6.6 Muude riskide hindamine

Pädevad asutused direktiivi (EL) 2019/2034 artiklitega 36 ja 40 kohaselt hindama, kui olulised on investeerimisühingu kapitalile muud riskid, mis ei ole hõlmatud 1. samba omavahendite nõuetega. Nende muude riskide hindamisel peaksid pädevad asutused võtma arvesse investeerimisühingu tegevuse laadi ja keerukust, mis mõjutab nende riskide olulisust.

6.6.2 Olemuslike riskide hindamine

1. samba omavahendite nõuetega hõlmamata olemuslike riskide hindamise kaudu peaksid pädevad asutused määrama kindlaks investeerimisühingu riskide peamised tegurid ja hindama nende riskide mõju olulisust investeerimisühingu jaoks. Selliste riskide hindamine peaks koosnema järgmistest põhietappidest:

• a. esialgne hindamine;
• b. selliste investeerimistegevuste laadi ja ulatuse hindamine, millega kaasneb risk investeerimisühingule, mis ei ole hõlmatud 1. samba omavahendite nõuetega;
• c. nende tegevustega seotud süsteemide ja protsesside hindamine.

Pädevad asutused peaksid hindama riske, mida 1. samba omavahendite nõuded ei hõlma, nii praegusest kui ka tuleviku seisukohast.

Kui asjakohane, peaksid pädevad asutused hindama ka muid riske kui need, mis on loetletud käesolevas peatükis.

Esialgne hindamine

Et määrata kindlaks selliste riskide hindamise ulatus, mis ei ole hõlmatud 1. samba omavahendite nõuetega, peaksid pädevad asutused kõigepealt tuvastama nende riskide allikad, millele investeerimisühing on või võib olla avatud.

71

Pädevad asutused peaksid arvestama vähemalt järgmist:

• a. ärimudel ja riskivalmidus;
• b. IT-lahenduste ettevõttesisene arendamine või allhange;
• c. tugifunktsioonid, nt vastavuskontroll, õigusfunktsioon, maksud (ka allhanke korral);
• d. kohtuasjade ja kohtuvaidluste kulud;
• e. tegevuskahju kokku, sealhulgas sise- ja välispettuste kulud;
• f. kauplemisportfelliväliste tegevuste ulatus.

Pädevad asutused peaksid tegema esialgse analüüsi, võttes arvesse eespool nimetatud muutumist aja jooksul, et kujundada teadlik seisukoht investeerimisühingu muude riskide peamistest tegurite kohta.

Kauplemisportfellivälistest tegevustest tulenev intressirisk

Pädevad asutused peaksid hindama investeerimisühingu intressiriski, mis tuleneb kauplemisportfellivälistest tegevustest.

Pädevad asutused peaksid hindama, kuidas intressimäärade muutused võivad avaldada negatiivset mõju investeerimisühingu varadele, kohustustele ja bilansivälistele riskipositsioonidele. Et määrata paremini kindlaks investeerimisühingu keerukus ja intressiriski profiil, peaksid pädevad asutused mõistma ka tema varade, kohustuste ja bilansiväliste riskipositsioonide põhiomadusi.

Kvantitatiivsel hindamisel peaksid pädevad asutused võtma arvesse investeerimisühingu kauplemisportfellivälistest tegevustest tuleneva intressiriski mõõtmise sisemetoodikate tulemusi. Lisaks peaksid pädevad asutused kaaluma asjakohaseid šokistsenaariume, arvestades investeerimisühingu kauplemisportfellivälistest tegevustest tuleneva intressiriskiga seotud riskipositsiooni olemust.

Competent authorities should assess operational risks not covered by minimum own funds requirements in accordance with Regulation (EU) 2019/2033. These risks might lead to direct operational losses and to indirect losses resulting from complaints and litigation. Large operational risks may also lead to a shortage of staff in key positions. The assessment should take into account not only operational losses, but also near misses and operational risk events ended with a gain.

Competent authorities should consider the following sources of inherent risk and, where relevant, focus the assessment on those aspects, which are considered the most significant for the investment firm:

• a. workplace safety;
• b. damage to physical assets;
• c. internal fraud;
• d. external fraud;
• e. ICT risks;
• f. conduct risk;
• g. regulatory, legal and fiscal risks;
• h. model risk, in relation to models used for business purposes;
• i. insufficient (both qualitative and quantitative) human and technical resources in key positions;
• j. reputational risk.

As part of all SREP assessments, competent authorities should form a view on the degree of ICT risk, and the consistency of ICT operations with the business strategy. Competent authorities should include in their assessment all relevant aspects of ICT risk, such as security risk, IT projects risk and ICT management risk, to the extent that this is not already covered by other parts of these guidelines, and having regard to the EBA Guidelines on ICT and security risk²¹ and the ESMA Guidelines on outsourcing to cloud service providers²² ;

²¹ EBA Guidelines on ICT and security risk management (EBA/GL/2019/04).

²² ESMA Guidelines on outsourcing to cloud service providers (ESMA50-164-4285).

Competent authorities should form a view on the degree of conduct risk related to investment and market activities of the investment firm, to the extent that it is not captured by Pillar 1 own funds requirements. Conduct risk should be understood as the current or prospective risk incurred by clients, markets or the firm itself due to an inappropriate behaviour of the firm or its staff. This risk may arise from cases of wilful or negligent misconduct (including inappropriate supply of financial services), to the extent that they might lead to negative financial or reputational impacts. This reputational risk may in turn cause a loss in market shares or key clients, and an increase of clients’ complaints.

Competent authorities should focus on the following sources of inherent conduct risk where relevant:

• a. closure or suspension of a fund;
• b. number of misconduct incidents: mis-selling, market manipulation;
• c. regulatory penalties incurred.

Competent authorities should form a view on regulatory, legal, and fiscal risks arising from non-compliance with laws or regulations. These risks might lead to litigation and penalties for the investment firm. Remedial programmes may also incur large expenses to comply with law and regulations.

Competent authorities should focus on these sources of inherent regulatory, legal, and fiscal risks where relevant:

• a. costs for achieving compliance with applicable regulations;
• b. payment of fines or other sanctions for non-compliance;
• c. tax reassessment or payment of late fees, fines and penalties;
• d. anticipation of regulatory changes relevant for the investment firm.

Competent authorities should assess the risk relating to models used for business purposes, including valuation/pricing models, models for algorithmic trading and other models which may have significant impact on the business decisions and activities of investment firm.

Having regard to the specificities of the investment firm, while performing the assessment of risks not covered by Pillar 1 own funds requirements, competent authorities may consider other sources of risks not included in the abovementioned categories.

Systemic risk

Based on quantitative and qualitative criteria, competent authorities should form a view of the systemic risk of the investment firm. Based on this assessment, competent authorities should determine whether the failure of the investment firm could result in major disruptions of the financial markets in which the investment firm operates.

Where appropriate, the assessment of systemic risk may be performed in an aggregate manner for a group of investment firms with a similar business model and risk profile. When performing such aggregated assessment competent authorities should consider potential impacts of simultaneous failure of a specified number/share of these investment firms on the financial markets in which they operate. For this purpose competent authorities may consider one or more scenarios.

6.6.3 Assessment of risks management and controls

To achieve a comprehensive understanding of the investment firm’s risk profile regarding risks not covered by Pillar 1 own funds requirements, competent authorities should review the governance and risk management framework that reduce the risk arising from other sources of risks. To this end, competent authorities should assess the following elements while taking into account the volume, nature and complexity of the investment firm’s activities:

• a. the investment firm’s strategy properly reflects the investment firm’s appetite for these risks and is consistent with the overall risk appetite;
• b. the investment firm has internal guidelines and policies to ensure a sound risk culture;
• c. the investment firm has appropriate framework for the management, measurement, monitoring and control of interest rate risk arising from non-trading book activities;
• d. the investment firm has an appropriate framework for the management, measurement, monitoring and control of IT risks, with sufficient (both qualitative and quantitative) human and technical resources;
• e. the investment firm has clearly defined policies and procedures for the control of operational risk.

6.6.4 Summary of findings and scoring

Following the above assessment, competent authorities should form a view on the investment firm’s other risks. This view should be reflected in a summary of findings, accompanied by a risk score based on the considerations specified in Table 8. If, based on the materiality of certain risk factors, competent authorities decide to assess and score them individually, the guidance provided in this table should be applied, as far as possible, by analogy.

Competent authorities should consider all these factors in parallel and not in isolation and understand the drivers behind risks not covered by Pillar 1 own funds requirements. Table 8. Supervisory considerations for assigning a score for other risks

Risk Considerations in relation to Supervisory view adequate management and score inherent risk