Article 383a 3.

the exposure model referred to in paragraph 1 is part of the institution’s internal CVA risk management system that includes the identification, measurement, management, approval and internal reporting of CVA and CVA risk for accounting purposes;

the institution has in place a process for ensuring compliance with a documented set of internal policies, controls, assessment of model performance and procedures concerning the exposure model referred to in paragraph 1;

the institution shall have an independent validation unit that is responsible for the effective initial and ongoing validation of the exposure model referred to in paragraph 1 of this Article; that unit shall be independent from business credit and trading units, including the unit referred to in Article 383(1), point (a), and report directly to senior management; it shall have a sufficient number of staff with a level of skills that is appropriate to fulfil that purpose;

the senior management shall be actively involved in the risk control process and shall regard CVA risk control as an essential aspect of the business, to which appropriate resources need to be devoted;

the institution shall document the process for initial and ongoing validation of the exposure model referred to in paragraph 1 to a level of detail that would enable a third party to understand how the models operate, their limitations, and their key assumptions, and recreate the analysis; that documentation shall set out the minimum frequency with which ongoing validation will be conducted, as well as other circumstances, such as a sudden change in market behaviour, under which additional validation shall be conducted; it shall describe how the validation is conducted with respect to data flows and portfolios, what analyses are used and how representative counterparty portfolios are constructed;

the pricing models used in the exposure model referred to in paragraph 1 for a given scenario of simulated market risk factors shall be tested against appropriate independent benchmarks for a wide range of market states as part of the initial and ongoing model validation process; pricing models for options shall account for the non-linearity of option value with respect to market risk factors;

an independent review of the institution’s internal CVA risk management system referred to in point (a) of this paragraph shall be carried out by the institution’s internal auditing process on a regular basis; that review shall include the activities both of the unit referred to in Article 383(1), point (a), and of the independent validation unit referred to in point (c) of this paragraph;

the regulatory CVA model used by the institution for calculating the simulated discounted future exposure referred to in paragraph 1, shall reflect transaction terms and specifications and margin agreements in a timely, complete, and conservative manner; the terms and specifications shall reside in a secure database subject to formal and periodic audit; the transmission of transaction terms and specifications data and margin agreements to the exposure model shall also be subject to internal audit, and formal reconciliation processes shall be in place between the internal model and source data systems to verify on an ongoing basis that transaction terms, specifications and margin agreements are being reflected in the exposure system correctly or, at least, conservatively;

the current and historical market data inputs used in the model by the institution for calculating the simulated discounted future exposure referred to in paragraph 1 shall be acquired independently of the business lines and fed into that model in a timely and complete manner and maintained in a secure database subject to formal and periodic audit; an institution shall have a well-developed data integrity process to handle inappropriate data observations; where the model relies on proxy market data, an institution shall design internal policies to identify suitable proxies and shall demonstrate empirically on an ongoing basis that the proxies provide a conservative representation of the underlying risk;

the exposure model referred to in paragraph 1 shall capture the transaction specific and contractual information necessary in order to aggregate exposures at the level of the netting set; an institution shall verify that transactions are assigned to the appropriate netting set within the model.