4.3 Criteria to determine the appropriate time to return to compliance with the limits of Article 395(1) of Regulation (EU) No 575/2013

Following the assessment of the breach reported by the institution in accordance with Section 4.2 of these guidelines, the competent authority should decide the appropriate time to return to compliance with the limits of Article 395(1) of Regulation (EU) No 575/2013.

A competent authority should not grant an institution a period longer than 3 months to resolve a breach if it concludes that the breach was repetitive or when the magnitude of the breach has the potential to have a major impact on the financial situation of the institution.

In cases where a competent authority decides to allow an institution a period longer than 3 months to resolve a breach and return to compliance with the limits set out in Article 395(1) of Regulation (EU) No 575/2013, the time deemed appropriate by the competent authority should be commensurate with a rapid restoration of the limits.

In any case, the time to return to compliance should not be longer than 1 year. Exceptionally, where the specific circumstances of the breach and the measures of the compliance plan referred to in Section 4.4 justify otherwise, the competent authority may grant a period longer than 1 year to resolve the breach. Such cases should however not be the norm.

In order to decide the appropriate time to return to compliance, the competent authority should at least consider the following elements in its assessment:

• a. the i nstitution’s record of breaches ;
• b. the promptness of notifying about the breach;
• c. the reason(s) for the breach;
• d. the systemic nature, complexity and magnitude of the breach;
• e. the possible impact on the overall financial situation of the institution;
• f. the overall risk concentration in the banking book of the institution across different counterparties;
• g. the type of client or group of connected clients and its creditworthiness;
• h. the measures already implemented to resolve the breach.

The institution’s record of breaches

The competent authority should take into account any previous breaches by the institution and the scope of measures adopted to return to compliance in those cases. The competent authority should in particular assess, in cases of repeated breaches, whether the new breach is due to the same cause as the ones identified in previous cases.

The promptness to notify about the breach or the remedial actions to return to compliance

If an institution unduly delays the notification of a breach, the competent authority may consider giving the institution a shorter timeframe to return to compliance.

The reason(s), or repetitive nature, complexity and magnitude of the breach

The competent authority should assess the reasons for the breach and assess the point in time and forward-looking materiality of the potential impact on the institution.

The competent authority might require and request additional information when the causes of the breach are complex.

The overall financial situation of the institution

The competent authority should consider whether the institution’s compliance with the regulatory capital requirements (CET 1 Ratio, Tier 1 Ratio, Total Capital Ratio) is well above the minimum level.

The overall risk concentration in the banking book of the institution across different counterparties

The competent authority should consider the adequacy of the risk management practices of the institution and its approach to diversification.

The type of client and its creditworthiness

The competent authority should take into account the type of counterparty and its creditworthiness. It should assess whether the possible default of the concerned client or group of connected clients, if available, and the consequent loss, has the potential to reduce the regulatory capital ratios below the minimum requirements.

The measures already implemented to resolve the breach

The competent authority should consider the measures already implemented by the institution, especially in view of the fact that some of those measures might eventually facilitate a rapid return to compliance.