BIPRU 4.2 The IRB approach: High level material

1. (1)

   This guidance sets out the basis on which a firm may rely upon a rating system or data provided by another member of its group.

2. (2)

   A firm may rely upon a rating system or data provided by another member of its group if the following conditions are satisfied:

   1. (a)

      the firm only does so to the extent that it is appropriate, given the nature and scale of the firm's business and portfolios and the firm's position within the group;

   2. (b)

      the group is an EEA banking and investment group;

   3. (c)

      the integrity of the firm's systems and controls is not adversely affected;

   4. (d)

      the outsourcing of these functions meets the requirements of SYSC; and

   5. (e)

      (if the provision of the rating system or data is not carried out in the United Kingdom or in the jurisdiction of the competent authority that is the lead regulator of the group) the firm can demonstrate to the appropriate regulator that the ability of the appropriate regulator and that lead regulator to carry out their responsibilities under the Handbook, the Banking Consolidation Directive and the Capital Adequacy Directive are not adversely affected.

3. (3)

   If a firm does use a rating system or data provided by another member of its group, the requirements in BIPRU 4 continue to apply to that firm in respect of that rating system and data. A firm cannot absolve itself of the responsibility for complying with those requirements by claiming that any breach is caused by the actions of a third party to which the firm has delegated tasks. The rating system and data provision are still those of the firm, even though personnel elsewhere in the firm's group are carrying out these functions on its behalf. So any references in BIPRU to what a firm, its personnel and its management should and should not do still apply.

4. (4)

   If a firm does use a rating system or data provided by another group member, the firm's governing body should formally delegate those functions to the persons or bodies that are to carry them out.

5. (5)

   Before delegating the provision of a rating system or data to another group member, the firm's governing body should have explicitly considered the arrangement and decided that it is appropriate and that it enables the firm to meet the conditions in (2).

1. (1)

   This paragraph provides guidance on BIPRU 4.2.2 R and in particular BIPRU 4.2.2 R (1).

2. (2)

   The information that a firm produces or uses for the purpose of the IRB approach should be reliable and take proper account of the different users of the information produced (customers, shareholders, regulators and other market participants).

3. (3)

   A firm should establish quantified and documented targets and standards, against which it should test the accuracy of data used in its rating systems.

4. (4)

   Tests under (3) might include:

   1. (a)

      report and accounts reconciliation, including completeness in relation to (b);

   2. (b)

      whether every exposure has a PD, LGD and, if applicable, conversion factor for reporting purposes;

   3. (c)

      whether the firm's risk control environment has key risk indicators for the purpose of monitoring and ensuring data accuracy;

   4. (d)

      whether the firm has an adequate business and information technology infrastructure with fully documented processes;

   5. (e)

      whether the firm has clear and documented standards on ownership of data (including inputs and manipulation) and timeliness of current data (daily, monthly, real time); and

   6. (f)

      whether the firm has a comprehensive quantitative audit programme.

5. (5)

   The reconciliation referred to in 4(a) should be reasonably fit for purpose. In particular it should meet the standards in (6) and (7).

6. (6)

   For data inputs, testing for accuracy of data, including the reconciliation referred to in 4(a), should be sufficiently detailed so that, together with other available evidence, it gives reasonable assurance that data input into the rating system is accurate, complete and appropriate. Input data fails the required standard if it gives rise to a serious risk of material misstatement in the capital requirement either immediately or subsequently.

7. (7)

   For data outputs, the firm, as part of the reconciliation referred to in 4(a), should be able to identify and explain material differences between the outputs produced under accounting standards and those produced under the requirements of the IRB approach, including in relation to areas that address similar concepts in different ways (for example expected loss on the one hand and accounting provisions on the other).

8. (8)

   A firm should have clear and documented standards and policies about the use of data in practice (including information technology standards) which should in particular cover the firm's approach to the following:

   1. (a)

      data access and security;

   2. (b)

      data integrity, including the accuracy, completeness, appropriateness and testing of data; and

   3. (c)

      data availability.

1. (1)

   This paragraph provides guidance on BIPRU 4.2.2 R and in particular BIPRU 4.2.2 R (2).

2. (2)

   The IRB approach as applicable to a firm should be an integral part of its business and risk management processes and procedures to the extent that credit risk is relevant to them. It should also have a substantial influence on its decision-making and actions.21

   1. (a)

      particular regard should be had to the use of the IRB approach in:

      1. (i)

         credit approval;

      2. (ii)

         individual and portfolio limit setting;

      3. (iii)

         reporting of credit risk information; and

      4. (iv)

         provisioning;21

   2. (b)

      other relevant aspects include:

      1. (i) 2

         assessment of economic capital;

      2. (ii)

         2internal capital allocation so far as related to credit risk;

      3. (iii)

         2risk appetite;

      4. (iv)

         2strategy and acquisitions;

      5. (v)

         2profitability and performance; and

      6. (vi)

         2performance-related remuneration;

   3. (c)

      the carrying out of the firm's obligations under the overall Pillar 2 rule; and

   4. (d)

      matters relating to the firm's infrastructure, including information technology, skills and resources and organisational culture.

This paragraph provides further guidance on BIPRU 4.2.2 R and in particular BIPRU 4.2.2 R (2). In the appropriate regulator's view risk management has an essential role in informing risk decisions. However, an essential role does not necessarily mean an exclusive role or even always a primary role. There may be justifiable differences between the IRB approach and the firm's use of rating systems for its internal purposes as referred to in BIPRU 4.2.2 R (2). For example, internal standards and policies may refer to estimates of PD and LGD for the length of the asset rather than to estimates based on a one-year period (in the case of PD estimates) or on an economic downturn (in the case of LGD estimates) required by the IRB approach.

If a firm uses scorecards for its internal credit approval process and the models it uses for the purpose of the IRB approach are fundamentally different from those scorecards, a firm's demonstration of how this is compatible with BIPRU 4.2.2 R (2) might include demonstrating that estimates calculated under the IRB approach are used to change sanctioning decisions at an individual or portfolio level. Examples of this might include amending cut-offs, the application of policy rules, the revision of an existing scorecard or the introduction of a new one or taking strategic decisions on which segments of the market to target.

To the extent that a firm uses LGD estimates in its internal risk management processes that differ from the downturn LGDs used in the calculation of risk weighted assets3 (see BIPRU 4.3.103 R), the reasons for the difference should be documented in accordance with BIPRU 4.3.109 R.

In meeting the experience requirement under BIPRU 4.2.11 R, the appropriate regulator would expect a firm to be able to demonstrate that it has been:

1. (1)

   operating an internal rating system with estimates of PD;

2. (2)

   meeting the standards in BIPRU 4 for senior management knowledge and reporting; and

3. (3)

   meeting the standards in BIPRU 4 relating to the use of rating systems in its business;

for the required minimum 3 year period.

In meeting the experience requirement under BIPRU 4.2.13 R, the appropriate regulator would expect a firm to be able to demonstrate that it has been:

1. (1)

   operating an internal rating system with estimates of LGD and with conversion factors; and

2. (2)

   compliant with BIPRU 4.2.11 R as applied to the advanced IRB approach.

for the required minimum 3 year period.

In the appropriate regulator's view the standard required by BIPRU 4.2.11 R and BIPRU 4.2.13 R is for a rating system to be improved in the light of experience during the three year period so that it meets the minimum requirements more fully for the last year than for the two prior years, provided that the rating system has not changed so profoundly that experience from the first or second years becomes of marginal relevance in assessing the reliability of the changed rating system.

1. (1)

   A firm should achieve full roll-out of the IRB approach to all its exposures, subject to the exemptions outlined in BIPRU 4.2.26 R, within the period specified in its IRB permission. A firm should not retain a permanent mix of portfolios on the standardised approach and the IRB approach, on the foundation IRB approach and the advanced IRB approach or on a mixture of all approaches with the exception of portfolios covered by those exemptions.

2. (2)

   This applies to a move:

   1. (a)

      from the standardised approach to the IRB approach;

   2. (b)

      from the foundation IRB approach to the advanced IRB approach; and

   3. (c)

      from the transitional rules and guidance for BIPRU to the IRB approach.

3. (3)

   The period referred to in BIPRU 4.2.20 R (1) will generally be not more than three years of starting use of the IRB approach or the advanced IRB approach as applicable.

The appropriate regulator will not agree to a firm's request to revoke or vary its IRB permission so as to permit the firm to revert to the standardised approach except for demonstrated good cause. Likewise, the appropriate regulator will not agree to a firm's request to revoke or vary its IRB permission so as to permit the firm to revert to the foundation IRB approach if the IRB permission provides for it to use the advanced IRB approach, except for demonstrated good cause.

As part of the application for an IRB permission, a firm should have a well documented policy explaining the basis on which exposures are to be selected for permanent exemption from the IRB approach and for treatment under the standardised approach. The firm's roll out plan should also contain provisions for the continuing application of that policy on a consistent basis over time.

A firm intending to make use of BIPRU 4.2.26 R (2) or BIPRU 4.2.26 R (3) should demonstrate to the appropriate regulator when applying for an IRB permission that it meets the requirements of those provisions with respect to its sovereign or, as the case may be, institutional, exposures.

Where BIPRU 4.2.31 R applies:

1. (1)

   the 15% limit in BIPRU 4.2.30 R (2) is a combined limit for excluded exposures remaining on the standardised approach and excluded exposures remaining on the foundation IRB approach; and

2. (2)

   the calculation in BIPRU 4.2.30 R (2)(a) is carried out under whichever method of calculation would be applicable to the exposure in question.

1. (1)

   Generally, the appropriate regulator will consider excluding, through a firm's IRB permission, exposures falling into BIPRU 4.2.26 R (6) from the IRB approach. The degree to which this exclusion applies will be set out in the firm's IRB permission.

2. (2)

   Exposures excluded under (1) will be eligible for a 0% risk weight under the standardised approach if they satisfy the conditions in BIPRU 3.2.25 R to BIPRU 3.2.27A R5 (Zero risk weight for certain intra-group exposures).

   5
3. (3)

   Exposures to or holdings in any non-financial undertakings in a firm's group are not eligible for permanent exemption from the IRB approach under BIPRU 4.2.26 R (6), as they are not subject to consolidated supervision. It is also the appropriate regulator's policy that exposures to or holdings in any insurance undertaking are ineligible. Such exposures should remain on the IRB approach unless excluded under another part of BIPRU 4.2.26 R.

4. (4)

   If a firm uses the exemption in (1) it should have a policy that:

   1. (a)

      provides for the identification of connected counterparties excluded under (1);

   2. (b)

      identifies exposures that would be permanently exempted from the IRB approach under (1); and

   3. (c)

      identifies the connected counterparty exposures that are not permitted to be permanently exempted from the IRB approach under (1).

5. (5)

   The policy in (4) should be applied consistently to all exposures excluded under (1).

1. (1)

   This guidance deals with some possible effects of acquiring a major new business after the grant of an IRB permission.

2. (2)

   A firm should if possible ensure that the exposures arising through the acquisition are dealt with in accordance with the firm's IRB permission.

3. (3)

   If the acquisition is made during the currency of a roll out plan under BIPRU 4.2.18 R, a firm should ensure that the exposures arising through the acquisition are dealt with in accordance with that plan. For these purposes the existing and the acquired business should be considered together. The whole of the firm's business, including the newly acquired business, should be included in both the denominator and numerator of the fraction in BIPRU 4.2.30 R.

4. (4)

   If a firm cannot comply with (2) the appropriate regulator will consider an application to vary the firm's IRB permission in order to deal with the acquisition. For example the appropriate regulator may agree to extend the time by which the roll out should be completed (see BIPRU 4.2.20 R). However any such variation should be consistent with the provisions of BIPRU 4.2 that would have applied if the acquisition had been included in the firm's original application for an IRB permission.

5. (5)

   If the acquisition is made after a firm has completed its roll out under BIPRU 4.2.18 R the appropriate regulator will not in general agree to an application to treat an exposure:

   1. (a)

      under the standardised approach if it would otherwise be treated under the IRB approach under the firm's IRB permission; or

   2. (b)

      under the foundation IRB approach if it would otherwise be treated under the advanced IRB approach under the firm's IRB permission.

6. (6)

   Any application to disapply the policy in (5) will be treated in accordance with the approach set out in BIPRU 4.2.25 G.

7. (7)

   The appropriate regulator will also adopt the approach in (5) while a roll out plan is in progress if, in relation to an exposure of a particular type, the period for completion of the roll out for those exposures under that plan has ended.