12.1. Application of SREP to third-country branches

The SREP assessment should focus on the TCB’s material risks and how these are dependent on the business, and the risk profile of the rest of the group and how they are managed. Recognising the status of the branch and its reliance on the third-country parent, the assessment should also focus on whether the branch has sufficient independence in its governance and risk management to act in the best interests of the branch, safeguarding its safety, soundness and viability, and its capacity to fulfil its commitment to clients and counterparties within the Member State where they have been authorised to carry out business.

To inform the assessment, competent authorities should take into account the results of the independent third-party assessment of the branch and the independent opinion on compliance with booking requirements mandated by Articles 48g(8) and 48h(3) of Directive 2013/36/EU, respectively. They should also cooperate with the authority responsible for supervision of the head undertaking (‘the home authority’) in accordance with administrative or other arrangements in accordance with Article 48c(2) of Directive 2013/36/EU and take into account the results of the home authority’s supervisory assessments of the branch where available.

Competent authorities should ensure that the scope of the assessment contains measures to identify TCBs of systemic importance or posing financial stability risks. Further, the assessment should enable identification of TCBs for which authorisation in accordance with Title III, Chapter 1 of Directive 2013/36/EU (as a subsidiary) may be appropriate. Competent authorities should refer to Article 48i for criteria to consider in this regard.

Where the review of the TCB’s governance, business model, or activities, gives competent authorities reasonable ground to suspect that, in connection with the TCB, money laundering or terrorist financing is being or has been committed or attempted, or that there is increased risk thereof, the competent authority is required to immediately notify the EBA and the TCB’s AML/CFT supervisor in accordance with Article 48n(4) of Directive 2013/36/EU.

12.1.2. Business model analysis

Competent authorities should analyse the TCB’s business model and strategy to understand the key drivers of its risks. They should use the guidance provided in Title 4 as the basis for the assessment and seek to apply the principles contained in a manner proportionate to the TCB. Competent authorities should verify that the strategy for the third-country branch and a separate assessment of the associated risks is adequately documented along with evidence of its review and scrutiny by branch management.

Competent authorities should pay specific attention to the outreach of the TCB activities, to assess whether it complies with the territorial scope of the authorisation granted by the competent authority where the TCB is established. Attention should also be paid to any cross-border business activity carried out upon reverse solicitation.

Competent authorities should consider how the head undertaking’s strategic priorities for the TCB impact its risk profile. They should pay attention to any earnings or strategic targets set for the TCB branch and whether these are supported by the TCB’s resourcing and risk management capabilities. They should also assess the nature of the services and activities offered by the TCB and how, if at all, these diverge from the offering of the wider group and whether this results in any increased risks or go beyond the scope of services and activities authorised to be carried out by the TCB, which cannot be more extensive than that of the direct head undertaking in the third country.

12.1.3. Assessment of internal governance arrangements and controls

Competent authorities should assess the adequacy of the TCB’s governance arrangements using Title 5 and section 7 of the EBA Guidelines on Internal Governance in accordance with Directive 2013/36/EU⁶¹ as a guide as well as the TCB-specific considerations below. The assessment should include the overall framework, risk culture and risk conduct, remuneration policies and practices, and the internal control and risk management framework including the management of ICT risks and third-party risks.

⁶¹ EBA/GL/2021/05

In conducting the assessment of internal governance, competent authorities should consider whether the TCB maintains sufficient substance in the Member State in accordance with the requirements in paragraph 90(g) of the EBA Guidelines on internal governance.

Organisational framework

Competent authorities should assess whether the persons directing the TCB:

• a. have sufficient understanding of the activities and risks of the branch and knowledge of the local market, as well as of EU and national regulations of the Member State;
• b. have sufficient authority, stature, and independence, taking into account the extent they are empowered to contribute to decisions by the head undertaking affecting the branch;
• c. spend sufficient time within its Member State and in the premises of the branch to effectively fulfil their role.

Where the TCB branch has established a management committee, competent authorities should review its role in ensuring adequate governance. In the absence of such body, competent authorities should review whether an appropriate and proportionate alternative framework for senior management oversight of the TCB’s activities and risks has been implemented.

Relation with the head undertaking

Competent authorities should assess the TCB’s relation with the head undertaking, including whether the branch is integrated into the group governance and risk management framework effectively. They should take into account whether:

• a. the branch’s reporting to the head undertaking provides sufficient visibility of the branch’s material risks;
• d. the risk framework applied to the TCB adequately addresses EU financial services regulations.

Where the TCB engages in back-to-back or intragroup operations, competent authorities should verify that the branch has an appropriate framework for managing its counterparty credit risk.

Internal control framework and third-party risk management

Competent authorities should assess whether the TCB has robust internal control functions. For class 1 TCBs (and class 2 TCBs where applicable in accordance with Article 48g(3) of Directive 2013/36/EU), competent authorities should assess whether suitable heads of internal control functions have been appointed who are independent and have sufficient capacity to fulfil the function as provided for in Article 76(6) of Directive 2013/36/EU.

Competent authorities should assess whether the TCB conducts appropriate due diligence and ongoing oversight of functions provided by third-party service providers. They should verify that third-party arrangements, including intragroup arrangements, are governed by documented agreements and that the TCB has access to all information required to exercise its monitoring obligations, including when subcontractors are used. Competent authorities should review the TCB’s management of its ICT risks, including whether the TCB maintains an appropriate register of its third-party service providers including when subcontractors performing critical or important function are used. 12.1.4. Assessment of capital endowment and liquidity resources

Competent authorities should assess:

• a. whether the TCB branch meets the minimum capital endowment requirement as specified in Article 48e(1) of Directive 2013/36/EU;
• b. whether the concentration of the capital endowment on a particular form of instrument or on instruments from a particular geographical location, or the currency inconsistency of the capital endowment instruments with the TCB’s liabilities, especially with deposits , would lead to heightened volatility of the value of the instruments and to the potential breach of the minimum requirement;
• c. whether the capital endowment is held in an eligible escrow account in the Member State where the third-country branch has been authorised and the capital endowment instruments meet the criteria specified in Article 48e(2) of Directive 2013/36/EU and the conditions set in the EBA Guidelines on instruments available for third-country branches for unrestricted and immediate use to cover risks or losses⁶² .

⁶² EBA/CP/2025/17

Competent authorities should assess whether the institution holds sufficient liquid and unencumbered assets to mitigate its liquidity risks and in particular that the branch’s liquid assets are sufficient for cover liquidity outflows over a minimum of 30 days in line with Article 48f(1) of Directive 2013/36/EU. For Class 1 TCBs, the assessment should cover the branch’s compliance with the liquidity coverage requirement as described in the same Article.

In conducting the capital endowment and liquidity assessment, competent authorities should consider whether the TCB maintains documentation that is adequate for a prompt and accurate review of its compliance with the minimum capital endowment and liquidity requirement.

Competent authorities should assess:

• a. the quality of the engagement between the TCB and head undertaking on capital and liquidity management decisions – including how the branch is covered in group capital and liquidity planning processes, monitoring and stress testing and the existence of appropriate escalation mechanisms for the branch to promptly notify the head undertaking of potential or actual capital or liquidity issues;
• b. whether the cross-border intra-group funding arrangements are within the limits of the exception allowed in accordance with Article 48c(4) (d) of Directive 2013/36/EU and do not disguise cross-border business activities in breach of the territorial scope of the authorisation – for instance where the intragroup funding provided to a TCB established in another Member State in exchange for a (total or partial) share of the economic risks and returns of a specific asset. 12.1.5. Assessment of booking arrangements

Competent authorities should assess whether the TCB has an adequate framework for managing and recording assets and liabilities booked or originated in the Member State, including off-balance sheet items. Competent authorities shall verify that the TCB’s framework includes a registry book that adequately documents all assets and liabilities booked or originated by the branch in line with Regulatory Technical Standards in accordance with Article 48h(4) of Directive 2013/36/EU and a policy in compliance with Article 48h of Directive 2013/36/EU.

Competent authorities should assess whether the activities performed by the TCB, its assets and liabilities booked or originated, or other hedging arrangements identified in the registry book are in line with the TCB’s policy on booking arrangements and its business strategy.

Where the TCB engages in back-to-back booking arrangements, competent authorities should assess whether the TCB appropriately manages the risks of back-to-back and remote booking arrangements respectively, including counterparty credit risk, CVA risk, and settlement risk.

Competent authorities should assess whether the TCB manages assets and liabilities autonomously. They should consider whether the TCB demonstrates independence in accepting new activities, including through the enforcement of a risk appetite agreed by the branch management. They should consider whether the TCB has sufficient controls and reporting to independently understand and act upon the risks of actual or prospective activities. They should take into account whether the TCB’s framework adequately addresses both the prudential risks of the booked activities in so far as they impact the branch’s capital and liquidity risk profile, and AML/CFT risks.

Where the TCB originates assets and liabilities for other branches or subsidiaries of the same group, competent authorities should assess whether any particular risks arise from these arrangements including operational vulnerabilities and legal constraints.