) the relevant peer group for the investment firm on the basis of its structure and activities; (ii) to conduct a BMA, the peer group on the basis of the rival product/business lines targeting the same source of profits/customers; c. support the application of the principle of proportionality: competent authorities may use the outcomes of the preliminary assessment to help determine the appropriate granularity of assessment. 4.3 Identifying the areas of focus for the BMA 80. Competent authorities should determine the focus of the BMA. They should focus on the business lines that are most important in terms of viability or future sustainability of the current business model, and/or most likely to increase the investment firm’s exposure to existing or new vulnerabilities. Competent authorities may take into account: a. the materiality of business activities – whether certain business activities are more important in terms of generating profits (or losses) or cash flows;

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 39 b. previous supervisory findings – whether the findings for other elements of the SREP can provide indicators on business lines requiring further investigation, including findings from AML/CFT supervisors; c. findings and observations from internal or external audit reports – whether the audit function has identified specific issues regarding the sustainability or viability of certain business lines; d. importance to strategic plans – whether there are business lines that the investment firm wishes to grow substantially, or to decrease; e. observed changes in the business model – whether there are observed de facto changes in the business model that have occurred without the investment firm declaring any planned changes or releasing new strategic plans and whether the business model changes may expose the investment firm to increased ML/TF risks; and f. peer comparisons – whether a business line has performed atypically (been an outlier) compared to peers. 4.4 Assessing the business environment 81. To form a view on the plausibility of an investment firm’s strategic assumptions, competent authorities should undertake an analysis of the business environment. This takes into consideration the current and future business conditions in which an investment firm operates or is likely to operate based on its main or material geographic and business exposures. Such analysis should be based on the main macro-economic variables, regulatory and market trends, and competitive landscape. 4.5 Analysis of the current business model 82. To understand the means and methods used by an investment firm to operate and generate profits, competent authorities should undertake quantitative and qualitative analyses. 4.5.1 Quantitative analysis 83. Competent authorities should undertake both a static and trend analysis of key quantitative features of the investment firm’s current business model to understand its financial performance and the degree to which this is driven by its risk appetite being higher or lower than peers. 84. Areas for analysis by competent authorities may include: a. profit and loss: competent authorities may assess the underlying profitability of the investment firm (after exception items and one-offs), the breakdown of income streams, the breakdown of costs, impairment provisions and key ratios (including cost/income net profit margin, net cash-flow);

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 40 b. the balance sheet: competent authorities may assess the asset and liability mix, the funding structure, the change in the own funds and own funds requirements, and key ratios (including return on equity, Core Tier 1, funding gap); c. concentrations: competent authorities may assess concentrations in the P&L and balance sheet related to customers, sectors and geographies; and d. risk appetite: competent authorities may assess the formal limits put in place by the investment firm (notably trading limits) and its adherence to them to understand the risks that the investment firm is willing to take to drive its financial performance. 4.5.2 Qualitative analysis 85. Competent authorities should undertake an analysis of qualitative features of the investment firm’s current business model to understand its success drivers and key dependencies. 86. Areas for analysis by competent authorities may include: a. key external dependencies: competent authorities may determine the main exogenous factors that influence the success of the business model; these may include third-party providers, intermediaries and specific regulatory drivers; b. key internal dependencies: competent authorities may determine the main endogenous factors that influence the success of the business model; these may include the quality of IT platforms and operational and resource capacity; and even key people; c. franchise: competent authorities may determine the strength of relationships with customers, suppliers and partners; this may include the investment firm’s reliance upon its reputation, the effectiveness of branches, the loyalty of customers and the effectiveness of partnerships; and d. areas of competitive advantage: competent authorities may also determine the areas in which the investment firm has a competitive advantage over its peers; these may include any of the above, such as the quality of the investment firm’s IT platforms, or other factors such as the investment firm’s global network, the scale of its business or its product proposition. e. ML/TF risks: in the analysis, competent authorities should consider any indications that the business model and activities give rise to increased ML/TF risks, including cash transactions or establishment or use of legal entities in high-risk third countries, as identified in accordance with Article 9 of Directive (EU) 2015/849. Where present, these indications should be complemented by quantitative analysis, as appropriate, focusing in particular on the materiality of the revenues and the income from operations run in such high risk third countries, the concentrations of exposures to customers for which the investment firms apply enhanced customer due diligence as set out in Chapter II, Section 3 of Directive 2015/849.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 41 4.6 Analysis of the strategy 87. Competent authorities should undertake a quantitative and qualitative forward-looking analysis of the investment firm’s financial projections and strategic plan to understand the assumptions, plausibility and riskiness of its business strategy. 88. Areas for analysis by competent authorities may include: a. overall strategy: competent authorities may consider the main quantitative and qualitative management objectives; b. projected financial performance: competent authorities may consider projected financial performance, covering the same or similar metrics as those covered in the quantitative analysis of the current business model; c. success drivers of the strategy: competent authorities may determine the key changes proposed to the current business model to meet the objectives; d. assumptions: competent authorities may determine the plausibility and consistency of the assumptions made by the investment firm that drive its strategy and forecasts; these may include assumptions in areas such as macro-economic metrics, market dynamics, volume and margin growth in key products, segments and geographies; and e. execution capabilities: competent authorities may determine the investment firm’s execution capabilities based on the management’s track record in adhering to previous strategies and forecasts, and the complexity and ambition of the strategy set compared to the current business model. 4.7 Assessing business model viability 89. Having conducted the analyses covered in Sections 4.4 and 4.5, competent authorities should form, or update, their view on the viability of the investment firm’s current business model on the basis of its ability to generate acceptable returns over the following 12 months, given its quantitative performance, key success drivers and dependencies and business environment. 90. Competent authorities may assess the level of returns against the following criteria: a. return on equity (ROE) against cost of equity (COE) or equivalent measure: competent authorities may consider whether the business model generates a return above cost (excluding one-offs) on the basis of ROE against COE; other metrics, such as return on assets or risk-adjusted return on capital, as well as considering changes in these measures through the cycle, may also support this assessment; b. cash-flow structure: competent authorities may consider whether the cash-flow mix is appropriate to the business model and to the strategy; volatility or mismatches in the cash-flow generation may mean that a business model or strategy, even one that generates returns above costs, may not be viable or sustainable given the current or future business environment; and

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 42 c. risk appetite: competent authorities may consider whether the investment firm’s business model or strategy relies on a risk appetite, for individual risks or more generally, that is considered high or is an outlier amongst the peer group, where available. 4.8 Assessing the sustainability of the investment firm’s strategy 91. Having conducted the analyses covered in Sections 4.4 to 4.6, competent authorities should form, or update, their view on the sustainability of the investment firm’s strategy over a forward-looking period taking into account its strategic plans and financial forecasts and the supervisory assessment of the business environment. Such forward-looking period should cover at least 3 years but could be extended to match the next expected full SREP assessment, in line with the minimum engagement model specified in Title 2. 92. In particular, competent authorities may assess the sustainability of the investment firm’s strategy based on: a. the plausibility of the investment firm’s assumptions and projected financial performance compared to the supervisory view of the current and future business environment; b. the impact on the projected financial performance of the supervisory view of the business environment (where this differs from the investment firm’s assumptions); and c. the risk level of the strategy (i.e. the complexity and ambition of the strategy compared to the current business model), and the consequent likelihood of success based on the investment firm’s likely execution capabilities (measured by the investment firm’s success in executing previous strategies of a similar scale or the performance against the strategic plan so far). 93. For non-complex investment firms and where financial projections are not available or not reliable, competent authorities may assess the sustainability of the investment firm’s strategy in a qualitative manner focusing on: a. the overall planned growth per significant business activities and potential impact of the business environment on the ability to realise the strategy; b. the potential misalignment between the investment firm’s long-term profit incentive and the interests of consumers and financial markets; c. the consistency of the investment firm’s strategy with its risk appetite. 4.9 Identification of key vulnerabilities 94. Having conducted the BMA, competent authorities should assess the key vulnerabilities to which the investment firm’s business model and strategy expose it or may expose it, considering any of the following:

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 43 a. poor expected financial performance; b. reliance on an unrealistic strategy; c. excessive concentrations or volatility (including earnings, revenues and customers subject to enhanced customer due diligence set out in Chapter II, Section 3 of Directive (EU) 2015/849, high risk third countries in accordance with Article 9 of that Directive); d. excessive risk-taking; e. cash-flow and financing structure concerns; f. significant external issues (including regulatory threats, such as mandating of ‘ring￾fencing’ of business units); and g. ESG risks and their impact on the viability and sustainability of the business model and long-term resilience of the investment firm. 95. Following the above assessment, competent authorities should form a view on the viability of the investment firm’s business model and the sustainability of its strategy, and any necessary measures to address problems and concerns. 4.10 Summary of findings and scoring 96. Based on the assessment of the viability and sustainability of the business model, competent authorities should form an overall view on the business model viability and strategy sustainability, and any potential risks to the viability of an investment firm stemming from this assessment. This view should be reflected in a summary of findings, accompanied by a viability score based on the considerations specified in the table below. Table 3. Supervisory considerations for assigning a score for business model analysis Score Supervisory view Considerations 1 The business model and strategy pose low level of risk to the viability of the investment firm. • The investment firm generates strong and stable returns which are acceptable given its risk appetite and funding structure. • There are no material asset concentrations or unsustainable concentrated sources of income. • The investment firm has a strong competitive position in its chosen markets and a strategy likely to reinforce this. • The investment firm has financial forecasts drawn up on the basis of plausible assumptions about the future business environment. • Strategic plans are appropriate given the current business model and management execution capabilities. 2 The business model and strategy pose a • The investment firm generates average returns compared to peers and/or historic performance which

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 44 medium-low level of risk to the viability of the investment firm. are broadly acceptable given its risk appetite and funding structure. • There are some asset concentrations or concentrated sources of income. • The investment firm faces competitive pressure on its products/services in one or more key markets. Some doubt about its strategy to address the situation. • The investment firm has financial forecasts drawn up on the basis of optimistic assumptions about the future business environment. • Strategic plans are reasonable given the current business model and management execution capabilities, but not without risk. 3 The business model and strategy pose a medium-high level of risk to the viability of the investment firm. • The investment firm generates returns that are often weak or not stable, or relies on a risk appetite or funding structure to generate appropriate returns that raise supervisory concerns. • There are significant asset concentrations or concentrated sources of income. • The investment firm has a weak competitive position for its products/services in its chosen markets, and may have few business lines with good prospects. The investment firm’s market share may be declining significantly. There are doubts about its strategy to address the situation. • The investment firm has financial forecasts drawn up on the basis of overly optimistic assumptions about the future business environment. • Strategic plans may not be plausible given the current business model and management execution capabilities. 4 The business model and strategy pose a high level of risk to the viability of the investment firm. • The investment firm generates very weak and highly unstable returns, or relies on an unacceptable risk appetite or funding structure to generate appropriate returns. • The investment firm has extreme asset concentrations or unsustainable concentrated sources of income. • The investment firm has a very poor competitive position for its products/services in its chosen markets and participates in business lines with very weak prospects. Strategic plans are very unlikely to address the situation. • The investment firm has financial forecasts drawn up on the basis of very unrealistic assumptions about the future business environment.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 45 • Strategic plans are not plausible given the current business model and management execution capabilities.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 46 Title 5 Assessing internal governance and investment firm-wide controls 5.1 General considerations 97. Competent authorities should assess whether or not an investment firm’s internal governance arrangements are adequate for and commensurate with the investment firm’s risk profile, business model, nature, size and complexity. They should identify the extent to which the investment firm complies with the applicable EU and national requirements regarding sound internal governance arrangements and identify any shortcomings. Competent authorities should evaluate in particular whether or not the internal governance arrangements ensure the sound management of risks and include appropriate internal controls and oversight. Competent authorities should establish if there are material risks posed by poor internal governance arrangements and their potential effect on the risk profile sustainability of the investment firm. 98. For SREP, the assessment of the investment firm’s internal governance and controls should include, having regard to the application of the principle of proportionality, an assessment of the following areas: a. the overall internal governance framework, which should include a clear organisational structure and appropriate corporate risk culture; b. the composition, organisation and functioning of the management body and its committees, where established; c. remuneration policies and practices; d. the internal control framework, which should include an independent compliance, and, where applicable, internal risk management and internal audit functions; e. risk management framework, including ICARAP; f. Information and communication technology; and g. business continuity planning. 99. The assessment of internal governance should inform the specific assessment of risk management and controls as specified in Titles 6 and 8 as well as the SREP capital assessment in Title 7 and the SREP liquidity assessment in Title 9. Likewise, a risk-by-risk analysis of internal capital adequacy and internal-risk assessment process reviewed under Title 7, and any deficiencies identified thereby, should inform the assessment of the overall risk management framework assessed under this title.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 47 100. In line with the EBA Guidelines on internal governance15, the assessment of the internal governance framework should include the verification of the existence of governance arrangements and mechanisms to ensure that the investment firm complies with applicable AML/CFT requirements and takes into account any supplementary information received from the AML/CFT supervisors on the assessment of these arrangements and mechanisms. 101. To ensure a consistent investor protection across the financial services, competent authorities should coordinate with market authorities, and consider relevant information received from such authorities for the assessment of governance arrangements and firm-wide controls. Principle of proportionality 102. Competent authorities should have regard to the principle of proportionality with a view to ensure that the internal governance arrangements established by investment firms including within the context of investment firm groups, are consistent with the individual risk profile of the firm and the group, commensurate to their size and internal organization, relevant to their business model, suitable for the nature, scale and complexity of their activities and sufficient to effectively achieve the objectives of the relevant regulatory requirements. 103. For the purpose of the above paragraph and having regard to the variety of different business models under which investment firms and investment firm groups operate, it should be assessed whether investment firms with a more complex organisation or with a larger scale should have more sophisticated governance arrangements, while investment firms with a simpler organisation or with a smaller scale or less complex activities may implement simpler governance arrangements. 104. Criteria to be taken into account for the application of the principle of proportionality such as the following should be considered for assessing the internal governance, in accordance with the EBA Guidelines on internal governance: a. the size in terms of the balance-sheet of the investment firm and its subsidiaries within the scope of prudential consolidation; b. the assets under management; c. whether the investment firm is authorized to hold client money or assets; d. the assets safeguarded and administered; e. the volume of client orders handled; f. the volume of daily trading flow; g. the geographical presence of the investment firms and the size of its operations in each jurisdiction, including in third countries jurisdictions; 15 EBA Guidelines on Internal Governance under Directive (EU) 2019/2034 (EBA/GL/2021/14).

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 48 h. the legal form of the investment firm, including whether the investment firm is part of a group and, if so, the proportionality assessment for the group; i. whether the investment firm is authorised to use internal models for the measurement of capital requirements, as referred to in Article 22 of Regulation (EU) 2019/2033; j. the type of authorised activities, the services performed by the investment firm as defined in Sections A and B of Annex I to Directive 2014/65/EU and other services performed by the investment firm; k. the underlying business model and strategy; the nature and complexity of the business activities, and the investment firm’s organisational structure l. the risk strategy, risk appetite and actual risk profile of the investment firm, taking into account also the result of the SREP capital and SREP liquidity assessments; m. the ownership and funding structure of the investment firm; n. the type of clients; o. the complexity of the financial instruments or contracts; p. the outsourced functions and distribution channels; q. the existing information and communication systems and technology (ICT), including continuity systems and outsourcing functions in this area; 105. For the appropriate application of the SREP in the case of investment firms classified, in accordance with Title 2, to category 3, adjusted minimum requirements are provided in the respective sections of this title. 106. For investment firms which meet the conditions for qualifying as small and non‐ interconnected investment firms set out in Article 12(1) of Regulation (EU) 2019/2033 (Class 3 firms), competent authorities should review their organisational arrangements as they deem appropriate, having regard to the applicable regulatory requirements. 5.2 Overall internal governance framework 107. Competent authorities should assess whether the investment firm establishes robust internal governance framework and arrangements, in accordance with the provisions of Article 26 of Directive (EU) 2019/2034, the EBA Guidelines on internal governance, the EBA Guidelines on sound remuneration policies 16, Commission Delegated Regulation (EU) 2017/56517, the ESMA Guidelines on MiFID II product governance requirements18, and the Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key 16 EBA Guidelines on sound remuneration policies under Directive (EU) 2019/2034 (EBA/GL/2021/13). 17 COMMISSION DELEGATED REGULATION (EU) 2017/565 of 25 April 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive (OJ L 087 31.3.2017, p. 1). 18 ESMA Guidelines on MiFID II product governance requirements (ESMA35-43-620).

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 49 function holders 19 . Competent authorities should assess whether the investment firm demonstrates at least that: a. the management body has set, approved and oversees an adequate and effective internal governance and internal control framework that includes a suitable and transparent organisational and operational structure and well-functioning internal control framework, including sound administration and accounting procedures and a permanent and effective compliance function and, where appropriate and proportionate, internal risk management and internal audit functions that have sufficient authority, stature and resources to perform their functions independently. Where investment firms do not establish and maintain a risk management function and an internal audit function, competent authorities should assess whether the policies and procedures adopted and implemented for an internal control framework achieve the same outcome with the ultimate responsibility remaining with the management body; b. the management body ensures and periodically assesses the effectiveness of the investment firm’s internal governance arrangements and takes appropriate steps to address any identified deficiencies; c. the management body has set, approved and oversees the overall business and risk strategy, including the setting of investment firm’s risk appetite and its risk management framework, including adequate policies and procedures; d. the management body knows and understands the legal, organisational and operational structure of the investment firm (‘know your structure’), in particular where the investment firm involves complex structures, and ensures that it is consistent with its approved business and risk strategies and risk appetite; e. the investment firm has an appropriate and transparent corporate structure that is ‘fit for purpose’ and that does not raise concerns that the investment firm might be used for purposes connected with financial crime and a sound corporate and risk culture that is comprehensive and proportionate to the nature, scale and complexity of the risks inherent within the business model and the investment firm's activities and consistent with the investment firm’s risk appetite; f. the investment firm promotes and ensures a risk culture and high ethical professional standards, through a code of conduct, and implemented appropriate internal alert policies and procedures; g. there is clear, strong and effective communication of strategies, corporate values, the code of conduct, risk and other policies to all relevant staff; 19 Joint ESMA and EBA Guidelines on the assessment of suitability of members of the management body and key function holders (EBA/GL/2017/12).

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 50 h. the management body established, approved and oversees the implementation and maintenance of effective policies and processes to identify, assess, manage and mitigate or prevent actual and potential conflicts of interest at firm level as well as between the investment firm and the private interests of staff, including members of the management body, which could adversely influence the performance of their duties and responsibilities; i. the management body has set out and ensures the implementation of a framework for entering into loans and other transactions, with members of the management body and their related parties; j. investment firms have put in place and maintain appropriate internal alert policies and procedures for staff to report potential or actual breaches of Regulation (EU) 2019/2033 and national provisions transposing Directive (EU) 2019/2034 through a specific, independent and autonomous channel; k. a selection and suitability assessment process for the members of the management body and key function holders has been implemented; l. arrangements aimed at ensuring the integrity of the accounting and financial reporting systems, including financial and operational controls and compliance with the law and relevant standards have been implemented; m. the internal governance framework is set, overseen and regularly assessed by the management body; and n. strategies, policies and procedures are communicated to all relevant staff throughout an investment firm and the structures of an investment firm and are clear, efficient and transparent to the investment firm’s staff, shareholders and other stakeholders and to the competent authority. 108. Competent authorities should assess whether the investment firm’s overall governance framework includes also the management of the New Product Approval Process (NPAP) and outsourcing. When analysing the internal governance framework and investment firm-wide controls, competent authorities should also take into account the assessments received from market supervisors and evaluate whether these give rise to prudential concerns. This could be the case in particular where findings point to material weaknesses in an investment firm’s systems and controls with regard to NPAP and outsourcing. Conversely, where the competent authority’s assessment indicates the shortcomings in an investment firm’s internal controls and governance framework and investment firm-wide controls give rise to prudential concerns related to NPAP and outsourcing, competent authorities should share the outcome of that assessment with market supervisors. Category 3 investment firms

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 51 109. For the purpose of proportionality and where category 3 investment firms are concerned, competent authorities should at least assess whether point a of paragraph 107 is complied with. 5.3 Organisation and functioning of the management body 110. In accordance with Articles 26 and 28 of Directive (EU) 2019/2034, the EBA Guidelines on internal governance and Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders, competent authorities should assess at least whether: a. arrangements aimed at ensuring that the individual and collective suitability of the management body and the individual suitability of key function holders are implemented and carried out effectively, upon appointment, when material changes happen, and on an ongoing basis, including notification to the relevant competent authorities; b. the composition of the management body is appropriate and the management body performs its functions effectively; c. effective interaction exists between the management body in its management and supervisory functions; d. the management body in its management function appropriately directs the business and the supervisory function oversees and monitors management decision-making and actions; e. appropriate internal governance practices and procedures are in place for the management body and its committees, where established; and f. all members of the management body are informed about the overall activity, financial and risk situation of the investment firm with clear, effective and well transparent reporting lines. Category 3 investment firms 111. For the purpose of proportionality and where category 3 investment firms are concerned, competent authorities should at least assess whether points a to b of paragraph 110 are complied with. 5.4 Remuneration policies and practices 112. Competent authorities should assess whether the investment firm has remuneration policies and practices that are gender neutral, as specified in Articles 25 to 26 and 30 to 33 of Directive (EU) 2019/2034 and the EBA Guidelines on sound remuneration policies, in particular for categories of staff including senior management, risk takers, staff engaged in control functions and any employees receiving overall remuneration equal to at least the lowest

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 52 remuneration received by senior management or risk takers, whose professional activities have a material impact on the investment firm’s risk profile or assets under management. 113. Competent authorities should assess at least whether: a. the remuneration policy for all staff is consistent with the investment firm’s business and risk strategies, corporate culture and values, the long-term interests of the investment firm and the measures taken to avoid conflicts of interest, is gender neutral and does not encourage excessive risk taking and is maintained, approved and overseen by the management body; b. staff whose professional activities have a material impact on the investment firm’s risk profile or assets under management are identified appropriately and in line with regulatory technical standard under Article 30(4) of Directive (EU) 2019/2034; c. variable remuneration does not affect the investment firms ability to ensure a sound capital base and is awarded in compliance with the requirements in Article 32 of Directive (EU) 2019/2034; d. remuneration of internal control functions where established is not linked to the performance of the activities the control functions monitor and control and does not otherwise likely compromise their objectivity; e. investment firms established, where applicable, a remuneration committee to advise the management body in its supervisory function and to prepare the decisions to be taken by this body. Where no remuneration committee has to be established, the requirements concerning the remuneration committee should be construed as applying to the management body in its supervisory function; and f. remuneration policy is subject to an independent internal review by internal control functions. 114. When applying the principle of proportionality, competent authorities should consider the criteria laid down in the EBA Guidelines on sound remuneration policies, in particular whether the investment firm is authorised to provide the services and activities referred to in Directive 2014/65/EU, point (2), (3), (4), (6) and (7) of Section A of Annex 1. In such case the competent authority should as a general principle expect a higher level of sophistication, in particular, if the investment firm is authorised to hold clients’ money or assets. 5.5 Internal control framework and functions 5.5.1 Internal control framework 115. Competent authorities should assess whether the investment firm has an internal control framework appropriate to the nature, scale and complexity of the investment firms’ activities, in accordance with the provisions laid down in EBA Guidelines on internal governance. This assessment should include, at least whether:

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 53 a. investment firms implement the internal control framework covering the whole organisation, including the management body’s responsibilities and tasks, and the activities of all business lines and internal units, including internal control functions, outsourced activities and distribution channels; b. investment firms establish, maintain and regularly update adequate written internal control policies, mechanisms and procedures, which should be approved by the management body; c. investment firms’ business lines are responsible for managing the risks they incur in conducting their activities and have controls in place that aim to ensure compliance with internal and external requirements; d. the management body is responsible for establishing and monitoring the adequacy and effectiveness of the internal control framework, processes and mechanisms, and for overseeing all business lines and internal units, including internal control functions; e. where applicable, the internal control framework of the investment firm is adapted on an individual basis to the specificity of its business, its complexity and the associated risks, taking into account the group context; f. there is a clear, transparent and documented decision-making process and a clear allocation of responsibilities and authority within its internal control framework, including its business lines, internal units and internal control functions; g. there is exchange of the information necessary, including policies, mechanisms and procedures and their updates, in a timely manner that ensures that the management body, each business line and internal unit, including each internal independent control function, is able to carry out its duties; h. internal control functions regularly submit to the management body timely, accurate, concise, comprehensive, clear and useful written reports on major identified deficiencies and such reports include, for each new identified major deficiency, the relevant risks involved, an impact assessment, recommendations and corrective measures to be taken; i. internal control functions have access and can report directly to the management body in its supervisory function, to raise concerns if necessary; j. the management body follows up on the findings of the internal control functions in a timely and effective manner and requires adequate remedial actions and a formal follow-up procedure on findings and corrective measures taken. 5.5.2 Internal control functions 116. Competent authorities should assess whether the investment firm has an effective and permanent internal compliance function and, where appropriate and proportionate, a risk

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 54 management function and internal audit function, with sufficient authority, stature, resources and, where necessary, direct access to the management body in its supervisory function and its committees, where established, including in particular the risk committee. 117. Competent authorities should assess whether the investment firm’s compliance function, and, where established, risk management function and internal audit function comply with the provisions of Title 5 of the EBA Guidelines on internal governance. 5.6 Risk management framework 118. Competent authorities should assess whether the investment firm has established an appropriate risk management framework and risk management processes. Competent authorities should review at least: a. the risk strategy, risk appetite and risk management framework; b. the ICARAP framework; c. sensitivity to cyclical economic fluctuations. 5.6.1 Risk management framework, risk appetite and strategy 119. When assessing the risk management framework, competent authorities should consider the extent to which it is embedded in, and how it influences, the overall strategy of the investment firm. Competent authorities should, in particular, assess if there are appropriate and consistent links between the business strategy, the risk strategy, risk appetite and risk management framework, and the capital and liquidity management frameworks. 120. When reviewing the risk strategy, risk appetite and risk management framework of an investment firm, competent authorities should assess at least whether: a. investment firms have a holistic investment firm-wide risk management framework extending across all the organisation, recognising fully the economic substance of all its risk exposures including the risks the investment firm poses to itself, its customers and markets and liquidity risk in particular those which can have a material impact on or deplete the level of own funds available; b. the risk management framework encompasses all relevant risks with appropriate consideration of both financial and non-financial risks; c. the investment firm when identifying and measuring or assessing risks, not only uses quantitative assessment methodologies (including stress testing), but also qualitative risk assessment tools (including expert judgement and critical analysis); d. there is effective risk reporting involving sound internal consideration and communication of risk strategy and relevant risk data, both horizontally across the investment firms and up and down the management chain; e. the investment firm’s risk management framework includes policies, procedures, risk limits and risk controls ensuring adequate, timely and continuous

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 55 identification, measurement or assessment, monitoring, management, mitigation and reporting of the risks at the business line, at the investment firm level and, where relevant, at consolidated level; f. the risk strategy and risk appetite translate all material risks into specific risk limits; g. the risk strategy and appetite appropriately consider the risk appetite and financial resources of the investment firm and take into account supervisory own funds and liquidity requirements and other supervisory measures and requirements; h. the investment firm has established processes for the approval of decisions on which the compliance function or, where relevant, the risk management function, have expressed a negative view. 5.6.2 Framework for Internal capital adequacy assessment process and internal risk￾assessment process (ICARAP) 121. Competent authorities should assess whether investment firms, which are not small and non-interconnected investment firms according to Article 12 of Regulation (EU) 2019/2033 or for which competent authorities exercised the discretion envisaged in the second subparagraph of Article 24(2) of Directive (EU) 2019/2034, at individual level, or investment firms groups, at consolidated level, have sound, effective and comprehensive arrangements, strategies and processes in place to assess and maintain on an ongoing basis the amounts, types and distribution of internal capital and liquid assets that they consider adequate to cover the nature and level of risks which they may pose to others and to which the investment firms themselves are or may be exposed to. Such arrangements, strategies and processes should be part of an internal capital adequacy and internal-risk assessment process that may be further split into an internal capital adequacy assessment process (ICAAP) and an internal liquidity adequacy assessment process (ILAAP). 122. In the case of investment firms which meet the conditions for qualifying as small and non‐ interconnected investment firms set out in Article 12(1) of Regulation (EU) 2019/2033 being requested by their competent authorities to apply the requirements according to Article 24(2) of Directive (EU) 2019/2034, the competent authorities should perform the assessment as deemed appropriate. 123. These assessments should contribute to the determination of additional own funds requirement and the assessment of capital adequacy as outlined in Title 7 as well as to the evaluation of liquidity adequacy as outlined in Title 9. Soundness of the ICARAP 124. When assessing the soundness of the ICARAP, competent authorities should assess, where relevant distinguishing between the ICAAP and the ILAAP, whether: a. the arrangements, strategies and processes constituting the ICARAP are appropriate and proportionate to the nature, size and complexity of the investment firm’s activities;

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 56 b. the arrangements, strategies and processes constituting the ICARAP are regularly reviewed by the investment firm; c. methodologies and assumptions applied by investment firms are appropriate and grounded in solid empirical input data; d. whether the confidence level is consistent with the risk appetite; e. whether the definition and composition of available internal capital or liquidity resources considered by the investment firm for the ICARAP is consistent with the risks measured by the investment firm and are eligible for the calculation of own funds and liquidity buffers. Effectiveness of the ICARAP 125. When assessing the effectiveness of the ICARAP, competent authorities should assess, where relevant distinguishing between the ICAAP and ILAAP, whether: a. the investment firm considers the ICARAP and its results in the decision-making and management processes at all levels in the investment firm; b. the investment firm uses the ICARAP and its results in its risk, capital and liquidity management; c. the investment firm has policies, procedures and tools to facilitate: i. clear identification of the functions and/or relevant committees responsible for the different elements of the ICARAP; ii. capital and liquidity planning: the calculation of capital and liquidity resources on a forward-looking basis in connection with the overall strategy or significant transactions; iii. the allocation and monitoring of capital and liquidity resources among business lines and risk types, notably by defining risk limits for business lines, entities or individual risks that are consistent with the objective of ensuring the overall adequacy of the investment firm’s internal capital and liquidity resources; iv. the regular and prompt reporting of capital and liquidity adequacy to senior management and to the management body; v. senior management or management body awareness and actions where business strategy and/or significant individual transactions may be inconsistent with the ICAAP and available internal capital or with the ILAAP and available internal liquidity resources; d. whether the management body demonstrates appropriate commitment to and knowledge of the ICARAP and its outcomes; and e. the ICARAP is forward-looking in nature by assessing the consistency of internal capital and liquidity assets with strategic plans.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 57 Comprehensiveness of the ICARAP 126. Competent authorities should assess the appropriateness of the ICARAP’s coverage of the investment firm’s business model, business lines, activities and legal entities. On the basis of this assessment, competent authorities should assess the appropriateness of the ICARAP’s identification and assessment of risks to which the investment firm is or may be exposed or pose to others, and the ICARAP’s compliance with legal requirements. In particular, they should assess: a. whether the ICARAP is implemented homogenously and proportionately for all the relevant investment firm’s business lines, activities and legal entities with respect to risk identification and assessment; b. where any entity has different internal governance arrangements or processes from the other entities of the group, whether these deviations are justified. The adoption of advanced models by only part of the group may be justified by a lack of sufficient data to estimate parameters for some business lines, activities, or legal entities, provided that these business lines, activities, or legal entities do not represent a source of risk concentration for the rest of the portfolio. 5.6.3 Investment firm’s assessment of cyclical economic fluctuations 127. Competent authorities should assess whether the investment firms perform a comprehensive assessment of the risks which are material to their business and operating model, to the composition of their portfolio or to their trading strategies. This should include an assessment of these risks in the context of cyclical economic fluctuations and of the impact such fluctuations may have on the investment firms’ ability to meet its own funds requirements, to fund its ongoing business operations or to orderly wind-down. 128. Competent authorities should assess whether investment firms performing activities referred to in point (3) or (6) of Section A of Annex I to Directive 2014/65/EU conduct more in￾depth assessment using stress test(s) or sensitivity analysis, expecting them to reflect a scope and level of sophistication appropriate to the nature, scale, and complexity of the investment firms’ activities. 129. Competent authorities should review investment firms’ assessments of cyclical economic fluctuations, if relevant in the form of stress testing or sensitivity analyses, and their outcomes. Where, on the basis of such review, the investment firm’s assessments of the impacts of cyclical economic fluctuations are sufficiently reliable, the results of such review should inform the assessment of various SREP elements, in particular: a. the identification of possible deficiencies in overall governance arrangements or investment firm-wide controls identified during the review should be taken into account;

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 58 b. the identification of relevant business vulnerabilities that should be taken into consideration when assessing investment firms’ business model viability and sustainability of their strategies in accordance with Title 4; c. the identification of possible vulnerabilities or weaknesses in risk management and controls on individual risk areas identified during the review should be taken into account by the competent authorities when assessing individual risks to capital as referred to in Title 6, or risks to liquidity as referred to in Title 8; and d. the potential determination of guidance on additional own funds (P2G), revised capital planning and other measures as set out in Titles 7 and 10. 130. For investment firms performing activities referred to in point (3) or (6) of Section A of Annex I to Directive 2014/65/EU, when assessing stress tests or sensitivity analyses, and their results, competent authorities should pay specific attention to the following: a. the appropriateness of the selection of the scenarios, which should be relevant to the investment firm’s business model or individual business lines or portfolios and the market in which it operates; b. the underlying assumptions, methodologies and risk drivers, including the scenario severity; c. the coverage of material risks and vulnerabilities identified, and their impact on the ability of the investment firms to generate profit and maintain adequate capital requirements; and d. the use of their results, before and after taking into account relevant management actions, in the investment firm’s risk and strategic management. 131. When assessing stress tests and sensitivity analyses and their results in the case of cross￾border groups, competent authorities should consider the transferability of capital and liquidity between the legal entities or business units during stressed conditions, as well as the functioning of any established intra-group financial support arrangements, taking into account the funding difficulties that might be expected in stressed conditions. 132. If competent authorities identify deficiencies in the design of the assessment of cyclical economic fluctuations, or, where relevant, in the design of the scenarios or assumptions used by investment firms forstress testing or sensitivity analyses, they may require investment firms respectively to re-perform or re-run their analyses, or some specific parts using modified assumptions provided by the competent authorities, or specific prescribed scenarios. 5.7 ML/TF risks and prudential concerns 133. When analysing the internal governance framework and investment firm-wide controls, competent authorities should also take into account the assessments received from AML/CFT supervisors, and evaluate whether these give rise to prudential concerns. This could be the case in particular where findings point to material weaknesses in an investment firm’s AML/CFT systems and controls. Conversely, where the competent authority’s assessment indicates the

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 59 shortcomings in an investment firm’s internal controls and governance framework and investment firm-wide controls give rise to prudential concerns related to ML/TF risk, competent authorities should share the outcome of that assessment with AML/CFT supervisors. 134. Competent authorities should assess whether the investment firm’s overall governance framework includes also the management of the ML/TF risks. 135. In line with the EBA Guidelines on internal governance and Joint ESMA and EBA Guidelines on the assessment of the suitability of the members of the management body and key function holders, competent authorities should assess from a prudential perspective whether the responsibilities of the management body with regard to ML/TF risks are being complied with. Competent authorities should take into account any supplementary information received from the AML/CFT supervisors following their assessment. Category 3 investment firms 136. For the purpose of proportionality, where lower ML/TF risk is justified by the types of clients and the nature, scale and complexity of activities of the investment firm allow, competent authorities should assess at least whether the investment firm’s overall governance framework includes also the management of ML/TF risks. 5.8 Information and communication technologies 137. Competent authorities should assess whether the investment firm has sound, effective and reliable information systems and whether their internal control functions have appropriate IT systems and support at their disposal with access to the internal and external information necessary to meet their responsibilities. 138. In particular, competent authorities should assess whether the investment firm is able to safeguard the security of its network and information systems to ensure confidentiality, integrity and availability of their processes, data and assets. 139. Competent authorities should assess whether the information systems effectively support the investment firm’s business and risk management. 5.9 Business contingency and continuity planning 140. Competent authorities should assess whether the investment firm has established an effective business continuity management to ensure its ability to operate on an ongoing basis and to limit losses in the event of severe business disruption. 141. Competent authorities should assess whether an investment firm: a. has put in place and tested contingency and business continuity plans to ensure that the investment firm reacts appropriately to emergencies and is able to maintain its critical business activities and functions if there is disruption to its ordinary business procedures;

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 60 b. has adequately documented and implemented its contingency and business continuity plans. 5.10 Application at the consolidated level and implications for group entities 142. At the consolidated level, in addition to the elements covered in the sections above, competent authorities should assess whether: a. the management body of the consolidating investment firm understands both the organisation of the group and the roles of its different entities, and the links and relationships among them; b. the organisational and legal structure of the group is clear and transparent, and suitable for the size and the complexity of the business and operations; c. the investment firm has established an effective group-wide management information and reporting system applicable to all business units and legal entities, and this information is available to the management body of the investment firm’s parent undertaking on a timely basis; d. the management body of the consolidating investment firm has established consistent group-wide strategies, including a group wide risk strategy and appetite framework; e. group risk management covers all material risks regardless of whether the risk arises from entities not subject to consolidation (including SPVs, SPEs, and property firms) and establishes a comprehensive view on all risks; f. where established, the group-wide internal audit function is independent, has a group-wide risk-based audit plan, is appropriately staffed and resourced, has appropriate stature and has a direct reporting line to the management body of the consolidating investment firm. 143. When conducting the assessment of internal governance and investment firm-wide controls at subsidiary level, in addition to the elements listed in this title, competent authorities should assess whether group-wide policies and procedures are implemented consistently at subsidiary level and whether group entities have taken steps to ensure that their operations are compliant with all applicable laws and regulations. 5.11 Summary of findings and scoring 144. Following the above assessments, competent authorities should form a view on the adequacy of the investment firm’s internal governance arrangements and investment firm￾wide controls. This view should be reflected in a summary of findings, accompanied by a viability score based on the considerations specified in Table 4. Table 4. Supervisory considerations for assigning a score for internal governance and investment firm-wide controls

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 61 Score Supervisory view Considerations 1 Deficiencies in internal governance and investment firm￾wide control arrangements pose a low level of risk to the viability of the investment firm. • The investment firm has a robust and transparent organisational structure with clear responsibilities and separation of risk taking from risk management and control functions. • There is a sound corporate culture, management of conflicts of interest and whistleblowing processes. • The composition and functioning of the management body are appropriate. • The remuneration policy is in line with the investment firm’s risk strategy and long-term interests. • The risk management framework and risk management processes are appropriate. • The internal control framework and internal controls are appropriate. • The internal risk management, compliance and audit functions are independent and have sufficient resources and the internal audit function operates effectively in accordance with established international standards and requirements. • Information and communication technologies are appropriate. • The business continuity and contingency planning arrangements are appropriate. 2 Deficiencies in internal governance and investment firm￾wide control arrangements pose a medium￾low level of risk to the viability of the investment firm. • The investment firm has a largely robust and transparent organisational structure with clear responsibilities and separation of risk taking from risk management and control functions. • There is a largely sound corporate culture, management of conflicts of interest and whistleblowing processes. • The composition and functioning of the management body are largely appropriate. • The remuneration policy is largely in line with the investment firm’s risk strategy and long-term interests. • The risk management framework and risk management processes are largely appropriate. • The internal control framework and internal controls are largely appropriate. • The internal risk management, compliance and audit functions are independent and their operations are largely effective. • Information and communication technologies are largely appropriate. • The business continuity and contingency planning arrangements are largely appropriate.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 62 3 Deficiencies in internal governance and investment firm￾wide control arrangements pose a medium￾high level of risk to the viability of the investment firm. • The investment firm’s organisational structure and responsibilities are not fully transparent and risk taking is not fully separated from risk management and control functions. • There are doubts about the appropriateness of the corporate culture, management of conflicts of interest and/or whistleblowing processes. • There are doubts about the appropriateness of the composition and functioning of the management body. • There are concerns that the remuneration policy may conflict with the investment firm’s risk strategy and long-term interests. • There are doubts about the appropriateness of the risk management framework and risk management processes. • There are doubts about the appropriateness of the internal control framework and internal controls. • There are doubts about the independence and effective operation of the internal risk management, compliance and audit functions. • There are doubts about the appropriateness of information and communication technologies. • There are doubts about the appropriateness of the arrangements for business continuity and contingency planning. 4 Deficiencies in internal governance and investment firm￾wide control arrangements pose a high level of risk to the viability of the investment firm. • The investment firm’s organisational structure and responsibilities are not transparent and risk-taking is not separated from risk management and control functions. • The corporate culture, management of conflicts of interest and/ or whistleblowing processes are inappropriate. • The composition and functioning of the management body are inappropriate. • The remuneration policy conflicts with the investment firm’s risk strategy and long-term interests. • The risk management framework and the risk management processes are inappropriate. • The internal risk management, compliance and/or audit function is not independent and/or the internal audit functions are not operating in accordance with established international standards and requirements; operations are not effective. • The internal control framework and internal controls are inappropriate. • The information and communication technologies are inappropriate. • The business continuity and contingency planning arrangements are inappropriate.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 63 Title 6 Assessing risks to capital 6.1 General considerations 145. Competent authorities should assess and score the risks to capital that have been identified as material for the investment firm. To determine the scope of the assessment, competent authorities should first identify the sources of risks to capital to which the investment firm is or may be exposed. To do so, competent authorities should leverage the knowledge gained from the assessment of other SREP elements, from the comparison of the investment firm’s position to peers and from any other supervisory activities. The assessment of the risks to capital should be performed in a proportionate manner, i.e. adjusting the level of detail of the analysis taking into account the nature, size, and complexity of the investment firm. 146. The purpose of this title is to provide common methodologies to be considered for assessing individual risks and risk management and controls. It is not intended to be exhaustive and gives leeway to competent authorities to take into account other additional criteria that may be deemed relevant based on their experience and the specific features of the investment firm. 147. This title provides competent authorities with guidance for the assessment of risks and costs related to potential orderly wind-down of the investment firm as well as guidelines for the assessment and scoring of the following categories of risks to capital in the ongoing activities of investment firms: a. Risk-to-Client; b. Risk-to-Market; c. Risk-to-Firm; d. other risks. 148. Paragraph 147, points (a) to (c) are applicable to the assessment of investment firms classified to categories 1, 2 or 3, considering the scope of authorised activities of these investment firms. Where relevant, competent authorities may take into account paragraph 147, points (a) and (c) for the assessment of small and non-complex investment firms meeting the criteria of Article 12 of Regulation (EU) 2019/2033, taking into account the relevance of certain sub-categories listed under the abovementioned risks to capital for these investment firms. Competent authorities should assess the orderly wind-down of an investment firm as well as other risks, both in the case of all investment firms subject to SREP. 149. The title also identifies a set of sub-categories within each risk category above, which need to be taken into account when risks to capital are assessed. Depending on the materiality of any of these sub-categories to a particular investment firm, they can be assessed and scored individually.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 64 150. The decision on materiality is based on the most recent available data and can be complemented by supervisory judgment. 151. Competent authorities should also assess other risks that are identified as material to a specific investment firm but are not listed above. Those other risks, which cannot be reasonably attributed to one of the three categories listed in paragraph 147, points (a) to (c), are a separate category of risks. The following may assist with the identification process: a. drivers of own funds requirements; b. risks identified in the investment firm’s ICARAP or stress tests if available; c. risks arising from the investment firm’s business model (including those identified by other investment firms operating a similar business model); d. information stemming from the monitoring of key indicators; e. findings and observations from internal or external audit reports; f. recommendations and guidelines issued by the EBA, as well as warnings and recommendations issued by macro-prudential authorities or the ESRB that are relevant to the firm; and g. reports of breaches and incidents to the competent authorities. 152. The above elements should also be taken into account by competent authorities when they are planning the intensity of their supervisory activity in relation to the assessment of a specific risk. 153. For Risk-to-Client, Risk-to-Market, Risk-to-Firm, as well as for fixed overheads requirement, competent authorities should verify the investment firm’s compliance with the minimum requirements specified in Regulation (EU) 2019/2033. However, these guidelines allow competent authorities to extend the scope of the assessment beyond those requirements to form a comprehensive view on risks to capital. In particular, competent authorities should identify situations where certain risks or elements of risk are insufficiently covered by the minimum own funds requirements, despite compliance with the requirements of Regulation (EU) 2019/2033. For instance, the lag due to the use of rolling average for some K-Factors may flatten activity peaks and using tied agents instead of internal staff results in underestimating expenses. This assessment should inform the determination of additional own funds requirement in accordance with section 7.2.1. 154. In their implementation of the methodologies specified in this title, competent authorities should use information coming from the monitoring of key indicators, as specified in Title 3. Competent authorities should use other quantitative and qualitative indicators where relevant for the purpose of this assessment. 155. When performing their assessments, competent authorities should use all available information sources, including regulatory reporting, ad-hoc reporting, the investment firm’s internal metrics and reports (including internal audit report, risk management reports, information from the ICARAP), on-site inspection reports and external reports (including the investment firm’s communications to investors, rating agencies). While the

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 65 assessment is intended to be firm-specific, comparison with peers should be considered to identify potential exposure to risks to capital. For such purposes, peers should be defined on a risk-by-risk basis and might differ from those identified for BMA or other analyses. 156. For each risk category, competent authorities should assess and reflect in the risk score: a. inherent risk (risk exposures); and b. the quality and effectiveness of risk management and controls. 157. Competent authorities should reflect the outcome of the assessment of each risk category in a summary of findings that provides an explanation of the main risk drivers, and a risk score, as specified in the following sections. 6.2 Assessment of orderly wind-down of the investment firm 158. Competent authorities should identify and assess the process to orderly wind-down the investment firm under plausible scenarios reflecting the business model and strategy of the investment firm. The level of details of such assessment including the number of considered scenarios should be determined taking into account the business model, scale and complexity of activities performed by the investment firm. The assessment should include at least the following elements: a. identification of wind-down scenarios; b. identification of the realistic timeframe to wind-down the investment firms; and c. assessment of the impact of a wind-down of an investment firm on its clients, counterparties and markets, and on the investment firm itself. 6.2.1 Identification of wind-down scenarios 159. There are many scenarios under which an investment firm may wind-down. While performing their analysis, competent authorities should focus on one or more scenarios under which the investment firm becomes unviable and is compelled to wind-down its business. Some typical scenarios that may be considered by competent authorities are: a. significant financial losses due to severe market fluctuations; and b. loss of critical infrastructure that are impossible to timely replace. 160. To set up adequate scenarios pursuant to paragraph 159, competent authorities should consider, where relevant, the following information, building on the analysis performed under Title 4 (Business Model Analysis): a. legal form of the investment firm and the related applicable insolvency requirements; b. business model of the investment firm and related vulnerabilities; c. key revenue and costs drivers of the investment firm; d. key cash inflows and outflows;

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 66 e. key internal or outsourced operating tools and processes (essential IT systems); and f. key business activities, especially ones that may be difficult to wind-down or that are subject to high internal/external interconnectedness. 161. Where a recovery plan is available, if appropriate, competent authorities should rely on the recovery plan scenarios by further stressing them to reach a wind-down (i.e. situations where recovery options will not be available). 6.2.2 Identification of the adequate time-horizon to wind-down 162. Competent authorities should determine the adequate time horizon for the investment firm to orderly wind-down. In particular, competent authorities should assess whether a time-horizon longer than three months would be needed to orderly wind-down investment firms’ businesses. 163. To determine the expected time-horizon of orderly wind-down, competent authorities should take into account the aspects detailed in paragraphs 165 to 167, which can impact the duration of wind-down. Competent authorities may also rely on the average time￾horizon of orderly wind-down previously conducted for investment firms with similar characteristics within their jurisdiction. 6.2.3 Assessment of the impact of a wind-down on clients, counterparties, and markets 164. Competent authorities should determine the various stakeholders that could be impacted by the investment firm’s wind-down, under the analysed scenarios. While performing their impact assessment, competent authorities should consider at least the investment firm’s main clients, other counterparties and markets. 165. Competent authorities should perform an assessment of the impact of a wind-down on the investment firm’s clients. Such assessment should include at least the following aspects, to the extent the relevant information is available: a. the ability of the investment firms to close outstanding transaction and the consequences such closure may have on clients and on the investment firm itself (i.e. whether the investment firm will suffer from termination penalties, or legal fees); b. where contracts are non-cancellable, the ability of the investment firm to handover all of them to another financial institutions and at what costs; and c. the ability of the investment firm to timely return client money held and assets under the investment firm’s custody, in line with the rules introduced under Directive 2014/65/EU. 166. Competent authorities should perform an assessment of the impact of a wind-down on the markets on which the investment firm is operating. Competent authorities should particularly focus on the following situations:

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 67 a. where a high share of the investment firm’s business is performed in one or some specific markets; and b. where the investment firm is a major business provider in a specific market. 6.2.4 Assessment of the impact of a wind-down on the investment firm 167. Based on the analysis of the investment firm’s organisational structure and operating model, competent authorities should determine the key risks to the investment firm in case of a wind-down. Competent authorities should consider the following aspects, to the extent they are relevant for the investment firm and the information is available: a. the ability of the investment firm to cover its operating costs, including the costs of maintaining its key internal or outsourced process and IT systems, permitting it to continue to function at a level that allows for an orderly wind-down; b. the investment firm’s ability to timely dispose of its fixed assets and absorb associated losses; c. the investment firm’s ability to manage/dismiss its employees, considering the requirements of the relevant employment legislation, especially in cases where the investment firm has cross-border entities, and the costs it may entail (considering in particular potential severance payments); d. the ability of the investment firm to retain key employees to perform the wind￾down and the costs it may entail; and e. any other operational costs or risks that could arise during the wind-down process. 6.3 Assessment of Risk-to-Client 6.3.1 General considerations 168. Competent authorities should assess Risk-to-Client arising from all types of exposures, including off-balance sheet exposures: assets under management, client money held, assets safeguarded and administered, and client orders handled. They should also consider the national laws governing segregation applicable to client money, and the availability for the investment firm of a professional indemnity insurance as an effective tool in the management of risks, in accordance with Article 29(1) of Directive (EU) 2019/2034. 169. In assessing Risk-to-Client, competent authorities should take into account the different types of clients, and the nature and complexity of the investment firm’s activities regarding these clients. 6.3.2 Assessment of inherent Risk-to-Client 170. Through the assessment of inherent Risk-to-Client, competent authorities should determine the main drivers of the investment firm’s Risk-to-Client K-factor amounts and evaluate the significance of the prudential impact of this risk for the investment firm. The

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 68 assessment of inherent Risk-to-Client should therefore be structured around the following main steps: a. preliminary assessment; b. assessment of the nature and scale of services and activities for managing client assets, holding client money, safeguarding client assets and handling client orders; and c. assessment of the systems and processes regarding these activities. 171. Competent authorities should assess Risk-to-Client in both current and prospective terms. 172. Where relevant, competent authorities should also conduct a more granular assessment, potentially at the level of single clients. Preliminary assessment 173. To determine the scope of the assessment of Risk-to-Client, competent authorities should first identify the sources of Risk-to-Client to which the investment firm is or may be exposed. 174. As a minimum, competent authorities should consider the following: a. the risk appetite with regard to Risk-to-Client, considering the business model of the investment firm; b. the weight of the K-factor amount for Risk-to-Client compared to the total K-factor amount; c. forecasts of the K-factor amount for Risk-to-Client, if available; d. the nature, size and composition of the investment firm’s on- and off-balance sheet client-related items; e. if available, the cost of operational losses on the client accounts versus fees. 175. Competent authorities should perform the preliminary analysis considering the change in the above indicators over time to form an informed view of the main drivers of the investment firm’s Risk-to-Client. Assets under management (AUM) 176. Competent authorities should assess the risk of incurring a loss for clients due to the mismanagement of client assets under management. Assets under management include both assets under discretionary portfolio management and nondiscretionary advisory arrangements of an ongoing nature. This risk may arise, among other sources, from breach of the mandate’s terms, excessive leverage, excessive concentration, assets subject to liquidity squeezes, or inadequate product complexity relative to the mandate. 177. Competent authorities should focus on these sources of inherent risk, where relevant:

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 69 a. complexity of mandates, Investment Policy Statement (IPS) or strategies implemented; b. client profiles (sovereign funds, institutional investors, corporate or retail) and risk tolerance; c. asset classes of underlying portfolio; d. amount of assets under management. Client money held (CMH) 178. Competent authorities should assess the risk of losing client money and having to compensate clients due to the mismanagement of client accounts by the investment firm. 179. Competent authorities should assess whether client money is held according to national law regarding client money protection and can be clearly distinguished from the investment firm’s own cash. 180. Competent authorities should focus on these sources of inherent risk, where relevant: a. account type (commercial bank deposit); b. agreement on investment firm access to client money; c. authorised investments policy for client money; d. omnibus or individual segregated accounts; e. client money traceability; f. amount of client money held and number of clients; g. currencies used to denominate client accounts. Assets safeguarded and administered (ASA) 181. Competent authorities should assess the risk of incurring a loss for clients and having to compensate them due to the mismanagement of assets safeguarded and administered by the investment firm. 182. Competent authorities should focus on these sources of inherent risk where relevant: a. reuse of collateral held; b. liquidation rights on assets; c. collateral depreciation; d. delegations incoming from and out-coming to other financial entities; e. types of assets; f. operations or failure to perform operations on events linked to assets (vote for general assembly, coupon payment, rights issues).

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 70 Client orders handled (COH) 183. Competent authorities should assess the risk of operational loss while handling client orders. This risk may arise from system or human errors due to the complexity of processes, procedures, and IT systems (including the use of new technologies), to the extent that they might lead to errors, including delays, misspecification or security breaches. 184. Competent authorities should focus on these sources of inherent risk, where relevant: a. quantity and amount of client orders handled; b. nature of underlying assets (OTC, more or less liquid…); c. order types and characteristics (by blocks, fixed price…); d. transmission or execution characteristics (electronic trading or by voice…); e. transmission or execution processes and organisation (dedicated desks by asset class, sales-traders, trading on own account, market access…). 6.3.3 Assessment of Risk-to-Client management and controls 185. To achieve a comprehensive understanding of the investment firm’s Risk-to-Client profile, competent authorities should also review the risk management framework underlying its activities. To this end, competent authorities should assess the following elements, where relevant: a. the investment firm has a sound, clearly formulated and documented risk strategy that is duly validated by the management board and covers asset management, cash flow management within the firm and management of assets safeguarded and administered; b. the investment firm has an appropriate organisational framework to ensure effective providing of services to clients, with sufficient (both qualitative and quantitative) human and technical resources (front and back offices, information systems); c. the investment firm has a strong and comprehensive control framework (effectiveness and independence of control functions) and sound safeguards to mitigate its risks to clients in line with the management strategy and risk appetite; d. the investment firm has clearly defined policies and procedures for the identification, management, measurement and control of operational risks to clients; e. access rights of the firm to client accounts are compliant with applicable regulations. 6.3.4 Summary of findings and scoring 186. Following the above assessment, competent authorities should form a view on the investment firm’s Risk-to-Client. This view should be reflected in a summary of findings,

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 71 accompanied by a risk score based on the considerations specified in Table 5. If, based on the materiality of certain risk factors, competent authorities decide to assess and score them individually, the guidance provided in this table should be applied, as far as possible, by analogy. Table 5. Supervisory considerations for assigning a risk score for Risk-to-Client Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls 1

There is a low risk of significant prudential impact on the investment firm considering the level of inherent risk and the management and controls. • The nature and composition of risk exposure implies nonmaterial risk/very low risk. • Exposure to complex products and transactions is not material/very low. • The level of concentration risk is not material/very low. • The level of risk related to processes and systems is not material/very low. • There is consistency between the investment firm’s management and controls and its overall strategy and risk appetite. • The organisational framework is robust with clear responsibilities and a clear separation of tasks between risk takers and management and control functions. • Measurement, monitoring and reporting systems are appropriate. 2

There is a medium￾low risk of significant prudential impact on the investment firm considering the level of inherent risk and the management and controls. The nature and composition of risk exposure implies low to medium risk. Exposure to complex products and transactions is low to medium. The level of concentration risk is low to medium. The level of risk related to processes and systems is low to medium. 3

There is a medium￾high risk of significant prudential impact on the investment firm considering the level of inherent risk and the management and controls. The nature and composition of risk exposure implies medium to high risk. Exposure to complex products and transactions is medium to high. The level of concentration risk is medium to high. The level of risk related to processes and systems is medium to high. • There is a deficiency in the investment firm’s management and controls compared to its overall strategy and risk appetite. • The organisational framework lacks clear responsibilities and a clear separation of tasks between risk takers and

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 72 4 There is a high risk of significant prudential impact on the investment firm considering the level of inherent risk and the management and controls. • The nature and composition of risk exposure implies high risk. • Exposure to complex products and transactions is high. • The level of concentration risk is high. • The level of risk related to processes and systems is high. management and control functions. • Measurement, monitoring and reporting systems are not sufficient or consistent enough, some risks are not properly monitored or reported. 6.4 Assessment of Risk-to-Market 6.4.1 General considerations 187. Competent authorities should assess Risk-to-Market arising from all types of exposures: for positions that are not subject to clearing (i.e. exposure computed through Net Position Risk methodology), and for positions that are subject to clearing or margining (i.e. exposure computed through Clearing Margin Given methodology). 188. In assessing Risk-to-Market, competent authorities should take into account the volume, nature and complexity of the investment firm’s activities. 6.4.2 Assessment of inherent Risk-to-Market 189. Through the assessment of inherent market risk, competent authorities should determine the main drivers of the investment firm’s market risk exposure and evaluate the risk of significant prudential impact on the investment firm. The assessment of inherent market risk should be structured around the following main steps: a. preliminary assessment; b. assessment of the nature and composition of the investment firm’s positions subject to risk-to-market; c. assessment of profitability; d. assessment of market concentration risk; e. assessment of the prudent valuation framework for trading book positions; and f. assessment of the model risk (i.e. models used for regulatory purposes). Preliminary assessment 190. To determine the scope of the assessment of risk-to-market, competent authorities should first identify the sources of market risk to which the investment firm is or may be exposed. 191. As a minimum, competent authorities should consider:

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 73 a. the investment firm’s market activities, business lines and products; b. the main strategy of the market risk portfolio within the trading book and the risk appetite in market activities; c. the relative weight of trading book positions in terms of total assets, changes over time and the investment firm’s strategy for these positions, if available; d. the relative weight of net gains on market positions in total operating income; and e. the own funds requirement for Risk-to-Market compared to the total own funds requirement, including the historical change in this figure and forecasts, if available. 192. In their initial assessments, competent authorities should also consider significant changes in the investment firm’s market activities with the focus on potential changes in the total exposure to market risk. In particular, they may assess: a. significant changes in market risk strategy, policies and sizes of limits; b. the potential impact on the investment firm’s risk profile of those changes; and c. major trends in the financial markets. Nature and composition of the investment firm’s market risk activities 193. Competent authorities should analyse the nature of the investment firm’s market risk exposures to identify particular risk exposures and related market risk factors/drivers (including exchange rates, interest rates or credit spreads) for further in-depth assessment. 194. Competent authorities should analyse market risk exposures by relevant asset classes and/or financial instruments according to their size, complexity and level of risk. For the most relevant exposures, competent authorities should assess their related risk factors and drivers. 195. While analysing market risk activities, competent authorities should also consider the complexity of the relevant financial products (including products valued using mark-to￾model techniques) and of specific market operations (including high-frequency trading). The following points should be considered: a. where the investment firm holds derivatives positions, competent authorities should assess both the market value and the notional amount; b. where the investment firm is engaged in OTC derivatives, competent authorities should evaluate, where available, the weight of these transactions in the total derivatives portfolio and the breakdown of the OTC portfolio by type of contract (swap, forward), underlying financial instruments (the counterparty credit risk associated with these products is covered under the risk-to-firm methodology); c. where the investment firm has implemented hedging strategies, competent authorities should assess the residual market risk after implementation of these strategies.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 74 196. Where appropriate, competent authorities should assess distressed and/or illiquid positions and evaluate their impact on the investment firm’s profitability. 197. For those investment firms using internal approaches to calculate their regulatory own funds requirements, competent authorities should also consider the following indicators to identify particular risk areas and related risk drivers: a. the split of market risk own funds requirements between the value at risk (VaR), stressed VaR (SVaR), incremental risk charge (IRC) and charge for correlation trading portfolio; b. the VaR broken down by risk factors; c. the change in the VaR and SVaR (possible indicators could be the day-to-day/week￾to-week change, the quarterly average and back-testing results); and d. the multiplication factors applied to VaR and SVaR. 198. Where appropriate, competent authorities should also consider the internal risk measures of investment firms. These could include the expected shortfall, the internal VaR not used in the calculations of own funds requirements or sensitivities of the market risk to different risk factors and potential losses. 199. When analysing inherent market risk, competent authorities should consider ‘point-in￾time’ figures and trends, both on an aggregate basis and by portfolio. Where possible, this analysis should be completed with a comparison of the investment firm’s figures to peers and to relevant macro-economic indicators. Profitability analysis 200. Competent authorities should analyse the historic profitability, including volatility of profits, of market activities to gain a better understanding of the investment firm’s market risk profile. This analysis could be performed at portfolio level as well as being broken down by business line, trading desk or asset class (potentially as part of the wider assessment carried out as part of the BMA). 201. While assessing profitability, competent authorities should pay specific attention to the main risk areas identified during the examination of market risk activities. Competent authorities should distinguish between trading revenues and non-trading revenues (such as commissions, clients’ fees) on the one hand and realised and unrealised profits/losses on the other hand. 202. For those asset classes and/or exposures generating abnormal profits or losses, competent authorities should assess profitability in comparison to the level of risk assumed by the investment firm (including VaR/net gains on financial assets and liabilities held for trading) to identify and analyse possible inconsistencies. Where possible, competent authorities should compare the investment firm’s figures to its historical performance and its peers. Market concentration risk

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 75 203. Competent authorities should form a view on the degree of market concentration risk to which the investment firm is exposed, either from exposures to a single risk factor or from exposures to multiple risk factors that are correlated. 204. When evaluating possible concentrations, competent authorities should pay special attention to concentrations in complex products (notably structured products), illiquid products (including collateralised debt obligations (CDOs)) or products valued using mark￾to-model techniques. Prudent valuation of the trading book positions 205. Competent authorities should form a view on the prudent valuation framework of the investment firm, as a flawed valuation process may lead to errors in the calculation of the exit value of financial instruments leading to an underestimation of potential losses of the investment firm. While performing this analysis, competent authorities should pay particular attention to the calculation of reserves (notably fair value reserves, model reserves) and their potential impact on the capital position of the investment firm. 206. Competent authorities should assess whether the investment firm’s trading book positions are valued at a prudent value that achieves an appropriate degree of certainty having regard to the dynamic nature of trading book positions. The level of certainty referred to in Commission Delegated Regulation 2016/101 20 should be considered to achieve an appropriate degree of certainty for this purpose. 207. Competent authorities should assess whether investment firms have robust prudent valuation methodologies and that they consider the following valuation adjustments: a. unearned credit spreads; b. close-out costs; c. operational risks; d. market price uncertainty; e. early termination; f. investing and funding costs; g. future administrative costs; and h. where relevant, model risk. 208. Competent authorities should assess whether: a. the governance arrangements, processes and procedures related to valuation adjustments are sufficiently sound, especially with regard to less liquid positions, and consistent with the investment firm’s strategy; 20 Commission Delegated Regulation (EU) 2016/101 of 26 October 2015 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical standards for prudent valuation under Article 105(14) (OJ L 021 28.1.2016, p. 54).

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 76 b. the IT systems and processes linked to the valuation framework are robust; c. the adequacy of the adjustments performed by the investment firms is periodically reviewed. Model risk 209. Competent authorities should assess the risk relating to the underestimation of own funds requirements by regulatory approved internal models used, notably internal ratings￾based (IRB) approach, IRC, models used for the purpose of credit risk mitigation, VaR and sVaR. 6.4.3 Assessment of Risk-to-Market management and controls 210. To achieve a comprehensive understanding of the investment firm’s market risk profile, competent authorities should review the governance and risk management framework underlying its market activities. To this end, competent authorities should assess the following elements while taking into account the volume, nature and complexity of the investment firm’s activities: a. the investment firm has a sound, clearly formulated and documented market risk strategy, approved by their management body; b. the investment firm’s market risk strategy properly reflects the investment firm’s appetite for market risk and is consistent with the overall risk appetite; c. the investment firm has an appropriate organisational framework for market risk management, measurement, monitoring and control functions, with sufficient (both qualitative and quantitative) human and technical resources; d. the investment firm has clearly defined policies and procedures for the identification, management, measurement and control of market risk, including limits reflecting the risk appetite approved by the management board; e. the investment firm has an appropriate framework for identifying, understanding and measuring market risk, in line with the investment firm’s size and complexity, and that this framework is compliant with relevant requirements in accordance with the relevant EU and national implementing legislation; and f. the investment firm has a strong and comprehensive control framework and sound safeguards to mitigate its market risk in line with its market risk management strategy and risk appetite. 6.4.4 Summary of findings and scoring

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 77 211. Following the above assessment, competent authorities should form a view on the investment firm’s market risk. This view should be reflected in a summary of findings, accompanied by a risk score based on the considerations specified in Table 6. If, based on the materiality of certain risk factors, competent authorities decide to assess and score them individually, the guidance provided in this table should be applied, as far as possible, by analogy. 212. Competent authorities should consider all these factors in parallel and not in isolation and understand the drivers behind Risk-to-Market. Table 6. Supervisory considerations for assigning a market risk score Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls 1

There is a low level of risk of significant prudential impact on the investment firm considering the level of inherent risk and the management and controls. • The nature and composition of market risk exposures imply not material/very low risk. • The investment firm’s exposures to market risk are non-complex. • The level of market risk concentration is not material/very low. • The investment firm’s market risk exposures generate non-volatile returns. • There is consistency between the investment firm’s market risk policy and strategy and its overall strategy and risk appetite. • The organisational framework for market risk is robust, with clear responsibilities and a clear separation of tasks between risk takers and management and control functions. • Market risk measurement, monitoring and reporting systems are appropriate. • Internal limits and the control framework for market risk are sound and in line with the investment firm’s risk management strategy and risk appetite. 2

There is a medium￾low risk of significant prudential impact on the investment firm considering the level of inherent risk and the management and controls. • The nature and composition of market risk exposures imply low to medium risk. • The complexity of the investment firm’s market risk exposures is low to medium. • The level of market risk concentration is low to medium. • The investment firm’s market risk exposures generate returns that have a low to medium degree of volatility.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 78 3 There is a medium￾high risk of significant prudential impact on the investment firm considering the level of inherent risk and the management and controls. • The nature and composition of market risk exposures imply medium to high risk. • The complexity of the investment firm’s market risk exposures is medium to high. • The level of market risk concentration is medium to high. • The investment firm’s exposures to market risk generate returns that have a medium to high degree of volatility. • There is a deficiency in the investment firm’s market risk policy and strategy relative to its overall strategy and risk appetite. • The organisational framework for market risk lacks clear responsibilities and a clear separation of tasks between risk takers and management and control functions. • Market risk measurement, monitoring and reporting systems are not sufficient or consistent enough, some risks are not properly monitored or reported. • Internal limits and the control framework for market risk are not in line with the investment firm’s risk management strategy and risk appetite. 4 There is a high risk of significant prudential impact on the investment firm considering the level of inherent risk and the management and controls. • The nature and composition of market risk exposures imply high risk. • The complexity of the investment firm’s market risk exposures is high. • The level of market risk concentration is high. • The investment firm’s exposures to market risk generate returns that have a high degree of volatility. 6.5 Assessment of Risk-to-Firm 6.5.1 General considerations 213. Competent authorities should assess Risk-to-Firm arising from different risk factors such as: operational risks from the daily trading flow (DTF), concentration risk due to large exposures (CON), and exposure to the default of trading counterparties (TCD). In their assessment competent should also consider sources of risk to the investment firm such as the material changes in the book value of assets, the failure of clients or counterparties, the positions in financial instruments, foreign currencies and commodities and the obligations to defined benefit pension schemes in accordance with Article 29 of Directive (EU) 2019/2034. Where relevant, they should also consider other factors that may pose risk to the investment firm. 214. In assessing Risk-to-Firm, competent authorities should take into account the volume, nature and complexity of the investment firm’s activities. 6.5.2 Assessment of inherent Risk-to-Firm 215. Through the assessment of inherent Risk-to-Firm, competent authorities should determine the main drivers and evaluate the significance of the prudential impact of this

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 79 risk for the investment firm. The assessment of inherent Risk-to-Firm should therefore be structured around the following main steps: a. preliminary assessment; b. assessment of the nature and scale of investment activities that incur a risk for the investment firm; c. assessment of the systems and processes regarding these activities. 216. Competent authorities should assess Risk-to-Firm in both current and prospective terms. 217. Where relevant, competent authorities should also conduct a more granular assessment, potentially at the level of single clients. Preliminary assessment 218. To determine the scope of the assessment of Risk-to-Firm, competent authorities should first identify the sources of Risk-to-Firm to which the investment firm is or may be exposed. 219. As a minimum, competent authorities should consider the following: a. the business model and risk appetite; b. the weight of the K-factor amount for Risk-to-Firm compared to the total K-factor amount; c. forecasts of the K-factor amount for Risk-to-Firm, if available; d. the cost of operational losses to the firm versus revenues. 220. Competent authorities should perform the preliminary analysis considering the change in the above over time to form an informed view of the main drivers of the investment firm’s Risk-to-Firm. Daily trading flow 221. Competent authorities should form a view on the degree of operational risk related to trading on own account. This risk may arise from system or human errors due to the complexity of processes, procedures, and IT systems (including the use of new technologies), to the extent that they might lead to errors, delays, misspecification, security breaches. 222. Competent authorities should focus on these sources of inherent risk, where relevant: a. volume, exposure, number and complexity of transactions implemented; b. unavailability or loss of integrity of IT systems; c. types of financial market infrastructures (FMIs) used to process transactions: voice, electronic platforms (MTF, OTF);

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 80 d. algorithmic trading. Concentration risk 223. Competent authorities should form a view on the degree of concentration risk to which the investment firm is exposed. Specifically, competent authorities should assess the risk that the investment firm will incur significant losses stemming from a concentration of exposures to a small group of counterparties or to highly correlated financial assets. 224. Competent authorities should conduct this assessment considering different categories of concentration risk, including: a. single-name concentrations (including a client or group of connected clients as defined for large exposures); b. sectoral concentrations; c. geographical concentrations; d. product concentration; and e. collateral and guarantees concentration. 225. Competent authorities should pay particular attention to hidden sources of concentration risk that can materialise under stressed conditions, when the level of correlation can increase compared to normal conditions and when additional exposures can arise from off-balance sheet items. 226. For groups, competent authorities should consider the concentration risk that can result from consolidation, which may be not evident at an individual level. Trading counterparty default risk 227. Competent authorities should assess the trading counterparty default risk faced by investment firms arising from exposures to transactions in financial instruments. 228. For this assessment, competent authorities should focus on the following sources of inherent risk, where relevant: a. the quality of counterparties and relevant credit valuation adjustments (CVAs); b. the complexity of the financial instruments underlying the relevant transactions; c. the wrong-way risk arising from the positive correlation between the counterparty credit risk and the credit risk exposure; d. the exposure to counterparty credit and settlement risks in terms of both current market values and nominal amount, compared to the overall credit exposure and to own funds; e. the proportion of transactions processed through financial market infrastructures (FMIs) that provide payment versus delivery settlement;

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 81 f. the proportion of relevant transactions to central counterparties (CCPs) and the effectiveness of their loss protection mechanisms such as margin levels and default fund contribution; and g. the existence, significance, effectiveness and enforceability of netting agreements (close-out netting). Material changes to the book value of assets 229. Competent authorities should form a view on the risks incurred by the investment firm’s due to material changes in the book value of assets. This risk might lead to losses if the value to which assets are recorded does not properly reflect their real market value. 230. Competent authorities should focus on assets whose value has been estimated through models and proxies instead of inputs directly inferred from the market. Credit risk (failure of clients or counterparties) 231. Credit risk may arise from granting loans to allow a client to carry out a transaction, direct loans to staff, intraday credit risk due to overdraft, guarantee and contingent credit exposures, hold to maturity or illiquid bond positions, margin loans to clients, accruing/unpaid fees and commissions, direct credit exposures to their managed funds via loans, seed investments and guarantees. 232. Competent authorities should focus on these sources of inherent risk if the relevant data is available: a. nature of credit risk in the investment firm taking into account the types of counterparties and exposures; b. off-balance sheet exposures, in particular guarantees given or received; c. impairment risk. 233. Competent authorities should form a view on the degree of risk of impairment or depreciation of assets outside the trading book that is not captured by K-factors such as the K-TCD. This risk may arise from revaluations when for instance a counterparty’s probability of default increases significantly or a subsidiary’s value has decreased since acquisition. 234. Competent authorities should focus on these sources of inherent risk where relevant: a. changes in creditworthiness of counterparties; b. complexity of transactions and high leverage (notably LBOs); c. exceptional events triggering revaluation. Positions in financial instruments, foreign currencies and commodities 235. Competent authorities should form a view on the risks incurred by the investment firm’s due to the exposure to financial instruments, foreign currencies and commodities.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 82 These sources of risk might lead to losses in case of adverse movements in the financial market, currencies market and commodity markets. 236. Competent authorities should focus on the nature of the financial instruments held by the investment firm, on the overall exposure of the investment firm to the currency market (also considering, for instance, the correlation of the currencies in which the investment firm has an exposure) and on the exposure to specific commodities. Risks related to employee benefits and pension risk 237. Competent authorities should form a view on the risks incurred by the investment firm’s remuneration and pension scheme. This risk might lead to losses if payments are excessive relative to the firm’s income, including endangering the firm’s profitability and solvency. 238. Competent authorities should focus on the risk resulting from a structural gap between assets and liabilities related to employee benefits, where relevant. 6.5.3 Assessment of Risk-to-Firm management and controls 239. To achieve a comprehensive understanding of the investment firm’s Risk-to-Firm profile, competent authorities should review the governance and risk management framework that reduce the risk arising from the trading flow, concentration and counterparty default. To this end, competent authorities should assess the following elements while taking into account the volume, nature and complexity of the investment firm’s activities: a. the investment firm has a sound, clearly formulated and documented risk strategy regarding trading flow, concentration and counterparty default, approved by their management body; b. the investment firm’s risk strategy properly reflects the investment firm’s appetite for these risks and is consistent with the overall risk appetite; c. the investment firm has an appropriate organisational framework for the management, measurement, monitoring and control of concentration and counterparty default risks, with sufficient (both qualitative and quantitative) human and technical resources; d. the investment firm has clearly defined policies and procedures for the identification, management, measurement and control of Risks-to-Firm, including limits reflecting risk appetite set by the Board; e. the investment firm has an appropriate framework for identifying, understanding and measuring Risks-to-Firm, in line with the investment firm’s size and complexity, and that this framework is compliant with relevant minimum requirements in accordance with the relevant EU and national implementing legislation; and

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 83 f. the investment firm has a strong and comprehensive control framework and sound safeguards to mitigate its Risks-to-Firm in line with its risk management strategy and risk appetite. 6.5.4 Summary of findings and scoring 240. Following the above assessment, competent authorities should form a view on the investment firm’s Risk-to-Firm. This view should be reflected in a summary of findings, accompanied by a risk score based on the considerations specified in Table 7. If, based on the materiality of certain risk factors, competent authorities decide to assess and score them individually, the guidance provided in this table should be applied, as far as possible, by analogy. 241. Competent authorities should consider all these factors in parallel and not in isolation and understand the drivers behind Risk-to-Firm. Table 7. Supervisory considerations for assigning a Risk-to-Firm score Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls 1

There is a low risk of significant prudential impact on the investment firm considering the level of inherent risk and the management and controls. • The nature of activities implies nonmaterial risk/very low investment risk. • The nature and composition of risk exposure implies nonmaterial risk/very low risk. • Exposure to counterparty default is not material/very low. • Exposure to risks related to employee benefits and pension risk is not material/very low. • The level of concentration risk is not material/very low. • The level of operational risk related to processes and systems is not material/very low. • There is consistency between the investment firm’s management and controls and its overall strategy and risk appetite. • The organisational framework is robust with clear responsibilities and a clear separation of tasks between risk takers and management and control functions.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 84 2 There is a medium￾low risk of significant prudential impact on the investment firm considering the level of inherent risk and the management and controls. • The nature of activities implies low to medium investment risk. • The nature and composition of risk exposure implies low to medium risk. • Exposure to counterparty default is low to medium. • Exposure to risks related to employee benefits and pension risk is medium to high. • The level of concentration risk is low to medium. • The level of operational risk related to processes and systems is low to medium. • Measurement, monitoring and reporting systems are appropriate. 3 There is a medium￾high risk of significant prudential impact on the investment firm considering the level of inherent risk and the management and controls. • The nature of activities implies medium to high investment risk. • The nature and composition of risk exposure implies medium to high risk. • Exposure to counterparty default is medium to high. • The level of concentration risk is medium to high. • The level of operational risk related to processes and systems is medium to high. • There is a deficiency in the investment firm’s management and controls compared to its overall strategy and risk appetite. • The organisational framework lacks clear responsibilities and a clear separation of tasks between risk takers and management and control functions. • Measurement, monitoring and reporting systems are not sufficient or consistent enough, some risks are not properly monitored or reported. 4 There is a high risk of significant prudential impact on the investment firm considering the level of inherent risk and the management and controls. • The nature of activities implies high investment risk. • The nature and composition of risk exposure implies high risk. • Exposure to counterparty default is high. • Exposure to risks related to employee benefits and pension risk is high. • The level of concentration risk is high. • The level of operational risk related to processes and systems is high. 6.6 Assessment of other risks 6.6.1 General considerations 242. Competent authorities should assess the importance of other risks to investment firm’s capital, which are not covered by Pillar 1 own funds requirements, in accordance with Article 36 and 40 of Directive (EU) 2019/2034. In assessing these other risks, competent

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 85 authorities should take into account the nature and complexity of the investment firm’s activities, having impact on the significance of these risks. 6.6.2 Assessment of inherent risks 243. Through the assessment of inherent risks not covered by Pillar 1 own funds requirements, competent authorities should determine the main drivers of the investment firm’s risks and evaluate the significance of the impact of these risks for the investment firm. The assessment of such risks should be structured around the following main steps: a. preliminary assessment; b. assessment of the nature and scale of investment activities that incur a risk for the investment firm not covered by Pillar 1 own funds requirements; c. assessment of the systems and processes regarding these activities. 244. Competent authorities should assess risks not covered by Pillar 1 own funds requirements in both current and prospective terms. 245. Where relevant, competent authorities should also conduct an assessment of other risks than those listed in this chapter. Preliminary assessment 246. To determine the scope of the assessment of risks not covered by Pillar 1 own funds requirements, competent authorities should first identify the sources of risks to which the investment firm is or may be exposed. 247. As a minimum, competent authorities should consider the following: a. the business model and risk appetite; b. in-house development or outsourcing of IT solutions; c. support functions such as compliance, legal, fiscal (also if outsourced); d. cost of lawsuits and litigation; e. total operational losses, including the cost of internal and external fraud; f. scope of non-trading book activities. 248. Competent authorities should perform the preliminary analysis considering the change in the above over time to form an informed view of the main drivers of the investment firm’s other risks. Interest rate risk arising from non‐trading book activities 249. Competent authorities should assess the interest rate risk arising from non-trading book activities to which the investment firm is exposed.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 86 250. Competent authorities should assess how changes in interest rates can have an adverse impact on the investment firm’s assets, liabilities and off-balance-sheet exposures. To better determine the complexity and the interest rate risk profile of the investment firm, competent authorities should also understand the main features of the investment firm’s assets, liabilities, and off-balance-sheet exposures. 251. In their quantitative assessment, competent authorities should consider the results of the investment’s firm internal methodologies for measuring interest rate risk arising from non-trading book activities. Moreover, competent authorities should consider appropriate shock scenarios given the nature of the exposure to the interest rate risk arising from non￾trading book activities of the investment firm. Operational risks not covered by Pillar 1 252. Competent authorities should assess operational risks not covered by minimum own funds requirements in accordance with Regulation (EU) 2019/2033. These risks might lead to direct operational losses and to indirect losses resulting from complaints and litigation. Large operational risks may also lead to a shortage of staff in key positions. The assessment should take into account not only operational losses, but also near misses and operational risk events ended with a gain. 253. Competent authorities should consider the following sources of inherent risk and, where relevant, focus the assessment on those aspects, which are considered the most significant for the investment firm: a. workplace safety; b. damage to physical assets; c. internal fraud; d. external fraud; e. ICT risks; f. conduct risk; g. regulatory, legal and fiscal risks; h. model risk, in relation to models used for business purposes; i. insufficient (both qualitative and quantitative) human and technical resources in key positions; j. reputational risk. 254. As part of all SREP assessments, competent authorities should form a view on the degree of ICT risk, and the consistency of ICT operations with the business strategy. Competent authorities should include in their assessment all relevant aspects of ICT risk, such as security risk, IT projects risk and ICT management risk, to the extent that this is not already covered by other parts of these guidelines, and having regard to the EBA Guidelines

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 87 on ICT and security risk 21 and the ESMA Guidelines on outsourcing to cloud service providers22; 255. Competent authorities should form a view on the degree of conduct risk related to investment and market activities of the investment firm, to the extent that it is not captured by Pillar 1 own funds requirements. Conduct risk should be understood as the current or prospective risk incurred by clients, markets or the firm itself due to an inappropriate behaviour of the firm or its staff. This risk may arise from cases of wilful or negligent misconduct (including inappropriate supply of financial services), to the extent that they might lead to negative financial or reputational impacts. This reputational risk may in turn cause a loss in market shares or key clients, and an increase of clients’ complaints. 256. Competent authorities should focus on the following sources of inherent conduct risk where relevant: a. closure or suspension of a fund; b. number of misconduct incidents: mis-selling, market manipulation; c. regulatory penalties incurred. 257. Competent authorities should form a view on regulatory, legal, and fiscal risks arising from non-compliance with laws or regulations. These risks might lead to litigation and penalties for the investment firm. Remedial programmes may also incur large expenses to comply with law and regulations. 258. Competent authorities should focus on these sources of inherent regulatory, legal, and fiscal risks where relevant: a. costs for achieving compliance with applicable regulations; b. payment of fines or other sanctions for non-compliance; c. tax reassessment or payment of late fees, fines and penalties; d. anticipation of regulatory changes relevant for the investment firm. 259. Competent authorities should assess the risk relating to models used for business purposes, including valuation/pricing models, models for algorithmic trading and other models which may have significant impact on the business decisions and activities of investment firm. 260. Having regard to the specificities of the investment firm, while performing the assessment of risks not covered by Pillar 1 own funds requirements, competent authorities may consider other sources of risks not included in the abovementioned categories. Systemic risk 21 EBA Guidelines on ICT and security risk management (EBA/GL/2019/04). 22 ESMA Guidelines on outsourcing to cloud service providers (ESMA50-164-4285).

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 88 261. Based on quantitative and qualitative criteria, competent authorities should form a view of the systemic risk of the investment firm. Based on this assessment, competent authorities should determine whether the failure of the investment firm could result in major disruptions of the financial markets in which the investment firm operates. 262. Where appropriate, the assessment of systemic risk may be performed in an aggregate manner for a group of investment firms with a similar business model and risk profile. When performing such aggregated assessment competent authorities should consider potential impacts of simultaneous failure of a specified number/share of these investment firms on the financial markets in which they operate. For this purpose competent authorities may consider one or more scenarios. 6.6.3 Assessment of risks management and controls 263. To achieve a comprehensive understanding of the investment firm’s risk profile regarding risks not covered by Pillar 1 own funds requirements, competent authorities should review the governance and risk management framework that reduce the risk arising from other sources of risks. To this end, competent authorities should assess the following elements while taking into account the volume, nature and complexity of the investment firm’s activities: a. the investment firm’s strategy properly reflects the investment firm’s appetite for these risks and is consistent with the overall risk appetite; b. the investment firm has internal guidelines and policies to ensure a sound risk culture; c. the investment firm has appropriate framework for the management, measurement, monitoring and control of interest rate risk arising from non￾trading book activities; d. the investment firm has an appropriate framework for the management, measurement, monitoring and control of IT risks, with sufficient (both qualitative and quantitative) human and technical resources; e. the investment firm has clearly defined policies and procedures for the control of operational risk. 6.6.4 Summary of findings and scoring 264. Following the above assessment, competent authorities should form a view on the investment firm’s other risks. This view should be reflected in a summary of findings, accompanied by a risk score based on the considerations specified in Table 8. If, based on the materiality of certain risk factors, competent authorities decide to assess and score them individually, the guidance provided in this table should be applied, as far as possible, by analogy. 265. Competent authorities should consider all these factors in parallel and not in isolation and understand the drivers behind risks not covered by Pillar 1 own funds requirements.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 89 Table 8. Supervisory considerations for assigning a score for other risks Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls 1

There is a low risk of significant prudential impact on the investment firm considering the level of inherent risk and the management and controls. • The nature of activities implies nonmaterial risk/very low conduct risk. • Exposure to interest rate risk arising from non-trading book activities is not material/very low. • The level of other operational risks not covered by Pillar 1, including in particular ICT risk as well as regulatory, legal and fiscal risks, is not material/very low. • There is consistency between the investment firm’s management and controls and its overall strategy and risk appetite. • The organisational framework is robust with clear allocation of responsibilities and dedicated management and control functions. • Measurement, monitoring and reporting systems are appropriate. 2

There is a medium￾low risk of significant prudential impact on the investment firm considering the level of inherent risk and the management and controls. • The nature of activities implies low to medium conduct risk. • Exposure to interest rate risk arising from non-trading book activities is low to medium. • The level of other operational risks not covered by Pillar 1 is low to medium. 3

There is a medium￾high risk of significant prudential impact on the investment firm considering the level of inherent risk and the management and controls. • The nature of activities implies medium to high conduct risk. • Exposure to interest rate risk arising from non-trading book activities is medium to high. • The level of other operational risks not covered by Pillar 1 is medium to high. • There are deficiencies in the investment firm’s management and controls compared to its overall strategy and risk appetite, if relevant. • The organisational framework lacks clear allocation of responsibilities or dedicated management and control functions. • Measurement, monitoring and reporting systems are not sufficient or consistent enough, some risks are not properly monitored or reported. 4

There is a high risk of significant prudential impact on the investment firm considering the level of inherent risk and the management and controls. • The nature of activities implies high conduct risk. • Exposure to interest rate risk arising from non-trading book activities is high. • The level of other operational risks not covered by Pillar 1 is high.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 90 Title 7 SREP capital assessment 7.1 General considerations 266. Competent authorities should determine through the SREP capital assessment whether the own funds held by the investment firm provide sound coverage of risks to capital stemming from regulated and non-regulated businesses to which the investment firm is or might be exposed, or poses to others, if such risks are assessed as material to the investment firm. 267. Competent authorities should do this by determining and setting the amount of additional own funds the investment firm is required to hold to cover risks and elements of risks the investment firm is exposed to or poses to others, that are not covered or not sufficiently covered by Parts Three and Four of Regulation (EU) 2019/2033. Where necessary, competent authorities should determine additional own funds requirement to address deficiencies in investment firm’s governance and control mechanisms, internal models used for regulatory purposes, prudent valuation of the trading book, or to address the investment firms’ repeated failure to maintain adequate level of additional own funds guidance. Additional own funds requirement should be met by the investment firm at all times. 268. To address potential capital inadequacies, including in adverse conditions, competent authorities should take appropriate supervisory measures, including, where relevant, establishing and communicating guidance on additional own funds (P2G), which is the amount of capital the investment firm is expected to hold to ensure that cyclical economic fluctuations do not lead to a breach of own funds and additional own funds requirement or threaten the ability of the investment firm to wind down and cease activities in an orderly manner. 269. When setting the additional own funds requirement and, where relevant, P2G, competent authorities should: a. take into account any supervisory measures that the competent authority has applied or is planning to apply to an investment firm in accordance with Title 10 and having regard to paragraphs 291 to 293; b. clearly substantiate the decision to impose additional own funds requirement and guidance; c. apply additional own funds requirement and guidance in a consistent manner to ensure broad consistency of prudential outcomes across investment firms. 270. Competent authorities should assess the adequacy of the investment firm’s own funds and the impact of cyclical economic fluctuations thereon as a key determinant of the investment firm’s viability. This determination should be summarised and reflected in a score based on the criteria specified at the end of this title.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 91 271. Competent authorities should determine and set the additional own fundsrequirement and, where relevant, P2G in accordance with the minimum engagement model specified in Title 2. In particular, the minimum frequency with which such additional requirement and, where relevant, P2G are determined and set should follow the frequency of the capital adequacy assessment under the SREP minimum engagement model. 272. Competent authorities may determine any additional own funds requirement for small and non-interconnected investment firms, complying with the criteria of Article 12 of Regulation (EU) 2019/2033, when they deemed justified and on a case-by-case basis. Such small and non-interconnected investment firms are not subject to any P2G, pursuant to Article 41 of Directive (EU) 2019/2034. 7.2 Determining additional own funds requirement 273. Competent authorities should determine additional own funds requirement for material risks and elements of risks stemming from the investment firm’s activities, considering all situations listed in Article 40(1) of Directive (EU) 2019/2034, including: a. risks or elements of risks the investment firm is exposed to or poses to others are not covered or not sufficiently covered by adequate amounts, types and distribution of capital in accordance with Part Three or Four of Regulation (EU) 2019/2033; b. deficiencies in the investment firms’ arrangements, processes, mechanisms and strategies, if such deficiencies cannot be resolved within an appropriate timeframe; c. deficiencies in the investment firm’s adjustments in relation to the prudent valuation of the trading book enabling it to sell or hedge out its positions within a short period without incurring material losses under normal market conditions; d. investment firm’s non-compliance with the requirement for the application of the permitted internal models leading to inadequate levels of capital; and e. investment firm’s repeated failure to establish or maintain an adequate level of additional own funds, as set out in Article 41 of Directive (EU) 2019/2034. 274. The total amount of additional own funds requirement should be the sum of any additional own funds requirement determined by competent authorities covering all situations listed in the preceding paragraph. 7.2.1 Determining additional own funds to cover risks or elements of risks not covered or not sufficiently covered by Part Three or Four of Regulation (EU) 2019/2033 275. Competent authorities are required to set the level of additional own funds requirement to cover risks or elements of risks that are not covered or not sufficiently covered by Part Three and Four of Regulation (EU) 2019/2033 further specified by the delegated regulation adopted in accordance with Article 40(6) of Directive (EU) 2019/2034 and following the risk assessment performed under Title 6.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 92 276. Competent authorities should rely on the following sources of information for the identification, assessment, and quantification of such risks or elements of risks: a. for investment firms that do not meet the criteria for qualifying as small on non￾interconnected investment firm set out in Article 12(1) of Regulation (EU) 2019/2033, investment firms groups, and for investment firms that meet those criteria where the competent authority deems it appropriate, the ICARAP or the consolidated ICARAP in the case of an investment firm groups, and more specifically its ICAAP component, and the outcomes of its assessment by the competent authority, including the ICAAP calculations, where deemed reliable or partially reliable in accordance with paragraphs 279 to 282; b. for investment firms subject to Directive 2014/59/EU, the recovery plan and the outcomes of its assessment by the competent authority, considering requirements for the recovery plans applicable to the investment firm under review; c. supervisory reporting; d. the outcomes of the supervisory assessment and any benchmark calculations; e. the outcomes of any relevant previous supervisory activities; and f. any other relevant inputs, including those arising from interactions and dialogues with the investment firm, public market studies or sectoral and portfolio views. 277. As referred in paragraph 276, point (a), the ICAAP and outcomes of its assessment should be taken into account by competent authorities as one of key inputs for the identification and assessment of risks and elements of risks, stemming from both non￾regulated and regulated businesses, the investment firm is exposed to or poses to clients and markets. The quantification of the amount of capital considered adequate and eventually additional own funds requirement should take into account, among other inputs, the ICAAP calculations if deemed reliable or partially reliable. 278. As referred to in paragraph 276, point (b), where appropriate, the recovery plan and its assessment should be taken into account by competent authorities to support the determination of capital considered adequate to orderly wind-down, as further specified by means of the delegated regulation adopted in accordance with Article 40(6) of Directive (EU) 2019/2034. More specifically, the competent authority should use the recovery plan’s inputs to identify key business lines and critical functions, recovery actions, governance arrangements, operational steps, and scenarios. They may leverage on the scenarios used in the recovery plan by increasing their level of severity to achieve a wind-down scenario. ICAAP calculations 279. Competent authorities should assess whether the ICAAP is covering both: a. the risks or elements of risks the investment firm or the investment firm group is exposed to or poses to others stemming from its businesses and operations either regulated or non-regulated; and

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 93 b. the necessary steps and resources but also the risks or elements of risks that might arise from an orderly wind-down process. 280. Competent authorities should assess the reliability of the ICAAP calculations related to paragraph 279, points (a) and (b), by assessing whether they are sufficiently: a. consistent: the quantified risks should be commensurate with the business model, composition of the portfolio and trading strategy of the investment firm; b. granular: the ICAAP methodologies should allow the calculations to be broken down at least by risk category23, where possible broken-down risk-by-risk, rather than presenting a single (economic capital) calculation covering all risks; c. credible: the calculations/methodologies used should demonstrably cover the risks they are looking to address and should be based on the investment firm’s knowledge and experience, or, where applicable, on appropriate models and prudent assumptions; d. understandable: the underlying drivers of the calculations/methodologies should be clearly specified. A ‘black box’ calculation should not be acceptable; and e. comparable: competent authorities should consider the ICAAP’s risk measurement methodologies, adjusting, or requiring the investment firm to adjust them to facilitate comparability with peers and supervisory benchmark estimations. 281. Competent authorities should further assess the reliability of the ICAAP calculations by comparing them against the outcome of the supervisory benchmarks for the same risks or, if sufficiently comparable, the same risk categories, and other relevant inputs. 282. An ICAAP calculation should be considered partially reliable where, despite not meeting all the above criteria, the calculation still seems highly credible, though this should be on an exceptional basis and accompanied by steps to improve deficiencies identified in the ICAAP calculation. Supervisory benchmarks 283. Competent authorities should develop and apply risk-specific supervisory benchmarks as a means to challenge ICAAP calculations for those material risks, or elements of such risks, that are not covered or not sufficiently covered by Part Three and Four of Regulation (EU) 2019/2033, or to further support the determination of risk category-by-risk category and preferably of risk-by-risk additional own funds requirement where ICAAP calculations for those material risks, or elements of such risks, are deemed unreliable or are unavailable. 284. The supervisory benchmarks should be developed, taking into account the implementation burden on competent authorities, where prudent, consistent, transparent 23 Risk categories cover the risks associated to an orderly wind-down, risk-to-clients, risk-to-markets, risk-to-firms and other risks further specified by means of the delegated regulation adopted in accordance with Article 40(6) of Directive (EU) 2019/2034.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 94 and comparable measure can be provided to compare across investment firms the capital considered adequate for a given category or element of risk. 285. Given the variety of different business models operated by, size and complexity of investment firms, the outcome of the supervisory benchmarks may not be appropriate in every instance for every investment firm. Competent authorities should address this by using the most appropriate benchmark where alternatives are available, and by applying judgment to the outcome of the benchmark to account for business-model-specific and investment firm-specific considerations. 286. When competent authorities take supervisory benchmarks into consideration for the determination of additional own funds requirement, as part of the dialogue, they should explain to the investment firm the rationale and general underlying principles behind the benchmarks. Other relevant inputs 287. Competent authorities should use other relevant inputs to support the determination of risk category-by-risk category or risk-by-risk additional own funds requirement. Other relevant inputs may include peer-group comparisons, or other relevant reports and studies. 288. Other relevant inputs should prompt competent authorities to reassess the appropriateness/reliability of an ICAAP/benchmark calculation for a specific risk or category of risk, and/or make adjustments to the outcome, where they prompt doubts about its accuracy. 289. To ensure consistency in determining additional risk category-by-risk category or risk-by-risk own funds requirement, competent authorities should use the same peer groups established to analyse risks to capital as specified in Title 6. 290. When competent authorities take other relevant inputs into consideration for the determination of additional own funds requirement, as part of the supervisory dialogue, they should explain to the investment firm the rationale and general underlying principles behind the inputs used. 7.2.2 Determining own funds or other measures to cover deficiencies in models used for regulatory purposes 291. If, during the ongoing review of internal approaches pursuant to the requirements of Article 37 of Directive (EU) 2019/2034, competent authorities identify model deficiencies that could lead to underestimation of the minimum own funds requirements set out in Regulation (EU) 2019/2033, they should set additional own funds requirement for such deficiencies, where this is determined to be more appropriate than other supervisory measures, such as requiring investment firms to adjust their models. Such additional own funds requirement should only be set as an interim measure while the deficiencies are addressed. 7.2.3 Determining own funds or other measures to cover deficiencies in adjusting the prudent valuation of the trading book

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 95 292. If during their reviews pursuant to Article 36 of Directive (EU) 2019/2034, and following the risk assessment performed under Title 6, competent authorities identify deficiencies in the prudent valuation of the investment firm’s trading book positions that could lead to underestimation of the K-NPR requirement set out in Article 22 of Regulation (EU) 2019/2033, they should set additional own funds requirement to cover such deficiencies. Such additional own funds requirement should only be determined if more appropriate than any other supervisory measures and should be maintained only as an interim measure until the deficiencies are addressed. 7.2.4 Determining own funds or other measures to cover other deficiencies 293. Competent authorities should set additional own funds to cover deficiencies in governance arrangements, processes, mechanisms and strategies or other deficiencies – identified following the risk assessment outlined in Titles 4 to 6 – where other supervisory measures are considered insufficient or not appropriate to ensure compliance with requirements. Competent authorities should only set such additional own funds requirement as an interim measure while the deficiencies are addressed. 294. Where an investment firm that does not meet the conditions for qualifying as small and non-interconnected set out in Article 12(1) of Regulation (EU) 2019/2033, repeatedly fails to establish or maintain an adequate level of own funds to cover the guidance on additional own funds communicated in accordance with Article 41(1) of Directive (EU) 2019/2034, competent authorities should set additional own funds requirement to cover that additional risk not later than two years after the breach of guidance. Competent authorities may postpone that decision where they allow the investment firm to operate below the level of guidance due to cyclical economic fluctuations or other firm-specific circumstances. 7.3 Articulation and justification of own funds requirements 295. In determining additional own funds requirement in accordance with Article 40 (3) of Directive (EU) 2019/2034, at a time specified in paragraph 271, competent authorities should set: a. an absolute amount of additional own funds requirement as a result of the conclusion based on the SREP assessment; and b. the ratio of the absolute amount referred to in point (a) to the investment firm’s own funds requirement determined in accordance with Article 11 of Regulation (EU) 2019/2033 at the time of the setting of that absolute amount referred to in point (a) (“D”) in accordance with the following formula: 𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴 𝑎𝑎𝑎𝑎 𝑎𝑎 𝑜𝑜 𝑎𝑎𝑎𝑎𝑎𝑎𝑎𝑎 𝑎𝑎 𝑎𝑎𝑎𝑎 𝑜𝑜 𝑟𝑟 𝐷𝐷 296. Competent authorities should ensure that the applicable additional own funds requirement should at all times be equal to the higher of the absolute amount referred to in paragraph 295, point (a) or, the amount of additional own funds requirement necessary to maintain, in cases where D is increasing and until a new absolute amount is being set as

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 96 a result of the conclusion of the SREP assessment by competent authorities, the ratio referred to paragraph 295, point (b). 297. When communicating the prudential requirements to investment firms, competent authorities should substantiate their decision to impose additional own funds requirement giving a clear account of the full assessment of the elements listed in paragraph 273 in accordance with Article 40(5) of Directive (EU) 2019/2034. The justification should be investment firm-specific and should provide a clear indication of the main drivers underlying the additional own funds requirement, including the risks and elements of risks contributing to such additional own funds requirement. In justifying additional own funds requirement competent authorities should refer to all relevant risk categories, i.e. risks associated to an unorderly wind-down, risk-to-clients, risk-to-markets, risk-to firms and other risks. 298. In the justification of additional own funds requirement pursuant to paragraph 273, points (b) to (d), competent authorities should also identify the main deficiencies to be covered by these requirements until they are addressed, in line with paragraphs 291 to 293. Taking into consideration appropriate supervisory measures in accordance with Title 10, competent authorities should request investment firms to identify appropriate actions to rectify these deficiencies and communicate expected timelines for rectifying the deficiencies. 7.4 Meeting requirements under cyclical economic fluctuations 299. For investment firms that do not meet the conditions for qualifying as small and non‐ interconnected investment firms set out in Article 12(1) of Regulation (EU) 2019/2033, competent authorities should determine the adequacy of the investment firm’s own funds in case of adverse cyclical economic fluctuations and whether supervisory measures, including guidance on additional own funds (P2G), revised capital planning and other measures as set out in Title 10, are necessary to address potential inadequacies. 300. When considering adverse cyclical economic fluctuations, competent authorities should assess how risks or elements of risks the investment firms pose to others or are exposed to may evolve over multi-year period, taking into account the investment firm’s business cycle. The level of details of this assessment should vary depending on the complexity of the business model and risk profile of the investment firm. 301. To assess capital adequacy in case of adverse cyclical economic fluctuations, competent authorities should consider the qualitative and quantitative outcomes of: a. where available, supervisory stress tests or sensitivity analyses; b. where available and sufficiently reliable on the basis of the assessment conducted in Title 5, investment firms’ stress tests or sensitivity analyses; or c. other assessment of cyclical economic fluctuations performed by competent authorities, or by the investment firm on the basis of the assessment conducted in Title 5, if considered sufficiently reliable; or

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 97 302. Based on the assessment pursuant to paragraph 301, competent authorities should determine whether the investment firm’s own funds are sufficient to cover applicable own funds requirements, including additional own funds requirement, under adverse cyclical economic fluctuations. 7.4.1 Determining and setting P2G 303. Competent authorities should determine P2G as specified in this section, and at a time specified in paragraph 271. Where the determination leads to a positive value, they should set P2G to address supervisory concerns about the sensitivity of the investment firm to adverse cyclical economic fluctuations. 304. P2G is the amount of capital considered adequate that should be set to allow for cyclical economic fluctuations while protecting against any potential breach of relevant own funds requirements in accordance with Article 9 of Regulation (EU) 2019/2033 and additional own funds requirement calculated in accordance with Article 39(2), point (a) of Directive (EU) 2019/2034 and against any threat to the ability of the investment firm to orderly wind￾down. Where competent authorities conclude the investment firm is not concerned by such impediments under adverse economic conditions, competent authorities may decide not to set P2G. 305. Competent authorities should determine and set P2G based on the outcomes of the assessment of cyclical economic fluctuations in line with paragraph 301. Such analyses should take into account the investment firm’s strategy and business model, as well as the environment in which it is operating, asthe basis to identify vulnerabilities and risks of harm at investment firm’s level, and reflect relevant economic fluctuations that may be system￾wide as wide spread disruption to the provision of financial services caused by an impairment of a large part of the financial system or wide spread volatility across asset prices or specific to the investment firm’s business model as shock specific to the nature and duration of financial instruments the investment firm is trading) over a forward looking horizon. 306. For the purpose of paragraph 305, competent authorities should ensure that the analyses conducted for the setup of the P2G adequately cover: a. all the material risks contributing to the additional own funds requirement set out in accordance with Article 39(2), point (a) of Directive (EU) 2019/2034; and b. situations where the investment firm incurs material losses impeding the run of its businesses or where it may have to cease activities in an orderly manner. 307. Competent authorities should generally not use P2G to cover aspects of risks that should be covered by additional own funds requirement in accordance with Section 7.2 of these guidelines. 308. When determining the size of P2G, competent authorities should ensure that it is set at a level appropriate to cover the maximum anticipated variations of the investment firm’s CET1 and ensure coverage of applicable own funds requirements.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 98 309. When determining the size of P2G, competent authorities should consider, where relevant, the following factors: a. where P2G is determined based on stress tests, the time when the maximum stress impact occurs in relation to the starting point and time horizon of the scenarios used in the stress tests; b. the outcome of a reliable investment firm’s internal stress test or sensitivity analysis of the investment firm, taking into account the specific scenario definitions and assumptions, in particular where they are deemed more relevant for the business model and risk profile of the investment firm or where the internal scenarios are more severe than the supervisory scenarios, where such supervisory scenarios are available; c. relevant management mitigating actions of the investment firms if sufficiently credible and highly certain following their supervisory assessment; d. information about and supervisory views on the relevance of supervisory or investment firm’s own stress tests or sensitivity analyses to the investment firm's strategy, financial plans and business model; e. reduced certainty on the actual sensitivity of the investment firm to adverse scenarios; f. any potential overlaps with the applicable additional own funds requirement; g. whether or not the investment firm is under restructuring or resolution. 310. Without prejudice to paragraph 271, competent authorities should timely review the level of the P2G if such level is deemed inaccurate based on all relevant information available to the competent authorities. They should at least assess whether the existing P2G level remains appropriate and revise it if necessary, whenever the qualitative and quantitative outcomes referred to in paragraph 305 display significant changes as compared to the analysis used previously for setting the P2G. 311. P2G set by competent authorities is additional to the highest component of own funds requirements in accordance with Article 11 of Regulation (EU) 2019/2033 and to the additional own funds requirement set out in accordance with Article 39(2), point (a) of Directive (EU) 2019/2034. 7.4.2 Communication and composition of P2G 312. Where P2G is set or updated, competent authorities should communicate to the investment firm its level and the relevant time limits for its establishment in accordance with paragraph 316 316. Competent authorities should also explain the potential supervisory reaction to situations where P2G is not met. 313. In case of a review in accordance with paragraph 310310, where supervisory reviews in accordance with Article 36 of Directive (EU) 2019/2034 are not carried out, competent authorities should communicate the new level of P2G.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 99 314. Competent authorities should communicate to investment firms that P2G is expected to be met with CET1 eligible own funds and that P2G is expected to be incorporated into their capital planning and risk management frameworks, including the risk appetite framework and, where applicable, recovery planning. 315. Competent authorities should also communicate to investment firms that own funds held for the purposes of P2G cannot be used to meet other own funds requirements. 316. When setting and communicating to the investment firm time limits to establish P2G, competent authorities should consider at least the following: a. whether or not an investment firm is under the restructuring or resolution; and b. the potential implications that CET1 denominated P2G may have for other parts of the capital requirements and the ability of investment firms to issue additional Tier 1 (AT1) or Tier 2 (T2) instruments. 7.4.3 Capital planning and other supervisory measures to address capital adequacy in stressed conditions Capital planning 317. When the quantitative outcomes referred to in Section 7.4 indicate that, under the given adverse scenarios, an investment firm will not be able to meet the applicable capital requirements, competent authorities should require the investment firm to submit a credible capital plan that addresses the risk of not meeting its applicable capital requirements. 318. To determine the credibility of the capital plan, the competent authority should consider, as appropriate: a. whether the capital plan covers the entire assumed adverse time horizon; b. whether the capital plan put forward a set of credible mitigating and management actions; c. whether the investment firm is willing and able to take such actions in order to address the breaches of the applicable capital requirements under adverse conditions; d. whether those mitigating and management actions are subject to any legal or reputational constraints; e. the probability that mitigating and management action would enable the investment firm to fully meet its applicable capital requirements within an appropriate timeframe; f. whether the proposed actions are broadly in line with macroeconomic considerations and with known future regulatory changes affecting an investment firm within the scope and timeline of the assumed adverse scenarios; and

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 100 g. where applicable, the range of recovery options and their analysis as set out in the investment firm’s recovery plan. 319. When assessing capital plans, competent authorities should, where appropriate, following an effective dialogue with the investment firm, require it to make changes to those plans as appropriate, including to the proposed management actions, or require investment firms to take additional mitigating actions that would become relevant given the scenarios and current macroeconomic conditions. 320. Competent authorities should expect investment firms to implement the revised capital plan, including further changes made based on the results of the supervisory assessment and supervisory dialogue. Additional supervisory measures 321. Competent authorities should, where relevant, consider the application of additional supervisory measures specified in Title 10, to ensure that the investment firm is adequately capitalised under adverse conditions. 322. In particular, where the quantitative outcomes of the stress tests or sensitivity analyses indicate that the investment firm is likely to breach its applicable capital requirements under the adverse scenario within the following 12 months, competent authorities should, where appropriate, treat such information as one of the possible circumstances within the meaning of Article 38, point (b) of Directive (EU) 2019/2034. In such cases, the competent authorities should apply appropriate measures in accordance with Article 39(2) of Directive (EU) 2019/2034 aimed at ensuring sufficient levels of own funds. In particular, when such measures relate to capital, competent authorities should in particular consider one or both of the following, as defined in Article 39(2), points (a) and (f): a. requiring investment firms to hold an appropriate amount of additional own funds in the form of a nominal amount, considering the outcome of the SREP assessment; b. requiring a reduction of the inherent risk in the activities, products and systems of the investment firm. 7.5 Summary of findings and scoring 323. Following the above assessment, competent authorities should form a view on whether existing own funds resources provide sound coverage of the risks to which the investment firm is or may be exposed. This view should be reflected in a summary of findings, accompanied by a viability score based on the considerations specified in Table 9. Table 9 - Supervisory considerations for assigning a score to capital adequacy

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 101 Score Supervisory view Considerations 1 The amount of own funds held pose a low level of risk to the viability of the investment firm. • The investment firm is able to comfortably meet its P2G with available CET1 capital, where applicable. • The investment firm holds a level of own funds comfortably above its own funds and additional own funds requirement and is expected to do so in the future. • The assessment of cyclical economic fluctuations, including if applicable stress testing or sensitivity analyses, do not reveal any discernible risk regarding the impact of cyclical economic fluctuations on own funds. • The investment firm has a plausible and credible capital plan that has the potential to be effective if required. 2 The amount of own funds held pose a medium-low level of risk to the viability of the investment firm. • The investment firm has difficulty meeting its P2G with its available CET1 capital. Management mitigating actions to address this difficulty are assessed as credible and efficient. • The assessment of cyclical economic fluctuations, including if applicable stress testing or sensitivity analyses, reveal a low level of risk regarding the impact of cyclical economic fluctuations on own funds, but management actions to address this are assessed as credible and efficient. • The investment firm has a plausible and credible capital plan that, although not without risk, has the potential to be effective if required. 3 The amount of own funds held pose a medium-high level of risk to the viability of the investment firm. • The investment firm does not meet its P2G with available CET1 capital. There are concerns about the credibility and effectiveness of management mitigating actions to address this. • The assessment of cyclical economic fluctuations, including if applicable stress testing or sensitivity analyses, reveal a medium level of risk regarding the impact of cyclical economic fluctuations on own funds. Management actions may not credibly and effectively address this. • The investment firm has a capital plan that is unlikely to be effective. 4 The amount of own funds held pose a high level of risk to the viability of the investment firm. • The investment firm does not meet its P2G (or deliberately has not established P2G) with available CET1 capital and will not be able to do so in the foreseeable future. Management mitigating actions to address this are assessed as neither credible nor effective. • The assessment of cyclical economic fluctuations, including if applicable stress testing or sensitivity

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 102 Score Supervisory view Considerations analyses, reveal that the investment firm would breach its additional own funds requirement due to cyclical economic fluctuations. Management actions will neither credibly nor effectively address this. • The investment firm has no capital plan, or one that is manifestly inadequate.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 103 Title 8 Assessing risk to liquidity 8.1 General considerations 324. Competent authorities should assess and score the risks to liquidity that have been identified as material for the investment firm, and the management and controls of these risks by the investment firm. 325. The formality and granularity of the assessment should depend on the investment firm’s size, the structure and the internal organisation of the investment firm and the nature, scope and complexity of its activities as well as its risk to clients, risk to market and risk to the investment firm. For the investment firms that do not deal on own account the assessment should be less comprehensive, whereas for investment firms that deal on own account the assessment should be granular and more comprehensive. 326. Investment firms which deal on own account should conduct liquidity assessment, including intra-day, in accordance with Article 29(1), point (d) of Directive (EU) 2019/2034. Competent authorities should therefore assess investment firms which engage into market making activity as defined in Article 2(1), point (k) of Regulation (EU) No 236/2012 comprehensively and assess whether such investment firms cover elements that are relevant for them, such as the assessment of intraday liquidity risk and adequacy of available liquid resources. 327. Competent authorities should verify the investment firm’s compliance with the minimum liquidity requirements specified in Regulation (EU) 2019/2033 and Directive (EU) 2019/2034. Competent authorities should extend the scope of the assessment in order to form a comprehensive view on the liquidity risk. 328. In conducting the assessment of risk to liquidity, competent authorities should consider all of the following sources of information, where available: a. outcomes from the analysis of the services and activities provided by the investment firm and information from the monitoring of key indicators’ particularly where that may help with understanding the key sources of risk to liquidity; b. supervisory reporting, and particularly the information provided by the investment firm in its reporting pursuant to Article 54 of Regulation (EU) 2019/2033; c. any investment firm’s periodic report, quantitative report, financial statement report, internal reports such as the management reports on liquidity and any other information requested from the investment firm by the competent authority;

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 104 d. any information from the investment firm’s parent if the investment firm is a subsidiary and is included in the supervision on a consolidated basis, and in particular information on liquidity risk of investment firms that are part of a banking group; e. outcomes of any supervisory activities; f. any information from the investment firm’s ILAAP; g. findings and observations from internal or external audit reports; h. recommendations and guidelines issued by the EBA or ESMA as well as warnings and recommendations issued by macro-prudential authorities or the ESRB; and i. risk identified in other investment firms operating a similar business model. 329. The assessment of liquidity risk should be based on reliable and up-to-date information, and the results should be taken into account when performing the assessment of the liquidity risk management process. 330. Competent authorities should reflect the outcome of the assessment of liquidity risk in a summary of findings that provides an explanation of the main risk drivers and a score. 8.2 Assessing liquidity risk 331. Competent authorities should evaluate the impact on liquid assets under severe, but plausible conditions and how the investment firm is ready to mitigate the stressed outflows in accordance with the liquidity risk management framework referred to in Section 8.4 of these guidelines. 332. Competent authorities should assessthe amount of liquid assets needed to ensure that the investment firm maintains adequate levels of liquid resources addressing material sources to risk of the investment firm, including risk to clients, risk to market, and risk to the investment firm under both normal and severe, but plausible conditions to cover idiosyncratic, market-wide and combined shocks. 333. In evaluating the impact of severe, but plausible conditions on the investment firm’s liquidity needs, competent authorities should assess all material sources of liquidity risk, including risk to clients, risk to market and risk to the investment firm as well as liquid resources needed for the potential investment firm’s orderly wind-down. In particular, competent authorities should assess all of the following: a. if the investment firm holds clients’ assets or money and its ability to return such assets in a timely manner under severe but plausible scenarios;

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 105 b. if the investment firm assesses its liquidity needs for its other off-balance sheet activities taking into account that the contingent nature of off-balance-sheet instruments adds complexity to the management of related cash flows; c. other potential sources of cash outflows including swaps, written or sold over the counter (OTC) options, other interest rate contracts, forward foreign exchange rate contracts, margin calls, and early termination agreements; d. if there are difficulties in accessing certain markets; e. if the foreign currency markets may lack liquidity; f. if the foreign exchange rate may depreciate sharply when the investment firm conducts transactions in foreign exchange at significant scale; and g. if the investment firm which leverages its positions is exposed to liquidity risk because of the risk of decrease in the market value of a position that would trigger the need for additional collateral or margin that would require to quickly liquidate its positions. Evaluation of intraday liquidity risk 334. For investment firms that deal on own account, competent authorities should assess if the investment firm has a sufficient level of high-quality liquid assets and other liquidity inflows to cover liquidity outflows on a daily basis, including intraday period. Competent authorities should assess investment firms that engage into market making activity more comprehensively. However, it should take into consideration any liquidity risk mitigation provided by clearing transactions via a clearing member. 335. Competent authorities should base their assessment on the investment firm’s analysis of intraday liquidity risk in accordance with Article 29(1), point (d) of Directive (EU) 2019/2034. Intraday liquidity should be assessed under normal and severe but plausible conditions. 336. For the purposes of the intraday liquidity risk assessment, competent authorities should assess if the investment firm clears its positions via clearing members or operates in an over-the-counter market. If the investment firm is guaranteed by a clearing member or any other party, the competent authority should assess the effectiveness of the guarantees in mitigating liquidity risk. 337. For the assessment of liquidity needs under normal conditions and the evaluation of intraday liquidity risk, competent authorities should support the analysis with evidence from the investment firm’s internal reports and information, and from supervisory reporting data as specified in the implementing regulation adopted in accordance with Article 54(3) of Regulation (EU) 2019/2033.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 106 338. Competent authorities should assess the investment firm’s exposure to intraday liquidity risk, including the intraday availability of liquid assets. Competent authorities should assess whether daily settlement requirements will be met including an evaluation of available intraday liquidity or of accessible liquidity under normal conditions as well as during financial or operational events that may affect liquidity access such as IT failures, legal constraints on the transfer of funds or trading counterparties’ default. Evaluation of available liquid resources 339. For investment firms which are market makers as defined in Article 2(1), point (k) of Regulation (EU) No 236/2012, competent authorities should assess available liquid resources. Competent authorities should perform similar assessments on investment firms that do not qualify as market makers to the extent that the competent authorities deem it to be appropriate. 340. Competent authorities should assess the adequacy of the liquidity resources of investment firms that are market makers necessary to meet its liquidity needs over different time horizons, including intraday. This assessment should take into account all of the following criteria: a. the liquid assets available in a timely manner for the investment firm’s viability under normal and severe but plausible conditions; b. the overall liquid assets available to the investment firm over the full period of the relevant severe, but plausible conditions; c. the characteristics of different severe, but plausible conditions, such as severity and duration, and periods considered in the evaluation of the investment firm’s liquidity needs; d. the amount of assets that would need to be liquidated over the relevant time horizons; and e. whether the actual liquid resources, including the quality of liquid assets, are in line with the investment firm’s liquidity risk; f. the availability and magnitude of liquidity resources provided by a clearing member. 341. Competent authorities should assess the ability of investment firms that are market makers to monetise its liquid assets in a timely manner in order to meet its liquidity needs during a stress period. Competent authorities should take into account all of the following criteria: a. whether the investment firm tests its market access by selling or repoing on a periodic basis;

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 107 b. whether there are high concentrations that may represent a risk of wrongly anticipated liquid resources; c. whether the liquidity resources are readily available and under the control of the relevant staff; d. whether the denomination of the liquid assets is consistent with the distribution of liquidity needs by currency; e. where the investment firm has borrowed liquid assets, whether it would no longer have them available to meet its outflows under severe but plausible conditions considering the net effect of the transaction; and f. the reliability of the committed liquidity facilities if they are used by the investment firm. Evaluation of funding 342. When assessing the risk to liquidity competent authorities should assess the investment firm’s funding arrangements and stability of funding sources under both normal and severe, but plausible conditions. 343. Competent authorities should assess the appropriateness of the investment firm’s funding profile taking into account all of the following criteria: a. whether the investment firm’s obligations are adequately met with stable funding; b. whether – in the case the investment firm belongs groups – there are regular intragroup flows of liquidity and whether they are mandated by contracts and are still in effect; and c. whether the investment firm has access to credit facilities from a credit institution or another group entity or other alternative funding sources. 344. Competent authorities should assess the diversity of funding sources. The assessment should consider if funding is secured or unsecured, such as the use of repurchase agreements, securities lending markets, issuance of long-term debt in the public and private markets, a variety of short-term funding instruments such as bank loans, and, where relevant, the diversity of regional markets. 345. Competent authorities should assess whether potential shortcomings arising from the investment firm’s funding profile, such as inflows and outflows mismatches in market activities breaching acceptable boundaries, or excessive concentrations of funding sources, could lead to liquidity risk. Competent authorities should assess the level of investment

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 108 firm’s reliance on particular funding sources based on investment services, nature and provider of the funds. 346. Competent authorities should consider factors that may reduce the stability of the funding in relation to the type and characteristics of both assets and liabilities. 347. Competent authorities should assess risk to the sustainability of the investment firm’s funding profile arising from concentrations in funding sources. They should take into account whether the investment firm’s counterparties are single or connected and other concentration risk that may affect the investment firm’s access to funding in the future. The assessment should include reliability of the investment firm’s alternative funding strategies, and their adequacy to protect the firm. 8.3 Assessing liquidity risk management 348. Competent authorities should assess the investment firm’s liquidity risk management framework. For smaller and less complex investment firms this assessment should be streamlined to avoid excessive burden on the authority as well as on the investment firm. Organisational framework, policies and procedures 349. Competent authorities should assess whether the investment firm has an effective liquidity risk management framework which enables the firm to identify how it is exposed to liquidity risk. Competent authorities should assess whether the investment firm has established a sound liquidity risk management and controls systems, which enable the investment firm to monitor the effectiveness of its liquidity, level of liquidity risk and compliance with established policies and procedures. 350. The framework should be proportional to the size, structure and internal organisation of the investment firm and the nature, scope and complexity of its activities, as well as its risk to clients, risk to market and risk to the investment firm. For investment firms that do not deal on own account, the liquidity risk management framework may not need to be separated from other risk-related policies and procedures. 351. Competent authorities should assess whether the investment firm’s risk management framework considers how the investment firm is able to identify liquid assets shortfalls before stressed conditions occur. 352. Competent authorities should assess whether the investment firm’s strategies focus on ensuring the ability of the investment firm to continue to operate and pursue new business opportunities through all market environments for an extended period without immediacy liquidating assets or raising additional funding. 353. When assessing the framework, policies and procedures for liquidity risk management, competent authorities should take into account all of the following criteria: a. whether the management body approves policies for managing liquidity risk and discusses and reviews them regularly;

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 109 b. whether senior management is responsible for developing and implementing the policies and procedures for managing liquidity risk; c. whether senior management ensures that the decisions of the management body are implemented and actively monitored; d. whether the liquidity risk management framework is internally coherent and ensures ILAAP, where available, is comprehensive, and is well integrated into the investment firm’s wider risk management framework; and e. whether the policies and procedures are properly defined, formalised and effectively communicated throughout the investment firm. 354. Competent authorities should assess whether the investment firm has an appropriate organisational framework for liquidity risk management, measurement and control functions. Competent authorities should take into account all of the following criteria: a. whether the liquidity risk control and monitoring systems and processes are controlled by independent control functions; and b. whether the risk management, measurement and control functions cover liquidity risk in the investment firm, and in particular all areas where liquidity risk can be taken, mitigated or monitored. Liquidity risk internal control framework 355. Competent authorities should assess whether the investment firm has a strong and comprehensive control framework and sound safeguards to mitigate or limit its liquidity risk. The liquidity control framework and the safeguard mechanisms may be separated from other risks’ control frameworks or mechanisms. When assessing such frameworks and mechanisms, the competent authorities should take into account all of the following criteria: a. whether the limit and control framework is adequate for the investment firm’s complexity, size and business model and reflects the different material drivers of liquidity risk, such as maturity mismatches, currency mismatches, derivatives transactions, off-balance sheet items and intraday liquidity risk; b. whether the investment firm has implemented adequate limits and monitoring systems that are consistent with its liquidity risk appetite; c. whether the risk limits are regularly reviewed by the competent bodies or control function of the investment firm and clearly communicated inside the firm; d. whether there are clear and transparent procedures regarding how compliance with individual liquidity risk limits is monitored and how limit breaches are handled (including clear escalation and reporting procedures); and

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 110 e. whether the limit and control framework helps the investment firm to ensure the availability of sufficient liquid assets. 8.4 Summary of findings and scoring 356. Following the above assessment, competent authorities should form a view on the investment firm’s liquidity risk. This view should be reflected in a summary of findings, accompanied by a risk score based on the considerations specified in Table 10. Table 10. Supervisory considerations for assigning a score to liquidity risk Risk score Supervisory view Considerations in relation to inherent risk Considerations in relation to adequate management and controls 1

There is a low risk of significant prudential impact on the investment firm considering the level of liquidity risk and the management and controls. • There is non-material/very low risk. • The size and composition of the liquid asset is adequate and appropriate. • The level of other drivers of liquidity risk (including reputational risk, inability to transfer intragroup liquidity) is not material/very low. • There is non-material/very low risk from the investment firm’s funding profile or its stability. • Other drivers of liquidity risk (including reputational risk) are not material/very low. • There is consistency between the investment firm’s liquidity risk management framework and its overall strategy and risk appetite. • Liquidity risk management and control systems are appropriate and in line with the investment firm’s risk management strategy and risk appetite. 2

There is a medium￾low risk of significant prudential impact on the investment firm considering the level of liquidity risk and the management and controls. • Mismatches (between maturities, currencies) entail low to medium risk. • The risk posed by the size and composition of the liquidity buffer is low to medium. • The level of other drivers of liquidity risk (including reputational risk, inability to transfer intragroup liquidity) is low to medium. • The risk posed by the investment firm’s funding profile and its stability is low to medium. • Other drivers of liquidity risk (including reputational risk) are low to medium.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 111 3 There is a medium￾high risk of significant prudential impact on the investment firm considering the level of liquidity risk and the management and controls. • Mismatches (including between maturities, currencies) entail medium to high risk. • The risk posed by the size and composition of the liquid assets is medium to high. • The level of other drivers of liquidity risk (including reputational risk, inability to transfer intragroup liquidity) is medium to high. • The risk posed by the investment firm’s funding profile and its stability is medium to high. • Other drivers of liquidity risk (including reputational risk) are medium to high. 4 There is a high risk of significant prudential impact on the investment firm considering the level of liquidity risk and the management and controls. • Mismatches (including between maturities, currencies) entail high risk. • The risk posed by the size and composition of the liquid assets is high. • The level of other drivers of liquidity risk (including reputational risk, inability to transfer intragroup liquidity) is high. • The risk posed by the investment firm’s funding profile and its stability is high. • Other drivers of liquidity risk (including reputational risk) are high.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 112 Title 9. Determination of the outcome of liquidity assessment 9.1 General considerations 357. Competent authorities should use the assessment under Title 8 to identify and assess current and future liquidity risk that the investment firm faces or may face and how the investment firm is able to mitigate those risk. 358. Competent authorities should conduct the SREP liquidity assessment process using the following steps: a. overall assessment of investment firm’s liquidity; b. determination of the need for specific liquidity measures based on the delegated regulation adopted in accordance with Article 42(6) of Directive (EU) 2019/2034; c. determination of the liquidity score. 9.2 Overall assessment of liquidity risk 359. To assess whether the liquidity held by an investment firm provides appropriate coverage of risk to liquidity, competent authorities should use all of the following sources of information: a. the outcomes of the assessment of liquidity risk; b. the investment firm’s ILAAP, where available; and c. other relevant inputs such as information from on-site inspections, AML/CFT supervisors peer group analysis or stress testing, internal risk management reports and ad-hoc reports requested by the competent authorities, where available. 360. For the outcome of the assessment of liquidity risk, competent authorities should take into account the findings regarding all of the following aspects: a. risk of liquidity not covered by liquidity requirements specified in Regulation (EU) 2019/2033, including, where relevant, intraday liquidity risk; b. other risks not adequately covered and measured by the investment firm, as a result of underestimation of outflows, overestimation of inflows, overestimation of the liquid assets or unavailability from an operational point of view of liquid assets, such as assets not available for sale and assets that are readily available; c. specific concentration funding by counterparties or product/type; and

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 113 d. other relevant outcomes of the supervisory liquidity stress tests. 361. When assessing the investment firm’s ILAAP framework, competent authorities should assess whether ILAAP calculations are credible. Calculations used by investment firms should be considered credible where they properly cover the risks they are looking to address. Calculations should be considered understandable where there is a clear breakdown and summary of the underlying components of the ILAAP calculations. 362. Competent authorities should translate this overall assessment into a liquidity and funding score, which should reflect the view of competent authorities on the threats to the investment firm’s viability that may arise from risk to liquidity. 9.3 Determining the need for specific liquidity requirements 363. When competent authorities determine specific liquidity requirement in accordance with Article 42 of Directive (EU) 2019/2034, they should decide on the application of quantitative requirements, as covered under this title, or on the application of qualitative requirements, as covered under Title 10 of these guidelines. 364. To determine the quantitative requirement, competent authorities should require an amount of liquid assets in accordance with the delegated regulation adopted in accordance with Article 42(6) of Directive (EU) 2019/2034 that mitigates the identified shortcomings. 9.4 Summary of findings and scoring 365. Following the above assessment, competent authorities should form a view on whether existing liquidity resources provide sound coverage of the risk to which the investment firm is or may be exposed. This view should be reflected in a summary of findings, accompanied by a score based on the considerations specified in Table 11. Table 11. Supervisory considerations for assigning a score to liquidity adequacy Score Supervisory view Considerations 1 The investment firm's liquidity position and funding profile pose no significant risk to the viability of the investment firm. • The investment firm’s liquidity is above specific supervisory quantitative requirements and are expected to remain so in the future. • The composition and stability of funding pose no discernible risk in relation to the activities and business model of the investment firm. • The free flow of liquidity between entities in the group, where relevant, is not impeded, or all entities have a counterbalancing capacity and liquidity above supervisory requirements. 2 The investment firm's liquidity position or funding profile pose a low level of risk to the viability of the investment firm. • The investment firm’s liquidity is above the specific supervisory quantitative

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 114 requirements, but there is a risk that they will not remain so. • The composition and stability of funding pose a low level of risk in relation to the activities and business model of the investment firm. • The free flow of liquidity between entities in the group, where relevant, is or could be marginally impeded. 3 The investment firm's liquidity position or funding profile pose a medium level of risk to the viability of the investment firm. • The investment firm’s liquidity is deteriorating and/or are below specific supervisory quantitative requirements, and there are concerns about the investment firm’s ability to restore compliance with these requirements in a timely manner. • The composition and stability of funding pose a medium level of risk in relation to the activities and business model of the investment firm. • The free flow of liquidity between entities in the group, where relevant, is impeded. 4 The investment firm's liquidity position or funding profile pose a high level of risk to the viability of the investment firm. • The investment firm’s liquidity is rapidly deteriorating or is below the specific supervisory quantitative requirements, and there are serious concerns about the investment firm’s ability to restore compliance with these requirements in a timely manner. • The composition and stability funding pose a high level of risk in relation to the activities and business model of the investment firm. • The free flow of liquidity between entities in the group, where relevant, is severely impeded.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 115 Title 10 Overall SREP assessment and application of supervisory measures 10.1 General considerations 366. This title covers the combination of the findings of the assessments of the SREP elements into the overall SREP assessment. It also addresses the application by competent authorities of supervisory measures to address deficiencies identified through the assessment of the SREP elements. Competent authorities may apply supervisory measures as specified in Directive (EU) 2019/2034 (Articles 38, 39, 40, 41 and 42) and national law, and, where applicable, early intervention measures as specified in Article 27 of Directive 2014/59/EU, or any combination of the above. 367. Competent authorities should exercise their supervisory powers on the basis of deficiencies identified during the assessments of the individual SREP elements and taking into account the overall SREP assessment, including the score, considering the following: a. the materiality of the deficiencies/vulnerabilities and the potential prudential impact of not addressing the issue (i.e. whether it is necessary to address the issue with a specific measure); b. whether the measures are consistent with/proportionate to their overall assessment of a particular SREP element (and the overall SREP assessment); c. whether supervisory or other administrative measures are needed to address prudential deficiencies/vulnerabilities related to ML/TF risks within their supervisory remit after having liaised with the relevant AML/CFT supervisors; d. whether the deficiencies/vulnerabilities have already been addressed/covered by other measures; e. whether other measures would achieve the same objective with less of an administrative and financial impact on the investment firm; f. the optimal level and duration of application of the measure to achieve the supervisory objective; and g. the possibility that risks and vulnerabilities identified may be correlated or self￾reinforcing, or both, meriting an increase in the rigorousness of supervisory measures. 368. When applying supervisory measures to address specific deficiencies identified in the assessment of SREP elements, competent authorities should take into account overall quantitative own funds and liquidity requirements to be applied based on the criteria specified in Titles 7 and 9.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 116 369. When applying supervisory measures or sanctions to address prudential deficiencies related to ML/TF risk, competent authorities should engage with AML/CFT supervisors so that the underlying deficiencies/vulnerabilities are adequately addressed by the appropriate measures within the respective remit of AML/CFT supervisors and competent authorities from their respective perspectives. 370. Competent authorities may take immediate supervisory measures directly linked to the outcomes of any supervisory activities. 10.2 Overall SREP assessment 371. In determining the overall SREP assessment, competent authorities should consider the findings of the assessments of the SREP elements, specifically: a. the risks to which the investment firm is or may be exposed; b. the likelihood that the investment firm’s governance, control deficiencies and/or business model or strategy are likely to exacerbate or mitigate these risks, or expose the investment firm to new sources of risk; c. whether the investment firm’s own funds and liquidity resources provide sound coverage of these risks; and d. the potential for positive and negative interaction between the elements (notably competent authorities may consider a strong capital position as a potential mitigating factor for certain concerns identified in the area of liquidity and funding, or by contrast, that a weak capital position may exacerbate concerns in that area). 372. On the basis of these considerations, competent authorities should determine the investment firm’s viability, defined as its proximity to a point of non-viability on the basis of the adequacy of its own funds and liquidity resources, governance, controls and/or business model or strategy to cover the risks to which it is or may be exposed. 373. On the basis of this determination, competent authorities should: a. take any supervisory measures necessary to address concerns; b. determine future supervisory resourcing and planning for the investment firm, including whether any specific supervisory activities should be planned for the investment firm; c. where applicable, determine the need for early intervention measures as specified in Article 27 of Directive 2014/59/EU; and d. determine whether the investment firm can be considered to be ‘failing or likely to fail’.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 117 374. The overall SREP assessment should be reflected in a viability score based on the considerations specified in Table 12 and clearly documented in a summary of the overall SREP assessment. This annual summary should also include the overall SREP score and scores for elements of the SREP, and any supervisory findings made over the course of the previous 12 months. Table 12. Supervisory considerations for assigning the overall SREP score Score Supervisory view Considerations 1 The risks identified pose a low level of risk to the viability of the investment firm. • The investment firm’s business model and strategy do not raise concerns. • The internal governance and investment firm-wide control arrangements do not raise concerns. • The investment firm’s risks to capital and liquidity pose a non-material/a very low risk of a significant prudential impact. • The composition and quantity of own funds held do not raise concerns. • The investment firm’s liquidity position and funding profile do not raise concerns. • Where relevant, no material concerns about the credibility and feasibility of the investment firm’s recovery plan including its overall recovery capacity. 2 The risks identified pose a medium-low level of risk to the viability of the investment firm.

• There is a low to medium level of concern about the investment firm’s business model and strategy. • There is a low to medium level of concern about the investment firm’s governance or investment firm-wide control arrangements. • There is a low to medium level of risk of a significant prudential impact caused by risks to capital and liquidity. • There is a low to medium level of concern about the composition and quantity of own funds held. • There is a low to medium level of concern about the investment firm's liquidity position and/or funding profile. • Where relevant, there is a low to medium level of concern about the credibility and feasibility of the investment firm’s recovery plan including its overall recovery capacity.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 118 Score Supervisory view Considerations 3 The risks identified pose a medium-high level of risk to the viability of the investment firm. • There is a medium to high level of concern about the investment firm’s business model and strategy. • There is a medium to high level of concern about the investment firm’s governance or investment firm-wide control arrangements. • There is a medium to high level of risk of a significant prudential impact caused by risks to capital and liquidity. • There is a medium to high level of concern about the composition and quantity of own funds held by the investment firm. • There is a medium to high level of concern about the investment firm’s liquidity position and/or funding profile. • Where relevant, there is a medium to high level of concern about the credibility and feasibility of the investment firm’s recovery plan including its overall recovery capacity. 4 The risks identified pose a high level of risk to the viability of the investment firm. • There is a high level of concern about the investment firm’s business model and strategy. • There is a high level of concern about the investment firm’s governance or investment firm-wide control arrangements. • There is a high level of risk of a significant prudential impact caused by risks to capital and liquidity. • There is a high level of concern about the composition and quantity of own funds held by the investment firm. • There is a high level of concern about the investment firm’s liquidity position and/or funding profile. • Where relevant, there is a high level of concern about the credibility and feasibility of the investment firm’s recovery plan including its overall recovery capacity. F The investment firm is considered to be ‘failing or likely to fail’. • There is an immediate risk to the viability of the investment firm.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 119 Score Supervisory view Considerations • The investment firm meets the conditions for failing or likely to fail, as specified in Article 32(4) of Directive 2014/59/EU24. 375. When determining that an investment firm is ‘failing or likely to fail’, as reflected by an overall SREP score of ‘F’, competent authorities, where relevant, should engage with the resolution authorities to consult on findings following the procedure specified in Article 32 of Directive 2014/59/EU. In the case of investment firms that are not subject to Directive 2014/59/EU, but which are assessed as ‘failing or likely to fail’ competent authorities should enhance engagement with the investment firm to ensure its orderly wind-down. 10.3 Application of capital measures 376. Competent authorities should impose additional own funds requirement and establish own funds expectations by setting P2R and P2G in accordance with Title 7. 377. Notwithstanding the requirements referred to in the previous paragraph, competent authorities may, on the basis of the vulnerabilities and deficiencies identified in the assessment of SREP elements, impose additional capital measures including: a. requiring the investment firm to use net profits to strengthen own funds in accordance with Article 39(2), point (h) of Directive (EU) 2019/2034; b. restricting or prohibiting distributions or interest payments by the investment firm to shareholders, members or holders of additional Tier 1 instruments where such prohibition does not constitute an event of default of the investment firm in accordance with Article 39(2), point (i) of Directive (EU) 2019/2034; and/or c. requiring the investment firm to apply a specific provisioning policy or treatment of assets in terms of own funds requirements in accordance with Article 39(2), point (d) of Directive (EU) 2013/2034. 378. If after liaising with the AML/CFT supervisor, there is a need for competent authorities to address prudential deficiencies/vulnerabilities related to ML/TF risks as a result of the 24 In particular, the competent authority is of the view that (1) the investment firm infringes, or there are objective elements to support a determination that the investment firm will, in the near future, infringe, the requirements for continuing authorisation in a way that would justify the withdrawal of the authorisation by the competent authority, for reasons including but not limited to the fact that the investment firm has incurred or is likely to incur losses that will deplete all or a significant amount of its own funds; (2) the investment firm’s assets are, or there are objective elements to support a determination that the investment firm’s assets will, in the near future, be, less than its liabilities; or (3) the investment firm is, or there are objective elements to support a determination that the investment firm will, in the near future, be, unable to pay its debts or other liabilities as they fall due. Article 32(4)(d) of Directive 2014/59/EU also identifies extraordinary public support criteria for the determination of whether an investment firm is failing or likely to fail, but these criteria are not considered for the purpose of SREP and the determination made by the competent authorities.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 120 SREP elements assessment, competent authorities should include those in their considerations when setting additional own funds requirement only where this is considered more appropriate than other supervisory measures. If additional own funds requirement are imposed, they should be used as an interim measure while the deficiencies are addressed 10.4 Application of liquidity measures 379. Competent authorities should impose specific liquidity requirements in accordance with the process and criteria specified in Title 9. 380. Notwithstanding the specific quantitative requirements referred to in the previous paragraph, competent authorities may, on the basis of the vulnerabilities and deficiencies identified in the assessment of risks to liquidity and funding, impose additional liquidity measures including,such as specific liquidity requirements in accordance with Article 39(2), point (k) or Article 42 of Directive (EU) 2019/2034. 10.5 Application of other supervisory measures 381. To address specific deficiencies identified in the assessment of SREP elements, competent authorities may consider applying measures that are not directly linked to quantitative capital or liquidity requirements. This section provides a non-exhaustive list of possible supervisory measures that can be applied based on Articles 39 Directive (EU) 2019/2034. Competent authorities may apply other supervisory measures as set out in that Article if these are more appropriate to address the identified deficiencies as described in this section. The choice of measures should take into account the results of assessment performed in accordance with Titles 4, 5, 6 and 8 of these guidelines. Business model analysis 382. Supervisory measures to address deficiencies identified in the BMA are likely to involve requiring the investment firm to adjust governance and control arrangements to help with the implementation of the business model and strategy or limiting certain business activities. 383. In accordance with Article 39(2), point (b) of Directive (EU) 2019/2034, competent authorities may require the investment firm to make adjustments to risk management and control arrangements, or to governance arrangements, to match the desired business model or strategy, by means including: a. adjusting the financial plan assumed in the strategy, if it is not supported by internal capital planning or credible assumptions; b. requiring changes to organisational structures, reinforcement of risk management and control functions and arrangements to support the implementation of the business model or strategy; and/or

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 121 c. requiring changes to and reinforcement of IT systems to support the implementation of the business model or strategy. 384. In accordance with Article 39(2), point (e) of Directive (EU) 2019/2034, competent authorities may require the investment firm to make changes to the business model or strategy where: a. they are not supported by appropriate organisational, governance or risk control and management arrangements; b. they are not supported by capital and operational plans, including allocation of appropriate financial, human and technological (IT) resources; and/or c. there are significant concerns about the sustainability of the business model. 385. In accordance with Article 39(2), point (f) of Directive (EU) 2019/2034, competent authorities may: a. require investment firms to reduce the risk inherent in the products they originate/distribute, by means including: • requiring changes to the risks inherent in certain product offerings; and/or • requiring improvements to the governance and control arrangements for product development and maintenance; b. require the investment firm to reduce the risk inherent in its systems, by means including: • requiring improvements to the systems, or increasing the level of investment or speeding-up the implementation of new systems; and/or • requiring improvements to the governance and control arrangements for system development and maintenance; c. require investment firms to reduce the risk inherent in their activities, including outsourced activities, by means including: • requiring changes to or reduction of certain activities with a view to reducing their inherent risk; and/or • requiring improvements to governance and control arrangements and oversight of outsourced activities. Internal governance and investment firm-wide controls 386. Supervisory measures to address deficiencies identified in the assessment of internal governance and investment firm-wide controls may focus on requiring the investment firm to strengthen governance and control arrangements, or reducing the risk inherent in its products, systems and operations. When applying supervisory measures to address

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 122 deficiencies identified in the assessment of the internal governance, competent authorities should engage with competent authorities for the purpose of Directive 2014/65/EU so that the underlying deficiencies/vulnerabilities are addressed in a consistent manner. 387. In accordance with Article 39(2), point (b) of Directive (EU) 2019/2034, competent authorities may: a. require the investment firm to make changes to its overall governance arrangements and organisation, by means including requiring: • changes to the organisational or functional structure, including reporting lines; • amendments to risk policies or how they are developed and implemented across the organisation; and/or • an increase in the transparency of governance arrangements; b. require the investment firm to make changes to the organisation, composition or working arrangements of the management body; c. require the investment firm to strengthen its overall risk management arrangements, by means including requiring: • changes to or reduction in risk appetite, or the governance arrangements for setting risk appetite, and the development of the overall risk strategy; • improvements to ICAAP or ILAAP procedures and models, where they are not deemed fit for purpose; • enhancement of stress-testing capacities and the overall stress-testing programme; and/or • enhancements to contingency planning; d. require the investment firm to strengthen internal control arrangements and functions, by means including requiring: • the independence and adequate staffing of the internal audit function; and/or • improvements to the internal reporting process to ensure that reporting to the management body is appropriate; e. require the investment firm to enhance information systems or business continuity arrangements, for example by requiring: • improvements in the reliability of systems; and/or

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 123 • development and testing of business continuity plans. 388. In accordance with Article 39(2), point (g) of Directive (EU) 2019/2034, competent authorities may require the investment firm to: a. make changes to remuneration polices; and/or b. limit variable remuneration as a percentage of net revenues. 389. Based on the outcomes of the qualitative review of stress testing programmes and if deficiencies are identified, competent authorities may require the investment firm: a. to develop a plan of remedial action aimed at improving stress testing programmes and practices; b. to make changes to the investment firm’s capital plan; c. where appropriate, to run specific prescribed scenarios (or elements of those) or using specific assumptions. Risk-to-client 390. Supervisory measures to address deficiencies identified in the assessment of the risk￾to-client and the associated management and control arrangements are likely to focus on requiring the investment firm to reduce the level of inherent risk or strengthening management and control arrangements. 391. In accordance with Article 39(2), point (b) of Directive (EU) 2019/2034, competent authorities may require the investment firm to: a. involve the management body or its committees more actively in risk-to-client management; b. improve the organisational framework to ensure effective providing of services to clients with sufficient (both qualitative and quantitative) human and technical resources (including front and back offices, information systems); c. improve the control framework (effectiveness and independence of control functions) to mitigate its risks to clients; d. enhance the quality and frequency of reporting on risk-to-client to the management body and senior management. 392. In accordance with Article 39(2), point (d) of Directive (EU) 2019/2034, competent authorities may require the investment firm to: a. apply a specific provisioning policy; b. adjust the internal estimates of the K-factor amount for risk-to-client and calculate additional own funds requirement.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 124 393. In accordance with Article 39(2), points (e) and (f) of Directive (EU) 2019/2034, competent authorities may require the investment firm to: a. restrict or limit the business, operations or network; b. request the divestment of activities that pose excessive risk to the financial soundness of the investment firm; c. reduce the risk inherent in the activities, products (including exposure to complex products and transactions, level of concentration risk) and systems including outsourced activities. Risk-to-market 394. Supervisory measures to address deficiencies identified in the assessment of risk-to￾market and the associated management and control arrangements are likely to focus on requiring the investment firm to reduce the level of inherent risk or to strengthen management and control arrangements. 395. In accordance with Article 39(2), point (b) of Directive (EU) 2019/2034, competent authorities may require the investment firm to address deficiencies identified with regard to the investment firm’s ability to identify, measure, monitor and control risk-to-market, by means including: a. ensuring that investment firm’s market risk properly reflects the investment firm’s appetite for market risk and is consistent with the overall risk appetite; b. requiring appropriate organisational framework with sufficient (both qualitative and quantitative) human and technical resources; c. enhancing the performance of the investment firm’s internal approaches, or of its back testing or stress-testing capacity; d. enhancing the quality and frequency of the reporting to the investment firm’s management body and senior management; and/or e. requiring more frequent and in-depth internal audits with reference to the risk-to￾market and calculate additional own funds requirement. 396. In accordance with Article 39(2), point (e) of Directive (EU) 2019/2034, competent authorities may: a. restrict investment in certain products when the investment firm’s policies and procedures do not ensure that the risk from those products will be adequately covered and controlled;

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 125 b. require the investment firm to present a plan to reduce its exposures to distressed assets and/or illiquid positions gradually; and/or c. require the divestment of financial products, including where the valuation processes of the investment firm do not produce conservative valuations. 397. In accordance with Article 39(2), point (f) of Directive (EU) 2019/2034, competent authorities may: a. require the investment firm to reduce the level of inherent market risk (through hedging or sale of assets); and/or b. require the investment firm to increase the amount of derivatives settled through central counterparties (CCPs). Risk-to-firm 398. Supervisory measures to address deficiencies identified in the assessment of risk-to￾firm and the associated management and control arrangements are likely to focus on requiring the investment firm to reduce the level of inherent risk or strengthening management and control arrangements. 399. In accordance with Article 39(2), point (b) of Directive (EU) 2019/2034, competent authorities may: a. ensure that investment firm’s risk strategy properly reflects the investment firm’s appetite for risk-to-firm including daily trading flow, concentration and counterparty default) and is consistent with the overall risk appetite; b. require appropriate organisational framework with sufficient (both qualitative and quantitative) human and technical resources; c. require the investment firm to involve the management body or its committees more actively in the risk-to-firm management; d. require the investment firm to consider inherent risk-to-firm when approving new products and systems; e. require the investment firm to improve operational risk identification (relating to daily trading flow) and measurement systems; and/or f. adjust the internal estimates of the k factor amount for risk-to-firm and calculate additional own funds requirement. 400. In accordance with Article 39(2), points (e) and (f) of Directive (EU) 2019/2034, competent authorities may:

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 126 a. require the investment firm to restrict or limit the business, operations or network of investments firms (reducing the degree of concentration risk or the exposure to trading counterparty default risk); b. require the divestment of activities that pose excessive risks to the soundness of the investment firm; c. require the investment firm to reduce the scope and/or extent of outsourcing activities including restructuring or exiting from outsourcing arrangements and switching to another service provider; d. require the investment firm to mitigate risk-to-firm exposures; e. restrict or limit the business, operations or network of investment firms or to request the divestment of activities that pose excessive risks to the soundness of an investment firm; f. require the reduction of the risk inherent in the activities, products and systems of investment firms, including the ML/TF risks with prudential implications. Other risks to capital 401. Irrespective of the requirement to hold additional own funds pursuant to Article 39(1), point (a) of Directive (EU) 2019/2034, competent authorities should consider the application of supervisory measures where the outcomes of SREP or other supervisory activities reveal deficiencies in the investment firm’s measurement, management, monitoring and control of operational risk, including in particular ICT risk, interest rate risk arising from non-trading book activities, or any other risk relevant for the investment firm. Liquidity risk 402. In accordance with Article 39(2), point (k) of Directive (EU) 2019/2034 competent authorities may: a. require diversification of the liquidity buffer and currency consistency between liquid assets and net outflows; b. impose requirements on the concentration of the liquid assets held, including: • requirements for the composition of the investment firm’s liquid￾assets profile in respect to asset classes, currencies; and/or • caps, limits or restrictions on funding concentrations; c. impose restrictions on short-term contractual or behavioural maturity mismatches: • limits on maturity mismatches (in specific time buckets); • limits on minimum survival periods; and/or

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 127 • limits on dependency on certain short-term funding sources, such as money market funding. 403. In accordance with Article 39(2), point (b) of Directive (EU) 2019/2034, competent authorities may require action to be taken to address deficiencies identified with regard to the investment firm’s ability to identify, measure, monitor and control liquidity risk, by means including: a. enhancing its stress-testing capacity to improve its ability to identify and quantify material sources of liquidity risk to the investment firm; b. enhancing its ability to monetise its liquid assets; c. enhancing its liquidity contingency plan and liquidity early warning indicators framework; and/or d. enhancing reporting of liquidity management information to the investment firm’s management body and senior management. 404. In accordance with Article 39(2), point (k) of Directive (EU) 2019/2034 competent authorities may require action to be taken to amend the investment firm’s funding profile, including: a. reducing its dependency on certain (potentially volatile) funding markets, such as wholesale funding; b. reducing the concentration of its funding profile with respect to counterparties, peaks in the long-term maturity profile, (mismatches in) currencies; and/or c. reducing the amount of its encumbered assets, potentially differentiating between total encumbrance and overcollateralization. 10.6 Supervisory reaction to a situation where Pillar 2 requirement is not met 405. Pillar 2 requirement is a legally binding requirement that investment firms have to meet at all times, including in stressed conditions. Where P2R set in accordance with these guidelines is no longer met, the competent authorities should consider additional intervention powers, including withdrawal of authorisation either directly if they have such competence or considering requesting it to the competent authorities for the purpose of Directive 2014/65/EU, or, where applicable, application of early intervention measures and resolution actions, in accordance with Article 8 of Directive 2014/65/EU and Directive 2014/59/EU, respectively. When exercising those powers, competent authorities should consider whether measures are proportionate to the circumstances and their judgement on how the situation is likely to develop. A breach of P2R should also be considered in determining if an investment firm is failing or likely to fail.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 128 10.7 Supervisory reaction to a situation where P2G is not met 406. Competent authorities should monitor whether the amount of own funds expected according to P2G is established and maintained by the investment firm over time. 407. When the investment firm’s own funds drop, or are likely to drop, below the level determined by P2G, the competent authority should expect the investment firm to notify it and prepare a revised capital plan. Competent authorities should ascertain that in its notification, the investment firm explains what adverse consequences are likely to force it to do so and what actions are envisaged for the eventual restoration of compliance with P2G as part of an enhanced supervisory dialogue. 408. There are generally three situations to be considered by a competent authority in which an investment firm could fail to meet its P2G. a. Where the level of own funds falls below the level of P2G in investment firm￾specific or external circumstances in which risks that P2G was aimed at covering have materialised, the competent authority may allow the investment firm to temporarily operate below the level of P2G provided that the revised capital plan is considered credible in accordance with the criteria set out in Section 7.7.3. The competent authority may also consider adjusting the level of P2G where appropriate. b. Where the level of own funds falls below the level of P2G in investment firm￾specific or external circumstances as a result of the materialisation of risks that P2G was not aimed at covering, competent authorities should expect the investment firm to increase the level of own funds to the level of P2G within an appropriate timeline. c. Where the investment firm disregards P2G, does not incorporate it into it risk management framework or does not establish own funds to meet P2G within the time limits set in accordance with paragraph 294, this may lead to competent authorities applying additional supervisory measures as set out in Sections 10.3 and 10.5. Where the permission to operate below the level of P2G as referred to in point (a) has not been granted and the investment firm’s own funds are repeatedly below the level of P2G, the competent authority should impose additional own funds requirement in accordance with Title 7. 409. Notwithstanding particular supervisory responses in accordance with the previous paragraph, competent authorities may also consider the application of the capital and additional supervisory measures set out in Sections 10.3 and 10.5, where these are deemed more appropriate to address the reasons for the own funds falling below the level determined by P2G.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 129 10.8 Interaction between supervisory and early intervention measures 410. In addition to the supervisory measures referred to in this title, for investment firms which are subject to the requirements of Directive 2014/59/EU, competent authorities may apply early intervention measures as specified in Article 27 of that Directive, which are intended to supplement the set of supervisory measures specified in Articles 39 to 42 of Directive (EU) 2019/2034. 411. Competent authorities should apply early intervention measures without prejudice to any other supervisory measures, and when applying early intervention measures, should choose the most appropriate measure(s) to ensure a response that is proportionate to the particular circumstances. 10.9 Interaction between supervisory and AML/CFT measures 412. Where competent authorities in the course of exercising their supervisory activities have reasonable indications of deficiencies in the investment firm’s systems and controls framework or the internal governance framework that are related to AML/CFT or reasonable grounds to suspect that the investment firm has increased exposure to ML/TF risks, they should: a. notify the AML/CFT supervisor of these deficiencies and risks as soon as they are identified; b. assess the impact that such deficiencies and risks may have on the prudential situation of the investment firm; c. liaise with AML/CFT supervisors and in line with the respective authorities’ mandates and functions, consider the most appropriate prudential supervisory measures to address these deficiencies and risks in addition to any measures taken by the AML/CFT supervisors. 413. Where the competent authorities are notified or become aware of supervisory measures or sanctions planned or imposed by the AML/CFT supervisors, they should consider whether and how the potential prudential implications of the weaknesses and failures identified by the AML/CFT supervisors need to be mitigated.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 130 Title 11 Application of SREP to investment firms groups 414. This title addresses the application of the common SREP procedures and methodology as specified in these guidelines in relation to investment firms’ groups and their entities. It also provides links with the supervisory cooperation and coordination pursuant to Articles 48 and 49 of Directive (EU) 2019/2034 and in accordance with the delegated regulation adopted based on Article 48(8) of that Directive25. 415. In the SREP, competent authorities should also consider the potential ML/TF risks, taking into account input received from the relevant AML/CFT supervisors of the Member State where a parent undertaking is established as well as AML/CFT supervisors responsible for the AML/CFT supervision of establishments of the group in different jurisdictions, in particular the assessment of ML/TF risks, material weaknesses and breaches of AML/CFT legislation, that are linked to the cross-border group structure. 416. When assessing prudential implications of ML/TF risks for an investment firm cross￾border group, competent authorities should leverage the information obtained through bilateral engagements with relevant AML/CFT supervisors and through their participation in AML/CFT colleges26 and prudential colleges. 11.1 Application of the SREP to cross-border groups 417. When applying the SREP and these guidelines to investment firms groups, competent authorities should assess the viability of the group as a whole, as well as its individual entities, while seeking to avoid the unnecessary duplication of supervisory requirements. This can be done by dividing the process into two stages: (1) competent authorities make an initial assessment of entities under their direct supervision, and (2) competent authorities coordinate the assessment, where established within the framework of colleges of supervisors pursuant to the requirements of Articles 48(2) and Article 49 of Directive (EU) 2019/2034. 418. In accordance with the scope of application of the guidelines as specified in Title 1: a. consolidating supervisors should perform the initial assessment of the parent undertaking and the group of investment firms on a consolidated level; and b. competent authorities should perform the initial assessment on the entities under their supervision (individual, or sub-consolidated, where relevant). 25 EBA/RTS/2021/06 on the colleges of supervisors for investment firm groups 26 AML/CFT colleges as defined in the Joint guidelines on cooperation and information exchange for the purpose of Directive (EU) 2015/849 between competent authorities supervising credit and financial institutions (“The AML/CFT Colleges Guidelines”).

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 131 419. Where these guidelines are applied to the subsidiaries of a cross-border group, competent authorities for subsidiaries should, when performing their initial assessment, primarily consider investment firms on an individual basis, i.e. assess the business model, strategy, internal governance and controls, risks to capital and liquidity, and capital and liquidity adequacy of an entity as they would for a standalone investment firm. The findings from such initial assessments, where relevant, should also include identification of key vulnerabilities in the group context, which may be related to the reliance of an investment firm on its parent/group for funding, capital and technological support. In their initial assessments made on an individual basis, competent authorities should also reflect strengths and mitigating factors related to the entity being part of the group, which may be related to group technological support and financial support arrangements. 420. The results of any such initial assessment of SREP elements, including, if identified, views on key dependencies on the parent/group, should serve as an input into the assessments and should be discussed by the competent authorities within the framework of the colleges of supervisors established pursuant to the requirements of Article 48 of Directive (EU) 2019/2034. 421. Following the discussions within the framework of colleges of supervisors, competent authorities should finalise their respective SREP assessments, making the necessary adjustments based on the outcomes of the college discussions. 422. Competent authorities should discuss and coordinate the following within the framework of colleges of supervisors: a. planning, including frequency, and timelines for performing the assessment of various SREP elements for the consolidated group; b. details of the application of benchmarks used for the assessment of SREP elements; c. approach to assessing and scoring sub-categories of risks individually, where such sub-categories have been identified as material; d. inputs required from the investment firm at consolidated and entity level for conducting the assessment of SREP elements; e. outcomes of the assessment, including SREP scores assigned to various elements, and the overall SREP assessment and overall SREP score at consolidated and entity level. When discussing the assessment of individual risks to capital and liquidity, competent authorities should focus on the risks that are identified as material for the respective entities; f. cross-border prudential implications of ML/TF risks and concerns; and g. planned supervisory and early intervention measures, if relevant.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 132 11.2 SREP capital assessment and investment firm-specific prudential requirements 423. The determination of capital adequacy and requirements in accordance with the process described in Title 7 for cross-border investment firms groups is part of the discussion within the college of supervisors. 424. The exercise of supervisory powers and the taking of supervisory measures, including with regard to imposing additional own funds pursuant to Article 39(2)(a) of Directive (EU) 2019/2034 at consolidated or individual entity level as specified in Title 7 should be discussed in the college of supervisors. 425. In the context of discussions on the adequacy of the level of own funds and determining additional own funds requirement, competent authorities should consider: a. the assessment of the materiality of risks and deficiencies identified at both consolidated and individual entity level (i.e. which risks are material to the group as a whole and which are material to just one entity) and the level of own funds required to cover such risks; b. where deficiencies identified are common across all entities, coordinating the assessment and supervisory response, and in particular, deciding whether measures should be imposed at a consolidated level or proportionally at entity level for the entities where common deficiencies are present; c. outcomes of the supervisory benchmark calculations used to determine additional own funds requirement for all entities within the group and at a consolidated level; d. additional own funds requirement to be imposed on entities and at a consolidated level to ensure there is consistency of final own funds requirements and whether there is a need for transferring own funds from consolidated to entity level; and e. determination of P2G for parent or subsidiary investment firm, or at consolidated level. 426. The capital requirement and other capital measures, if applicable, should be set at consolidated and solo levels. For the sub-consolidated level, the capital requirement and other capital measures should cover only the parent undertaking of the sub-consolidated group to avoid double counting of additional own funds requirement considered by competent authorities for subsidiaries in other Member States. 11.3 Application of other supervisory measures

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 133 427. Competent authorities responsible for the supervision of cross-border investment firms groups and their entities should discuss and coordinate, where possible, application of all supervisory and early intervention measures, where applicable, to the group and/or its material entities to ensure that the most appropriate measures are consistently applied to the identified vulnerabilities, taking into account the group dimension, including inter￾dependencies and intra-group arrangements as discussed above. 428. Competent authorities responsible for the prudential supervision of entities of a cross￾border investment firms group should, when imposing supervisory or administrative measures including sanctions on investment firms for their failure to address deficiencies related to ML/TF risks adequately, liaise with the relevant AML/CFT supervisors.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 134 4. Accompanying documents 4.1 Draft cost-benefit analysis / impact assessment Article 45(2) of Directive (EU) 2019/2034 mandates EBA and ESMA to issue guidelines for the competent authorities to further specify, in a manner that is appropriate to the size, the structure and the internal organisation of investment firms and the nature, scope and complexity of their activities, the common procedures and methodologies for the supervisory review and evaluation process referred to in Article 36 of that Directive and the assessment of the treatment of the risks referred to in Article 29 of that Directive. As per Article 16(2) of Regulation (EU) No 1093/2010, any guidelines and recommendations developed by the EBA shall be accompanied by an Impact Assessment, which analyses ‘the potential related costs and benefits’. This section presents the cost-benefit analysis of the provisions included in the draft Guidelines as described in this Final Report. The analysis provides an overview of problem identified, the proposed options to address this problem and the potential impact of these options. Given the nature and the scope of the draft Guidelines, the analysis is high-level and qualitative in nature. A. Problem identification Until 25 June 2021, the prudential rules for investment firms were part of the wider EU prudential framework which applies to banks, as set out in Regulation (EU) No 575/2013 and Directive 2013/36/EU, also known as the Capital Requirements Regulation (CRR) and Capital Requirements Directive (CRD), respectively. Under Article 97 CRD, competent authorities had to review the arrangements, strategies, processes and mechanisms implemented by the investment firms to comply with CRD and CRR, for which the EBA has issued Guidelines to promote common procedures and methodologies for the supervisory and evaluation process across all institutions in the EU.27 On 26 June 2021, most investment firms became subject to a new prudential framework, composed of Regulation (EU) 2019/2033 and Directive (EU) 2019/2034, also known as the Investment Firms Regulation (IFR) and the Investment Firms Directive (IFD), respectively. As a result, the existing Guidelines for common procedures and methodologies for the SREP and supervisory stress testing are not fit for purpose and the EBA has been mandated under Article 45(2) of the IFD to develop dedicated Guidelines for investment firms on the common procedures and methodologies for SREP. 27 https://www.eba.europa.eu/regulation-and-policy/supervisory-review-and-evaluation-srep-and-pillar-2/guidelines￾for-common-procedures-and-methodologies-for-the-supervisory-review-and-evaluation-process-srep-and-supervisory￾stress-testing

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 135 B. Policy objectives Investment firms throughout the EU are an important element of a well-functioning economy, thanks to their key role in efficient capital allocation. Adequate supervisory requirements are therefore necessary to reduce the likelihood of failure of an investment firm, or, in the event that it does fail, to limit the risk of unorderly wind-down that could bring disruption to clients, counterparties or to the markets in which it operates. The specific objective of these proposed draft guidelines is to promote common procedures and methodologies for the supervisory review and evaluation process (SREP) of the investment firms as referred to in Article 36 of Directive (EU) 2019/2034. Thus, these draft guidelines aim at achieving convergence of supervisory practices followed by competent authorities across the EU in the prudential assessment of investment firms. The methodology specified in these proposed draft guidelines promotes the application of supervisory practices that properly encompass the proportionality principle by taking into account the investment firm’s size, complexity and business model that should also help improve the efficiency and stability of financial markets, as well as market confidence in the sector overall. The methodology proposed in these guidelines envisages the assessment of four main pillars: (i) business model, (ii) internal governance and firm-wide control arrangements, (iii) risks to capital and capital adequacy and (iv) risks to liquidity and liquidity adequacy. Through the assessment of these four building blocks, competent authorities should form a view on the investment firm’s viability. It is expected that these guidelines will have a positive impact on investor protection through the establishment of clear supervisory expectations for the SREP assessment to which investment firms across the EU will be subject. C. Baseline scenario Without the implementation of the new Guidelines there could have been problems of an inconsistent application of the of supervisory review processes and methodologies across competent authorities. Such inconsistencies could have resulted in different supervisory outcomes for investment firms with similar risk profiles and business models. D. Options considered Categorisation a. Categorisation criteria The EBA considered 2 policy options regarding the SREP categorisation criteria: Option 1a: Use only objective and quantitative criteria for assigning an investment firm into a SREP category

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 136 Option 1b: Use both quantitative and qualitative (expert judgement) criteria for assigning an investment firm into a SREP category b. Specific quantitative criteria The EBA considered 2 policy options for quantitative criteria used in the categorisation of investment firms: Option 2a: Determine categorisation of the investment firms by considering only the total assets of the firm, i.e. the on-balance sheet exposures; Option 2b: Determine the categorisation of the investment firms by considering the total assets and off-balance sheet exposures of the firm. Minimum engagement model The EBA considered 3 policy options for determining the minimum engagement model for investment firms: Option 3a: Minimum SREP frequency of 2 to 4 years depending on the category of investment firm, and in addition assessment of at least capital and liquidity adequacy annually, or every 2 years for smaller investment firms; Option 3b: Minimum SREP frequency of 2 to 4 years depending on the category of investment firm, without the need for more frequent assessments of capital and liquidity adequacy; Option 3c: Minimum SREP frequency of 2 to 3 years for category 1 and 2 investment firms, SREP for category 3 firms in case of specific events. Assessment of governance arrangements The EBA considered 3 policy options regarding the assessment of the governance arrangements for investment firms: Option 4a: Application of simplified criteria for the assessment of the internal governance framework of category 3 firms and small and non-interconnected investment firms as defined in Article 12 of Regulation (EU) 2019/2033; Option 4b: Application of simplified criteria for the assessment of the internal governance framework of small and non-interconnected investment firms as defined in Article 12 of Regulation (EU) 2019/2033; Option 4c: Application of the same assessment criteria of the internal governance framework to all the investment firms regardless of their size, complexity and activities performed. Treatment of Pillar 2 risks

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 137 In accordance with the requirements of Directive (EU) 2019/2034, any elements of risk mentioned in Article 29 of that Directive are allocated to existing categories of risk (i.e. risk-to-client, risk-to￾market or risk-to-firm) whereas risks mentioned in Article 36 of that Directive are treated separately as other risks. The EBA considered 2 policy options for the treatment of any additional Pillar 2 risks which are not referred to Article 29 or 36 of Directive (EU) 2019/2034: Option 5a: Allocate any additional risks to one of the existing categories, i.e. risk-to-client, risk￾to-market, risk-to-firm; Option 5b: Include any additional risk as a separate risk category. Application of risk categories to class 3 firms The EBA considered 2 policy options with regards to the opportunity of applying the assessment of the elements of risk addressed by the K-factors to class 3 investment firms: Option 6a: Exclude class 3 firms from the assessment of the elements of risk addressed by the K￾factors; Option 6b: Partial application of the assessment of the elements of risk addressed by the K￾factors (only to the relevant extent and without the need to calculate all the K-factors) also to class 3 firms. Communication and review of additional own funds requirement The EBA considered 2 policy options with regards to the communication and review of additional own funds requirements: Option 7a: Competent authorities communicate to investment firms an absolute amount of additional own funds requirement. During the years where SREP is not carried out, where Pillar 1 own funds requirements are subject to a significant increase, the additional own funds requirement is reviewed and increased proportionally to the evolution of the own funds requirement; Option 7b: competent authorities communicate to investment firms an absolute amount of additional own funds requirement and a relative amount of additional own funds requirement (as a percentage of Pillar 1 requirement). The applicable additional own funds requirement is at all times equal to the higher of the absolute or the relative amount, including during the years where the SREP is not carried out.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 138 E. Cost-Benefit Analysis Articles 10 and 16 of Regulation (EU) No 1093/2010 establishing the European Banking Authority (EBA), require the EBA to publish a cost-benefit analysis that will arise from the proposed provisions laid out in the guidelines. In this context, a qualitative questionnaire was launched for the purpose of assessing the impact of these Guidelines on procedures and methodologies for the SREP, which the EBA is required to develop under Article 45 of Directive (EU) 2019/2034 (IFD). Investment firms subject to the CRR/CRD requirements prior to the application of the IFR/IFD The vast majority of competent authorities (76% of the answers) reported that the investment firms under their remit were subject to, fully or partially, CRR/CRD requirements before the date of application of the IFR and IFD. Only four competent authorities (18% of the answers) mentioned that few investment firms (i.e. below 40% of the total) or none were subject to, fully or partially, CRR/CRD requirements before the date of application of the IFR and IFD. Application of the P2G The majority of competent authorities (64% of the answers) reported that the investment firms under their remit, previously subject to CRR/CRD, were not subject to P2G requirements. Thus these investment firms, despite being subject to CRR/CRD provisions, were not subject to P2G. Moreover, the vast majority of competent authorities (88% of the answers) reported that the investment firms under their remit, not previously subject to CRR/CRD, were also not already subject to P2G requirements. Therefore, as expected, investment firms not previously subject to CRR/CRD were also not subject to P2G requirements. Impact of the application of the P2G requirements Most of the competent authorities consider that the expected average level of P2G as compared to current Pillar 1 requirements should be negligible or low (75% of the answers, i.e. lower or equal to 2% of Pillar 1 requirements). The remaining answers (25%) indicate a medium average level (i.e. between 2% and 5% of Pillar 1 Requirements). Therefore, competent authorities do not consider the expected average level of P2G high compared to current Pillar 1 requirements. Share of small and non-interconnected investment firms The majority of competent authorities (64% of the answers) reported that the share of small and non-interconnected investment firms which will be subject to SREP is limited (i.e. 40% or below of the total investment firms under their remit) or none. Nevertheless, some competent authorities

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 139 (24% of the answers, representing six CAs) reported that all small and non-interconnected investment firms will be subject to SREP. One-off costs incurred by competent authorities due to implementation of the SREP guidelines The one-off costs incurred by competent authorities due to the implementation of the SREP guidelines, namely costs of training and consultancy are negligible, low, or moderate (according to 76% of the competent authorities). Similarly, the one-off costs incurred by competent authorities due to the implementation of the SREP guidelines regarding IT costs and Other costs are also low or moderate (respectively, 72% and 85% of the answers). However, none of the competent authorities consider the IT costs to be negligible. On the contrary, the same does not occur with other costs, where 25% of the competent authorities consider them as negligible. In general, the total cost of implementing the SREP guidelines for the investment firms is deemed low or moderate by 80% of the competent authorities. Level of costs incurred by competent authorities due to the implementation of the SREP guidelines The level of costs incurred by competent authorities due to the implementation of the SREP guidelines per area, compared to the costs incurred before the entry into force of IFR/IFD is another important element to consider. As regards the Business Model Analysis area, 52% of the competent authorities indicate that the level of costs is moderate and in 20% of the cases these costs are deemed negligible. Only three CAs consider these costs to be high. With regards to the governance arrangements and firm-wide controls area, the vast majority of competent authorities consider the costs to be negligible, low or moderate (92% of the answers). Only 2 competent authorities (the same CAs that also consider business model analysis area to have high implementation costs) deem the implementation costs in this area to be high. Another important area on which it is important to assess the level of costs incurred by competent authorities due the implementation of the SREP guidelines, compared to the costs incurred before the entry into force of IFR/IFD, is the risk of unorderly wind-down. Once again (and similar to the costs incurred for the governance arrangements and firm-wide controls area), the vast majority of competent authorities deem these costs to be negligible or low (32% of the answers), or moderate (60% of the answers). Concerning risks from ongoing activities, the level of costs encountered by the vast majority of competent authorities due to the implementation of the SREP guidelines (compared to the costs encountered before the entry into force of IFR/IFD) is negligible or low for almost half of the CAs (44% of the answers) or moderate (52% of the answers). Only one CA considers the level of costs for risks from ongoing activities area as high. In sum, the vast majority of competent authorities reported that the investment firms under their remit were already subject to, fully or partially, CRR/CRD requirements before the date of application of the IFR and IFD. Nevertheless, the majority of the CAs also reported that the

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 140 investment firms under their remit, either subject to CRR/CRD provisions or not, were not subject to P2G requirements. Most of the competent authorities consider that the expected average level of P2G as compared to current Pillar 1 requirements should be negligible or low. As mentioned, the majority of the CAs indicate that the share of small and non-interconnected investment firms which will be subject to SREP is limited (i.e. 40% or below of the total investment firms under their remit) or none. In relation to the implementation costs, for most of the areas assessed, the level of costs encountered by competent authorities due the implementation of the SREP guidelines compared to the costs encountered before the entry into force of IFR/IFD are considered to be negligible, low, or moderate (between 88% and 96% of the answers from the competent authorities). This implies that the application of the provisions laid out in the IFR and IFD do not have a significant impact in terms of costs. Overall, the Impact Assessment on the draft Guidelines on procedures and methodologies for the SREP indicates that the possible impact is low to moderate and that the expected benefits are higher than the expected costs. F. Preferred option Categorisation a. Categorisation criteria Under Option 1a, the categorisation is based on specific objective criteria (performed activities and size of on- and off-balance sheet exposures as well as whether is a small and non-interconnected firm according to Article 12 of IFR) to determine the SREP category under which an investment firm will fall. This option is simple and ensures full harmonisation across the EU by establishing specific quantitative metrics to determine categories. However, these specific quantitative criteria alone are not able to appropriately reflect the wide range of business models and risk profiles of investment firms that exist across the EU. Option 1b solves the issue stated under Option 1a, by providing competent authorities, on top of the objective and quantitative criteria, a set of additional qualitative criteria that they can use to upgrade or downgrade an investment firm by one category. This ensures that there is a consistent approach for the vast majority of investment firms, as determined by the quantitative criteria, while the flexibility granted to competent authorities allows to capture specific characteristics of individual investment firms. In this way, Option 1b allows for further proportionality to be embedded in the SREP categorisation. Option 1b is the preferred option. b. Specific quantitative criteria

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 141 Option 2a entails a simplified approach focused on the on-balance sheet exposures of the investment firms. Nevertheless, such approach is not fully consistent with the provisions set out in Article 12(1)(h) of Regulation (EU) 2019/2033 that envisages that for the definition of small and non-interconnected firms the off-balance sheet exposures should be taken into account. Furthermore, such simplified approach may not be sufficiently prudent by not capturing appropriately the higher potential riskiness of investment firms having off-balance sheet exposures. Option 2b is consistent with Regulation (EU) 2019/2033 as it takes into account also the off-balance sheet exposures of the firms for their categorisation. It is a more prudent approach as it considers the riskiness of potential items not reflected in the balance sheet of the firm. Furthermore, this information will be directly available through supervisory reporting, therefore reducing any additional administrative burden related to data collection. Option 2b is the preferred option. The Guidelines propose the following categories, with the possibility to reclassify an investment firm by one notch up or down between categories 1 to 3 based on qualitative criteria: • Category 1: total assets and off-balance sheet exposures equal to or exceeding EUR 1 billion, or EUR 250 million and activities (3) and (6) MiFID, or firms considered significant based on supervisory judgement of the competent authority • Category 2: total assets and off-balance sheet exposures between EUR 250 million and EUR 1 billion and not category 1 • Category 3: total assets and off-balance sheet exposures below EUR 250 million and not small and non-interconnected investment firms as set out in Article 12(1) IFR • Class 3: small and non-interconnected investment firms as set out in Article 12(1) IFR Error! Reference source not found.2 shows the number of investment firms that will fall in each category. It should be noted that the categorisation is based on total assets alone and does not include off-balance sheet exposures due to unavailability of data (i.e. Option 2a – not the preferred option). As a result, the number of firms in category 3 may be overestimated, while the number of firms in category 1 and 2 underestimated compared to the preferred option (Option 2b). Moreover, the classification of firms into small and non-interconnected (class 3) was provided by the competent authority on a best-effort basis and may rely in some cases on the expert judgement. Finally, the categorisation does not consider any qualitative criteria (including supervisory judgement on the significance of an investment firm to fall into category 1). Table 13 Number of investment firms by SREP category Country Category 1 of which: Category 1a of which: Category 1b Category 2 Category 3 Class 3 Total AT 1 58 59 BE 1 17 14 32

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 142 Country Category 1 of which: Category 1a of which: Category 1b Category 2 Category 3 Class 3 Total BG 2 34 1 37 CY 4 3 1 193 22 219 CZ 1 16 5 22 DE 2 1 62 639 704 DK 17 32 49 EE 4 1 5 ES 1 58 144 203 FI 42 8 50 FR 9 8 1 4 33 31 77 GR 34 12 46 HR 6 1 7 HU 2 1 6 9 IE 7 2 5 1 46 41 95 IS 8 1 9 IT 1 1 34 26 62 LI 103 103 LT 5 3 8 LU 1 34 54 89 LV 3 3 MT 2 26 15 43 NL 7 2 5 1 72 127 207 NO 2 1 52 52 107 PL 1 1 21 15 38 PT 12 16 28 RO 18 18 SE 1 66 21 88 SI 2 2 Total 40 17 23 15 922 1442 2419 Source: 2020 EBA data collection on EEA population of investment firms and EBA calculations.28 Notes: The reference date for the data is end-December 2019. The analysis excludes class 1 investment firms, as well as investment firms that hold simultaneously a banking and investment firm license, included both own assets of an investment firm and client money and financial instrument belonging to clients in its total assets, or did not provide information on their total assets. Category 1a captures investment firms with total assets and off-balance sheet exposures equal to or exceeding EUR 1 billion; category 1b captures investment firms with total assets and off-balance sheet exposures equal to or exceeding or EUR 250 million and perform activities (3) and (6) MiFID. Minimum engagement model Under option 3a, competent authorities are expected to have more frequent engagement and dialogue with the investment firms and must update regularly the additional own funds requirement and liquidity measures. Thus, this option would result in an increased administrative burden for both the competent authorities and the supervised firms, causing inefficient allocation of supervisory resources. Under option 3b, competent authorities would engage with investment firms less frequently which would alleviate the administrative burden but could in some cases result in inadequate capital and liquidity measures, in case of significant changes in business models or risk profiles of investment firms between the SREP assessments. 28 For more information on the 2020 EBA data collection on EEA population of investment firms see the Final draft RTS on prudential requirements for Investment Firms (EBA/RTS/2020/11)

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 143 Option 3c allows for less frequent engagement with smaller investment firms and hence facilitates efficient allocation of supervisory resources. At the same time, prudent approach is ensured by including the requirement for engagement if specific events occur. Option 3c is the preferred option. Assessment of governance arrangements Option 4a entails a broad application of the principle of proportionality by specifying simplified criteria for the assessment of investment firms depending on their size, complexity and activities performed. This option would ensure that deeper assessment is performed for more complex investment firms, which are expected to have in place more sophisticated internal governance arrangements. In all cases, the assessment is to be carried out in accordance with the applicable requirements for investment firms. Option 4b envisages the application of simplified assessment criteria of the internal governance arrangements only for the small and non-interconnected investment firms as defined in Article 12 of Regulation (EU) 2019/2033. While this option relies on the expectation that more complex investment firms should have more sophisticated internal governance arrangements in place, it does not fully acknowledge the diversity of class 2 investment firms. Option 4c entails the application of the same provisions to all the investment firms regardless of their size, complexity and activities performed. This option applies the principle of proportionality in an implied manner, by allowing the supervisory judgement with regards to the granularity of assessment. It could however lead to less consistent supervisory practices and would risk increasing the burden on both the competent authorities and the investment firms. Option 4a is the preferred option. Treatment of Pillar 2 risks Under option 5a, the elements of risk mentioned in Article 36 of Directive (EU) 2019/2034 are included as a separate risk category with all the other elements included in the existing categories. This option would foster broader understanding of the existing risk categories but could lead to inconsistent classification of additional elements of risk and hence limited comparability of results. Under option 5b, all the additional elements of risk are treated as a separate category with all the other elements explicitly mentioned in Article 29 of the Directive 2019/2034 included in the existing categories. This option ensures better transparency of additional risks and avoids inconsistent classification of various elements of risk under specified categories. Option 5b is the preferred option. Application of risk categories to class 3 firms

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 144 Under option 6a, class 3 firms are excluded from the assessment of the elements of risk addressed by the K-factors. This option entails a simplified approach and is potentially less burdensome for competent authorities, but is not adequately conservative from a prudential perspective, as for some class 3 investment firms the elements of risks addressed under the K-factors could have a significant impact. Under option 6b, the assessment of the elements of risk addressed by the K-factors should be performed also to class 3 firms to the extent relevant. More specifically, while these firms are excluded from the calculation of K-factors, certain elements of risk addressed by the K-factors that are particularly relevant for a class 3 investment firm should be taken into account in the supervisory assessment. Even if this option entails an increased burden on supervisory authorities it results in a more prudent approach and ensures that all material risks are adequately addressed. Option 6b is the preferred option. Communication and review of additional own funds requirement Under option 7a, competent authorities communicate to the investment firm the additional own funds requirement expressed only as an absolute amount. Given the potentially long time between SREP assessments, this amount may become less adequate over time, especially in the case of significant change in business activities and risk profile of an investment firm. One of the simplest metrics reflecting the scope of activities and riskiness of investment firms is their Pillar 1 own funds requirements. For this reason, competent authorities would also have to monitor the evolution of Pillar 1 requirements and, in the case of significant increase, update proportionally also the additional own funds requirement. This update would not be based on a comprehensive SREP analysis, but rather assume that the level of additional risks increases proportionally to the scope of activities and would therefore ensure a prudent approach during the time between SREP assessments. While this option would give large degree of flexibility for competent authorities to react and update own funds requirements in case of significant changes in operations of investment firms, it would also increase the burden for competent authorities, not only by monitoring of the main metrics for investment firms, but also for issuing and justifying their decisions every time where own funds requirements are updated. Therefore, this option introduces more complexity and increases the administrative burden on competent authorities. Under option 7b, competent authorities communicate to the investment firm the additional own funds requirement expressed both in absolute and relative terms. They also inform investment firms that the additional own funds requirement should at all time be equal to the greater of the absolute or relative amount. As a result, in the case of an increase of Pillar 1 requirements during the years where SREP is not performed, the additional own funds requirement will automatically increase accordingly and no specific update is necessary. Therefore, this option is more efficient from a cost-benefit perspective and ensures prudent coverage of risks at all times, including when SREP is not performed. Option 7b is the preferred option.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 145 4.2 Feedback on the public consultation The EBA publicly consulted on the draft proposal contained in this paper. The consultation period lasted for three months and ended on 18 February 2022. Six responses were received, of which four were published on the EBA website. This paper presents a summary of the key points and other comments arising from the consultation, the analysis and discussion triggered by these comments and the actions taken to address them if deemed necessary. In many cases several industry bodies made similar comments or the same body repeated its comments in the response to different questions. In such cases, the comments, and EBA analysis are included in the section of this paper where EBA considers them most appropriate. Changes to the draft Guidelines have been incorporated as a result of the responses received during the public consultation. Summary of key issues and the EBA’s response The main feedbacks on the consultation paper on the SREP Guidelines for Investment firms touched upon various areas addressed in the Guidelines, from comments of general nature to the answers provided to the eleven consultation questions. The main feedbacks received can be divided into three blocks: the common SREP framework, the application of the principle of proportionality, and the expression of additional capital requirement (P2R) and of guidance on additional own funds (P2G). The common SREP framework With regards to categorisation, the respondents suggested to drop from the list of criteria for the allocation into a specific category the size of the balance sheet as such metrics may not adequately reflect the actual riskiness of some investment firms. With regards to supervisory engagement, one respondent suggested to lower the frequency of the SREP assessment for category 1 investment firms. Finally, with regards to supervisory dialogue, several respondents enquired on the possibility to require an ad hoc SREP assessment, and related review of P2R and P2G, in case of an early remediations of supervisory measures. The EBA maintains the balance sheet size criterion in line with Regulation (EU) 2019/2033, where such metric is used as an indicator of risk, while leaving the possibility for competent authorities to reclassify an investment firm by one notch up or down between categories 1 to 3. The EBA maintains the current frequency correctly striking the balance between the need to ensure proportionality of treatment for investment firms. Finally, the SREP being a continuous process and depending on the investment firm’s specific circumstances, competent authorities have the ability

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 146 to conduct ad hoc SREP assessment and potentially review the investment firm’s P2R and P2G, at any time and at their discretion. The application of the principle of proportionality Several respondents requested to better reflect the principle of proportionality throughout the SREP Guidelines, and more specifically with regards to Titles 4 and 5, ensuring that proportionality is duly considered by competent authorities across all elements. Regarding Title 5 on internal governance and firm-wide controls, one respondent suggested to lighten the assessment under sections 5.5, 5.7 and 5.8 respectively on internal control functions, new products including significant changes and outsourcing. The EBA reminds that the proportionality principle set out in section 2.4 applies throughout the SREP Guidelines, including the possibility to perform a lighter assessment on some specific risk areas depending on their relevance for the investment firm. The EBA has revised Title 5 of the SREP Guidelines aligning with the provisions of the EBA Guidelines on internal governance (EBA/GL/2021/14). As under the scope of market supervisors’ assessment, sections 5.7 and 5.8 have been deleted asking competent authorities to rely on market supervisors’ assessment to evaluate whether this gives rise to prudential concerns. The expression of P2R and P2G Some respondents contested expressing P2R and P2G using a relative amount as it will increase P2R and P2G proportionally to any increase of own funds requirements without supervisory assessment. Such expression may be particularly detrimental to trading firms with market making obligation, as any automatic increase of P2R, notably under stress, may endanger the supply of liquidity in the market. Respondents proposed therefore to express P2R using an absolute expression only. The EBA maintained the P2R expression using both an absolute and a relative amount, as the relative expression allows for P2R to properly reflect changes in the investment firms’ own funds requirements, and therefore changes to the investment firms’ activities and risk profile, especially for the years where supervisory assessments are not conducted. The EBA amended the SREP Guidelines regarding P2G expression, leaving such expression at competent authorities’ assessment.

147 Summary of responses to the consultation and the EBA’s analysis Comments Summary of responses received EBA analysis Amendments to the proposals General comments Scope of application of the application of the capital requirements One respondent considered that the scope of application of the SREP guidelines and the respective capital requirements should be reconsidered by the EBA as this creates an unlevel regulatory playing field. The scope of application of the SREP guidelines for investment firms is defined in the Regulation (EU) 2019/2033 and Directive (EU) 2019/2034. No changes. SREP assessment cycle One respondent suggested that investment firms should be granted the power to request an updated SREP assessment when remedial actions to address supervisory recommendations are implemented. The SREP being a continuous process, competent authorities and investment firms should engage in supervisory dialogue based on the outcomes of the SREP assessment and associated supervisory measures. Competent authorities may perform ad hoc assessment at any time. No changes. Definition of ‘material’ The term ‘material’ used throughout the SREP Guidelines is not defined in Title 1. No definition of ‘material’ has been introduced in the CP on the SREP Guidelines. Non-defined terms must be interpreted by competent authorities according to the general meaning of the terms used, together with other recognised interpretative methods, such as contextual interpretation and by identifying the objective of the concerned provisions. No changes. Key indicators One respondent suggested amending paragraph 62 (56 of the CP), concerned with the identification of the key indicators that competent authorities should monitor on a regular basis, by stating clearly Under paragraph 62 (56 of the CP) competent authorities are granted the power to define a set of indicators relevant for the investment firms (also taking into account their peer groups). The provisions laid out in this paragraph entail that when defining No changes.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 148 Comments Summary of responses received EBA analysis Amendments to the proposals that the data on geographies and sectors should be used only when available. this set of indicators competent authorities should take into account the geographies, sectors, and markets where the investment firm operates. These sources of information are relevant to actively monitor the risk profile of the investment firm and therefore should be provided to the competent authorities by the investment firm. Definition of ‘reputational risk’ Two respondents noted that the definition of ‘reputational risk’ is based on the term ‘reputation’, with no definition of the latter, transgressing the principle that the definiendum should not be part of the definiens. The definition of ‘reputational risk’ is in line with other EBA regulatory products. No changes. Principle of proportionality Several respondents requested to better reflect the principle of proportionality in the text of the guidelines, especially with regards to Title 4 “Business Model Analysis”. The principle of proportionality is well reflected throughout the text of the guidelines. Investment firms are divided into categories with different minimum engagement level and competent authorities are empowered to perform lighter assessments where risks are considered immaterial. Paragraph 74 of the Guidelines (68 of the CP) advocates for a proportionate application of the provisions of Title 4, adjusting the level of details of the analysis to the investment firm-specific situation, including its perceived risks and the scale and complexity of its activities. Therefore, no further changes are deemed necessary in Title 4. The wording of Title 6 has been further refined to better reflect the principle of proportionality. Wording of paragraph 145, in the context of the assessment of the risks-to-capital (Title 6), amended to better reflect the principle of proportionality.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 149 Comments Summary of responses received EBA analysis Amendments to the proposals Title 10 Overall SREP assessment and application of supervisory measures Other supervisory measures Some respondents sought clarifications on the scope of application of paragraph 383 of the SREP Guidelines (389 of the CP), setting out guidance for competent authorities exercising their powers under Article 39(2)(e) of Directive (EU) 2019/2034. Based on the Directive’s provisions, such respondents pointed out the absence, in paragraph 383 (389 of the CP), of subordination of the use of supervisory measures to the existence of activities that pose excessive risks to the financial soundness of an investment firm. The respondents commented more particularly point b of paragraph 383 (389 of the CP) where alternative grounds for the application of Article 39(2)(e) could be created if the assessment of ‘operational plans’ is not constrained by the presence of excessive risk. Moreover, while the Directive allows competent authorities to restrict or limit ‘the business, operations or network of investment firms’, the Guidelines focuses on changes to the ‘business model and strategy’. By directly quoting Article 39(2)(e) of Directive (EU) 2019/2034, paragraph 383 (389 of the CP) on the SREP Guidelines is automatically constrained by the provisions of this Article. The intention of such paragraph is to specify situations where excessive risks could occur, as listed in points (a) to (c), establishing common grounds for the activation of competent authorities’ supervisory powers. No changes. Title 11 Application of SREP to investment firms’ groups Application of SREP to investment firms’ group One respondent noticed that the SREP Guidelines for Investment Firms do not provide information on the assessment of investment firms group where no colleges of supervisors are established. In such On the basis of Article 4(11) of Regulation (EU) 2019/2034, regulatory requirements should apply to an investment firm group as if that group was a single investment firm. The provisions of the CP on the SREP No changes.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 150 Comments Summary of responses received EBA analysis Amendments to the proposals situation, the respondent suggested indicating that the assessment of the risk resulting from operating within a group should be performed at competent authorities’ discretion. Guidelines are therefore applicable at consolidated level. Where no colleges of supervisors are established, the provisions of Title 11 do not apply. Responses to questions in Consultation Paper EBA/CP/2021/35 Question 1. Do you agree with the proposed categorisation and the proportionate approach to the application of the SREP to different categories of investment firms? Use of the balance sheet size as a criterion for the categorisation of the investment firm Several respondents argued against the use of the balance sheet size as a criterion for the categorisation of the investment firms claiming that such a metric does not fully reflect the actual riskiness of some investment firm carrying out a specific business model. They therefore requested the deletion of such a criterion from the paragraph 2.1.1 “categorisation of the investment firms”. The balance sheet size criterion is used in Regulation (EU) 2019/2033), notably in the context of the definition of the small and non-interconnected investment firms, as an indicator of risks, justifying its use for the categorisation of the investment firms. Furthermore, it should be noted that competent authorities are granted the power to change the categorisation of the investment firm by one notch up or down, taking into account qualitative criteria, where appropriate. No changes. Frequency of the SREP assessment for category 1 investment firms One respondent suggested to lower the frequency of the SREP assessment for category 1 investment firms by reducing it from 2 to 3 years in order to further stress the principle of proportionality in the text of the guidelines. The frequency of the SREP assessment for category 1 firms is fit for the purpose and correctly striking the balance between the need to ensure proportionality of treatment for investment firms as well as a prudential approach. No changes. SREP assessment trigger event for class 3 firms Several respondents requested to provide guidance on the kind of event that should be deemed material in order to trigger the SREP assessment for class 3 firms. It is not possible to clearly identify in the text of the guidelines a list of events that could trigger the SREP assessment for class 3 firms as these events may be firm specific and any list may hardly be exhaustive. No changes.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 151 Comments Summary of responses received EBA analysis Amendments to the proposals Competent authorities may decide to carry out a SREP assessment when the risk profile of the firm has substantially changed due to some unexpected events. Question 2. Do you agree with our proposal regarding BMA? Are there any other drivers of business model/strategy that you believe competent authorities should consider when conducting the investment firms' BMA? Assessment of the investment firm risk appetite One respondent requested the deletion of the provision under paragraph 90(c) (84(c)of the CP) that envisages the comparison of the investment firm’s risk appetite with the average risk appetite levels of the peer group claiming that: i) it would not be based on the own merits of the investment firm; ii) it would risk jeopardising the EU supervisory convergence; and iii) it would be difficult to implement. Comparing the risk appetite of the investment firm against the average levels of its peer group provides CAs with useful information. In this respect it would be worth noticing that CAs are not expected to base their assessment solely on the peer review analysis and that they are expected to perform this analysis only when a clearly identifiable peer group for the IF exists. Paragraph 90(c) has been amended to further clarify that this assessment is expected when a peer group for the investment firm exists. Assessment of the ML/TF risk in cooperation with AML/CFT authorities One respondent requested amendment of paragraph 73 of the guidelines (67 of the CP), concerned with the assessment of the ML/TF risk in cooperation with AML CFT authorities, by clearly stating that such an assessment should be performed by prudential supervisors only when the relevant data is available. The EBA agrees on the importance of acknowledging and respecting the different roles, responsibilities and expertise of competent authorities and AML/CFT supervisors. Paragraph 73 (67 of the CP) of Title 4 already sets out the interaction with the AML/CFT supervisor in the context of the business model analysis and the need for competent authorities to use the input received from AML/CFT supervisors as well as for the competent authorities to focus their assessment on the ‘prudential implications’ of the ML/TF risks linked to the business model of the investment firm. No changes.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 152 Comments Summary of responses received EBA analysis Amendments to the proposals Question 3. Do you agree with the proposed criteria for the assessment of internal governance and firm-wide controls? Application of the principle of proportionality Some respondents advised to reinforce the principle of proportionality, especially considering the variety of business models undertaken by investment firms. Such respondents took the example of liquidity providers that usually display simple governance model, fit-for-purpose for the business and nature of such firms. The EBA is aware of the different business and operating models of investment firms within the EU, whose particularities should be taken into account by competent authorities performing their assessment in line with paragraphs 102 to 106 of the SREP Guidelines for Investment Firms. Title 5 amended where relevant. Outsourcing, new products and significant changes One respondent suggested to lighten the assessment of new products and significant changes (subtitle 5.7 of the SREP Guidelines) as well as of outsourcing (subtitle 5.8) and include it in the assessment of the overall governance framework. Such detailed assessment is deemed representing an excessive burden both for the investment firms and their competent authorities. New products and significant changes as well as outsourcing are subject to Directive 2014/65/EU, and respectively to ESMA Guidelines on MiFID II products governance (ESMA35-43-620) and to the Commission Delegated Regulation (EU) 2017/565, therefore are not in the scope of Directive (EU) 2019/2034. On that basis, section 5.7 on new products and significant changes and 5.8 on outsourcing have therefore been deleted. Such topics have been included under section 5.2 on overall internal governance framework, requiring competent authorities to rely on market supervisors’ assessment to evaluate whether such topics give rise to prudential concerns. Sections 5.7 and 5.8 of the SREP Guidelines deleted. Section 5.2 amended. Internal control functions One respondent expressed concerns on the assessment of risk management, compliance, and internal audit functions, as exceeding the requirements set out in the Directive (EU) 2019/2034 and the Regulation (EU) 2019/2033. The EBA was mandated under Article 26 of Directive (EU) 2019/2034 to issue Guidelines, in consultation with ESMA, on the application of the governance arrangements referred to in paragraph 1 of this Article. The SREP Guidelines are aligned with the Title 5 reworded using cross￾references to relevant guidelines, where appropriate.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 153 Comments Summary of responses received EBA analysis Amendments to the proposals More specifically, with regard to the internal audit function, this respondent suggested to leave the assessment of point b of paragraph 116 of the SREP Guidelines (113 of the CP) about the adherence of such function to national and international professional standards at competent authorities’ discretion. provisions laid out in such Guidelines (EBA/GL/2021/14). ML/TF risks assessment One respondent suggested to scale competent authorities’ assessment of ML/TF risks to the range of information provided by AML/CFT supervisors, as AML/CFT supervisors have the expertise to assess such risks. The EBA agrees on the importance of acknowledging and respecting the different roles, responsibilities, and expertise of competent authorities and AML/CFT supervisors. At relevant instances, Title 5 has been amended to clarify that whereas competent authorities should verify the existence of governance arrangements and mechanisms related to AML/CFT, their actual assessment is performed by the AML/CFT supervisors. Interaction with AML/CFT supervisors further explained in relevant instances. Question 4. What are the appropriate methods for the investment firms to analyse the potential impact of cyclical economic fluctuations on their activities and risks? Are they currently used by investment firms in their risk management processes? Cyclical economic fluctuations Some respondents confirmed the use of stress tests for the assessment of the impact of cyclical fluctuations, using different scenarios depending on the business and operating model of the investment firms. Such respondents reminded that liquidity providers are mostly immune from cyclical market fluctuations due to their business model, benefitting from the spread between bid and ask prices. For such specific cases, these respondents Investment firms should provide forward-looking financial projections under plausible adverse circumstances. The scenarios used by the investment firm should be tailored to its business model and market it is operating on. The EBA is aware of the different business and operating models of investment firms within the EU. However, the provisions of the SREP Guidelines Section 5.6.3 amended confirming that scenarios should be relevant to the investment firm’s business model and the market in which it operates.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 154 Comments Summary of responses received EBA analysis Amendments to the proposals suggested for the stress tests to tackle operational and enterprise risks, as being the most relevant risks under adverse conditions. should apply to all investment firms, therefore not specifying any business model-specific assumptions. Question 5. Do you agree with the proposed criteria for the assessment of the risks-to-capital? Does the breakdown of risk categories and subcategories provide appropriate coverage and scope for the supervisory review, having in mind various business models of investment firms? Preliminary assessment - other risks One respondent suggested the deletion of points a and c of paragraph 247 (251 of the CP), which is concerned with the preliminary assessment to be performed by competent authorities when assessing the other risks not covered by Pillar 1 requirements, claiming that it is a repetition of the assessment requested under other paragraphs of the guidelines. Paragraph 247 (251 of the CP) requires competent authorities to consider a list of items when defining the scope of the assessment of the other risks not covered by Pillar 1 own funds requirements. Such a provision therefore should not be intended as a request to repeat the prudential assessment of these items. No changes. Operational risks not covered by Pillar 1 One respondent suggested to move paragraphs from 252 to 260 (256 to 264 of the CP), concerned with the assessment of the operational risks not covered by Pillar 1 own funds requirements, under the section “Daily Trading Flow” (paragraphs 221 to 222) claiming that the operational risk is already covered under the K-DTF. K-DTF, as defined in Regulation (EU) 2019/2033, captures only some specific operational risks that are linked to a particular activity performed by the investment firm, and therefore not the full scope of potential operational risks arising from all investment firms’ activities. Paragraph 253 of the guidelines (257 of the CP) aims at supporting competent authorities identifying potential additional sources of operational risks and performing an assessment should such risks deemed material. No changes. Risks to capital – assessment of risk-to-market One respondent proposed to add an option in paragraph 148 of the guidelines (152 of the CP), which details what sources of risks-to-capital are applicable to investment firms belonging to Article 21 and subsequent of the Regulation (EU) 2019/2033 state that the provision for the assessment of Risk-to-Market apply only if the investment firm has a trading book. Where the No changes.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 155 Comments Summary of responses received EBA analysis Amendments to the proposals categories 1,2 and 3, to allow competent authorities not to perform the assessment of the Risk-to￾Market for investment firms that do not deal on own account neither underwrite financial instruments and/or place financial instruments on a firm commitment basis but belong to one of the abovementioned categories (i.e. 1,2 or 3). investment firm does not have a trading book excluding the exceptions identified in Article 21(4) of the Regulation (EU) 2019/2033, the Risk-to-Market should not be assessed. Question 6. Do you agree with the proposed guidance for the setting and communication of additional own funds requirement? P2R expression Some respondents contested any automatic increase of P2R, without supervisory assessment. Such potential automatic increase is linked to the proposed P2R expression in the draft RTS on Pillar 2 add-ons (EBA/CP/2021/34) and in the SREP Guidelines for Investment Firms, using both an absolute and a relative amount, with the highest of the two being at all times the effective additional own funds requirement. An increase of own funds requirements determined in accordance with Parts Three and Four of Regulation (EU) 2019/2033 will therefore automatically increase the investment firm’s P2R. Such respondents remarked that this proposal would be particularly detrimental to trading firms with market making obligations, whose capital requirements vary depending on trading volumes and market volatility, notably in case of stress by impeding their business and endangering the supply of liquidity in the market. While Article 40(3) of Directive (EU) 2019/2034 specifies the determination of additional own funds requirement, the Directive is silent on the expression of such additional own fundsrequirement. To achieve higher degree of harmonisation and ensure level playing field, such expression is clarified in the SREP Guidelines for Investment Firms. The CP on the SREP Guidelines for Investment Firms require expressing additional capital requirement using both an absolute and a relative amount, as a percentage of own funds requirements determined in accordance with Article 11 of Regulation (EU) 2019/2033. On the one hand, the relative expression allows for additional capital requirement to properly reflect changes in business activities and in the riskiness of an investment firms, translated into an increase in Pillar 1 requirement, especially during the years where SREP is not performed. On the other hand, the absolute amount sets an adequate minimum level of additional capital requirement to No changes.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 156 Comments Summary of responses received EBA analysis Amendments to the proposals Moreover, one respondent noted that this proposal is not fully in line with Article 40(3) of Directive (EU) 2019/2034, defining P2R as an absolute amount resulting from the difference between the capital considered adequate to cover risks or elements of risks not covered by own funds requirements and the own funds requirements set out in Parts Three or Four of Regulation (EU) 2019/2033. be met at all times, especially for the years where SREP assessment is not conducted. Disclosure of own funds requirements One respondent suggested to limit the disclosure of investment firms’ own funds requirements to the annual publication requirement, despite any potential update of such requirements due to the use of the relative expression for P2R. Such additional disclosures could increase pressure on listed investment firms while not being backed up by clear supervisory rationale. In accordance with Article 46 and 50 of Regulation (EU) 2019/2033, investment firms are expected to disclose their own funds requirement at the same time than the publication of their annual financial statements, if requested by competent authorities. No changes. P2R revisions The respondents enquired on the possibility and frequency of additional own funds requirement’s adjustments in case of an early remediations of supervisory measures. The setting of P2R is linked to the minimum engagement model and SREP assessment. Depending on the specific circumstances of the investment firm, both can be performed more frequently at competent authorities’ discretion and could lead to reviewing P2R. No changes. Question 7. What are your views regarding the interactions between SREP and internal processes of investment firms (such as recovery planning or ICARAP)? ICAAP reliability criteria One respondent suggested to remove comparability as a reliability criterion for the ICAAP, Competent authorities should determine additional own funds requirement in a consistent manner to ensure broad consistency of prudential outcomes No changes.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 157 Comments Summary of responses received EBA analysis Amendments to the proposals due to the variety and specificities of investment firms’ business and operating models. across investment firms. On that basis, and since the ICAAP is one of the key inputs for the determination of such additional own funds requirement, a sufficient level of comparability between the investment firms’ ICAAP risk measurement is crucial to foster level playing field. To take into account the fact that the investment firms in the EU display various business and operating models that may be difficult to compare, such comparability criteria should be applied at an activity/risk-level. ICARAP review Where the investment firm’s ICARAP is deemed partially reliable or unreliable on the basis of competent authorities’ assessment, some respondents suggested to leave the possibility, for the investment firms, to submit an updated ICARAP prior to the determination of additional own funds requirement. In cases where the ICARAP is deemed partially reliable or unreliable, competent authorities could require the investment firm, as a result of their SREP assessment, to reinforce such process and mitigate identified deficiencies, in accordance with Article 39(2)(b) of Directive (EU) 2019/2034. Moreover, in line with paragraph 288 of the SREP Guidelines for Investment Firms, where available, the investment firm could communicate any additional relevant input that may prompt competent authorities to reassess the appropriateness/reliability of ICARAP calculations for a specific risk or category of risk, and/or make adjustment to the ICARAP outcomes, where they prompt doubts about their accuracy. No changes. Mitigation actions Some respondents suggested competent authorities to consider mitigations identified in the ICARAP and, where applicable, recovery plans, Competent authorities should only take into account the risk management and control factors No changes.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 158 Comments Summary of responses received EBA analysis Amendments to the proposals while determining additional own funds requirement. implemented by the investment firm while determining additional own funds requirement. Supervisory benchmark Some respondents suggested supervisory benchmarks to be an optional supervisory tool. Due to the sometimes-limited number of investment firms operating in many EU countries, themselves displaying various business models, such respondents argued that using supervisory benchmark may not provide reliable information to competent authorities or may not ensure a fair SREP assessment. Competent authorities should determine additional own funds requirement in a consistent manner to ensure broad consistency of prudential outcomes across investment firms. In that context and in accordance with paragraphs 287 to 290 of the Consultation Paper on SREP Guidelines, competent authorities should develop and use supervisory benchmarks, taking into account both their implementation burden and the reliability of their outcomes. Where outcomes are deemed not appropriate, in a context of investment firms’ specific circumstances, competent authorities have the possibility to apply supervisory judgment or to reject the outcomes of the benchmark. Paragraph 283 amended emphasizing on the appropriateness of the outcomes of supervisory benchmarks. Question 8. Do you agree with the proposed guidance for the setting and communication of P2G? Would you consider it appropriate to express P2G not only as an absolute amount of own funds but also as a percentage of Pillar 1 own funds requirements? Please provide rationale for your views. P2G determination One respondent sought confirmation that P2G should not be automatically imposed. As referred to in Article 41 of Directive (EU) 2019/2034, competent authorities should determine the P2G where the investment firms’ own funds are insufficient to cover applicable own funds requirements, including additional own funds requirement, under adverse cyclical economic fluctuations. No changes.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 159 Comments Summary of responses received EBA analysis Amendments to the proposals Link between P2G determination and business model One respondent suggested to reinforce the link between P2G determination and the business model of the investment firms. The EBA acknowledges that the investment firm’s business model, strategy, and the environment in which it is operating are key factors for the identification of investment firm’s vulnerabilities and potential risk of harm under adverse conditions. Paragraph 300 amended reinforcing the link between P2G determination and the investment firm’s strategy and business model. P2G and stress-testing One respondent argued that stress tests should not be regulatory prescribed, as the investment firms’ own methodologies are more able to tackle firm￾specific vulnerabilities, while another respondent suggested to rely only on supervisory stress testing. The Directive (EU) 2019/2034 neither prescribe nor prevent competent authorities to perform supervisory stress tests. Where competent authorities decide to perform supervisory stress testing, in line with paragraph 305 of the SREP Guidelines (309 of the CP), competent authorities should take into account the investment firm’s business model and strategy, as well as the environment in which it is operating, ensuring such supervisory stress test captures the investment firm￾specific vulnerabilities and risks of harm. No changes. P2G expression Some respondents contested any automatic increase of P2G, without supervisory assessment. Such potential automatic increase may arise from expressing P2G using both an absolute and a relative amount, with the highest of the two being at all times the effective P2G requirement. In that context, any increase of own funds requirements determined in accordance with Parts Three and Four of Regulation (EU) 2019/2033 will therefore automatically increase the investment firm’s P2G. P2G can be expressed as an absolute amount or as a percentage of own funds requirements, at competent authorities’ discretion. The latter should be preferably used where the vulnerabilities of the investment firm’s business model and its risks under adverse conditions are correlated to potential volatility in its own funds requirements. Paragraph 317 of the consultation paper deleted.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 160 Comments Summary of responses received EBA analysis Amendments to the proposals Such respondents remarked that this proposal would be particularly detrimental to trading firms with market making obligations, whose capital requirements vary depending on trading volumes and market volatility, notably in case of stress, by impeding their business and endangering the supply of liquidity in the market. P2G review The respondents enquired on the possibility and frequency of P2G adjustments in case of an early remediations of supervisory measures, through the common supervisory dialogue. The setting of P2G is linked to the minimum engagement model and SREP assessment. Depending on the specific circumstances of the investment firm, both can be performed more frequently at competent authorities’ discretion and could lead to reviewing P2G. No changes. Question 9. Do you agree with the proposed criteria for the assessment of liquidity risk? Should investment firms that deal on own account, in particular market makers, be subject to more comprehensive liquidity risk assessment? Assessment of risks to liquidity for market makers Respondents suggested that a more comprehensive liquidity assessment for market makers is not necessary, as liquidity providers hold their cash and positions at the clearing members, which, in turn require the investment firm to maintain a certain level of cash and the positive balance between long and short positions Firms dealing on own accounts have no other clients that could demand liquidity while the collateral posted to the clearing members mitigate the risks related to clearing. IFR and IFD address other risks beyond those to clients, including the impact that certain investment firms may have on the functioning and liquidity of the markets they operate in. Reliance on a clearing member does not mitigate liquidity risks in all circumstances. However, investment firms that rely on clearing members guarantees and that centrally clear most or all of their positions, may objectively benefit of a certain degree of risk mitigation. The clearing members’ collateral requirements should be considered in the overall assessment. This additional element has been added to the revised guidelines. Question 10. Do you agree with the proposed guidance for the setting and communication of specific liquidity requirements?

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 161 Comments Summary of responses received EBA analysis Amendments to the proposals Criteria for the determination of liquidity requirements Respondents suggested to include clear qualitative and quantitative criteria that will be taken into account in determining liquidity requirements. Note that setting specific liquidity requirements is addressed under the draft RTS on specific liquidity measures adopted in accordance with Article 42(6) of Directive (EU) 2019/2034. No changes. Frequency of assessment of risks to liquidity Respondents noted that in cases where the frequency of the review of the liquidity requirements is not prescribed in the guidelines, any improvement of the liquidity risk management and reporting may not be reflected until the next supervisory assessment. Therefore, respondents suggest that investments firms might request an updated SREP assessment when they implemented the remediation actions. The SREP being a continuous process, competent authorities and investment firms should engage in supervisory dialogue notably based on the outcomes of the SREP assessment and associated supervisory measures, included where mitigated. Any review of outcome of the SREP assessment concerning liquidity risks will be at competent authority’s discretion. No changes. Question 11. Do you have any views or suggestions with regard to appropriate incorporation of ESG risks within SREP, including any proposed methods or criteria for the assessment of ESG risks within SREP? Scope and scale of ESG supervision Two respondents favoured, at the present stage, a principle-based approach for ESG supervision without prescriptive requirements within the Guidelines. Such approach should be maintained until publication of the EBA report on ESG objectives for the SREP under Article 35 of Directive (EU) 2019/2034, and improvement of market practices on ESG risk monitoring. The CP on the SREP Guidelines for Investment Firms specify common procedures and methodologies for the functioning of the SREP, in accordance with Article 36 and 45 of Directive (EU) 2019/2034, and processes and actions taken in accordance with Article 39 to 42 of that Directive. Further integration of the ESG factors and risks in SREP will be considered following the completion of the EBA report on ESG risks as per Article 35 of Directive (EU) 2019/2034. The EBA is going to complete the Report in coming months after the publication of the SREP GLs for investment firms. No changes.

JOINT EBA AND ESMA GUIDELINES ON SREP FOR INVESTMENT FIRMS 162 Comments Summary of responses received EBA analysis Amendments to the proposals ESG supervision and business model of the investment firm One respondent suggested to tailor ESG risks assessment to the business model and activities of the investment firm, in line with Regulation (EU) 2019/2088 on sustainable finance disclosure. The EBA is aware of the variety of business models, activities and services provided by investment firms in the EU, whose particularities should be taken into account by competent authorities performing their assessment in line with the provisions of Title 4 of the CP on SREP Guidelines for Investment Firms. Such consideration is applicable for the assessment of ESG risks to the business model of the investment firm, that could take into account, among others, information received in accordance with Regulation (EU) 2019/2088. No changes. ESG consideration into the assessment of business model While they overall supported the integration of ESG risks into the business model analysis, the respondents sought clarifications on the extent of the assessment under paragraph 94(g) of the SREP Guidelines (88(g) of the CP) for Investment Firms. The respondent suggested to enlarge the integration of ESG risks into the business model analysis, considering them in every step as defined in paragraph 72 (66 of the CP), in line with the detailed approach taken in the EBA report on management and supervision of ESG risks, published in June 2021. One respondent suggested to consider, within the business model assessment, potential opportunities generated by ESG investment at investment firm’s level notably in terms of competitive advantage created compared to peers or increased ability to answer consumer’s preferences. The CP on the SREP Guidelines for Investment Firms specify common procedures and methodologies for the functioning of the SREP, in accordance with Article 36 and 45 of Directive (EU) 2019/2034, and processes and actions taken in accordance with Article 39 to 42 of that Directive. In accordance with paragraph 72 of the SREP Guidelines (71 of the CP), competent authorities should use their assessment of the business model under Title 4 to identify key vulnerabilities, including vulnerabilities arising from ESG risks, which are most likely to have a material impact on the investment firm’s viability and sustainability. Further integration of the ESG factors and risks in SREP will be considered following the completion of the EBA report on ESG risks as per Article 35 of Directive (EU) 2019/2034. No changes.

163