6.5. Assessment of interest rate risk and credit spread risk arising from non-trading book activities

When assessing the inherent interest rate risk arising from interest rate-sensitive positions from non-trading on and off-balance sheet activities (commonly referred to as interest rate risk in the non-trading book, or IRRBB) and credit spread risk arising from positions in the non-trading book (commonly referred to as CSRBB) and the adequacy of the internal control framework, competent authorities should evaluate inter alia the compliance of the institution with the legal acts published separately on the EBA website as referred to in paragraph 12.

Competent authorities should assess IRRBB, including hedges for these positions, irrespective of their recognition and measurement, and irrespective of the recognition and measurement of losses and gains, for accounting purposes.

Competent authorities should consider the relevance and materiality of at least the following subcategories⁴⁸ when assessing IRRBB: gap risk, basis risk and option risk.

⁴⁸ Please refer to Annex IV for a non-exhaustive breakdown of IRRBB sub-categories.

Assessment of IRRBB should be differentiated from assessment of CSRBB that competent authorities should also conduct in accordance with section 6.5.3. In particular, competent authorities should take into account whether institutions’ internal systems adequately assess and monitor the risk from CSRBB from an economic value and net interest income (including market value changes) perspective and appropriately define CSRBB and determine its scope⁴⁹ .

⁴⁹ Also considering the guidance in EBA/2022/14.

Based on the overall assessment of the inherent risk of IRRBB and the risk management and controls for IRRBB and CSRBB, competent authorities should form a view on the IRRBB and CSRBB resulting in a combined score using the criteria laid out in table 12. The outcome of the assessment of each individual risk should be reflected in a summary of findings and an explanation of the main risk drivers.

6.5.2. IRRBB

6.5.2.1. Assessment of inherent IRRBB

Through the assessment of the inherent level of IRRBB, competent authorities should determine the main drivers of the institution’s IRRBB exposure and evaluate the potential prudential impact of this risk on the institution.

Preliminary assessment

To determine the scope of the IRRBB assessment, competent authorities should first identify the sources of IRRBB to which the institution is or might be exposed and if there have been any significant changes. To do so, competent authorities should leverage the knowledge gained from ICAAP and ILAAP information collected for SREP purposes, from reporting established on IRRBB, from the assessment of other SREP elements, from the comparison of the institution’s position with those of its peers and from any other supervisory activities. As part of this, competent authorities should consider the institution’s governance of interest rate risk, including its main IRRBB strategy and its risk appetite in relation to IRRBB, and the level of internal capital the institution has allocated to IRRBB.

Nature and composition of the institution’s interest rate risk profile

Competent authorities should form a clear view on how changes in interest rates can have an adverse impact on an institution’s net interest income (and, where relevant, its earnings) and economic value (the present value of expected cash flows) to gain both a short-term and a longer-term view on the possible threat to capital adequacy.

For this purpose, competent authorities should analyse and form a clear view on the structure and features of the institution’s assets, liabilities, and off-balance-sheet exposures, including their sensitivities to changes in interest rates, maturities and repricing dates, and the proportion of products and positions with uncertain maturities (e.g. with embedded options or prepayment features) and any associated behavioural assumptions.

In addition, competent authorities should review the institution’s hedging strategy and the extent to which a natural hedge may apply (considering also the robustness of modelling of repricing maturities for items with an undefined maturity), the amount of derivatives used for hedging purposes and whether the derivatives may mitigate sensitivity in EVE, NII or other metrics used by the institution internally.

Competent authorities should also pay attention to any concentrations (e.g. in the loan or bond portfolios) in terms of repricing maturity or in products with automatic or behavioural optionality, non-performing exposures, and the nature of IRRBB embedded in fair value instruments, including less liquid instruments such as level 3 assets and liabilities.

When analysing the impact on the institution’s earnings, competent authorities should be aware of how much the institution’s returns depend on interest rate-sensitive positions, and they should determine how different changes in interest rates would affect the institution’s net interest income, as well as determining the effects of changes in the market value of instruments – depending on accounting treatment – either shown in the profit and loss (P&L) account or directly in equity (e.g. via other comprehensive income).

When analysing the impact on the institution’s economic value and earnings, competent authorities should first consider the results of the supervisory outlier tests stipulated in Article 98(5) of Directive 2013/36/EU and further specified in Delegated Regulation (EU) 2024/856, to get an initial benchmark against which to compare how interest rate changes would affect the institution. For this assessment, competent authorities should pay particular attention to the sensitivity of cash flows to repricing, in terms of both their timing and amount and to changes in the underlying key assumptions (particularly for customer accounts without specific repricing dates, customer accounts with embedded customer optionality and/or equity capital).

Where the institution is identified as an outlier by the supervisory outlier test on net interest income, competent authorities should consider analysing additional dimensions to complement the assessment, when deemed appropriate (e.g. given the institution’s the business model). Additional dimensions to consider may include market value changes of fair value instruments, the evaluation of the worst NII projections versus current realised NII and versus administrative expenses/overhead cost and net commissions/fees for capturing embedded losses/gains due to observed changes in the interest rates and in the market conditions.

Competent authorities should pay attention to the sensitivity of cash flows to changes in the valuation of fair value instruments in the non-trading book, including interest rate derivatives used for the hedging of non-trading book instruments (e.g. impact of mark-to- market changes in fair value instruments on P&L, hedge account effectiveness).

In addition to using the supervisory outlier test stipulated in Article 98(5) of Directive 2013/36/EU and further specified in Delegated Regulation (EU) 2024/856, competent authorities may require institutions to take into account other interest rate shock scenarios.

In their quantitative assessment, competent authorities should also consider the results of the institution’s internal or standardised methodologies for measuring IRRBB, among which competent authorities should also assess, for those institutions operating in different currencies, the impact for the economic value and earnings measures coming from different currencies and, where an internal methodology is applied, the approaches that the institutions use for the aggregation across these currencies. Through the analysis of these methodologies, competent authorities should gain a deeper understanding of the main risk factors underlying the institution’s IRRBB profile.

When analysing the results of both the impact of the supervisory outlier tests, and the institution’s internal or standardised methodologies, competent authorities should consider ‘point in time’ figures as well as historical trends. These rates should be compared to peers and considered in the context of the global market situation.

Shock Scenarios and stress testing

Competent authorities should assess and take into account the results of the interest rate shock scenarios for ongoing management as well as the IRRBB stress tests performed by the institution as part of its ongoing internal management process. In this context, competent authorities should be aware of the main sources of the institution’s IRRBB and in particular of the effect of changes in behavioural assumptions such as on NMD.

If, when the outcome of the institution’s shock scenarios and stress tests is reviewed, particular accumulations of repricing/maturity at different points on the curve are revealed or suspected, competent authorities may need to carry out additional analyses.

6.5.2.2 Assessment of IRRBB management and control framework

To achieve a comprehensive understanding of the institution’s interest rate risk profile in the non-trading book, competent authorities should review the governance and framework underlying its interest rate exposures.

IRRBB strategy and appetite

Competent authorities should assess whether the institution has a sound, clearly formulated and documented IRRBB strategy and appetite, approved by the management body. For this assessment, among other factors, competent authorities should take into account the role of the management body in setting, approving and reviewing the IRRBB strategy and appetite, the proper implementation of this strategy by senior management as well as its appropriateness for the institution given its business model, its market environment and role in the financial system, and capital adequacy. Organisational and internal control framework

Competent authorities should assess whether the institution has an appropriate organisational framework and clearly assigned responsibilities for IRRBB management, measurement, monitoring and control functions with sufficient human and technical resources. For this assessment, competent authorities should take into account the adequacy of the lines of responsibility for the overall management of IRRBB, and for taking, monitoring, controlling and reporting IRRBB, including the independence of the IRRBB control area.

Competent authorities should assess whether the institution has clearly defined policies and procedures for the management of IRRBB that are consistent with its IRRBB strategy and appetite, approved and reviewed regularly by the management body. The policies should be clearly formalised and communicated and applied consistently across the institution, as well as across banking groups. Competent authorities should verify that policies define the procedures for new product development, major hedging or risk management initiatives, ensuring that these are subject to adequate procedures and controls before they are undertaken and the institution has undertaken an analysis of their possible impact in its overall risk profile.

Competent authorities should assess whether the institution has an appropriate framework for identifying, evaluating, managing and mitigating IRRBB, in line with the level, complexity and riskiness of non-trading book positions and the institution’s size and complexity. The assessment should encompass internal models, such as those related to customer behaviour (e.g. models of deposit stability and loan early repayment). In this assessment competent authorities should evaluate whether the risk managers and the institution’s senior management understand the assumptions underlying the measurement systems and they are aware of the degree of model risk that prevails in the institution’s risk measurement techniques.

In addition, they should consider whether the information systems and measurement techniques enable management to measure the inherent IRRBB in all its material on- and off-balance- sheet exposures (where relevant at group level), including internal hedges, in concentrations in maturities and counterparties, in the non-trading book portfolio. The IRRBB framework should be subject to regular reviews and evaluations of the effectiveness of the framework. Competent authorities should compare internal reviews and evaluations with information from COREP.

Competent authorities should assess the institution’s approach to modelling the behaviour of non-maturity deposits (NMDs), including whether this takes account of relevant risk factors impacting NMD repricing behaviour. Competent authorities should use appropriate analytical tools for this assessment, taking into account the institution’s business model. Approaches that may be relevant include evaluation of how the institution segments NMDs using risk factors related to the customer, institution or market profile and benchmarking with peers that have a similar risk profile. In addition, competent authorities should consider how the institution balances historical data with forward looking approaches and expert judgment, and review the impact on NII and EVE if behavioural assumptions were adjusted.

Competent authorities should consider whether the institution’s internal measurement systems (IMS) take into account all material forms of interest rate risk to which the institution is exposed (e.g. gap risk, basis risk and option risk). The IMS should be properly calibrated, independently validated, back-tested and reviewed at an appropriate frequency. Competent authorities should take into account whether the IMS is supported by documentation considering the nature, scale and complexity of the IRRBB inherent in the business model and the institution’s activities.

Competent authorities should assess whether the institution has an appropriate monitoring and internal reporting framework for IRRBB that ensures there is prompt action at the appropriate level of the institution’s senior management or management body, where necessary. The monitoring system should include specific indicators and relevant triggers to provide effective early warning alerts (e.g. for breaches of IRRBB limits). Competent authorities should take into account whether the management and control area reports the results of the monitoring regularly to the management body and senior management, with an appropriate frequency depending on the scale, complexity and level of IRRBB exposures.

Competent authorities should assess whether the institution has a strong and comprehensive control framework and sound safeguards to mitigate its exposures to IRRBB in line with its risk management strategy and risk appetite, including an appropriate limit system on both IRRBB measures. The internal control function should include all consolidated entities, all geographical locations and all financial activities. Competent authorities should assess the functionality of the internal audit function, including whether its reviews are conducted sufficiently frequently and cover the main elements of the IRRBB framework.

6.5.3. CSRBB

6.5.3.1. Assessment of inherent CSRBB

Through the assessment of the inherent level of CSRBB, competent authorities should understand the main drivers of the institution’s CSRBB exposure and evaluate the potential prudential impact of this risk on the institution.

To determine the scope of the CSRBB assessment, competent authorities should first identify the sources of CSRBB to which the institution is or might be exposed and if there have been any significant changes. As part of this, competent authorities should have regard to the institution’s governance of credit spread risk, including its CSRBB strategy and its risk appetite in relation to CSRBB, and the treatment of CSRBB within the ICAAP context.

Competent authorities should form a clear view on how changes in credit spreads can have an adverse impact on an institution’s net interest income (and, where relevant, its earnings) and economic value to gain both a short-term and a longer-term view on the possible threat to capital adequacy. For this purpose, competent authorities should consider the approach applied by the institution to form this clear view on the structure and features of the institution’s assets, liabilities, and off-balance-sheet exposures, and how these are driving the level and direction of CSRBB.

When analysing the impact on the institution’s earnings, competent authorities should consider the impact of credit spread-sensitive positions on the institution’s return, the impact of the changes in credit spreads on the institution’s net interest income, and the effects of changes in the market value of instruments – depending on account treatment – either shown in the profit and loss (P&L) account or directly in equity (e.g. via other comprehensive income).

Competent authorities should consider the results of the institution’s methodologies for measuring CSRBB, where appropriate. Through the analysis of these methodologies, competent authorities should gain a deeper understanding of the main risk factors underlying the institution’s CSRBB profile.

6.5.3.2. Assessment of CSRBB management and control framework

To achieve a comprehensive understanding of the institution’s credit spread risk profile in the non-trading book, competent authorities should review the governance and framework underlying its interest rate exposures.

The review of the institution’s governance of CSRBB should include the following elements:

• a. the institution’s CSRBB strategy and appetite;
• b. the institution’s organisational framework and allocation of responsibilities with respect to CSRBB management, measurement, monitoring and control functions;
• c. the institution’s policies and procedures for the management of CSRBB.

For the assessment of these areas, competent authorities should refer to section 6.5.2.2 on the assessment of the IRRBB management and control framework, with the principles contained also applicable to the assessment of CSRBB management.

When analysing the perimeter of assets and liabilities covered by the CSRBB assessment, also as considered within the institution’s methodologies, competent authorities should assess whether any potential exclusion of instruments from the relevant perimeter is only made in the absence of sensitivity to credit spread risk and is appropriately documented and justified, as required in paragraph 124 of the EBA Guidelines on IRRBB and CSRBB⁵⁰ . Factors to take into account include:

• a. whether the institution includes all assets and liabilities accounted at fair value;
• b. whether the institution includes all assets and liabilities whose credit spread risk can be inferred from a direct/indirect or even modelled market price, whatever their accounting treatment;
• c. the potential relevance of credit spreads in the institution’s pricing practice for different assets/liabilities (for example through explicit references to observed market prices or more indirect relevance);
• d. differences, if any, that the institution applies between the perimeter for EVE and NII in the measurement of CSRBB (e.g. due to the NII time horizon or other reasons).

⁵⁰ Guidelines issued on the basis of Article 84 (6) of Directive 2013/36/EU specifying criteria for the identification, evaluation, management and mitigation of the risks arising from potential changes in interest rates and of the assessment and monitoring of credit spread risk, of institutions’ non-trading book activities (EBA/GL/2022/14).

To analyse the institution’s measurement of CSRBB, competent authorities should consider, where appropriate, to review which shock scenarios the institution is considering, and, how and why the shocks may be different between balance sheet items.

Competent authorities should check the exclusion of idiosyncratic spread in the institution’s measurement of CSRBB or its inclusion only for proportionality reasons and regardless of the SREP categorisation of the institution, as long as it is ensured that the measures will yield more conservative results.

Competent authorities should assess whether the institution has an appropriate framework for identifying, evaluating, managing and mitigating CSRBB, in line with the level, complexity and riskiness of non-trading book positions and the institution’s size and complexity. They should consider whether the information systems and measurement techniques enable management to measure the inherent CSRBB in all its material on- and off-balance- sheet exposures (where relevant at group level) in the non-trading book portfolio. The CSRBB framework should be subject to regular reviews and evaluations of its effectiveness. In this context, competent authorities should assess whether significant measurement assumptions are reviewed at least annually and more frequently during rapidly changing market conditions.

Competent authorities should consider whether the institution’s internal measurement systems (IMS) take into account all sources of CSRBB which are relevant for the institution’s business model. The IMS should be properly calibrated, independently validated, back-tested and reviewed at an appropriate frequency. Competent authorities should take into account whether the IMS is supported by documentation considering the nature, scale and complexity of the CSRBB inherent in the business model and the institution’s activities.

Competent authorities should assess whether the institution has an appropriate monitoring and internal reporting framework for CSRBB that ensures there is prompt action at the appropriate level of the institution’s senior management or management body, where necessary. Competent authorities should take into account whether the management and control area reports the results of the monitoring regularly to the management body and senior management, with an appropriate frequency depending on the scale, complexity and level of CSRBB exposures.

Competent authorities should assess whether the institution has a strong and comprehensive control framework and sound safeguards to mitigate significant exposures to CSRBB in line with its risk management strategy and risk appetite. The internal control function should include all consolidated entities, all geographical locations and all financial activities. Competent authorities should assess the functionality of the internal audit function, including whether its reviews are conducted sufficiently frequently and cover the main elements of the CRSBB framework.

6.5.4. Summary of findings, scoring and supervisory measures

Following the above assessments, competent authorities should form a view on the

accompanied by a score based on the considerations specified in table 12. If, based on the materiality of certain risk subcategories, the competent authority decides to assess and score them individually, the guidance provided in this table should be applied, as far as possible, by analogy.

Table 12. Supervisory considerations for assigning an IRRBB and CSRBB score

The table below presents a non-exhaustive list of supervisory measures that competent authorities may take in case of identified deficiencies in the institution’s IRRBB and CSRBB management framework. Competent authorities should decide on the type of the measure based on its effectiveness to the specific identified deficiency. Competent authorities may apply additional supervisory measures (including quantitative measures in accordance with Article 104(1)(a) of the Directive 2013/36/EU) or a combination of them if these are deemed more appropriate to address the identified deficiencies.

Table 13. Potential and non-exhaustive supervisory measures for IRRBB and CSRBB Potential supervisory measures for competent authorities in accordance with Article 104(1), points (b), (d), (e), (f), (j), and (l) and Article 84(3) of Directive 2013/36/EU – Competent authorities may require the institution to: A. enhance their stress testing capacity; B. enhance the reporting of IRRBB management information to the management body and senior management; C. apply variations to internal limits to reduce the risk inherent in activities, products and systems; D. provide additional or more frequent reporting of the institutions’ IRRBB positions; E. use the standardised methodology for IRRBB; F. specify modelling and parametric assumptions, other than those identified by the EBA RTS (in accordance with the last paragraph of Article 98(5) of Directive 2013/36/EU.