Having regard to the Treaty on the Functioning of the European Union,

Having regard to Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC, and in particular the third subparagraph of Article 78(7) thereof,

1. (1)

   Competent authorities carrying out annual assessments of the quality of the internal approaches of institutions in accordance with Article 78(3) of Directive 2013/36/EU shall share those assessments with all other relevant competent authorities and the European Banking Authority (EBA) within three months after the circulation of the report produced by EBA referred to in the second subparagraph of Article 78(3) of that Directive.

2. (2)

   Upon receipt of the assessments referred to in paragraph 1, EBA shall share them with the relevant competent authorities responsible for the supervision of institutions belonging to a group subject to consolidated supervision where the competent authorities that prepared those assessments have not already done so.

When sharing assessments made in accordance with Article 78(3) of Directive 2013/36/EU, competent authorities shall provide the following information:

1. (a)

   the conclusions and rationale of their assessment, based on the application of the assessment standards referred to in Articles 3 to 11;

2. (b)

   their views on the level of potential underestimation of own fund requirements stemming from the internal approaches used by institutions.

1. (1)

   When carrying out the annual assessment of the quality of internal approaches paying particular attention to:

   1. (i)

      those exposures that exhibit significant differences in own fund requirements for the same exposure;

   2. (ii)

      approaches where there is particularly high or low diversity, and also where there is a significant and systematic under-estimation of own funds requirements;

   competent authorities shall identify the internal approaches that need specific assessment in a manner which is proportionate to the nature, scale and complexity of the risks inherent in the business model as well as the relevance of the portfolios included in Implementing Regulation (EU) 2016/2070 for the institution in relation to the risk profile of the institution.

   1. (a)

      they shall treat values resulting from modelling which are considered as extreme in the EBA report as an indication of significant differences in own funds requirements in accordance with the first subparagraph of Article 78(3) of Directive 2013/36/EU;

   2. (b)

      they shall treat values resulting from modelling and the standard deviation of those values for exposures in the same benchmark portfolio or similar benchmarking portfolios identified in the EBA report as a preliminary indication of significant differences and low or high diversity, as applicable, in own funds requirements in accordance with the first subparagraph of Article 78(3) of Directive 2013/36/EU;

   3. (c)

      they shall treat potential differences computed in accordance with Article 4 of this Regulation as a preliminary indication of significant and systematic underestimation of own funds requirements in accordance with the first subparagraph of Article 78(3) of Directive 2013/36/EU;

   4. (d)

      they shall treat potential differences between estimated risk parameters reported by the institutions under Implementing Regulation (EU) 2016/2070 and the historically observed risk parameters ("outturns") reported by the institutions in accordance with that Implementing Regulation as a preliminary indication of significant differences in own funds requirements in accordance with the first subparagraph of Article 78(3) of Directive 2013/36/EU;

   5. (e)

      they shall treat potential differences between the own funds requirements for credit risk as reported by the institutions under Implementing Regulation (EU) 2016/2070 and the own funds requirements for credit risk that result from the use of outturns by the institutions in accordance with that Implementing Regulation or computed by EBA in its report referred to in the second subparagraph of Article 78(3) of Directive 2013/36/EU as a preliminary indication of significant and systematic underestimation of own funds requirements in accordance with the first subparagraph of Article 78(3) of that Directive. When using the report provided by EBA, competent authorities may take into account possible data limitations and reflect this in their assessment as deemed appropriate.

2. (2)

   When carrying out the assessment referred to in paragraph 1 of this Article, competent authorities shall apply the assessment standards referred to in Articles 6 to 11.

1. (1)

   Competent authorities shall compute the potential differences referred to in point (c) of Article 3(1) by subtracting the own funds requirements for credit risk as reported by the institutions under Implementing Regulation (EU) 2016/2070 from the own funds requirements for credit risk that result from the application of the standardised approach. In addition, they shall calculate the benchmark statistics regarding those differences as follows:

   1. (a)

      for low-default portfolios (LDPs), at the portfolio level excluding the exposures to Member States' central government and central banks denominated and funded in the domestic currency as referred to in Article 114(4) of Regulation (EU) No 575/2013;

   2. (b)

      for high-default portfolios (HDPs), at the portfolio level.

2. (2)

   For the computation of benchmark statistics referred to in paragraph 1 of this Article, competent authorities shall use the own funds requirements for credit risk adjusted at the level applied for the computation of the transitional Basel I floor based on Article 500 of Regulation (EU) No 575/2013.

For the purposes of point (d) and (e) of Article 3(1), competent authorities shall use both one-year and five-year average outturns for computing the differences.

1. (1)

   When carrying out the assessment referred to in Article 3(1) of this Regulation, competent authorities shall assess the compliance of institutions with the requirements of Implementing Regulation (EU) 2016/2070, where institutions have exercised the option of Article 3(2) of that Implementing Regulation in order to submit more limited reporting under that Implementing Regulation. Competent authorities shall do so by confirming the rationale and justification behind any limitations in the reporting that these institutions have provided under that Implementing Regulation.

2. (2)

   When carrying out the assessment referred to in Article 3(1), competent authorities shall investigate the reasons for the significant and systematic underestimation and for the high or low diversity in the own funds requirements referred to in that paragraph, as follows:

   1. (a)

      for assessments relating to credit risk approaches, by applying the standards referred to in Articles 7 and 8;

   2. (b)

      for assessments relating to market risk approaches, by applying the standards referred to in Articles 9 to 11.

1. (1)

   When carrying out an assessment referred to in Article 3(1) relating to credit risk approaches, competent authorities shall use at least the information on the internal approaches applied to the supervisory benchmarking portfolios which is contained in the following documents, where relevant:

   1. (a)
   2. (b)

      the institution's regular validation reports;

   3. (c)

      model documentation including manuals, documentation on the development and calibration of the model and methodology for the internal approaches;

   4. (d)

      reports regarding on-site visits.

2. (2)

   When carrying out an assessment referred to in Article 3(1) relating to credit risk approaches, competent authorities shall take into account the following elements, where relevant:

   1. (a)

      whether the institution uses own estimates of loss given default (LGD) and conversion factors in accordance with Article 143 of Regulation (EU) No 575/2013;

   2. (b)

      the model's application perimeter and the representativeness of the benchmarking portfolios;

   3. (c)

      key characteristics of the models such as distinguishing between models designed and calibrated at the centralised group level (global) and models designed and calibrated only at the level of the host jurisdiction (local), vendor and institution models, models developed and calibrated using internal data and models developed and calibrated using external data;

   4. (d)

      the date of model approval and the date of model development;

   5. (e)

      the comparison of predicted and observed default rates over a relevant time period;

   6. (f)

      the comparison of predicted downturn LGDs with observed LGDs;

   7. (g)

      the comparison of estimated and observed exposures at default;

   8. (h)

      the length of the time series used and, as applicable, the inclusion of distressed years or nature and materiality of any adjustment for capturing downturn conditions and adding margins of conservatism in the models' calibration;

   9. (i)

      recent changes in the composition of the portfolio of the institution to which the internal approach is applied;

   10. (j)

       the micro- and macroeconomic situation of the institution's portfolio, the risk and business strategy as well as internal process, such as recovery procedures for defaulted assets ("workout procedures");

   11. (k)

       the current position in the cycle, choice of rating philosophy between point-in-time (PIT) or through-the-cycle (TTC) and the observed cyclicality in the model;

   12. (l)

       the number of rating grades and dimensions used by the institutions in the probability of default (PD), LGD and conversion factor models;

   13. (m)

       the default and cure rates definitions used by the institution;

   14. (n)

       the inclusion or not of open workout procedures in the time series used for the calibration of the LGD models, where applicable.

3. (3)

   Where competent authorities deem that the information referred to in paragraph 1 is not sufficient in order to reach conclusions in relation to the elements listed in paragraph 2, they shall promptly collect from the institutions additional information they deem necessary in order to finalise their assessment.

   When deciding on what additional information to collect, competent authorities shall consider the materiality and relevance of the deviation of the institution's parameters and own funds requirements. Competent authorities shall collect the additional information in the way they deem to be most appropriate, including through questionnaires, interviews and ad hoc on-site visits.

1. (1)

   When carrying out an assessment referred to in Article 3(1) relating to the LDP counterparties set out in template 101 of Annex I of Implementing Regulation (EU) 2016/2070, competent authorities shall assess whether the differences between the own funds requirements for credit risk of an institution and those of its peers are driven by any of the following:

   1. (a)

      different rank ordering of the counterparties included in the LDP samples or different PD levels assigned to each grade;

   2. (b)

      specific facility types, collateral instruments or location of the counterparties;

   3. (c)

      heterogeneity in the PDs, LGDs, maturities or conversion factors;

   4. (d)

      collateralisation practices;

   5. (e)

      level of independency from external ratings assessment and frequency in the internal rating update.

2. (2)

   Where an institution classifies a counterparty as "defaulted" while other institutions classify it as "performing", or vice versa, competent authorities shall apply the approach referred to in paragraph 1 to that counterparty.

1. (1)

   When carrying out an assessment referred to in Article 3(1), competent authorities shall use at least the information on the internal approaches applied to the supervisory benchmarking portfolios which is contained in the following documents, where relevant:

   1. (a)
   2. (b)

      the institution's validation reports, conducted by qualified independent parties, when the internal model is initially developed and when any significant changes are made to the internal model. This information shall include tests to demonstrate that any assumptions made within the internal approaches are appropriate and do not underestimate or overestimate the risk, specific back-testing designed in relation to the risks and structures of their portfolios and use of hypothetical portfolios to ensure that the internal approaches are able to account for particular structural features that may arise, such as material basis risks and concentration risk;

   3. (c)

      notifications of the number and justification of daily back-testing over-shootings, observed over the previous year, on the basis of back-testing on hypothetical and actual changes in the portfolio's value;

   4. (d)

      model documentation including manuals, documentation on the development and calibration of the model and methodology for the internal approaches;

   5. (e)

      reports regarding on-site visits.

2. (2)

   When carrying out an assessment referred to in Article 3(1), competent authorities shall take into account the following elements, where relevant:

   1. (a)

      the choice of the VaR methodology applied by the institution;

   2. (b)

      the model's application perimeter and the representativeness of the benchmarking portfolios;

   3. (c)

      the justification and rationale in case a risk factor is incorporated into the institution's pricing model but not into the risk-measurement model;

   4. (d)

      the set of risk factors incorporated corresponding to the interest rates in each currency in which the institution has interest rate sensitive on- or off-balance sheet positions;

   5. (e)

      the number of maturity segments in which each yield curve is divided;

   6. (f)

      the methodology applied to capture the risk of less than perfectly correlated movements between different yield curves;

   7. (g)

      the set of risk factors modelled corresponding to gold and to the individual foreign currencies in which the institution's positions are denominated;

   8. (h)

      the number of risk factors used to capture equity risk;

   9. (i)

      the methodology applied to assess the risk arising from less liquid positions and positions with limited price transparency under realistic market scenarios;

   10. (j)

       the track record of the proxies used in the model, assessment of their impact on the risk metrics;

   11. (k)

       the length of the time series used for VaR;

   12. (l)

       the methodology applied for determining the stressed period for sVaR, adequacy of the stressed period selected for the benchmarking portfolios;

   13. (m)

       the methodologies applied in the risk-measurement model to capture nonlinearities for options, in particular where the institution uses Taylor-approximation approaches instead of full revaluation, and other products as well as to capture correlation risk and basis risk;

   14. (n)

       the methodologies applied to capture name-related basis risk and whether they are sensitive to material idiosyncratic differences between similar but not identical positions;

   15. (o)

       the methodologies applied to capture event risk;

   16. (p)

       for internal incremental default and migration risk (IRC), the methodologies applied to determine liquidity horizons by position, as well as the PDs, LGDs and transition matrices used in the simulation referred to in Article 374 of Regulation (EU) No 575/2013;

   17. (q)

       for the internal approach for correlation trading, the methodologies applied to capture risks laid down in Article 377(3) of Regulation (EU) No 575/2013, as well as the correlation assumptions between the relevant modelled risk factors.

3. (3)

   Where competent authorities deem that the information referred to in paragraph 1 is not sufficient in order to reach conclusions in relation to the elements listed in paragraph 2, they shall promptly collect from the institutions additional information they deem necessary in order to finalise their assessment.

   When deciding on what additional information to collect, competent authorities shall consider the materiality and relevance of the deviation of the institution's parameters and own funds requirements. Competent authorities shall collect the additional information in the way they deem to be most appropriate, including through questionnaires, interviews and ad hoc on-site visits.

1. (1)

   When carrying out an assessment referred to in Article 3(1) relating to market risk approaches, competent authorities shall apply the standards set out in paragraphs 2 to 8 of this Article.

2. (2)

   When assessing the causes of the differences for VaR values, competent authorities shall consider both of the following:

   1. (a)
   2. (b)

      the dispersion observed in the VaR metric provided by institutions under Implementing Regulation (EU) 2016/2070.

3. (3)

   For institutions using historical simulation, competent authorities shall assess the variability observed both in the alternative homogenised VaR calculations and in the VaR data reported by institutions referred to in paragraph 2, in order to determine the effect of the different options applied by those institutions within the historical simulation.

4. (4)

   Competent authorities shall assess the dispersion among institutions in relation to particular risk factors included in each one of the non-aggregated benchmark portfolios using the observed volatility and the observed correlation in the profit-and-loss vector provided by institutions applying historical simulation for non-aggregated portfolios.

5. (5)

   Competent authorities shall analyse VaR models of an institution for portfolios which might show a profit-and-loss time-series that significantly diverges from the profit-and-loss time-series of the institution's peers, even where the final own funds requirement for that particular portfolio is similar to the one provided by the institution's peers in absolute terms.

6. (6)

   In addition, for VaR, sVaR, IRC and models used for correlation trading activities, competent authorities shall assess the effect of regulatory variability drivers by clustering the metric outcomes by the different modelling options.

7. (7)

   Once the causes of variability stemming from the different regulatory options have been assessed, competent authorities shall assess whether the remaining variability and underestimation of own funds requirements is driven by one or more of the following:

   1. (a)

      misunderstandings regarding the positions or risk factors involved;

   2. (b)

      incomplete model implementation;

   3. (c)

      missing risk factors;

   4. (d)

      differences in calibration or data series used in modelling simulation;

   5. (e)

      additional risk factors incorporated in the model;

   6. (f)

      alternative model assumptions applied;

   7. (g)

      differences attributable to the methodology applied by the institution.

8. (8)

   Competent authorities shall carry out a comparison between the outcomes obtained from portfolios, which only differ in a specific risk factor, to determine whether institutions have incorporated such a risk factor into their internal models consistently with their peer institutions.

1. (1)

   Where assessing the level of own funds of each institution, competent authorities shall take into account both of the following:

   1. (a)

      the level of own funds by non-aggregated portfolio;

   2. (b)

      the effect of the diversification benefit applied by each institution in aggregated portfolios, by comparing the sum of own funds of the non-aggregated portfolios referred to in point (a) of this paragraph with the level of own funds provided for the aggregated portfolio

2. (2)

   Where assessing the level of own funds by institution, competent authorities shall also take into account both of the following:

   1. (a)

      the effect of the supervisory add-ons;

   2. (b)

      the effect of the supervisory actions not contemplated in the data collected.

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.