4.1 Criteria to determine the exceptional cases referred to in Article 396(1) of Regulation (EU) No 575/2013

A breach of the limits set out in Article 395(1) of Regulation (EU) No 575/2013 should always be considered as an exceptional case.

In order to assess a situation in which an institution has exceeded the limits of Article 395(1) of Regulation (EU) No 575/2013, a competent authority should evaluate at least the following aspects:

• a. Frequency and number of breaches.
• b. Predictability of the breach.
• c. Reasons beyond control of the institution that led to inability to prevent the breach.

Frequency and number of breaches

The competent authority should assess whether the breach of the limits of Article 395(1) of Regulation (EU) No 575/2013 by the institution is a rare event. The assessment should take into account any previous breaches of the institution due to the same cause, triggered by the same event or concerning the same client or group of connected clients.

If an institution reports a second breach during the last 12 months that concerns the same client or group of connected clients as the first breach, the competent authority may decide that the event cannot qualify as a rare one. Equally, if an institution reports a second breach during the last 12 months that stems from the same origin as the first breach, the competent authority may decide that the event cannot qualify as a rare one.

If, during the last 12 months, an institution has already reported two breaches of the large exposure limits that concern a different client or group of connected clients, are due to different causes or have been triggered by a different event, the competent authority may decide that any further breach (or breaches) though unrelated may not qualify as a rare event.

Predictability of the breach

The competent authority should assess whether the breach would have been a foreseeable event had the institution applied a proper and effective risk management in accordance with its obligations under Article 393 of Regulation (EU) No 575/2013 and the EBA Guidelines on Internal Governance.¹³

¹³ EBA Guidelines on Internal Governance EBA/GL/2021/05.

The competent authority should also consider whether the institution could have been in a position to anticipate the breach using available information.

In cases where identical or similar breaches of other institutions occur that could be attributed to the same cause, the competent authority might conclude that the breach was caused by an unforeseeable event.

Reasons beyond control of the institution to prevent the breach

The competent authority should assess whether the breach was caused by reasons beyond the control of the institution. This could at least be assumed in the following cases:

• a. An unexpected and substantial decrease of own funds of the institution, including due to the impact of major operational risk events, such as external fraud, natural disaster or pandemic, that are not linked to a failure of the institution’s internal control mechanisms.
• b. In cases where an exposure (fully or partially) exempted ceases to be eligible for such an exemption due to a decision of a third party that could not have been anticipated or prevented by the institution.
• c. A court ruling or administrative decision that leads to a different interpretation of the applicable large exposures regulatory framework where the institution has not had sufficient time to implement it such as to prevent a breach of the limits of Article 395(1) of Regulation (EU) No 575/2013.
• d. The merger of counterparties/clients or acquisitions between counterparties/clients, but only in cases when the institution did not have knowledge of or could not have anticipated this merger or acquisition to prevent a breach.

A breach caused by an inappropriate application or misinterpretation of the large exposures framework should, in general, not qualify as a reason beyond the control of the institution.

In general, if the competent authority concludes that the breach does not fulfil the criteria specified in this section, the competent authority should not grant a period longer than 3 months to restore compliance with the large exposure limits.