4.1 Credit risk governance and culture

The management body, as referred to in the EBA Guidelines on internal governance, in relation to credit granting, should:

• a. approve the institution’s credit risk strategy, within the overall risk strategy, and business strategy, to ensure that they are in line with the institution’s risk appetite framework (RAF), capital and liquidity planning, and are in line with the internal capital adequacy assessment process (ICAAP) and internal liquidity adequacy assessment process (ILAAP), when relevant;
• b. set the credit risk appetite within the overall RAF, including credit-granting standards, qualitative statements, quantitative metrics and limits, and escalation thresholds, without business performance biases;
• c. approve the framework for the credit approval process, including, when relevant, the internal structures for credit granting and monitoring, and defining delegated decision-making authorities;
• d. ensure an effective oversight of credit risk quality, in particular at the point of credit granting, and provisioning;
• e. ensure adequate credit approval, monitoring and control processes, for the purposes of effective credit risk management;
• f. ensure that all staff involved in credit risk taking, and the managing, monitoring and controlling of credit risk, are adequately skilled, resourced and experienced;
• g. set, approve and oversee the implementation of the institution’s risk culture, core values and expectations regarding credit risk;
• h. ensure that the remuneration framework, including any relevant performance targets, and the performance assessment framework for credit decision-makers who are identified staff remain aligned with the credit risk and credit risk appetite.

4.1.2 Credit risk culture

Institutions should develop a credit risk culture as part of the overall risk culture through policies, communication and staff training, in accordance with the EBA Guidelines on internal governance.

The credit risk culture should include an adequate ‘tone from the top’ and ensure that credit is granted to borrowers who, to the institution’s best knowledge at the time of granting the credit, will be able to fulfil the terms and conditions of the credit agreement, and is secured, when relevant, by sufficient and appropriate collateral, where relevant, and considering the impact on the institution’s capital position and profitability, and sustainability, and related environmental, social and governance (ESG) factors.

Institutions should ensure that a credit risk culture is implemented effectively across all levels of the institution, and that all members of staff involved in the credit risk-taking, credit risk management and monitoring processes are fully aware of it and they will be held accountable for their actions.

Institutions should adopt policies and processes to monitor adherence of all staff members involved in credit-granting, monitoring and control processes to the institution’s credit risk culture (e.g. by means of self-assessments carried out by staff members). In situations in which there are noted deficiencies in the credit culture, evidenced either via an institution’s self-assessment or via supervisory actions, the institution should take well-defined, outcome-driven and timely actions to remediate these deficiencies. The credit risk strategy, credit policies and procedures should be tailored to mitigate any potential negative effects arising from a poor credit culture.