4.5 Proportionality

In accordance with the principle of proportionality, an institution’s stress testing programme should be consistent with its individual risk profile and business model.

Institutions should take into account their size and internal organisation, and the nature, scale and complexity of their activities when developing and implementing a stress testing programme. Significant institutions and more complex institutions, including at consolidated level, should have more sophisticated stress testing programmes, while small and less complex institutions and groups (consolidated level) may implement simpler stress testing programmes.

For the purpose of the application of the principle of proportionality and in order to ensure an appropriate implementation of the requirements, the following criteria should be taken into account by institutions and competent authorities:

• a) the size in terms of the balance-sheet total or the quantity of assets held by the institution or its subsidiaries within the scope of prudential consolidation;
• b) the geographical presence of the institution and the size of its operations in each jurisdiction;
• c) the legal form and whether or not the institution is part of group and, if so, the proportionality assessment performed for the group;
• d) whether the institution is listed or not;
• e) whether or not the institution is authorised to use internal models for the measurement of capital requirements (e.g. the internal ratings-based (IRB) approach);
• f) the type of authorised activity and services (e.g. loans and deposits, investment banking);
• g) the underlying business model and strategy, the nature and complexity of the business activities, and the organisational structure;
• h) the risk strategy, risk appetite and actual risk profile of the institution, also taking into account the result of the annual capital adequacy assessment;
• i) the ownership structure and funding structure of the institution;
• j) the type of clients (e.g. retail, corporate, institutional, small businesses, public entity) and the complexity of the products or contracts;
• k) the outsourced processes, services and activities and their distribution channels;
• l) the existing information technology systems, including IT continuity systems and outsourcing arrangements in this area, e.g. cloud computing.