6.1 General considerations

Competent authorities should assess and score the risks to capital that have been identified as material for the investment firm. To determine the scope of the assessment, competent authorities should first identify the sources of risks to capital to which the investment firm is or may be exposed. To do so, competent authorities should leverage the knowledge gained from the assessment of other SREP elements, from the comparison of the investment firm’s position to peers and from any other supervisory activities. The assessment of the risks to capital should be performed in a proportionate manner, i.e. adjusting the level of detail of the analysis taking into account the nature, size, and complexity of the investment firm.

The purpose of this title is to provide common methodologies to be considered for assessing individual risks and risk management and controls. It is not intended to be exhaustive and gives leeway to competent authorities to take into account other additional criteria that may be deemed relevant based on their experience and the specific features of the investment firm.

This title provides competent authorities with guidance for the assessment of risks and costs related to potential orderly wind-down of the investment firm as well as guidelines for the assessment and scoring of the following categories of risks to capital in the ongoing activities of investment firms:

• a. Risk-to-Client;
• b. Risk-to-Market;
• c. Risk-to-Firm;
• d. other risks.

Paragraph 147, points (a) to (c) are applicable to the assessment of investment firms classified to categories 1, 2 or 3, considering the scope of authorised activities of these investment firms. Where relevant, competent authorities may take into account paragraph 147, points (a) and (c) for the assessment of small and non-complex investment firms meeting the criteria of Article 12 of Regulation (EU) 2019/2033, taking into account the relevance of certain sub-categories listed under the abovementioned risks to capital for these investment firms. Competent authorities should assess the orderly wind-down of an investment firm as well as other risks, both in the case of all investment firms subject to SREP.

The title also identifies a set of sub-categories within each risk category above, which need to be taken into account when risks to capital are assessed. Depending on the materiality of any of these sub-categories to a particular investment firm, they can be assessed and scored individually.

The decision on materiality is based on the most recent available data and can be complemented by supervisory judgment.

Competent authorities should also assess other risks that are identified as material to a specific investment firm but are not listed above. Those other risks, which cannot be reasonably attributed to one of the three categories listed in paragraph 147, points (a) to (c), are a separate category of risks. The following may assist with the identification process:

• a. drivers of own funds requirements;
• b. risks identified in the investment firm’s ICARAP or stress tests if available;
• c. risks arising from the investment firm’s business model (including those identified by other investment firms operating a similar business model);
• d. information stemming from the monitoring of key indicators;
• e. findings and observations from internal or external audit reports;
• f. recommendations and guidelines issued by the EBA, as well as warnings and recommendations issued by macro-prudential authorities or the ESRB that are relevant to the firm; and
• g. reports of breaches and incidents to the competent authorities.

The above elements should also be taken into account by competent authorities when they are planning the intensity of their supervisory activity in relation to the assessment of a specific risk.

For Risk-to-Client, Risk-to-Market, Risk-to-Firm, as well as for fixed overheads requirement, competent authorities should verify the investment firm’s compliance with the minimum requirements specified in Regulation (EU) 2019/2033. However, these guidelines allow competent authorities to extend the scope of the assessment beyond those requirements to form a comprehensive view on risks to capital. In particular, competent authorities should identify situations where certain risks or elements of risk are insufficiently covered by the minimum own funds requirements, despite compliance with the requirements of Regulation (EU) 2019/2033. For instance, the lag due to the use of rolling average for some K-Factors may flatten activity peaks and using tied agents instead of internal staff results in underestimating expenses. This assessment should inform the determination of additional own funds requirement in accordance with section 7.2.1.

In their implementation of the methodologies specified in this title, competent authorities should use information coming from the monitoring of key indicators, as specified in Title 3. Competent authorities should use other quantitative and qualitative indicators where relevant for the purpose of this assessment.

When performing their assessments, competent authorities should use all available information sources, including regulatory reporting, ad-hoc reporting, the investment firm’s internal metrics and reports (including internal audit report, risk management reports, information from the ICARAP), on-site inspection reports and external reports (including the investment firm’s communications to investors, rating agencies). While the assessment is intended to be firm-specific, comparison with peers should be considered to identify potential exposure to risks to capital. For such purposes, peers should be defined on a risk-by-risk basis and might differ from those identified for BMA or other analyses.

For each risk category, competent authorities should assess and reflect in the risk score:

• a. inherent risk (risk exposures); and
• b. the quality and effectiveness of risk management and controls.

Competent authorities should reflect the outcome of the assessment of each risk category in a summary of findings that provides an explanation of the main risk drivers, and a risk score, as specified in the following sections.