+Guidelines for common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing (EBA/GL/2026/06)
---+Compliance and reporting obligations
------+Status of these guidelines
---------+1. This document contains guidelines issued pursuant to Article 16 of Regulation (EU) No 1093/2010 …
---------+2. Guidelines set out the EBA’s view of appropriate supervisory practices within the European …
------+Reporting requirements
---------+3. According to Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must notify …
---------+4. Notifications will be published on the EBA website, in line with Article 16(3).
---+1. Title 1. Subject matter, scope and definitions, and implementation
------+Subject matter
---------+1. These guidelines specify the common procedures and methodologies for the functioning of the …
---------+2. These guidelines do not set methodologies for the stress tests conducted by the EBA in …
------+Scope of application
---------+3. Competent authorities should apply these guidelines in accordance with the level of application …
---------+4. For parent undertakings and subsidiaries included in the consolidation, competent authorities …
---------+5. Where an institution has a subsidiary in the same Member State, but no waivers specified in Part …
---------+6. For cross-border groups, procedural requirements should be applied in a coordinated manner …
---------+7. When an institution has established a liquidity subgroup pursuant to Article 8 of Regulation …
------+Addressees
---------+8. These guidelines are addressed to competent authorities as defined in Article 4(2), points (i) …
------+Definitions
---------+9. Unless otherwise specified, terms used and defined in Regulation (EU) No 575/2013 , Directive …
------+Date of application
---------+10. These guidelines apply from 1 January 2027. Paragraphs 102, 103, 239, 462, 463 and 470(f) apply …
------+Repeal
---------+11. The EBA Guidelines on common procedures and methodologies for the supervisory review and …
---+2. Title 2. SREP framework
------+2.1. Overview of the SREP framework
---------+12. Competent authorities should have a comprehensive SREP framework covering the following …
---------+13. Competent authorities should consider the SREP an ongoing process that integrates the outcome …
---------+14. Competent authorities should categorise all institutions under their supervisory remit into …
---------+15. Within a group of entities, if competent authorities determine that the relevance of different …
---------+16. Competent authorities should review the categorisation of their institutions periodically, and …
---------+17. To ensure a minimum level of comparability, competent authorities should refer to the …
---------+18. Competent authorities should continuously assess the risks to which the institution is or might …
---------+19. Competent authorities should ensure that the findings of their assessments are clearly …
---------+20. As part of their ongoing supervisory activities, competent authorities should undertake …
---------+21. The framework referred to in the previous paragraph should consider the following actions …
---------+22. When selecting supervisory measures, competent authorities should identify the full escalation …
---------+23. Without prejudice to the discretion of the competent authorities in selecting the most …
---------+24. The provisions of this title are without prejudice to the possibility of competent authorities …
---------+25. Competent authorities should engage in dialogue with institutions as they perform their …
---------+26. Competent authorities should communicate the outcomes of the SREP assessment to the institution …
------+2.2. Scoring in the SREP
---------+27. Competent authorities should apply a consistent scoring system to help facilitate communication …
---------+28. When assigning risk scores, SREP elements scores and the overall SREP score, competent …
---------+29. The risk scores aim to capture the likelihood that the risks to capital, liquidity and funding …
---------+30. The scores are: 1 (low risk), 2 (medium-low risk), 3 (medium-high risk), and 4 (high risk – …
---------+31. Competent authorities should review the scores upon completion of the SREP assessments with the …
---------+32. Risk scores are assigned to summarise risks to capital (as specified in Title 6). These scores …
---------+33. Competent authorities should determine the risk score through an assessment of an institution’s …
---------+34. When assessing risks to capital, competent authorities should also consider relevant …
---------+35. Competent authorities may use different methods to apply the risk scores, they could score …
---------+36. At the end of the overall SREP assessment, competent authorities should form a comprehensive …
---------+37. Capital adequacy and liquidity and funding adequacy represent the supervisory view of the …
---------+38. The final score is an overall SREP score. This incorporates the four SREP element scores above …
---------+39. Competent authorities should ensure that the SREP element scores and the overall SREP score: a. …
------+2.3. Organisational arrangements
---------+40. Competent authorities should ensure that their organisational arrangements for conducting SREP …
---------+41. When defining arrangements for dialogue with institutions, competent authorities should …
------+2.4. Proportionality and supervisory engagement
---------+42. Competent authorities should adjust the scope, frequency, granularity and intensity of …
---------+43. Under this model, competent authorities should form a view on all the SREP elements (business …
---------+44. This view should be based on information gathered through the full range of supervisory …
---------+45. Competent authorities should engage with the institutions’ management body and senior …
---------+46. Where institutions are part of cross-border groups, competent authorities should discuss how …
---------+47. Where competent authorities determine that institutions have similar risk profiles or may be …
---------+48. For institutions covered by the supervisory examination programme required by Article 99 of …
---------+49. When planning supervisory activities, competent authorities should coordinate activities …
---+3. Title 3. Monitoring of key indicators
------+50. Competent authorities should regularly monitor key financial and non-financial indicators to …
------+51. Consistent with the SREP engagement model in section 2.4, competent authorities should monitor …
------+52. Competent authorities should set up monitoring systems to identify patterns, material changes …
------+53. Competent authorities should tailor the monitoring systems, and the escalation procedures in …
------+54. The monitoring systems should as a minimum be based on information and data reported to the …
------+55. Competent authorities should accompany institution-specific indicators with relevant …
---+4. Title 4. Business model analysis (BMA)
------+4.1. General considerations
---------+56. This title specifies criteria for the assessment of the business model and strategy of the …
---------+57. Competent authorities should use the outcome of the BMA to support the assessment of all other …
---------+58. Competent authorities should take into account environmental, social and governance (ESG) …
---------+59. Competent authorities should also use the business model analysis to assess prudential …
---------+60. To conduct the BMA, competent authorities should use at least the following sources of …
------+4.2. Identifying the areas of focus for the BMA
---------+61. In accordance with the engagement model set out in Title 2, competent authorities should focus …
---------+62. Competent authorities should form a view on the materiality of the changes to the institution’s …
---------+63. Competent authorities should carry out a materiality assessment of the institution’s business …
------+4.3. Assessment of BMA robustness and identification of vulnerabilities
---------+64. Competent authorities should perform an analysis of quantitative features of the institution’s …
---------+65. Competent authorities should perform an analysis of qualitative features of the institution’s …
---------+66. Competent authorities should complement the analysis by carrying out a forward-looking analysis …
---------+67. In the analysis, competent authorities should consider any indications that the business model …
------+4.4. Business model viability and sustainability
---------+68. Competent authorities should assess the resilience of the institution’s business model to …
---------+69. Based on the performed analysis, competent authorities should form, or update, their view on …
------+4.5. Summary of findings, scoring and supervisory measures
---------+70. Based on the assessment of the viability and sustainability, and of any potential risks and …
---------+71. The table below presents a non-exhaustive list of supervisory measures that competent …
---------+72. Competent authorities may apply additional supervisory measures (including quantitative …
---+5. Title 5. Assessing internal governance and institution-wide controls
------+5.1. General considerations
---------+73. When assessing the internal governance and institution-wide controls, competent authorities …
---------+74. Competent authorities should assess the adequacy of the institution’s internal governance …
---------+75. Competent authorities should take into account ESG risks, giving priority to environmental …
---------+76. The assessment of internal governance should inform the specific assessment of risk management …
---------+77. As part of the overall assessment of internal governance and institution-wide controls …
---------+78. When conducting the assessment of internal governance and institution-wide controls at …
------+5.2. Organisational structure, management body and its committees
---------+79. In assessing the institution’s organisational structure, management body and committees …
---------+80. In the context of assessing the institution’s management body, competent authorities should …
---------+81. When reviewing the composition and functioning of the institution’s management body and its …
------+5.3. Risk culture and business conduct
---------+82. In assessing the institution’s risk culture and business conduct, competent authorities should …
---------+83. Competent authorities should assess whether the institution has an appropriate framework in …
------+5.4. Remuneration policies and practices
---------+84. In assessing the institution’s remuneration policies and practices, competent authorities …
------+5.5. Internal control functions
---------+85. In assessing the institution’s internal control functions, competent authorities should assess …
---------+86. Competent authorities should assess whether the risk management function covers the whole …
---------+87. Competent authorities should assess whether the compliance function effectively assesses and …
---------+88. Competent authorities should assess whether the internal audit function independently reviews …
------+5.6. Risk management framework
---------+89. In assessing the institution’s risk management framework, competent authorities should assess …
---------+90. Competent authorities should assess whether the institution has in place a well-documented new …
---------+91. In assessing the institution’s ICAAP and ILAAP frameworks, competent authorities should assess …
---------+92. These assessments should contribute to the determination of P2R and to the assessment of …
---------+93. In assessing the institution’s stress testing, competent authorities should assess …
---------+94. Competent authorities should perform a qualitative assessment of the institution’s stress …
---------+95. Competent authorities should assess the extent to which stress testing is embedded in the …
---------+96. When assessing the stress testing programme, the results of stress tests and proposed …
---------+97. Competent authorities should assess the results of stress tests and whether the institution is …
---------+98. In the assessment of stress test results, competent authorities should also consider all known …
------+5.7. ICT systems, risk data aggregation and risk reporting
---------+99. Competent authorities should assess whether the institution’s ICT systems are reliable …
---------+100. Competent authorities should verify whether the institution develops and maintains appropriate …
---------+101. Competent authorities should determine whether the management body of the institution approves …
------+5.8. ML/TF risks and prudential concerns
---------+102. When analysing the internal governance framework and institution-wide controls, competent …
---------+103. Competent authorities should assess whether the institution’s overall internal governance and …
---------+104. Competent authorities should assess from a prudential perspective whether the roles and …
------+5.9. Recovery planning governance
---------+105. To assess internal governance and institution-wide controls, competent authorities should …
---------+106. Similarly, findings identified from the assessment of the SREP elements, including internal …
------+5.10. Summary of findings, scoring and supervisory measures
---------+107. Following the above assessment, competent authorities should form a view on the adequacy of …
---------+108. The table below presents a non-exhaustive list of supervisory measures that competent …
---+6. Title 6. Assessing risks to capital
------+6.1. General considerations
---------+109. Competent authorities should assess and score the risks to capital that have been identified …
---------+110. The purpose of this title is to provide common methodologies to be considered for assessing …
---------+111. This title provides competent authorities with guidance for the assessment and scoring of the …
---------+112. The title also identifies a set of subcategories within each risk category above, which need …
---------+113. The decision on materiality depends on the supervisory judgement. However, for FX lending …
---------+114. Competent authorities should also assess other risks that are identified as material to a …
---------+115. The above elements should also be taken into account by competent authorities when they are …
---------+116. For credit, market and operational risk, competent authorities should evaluate inter alia the …
---------+117. When evaluating risks to capital, competent authorities should also consider the potential …
---------+118. In their implementation of the methodologies specified in this title, competent authorities …
---------+119. For each material risk, competent authorities should assess and reflect in the risk score: a. …
---------+120. This assessment flow is represented in figure 2 below. Figure 2. Assessment workflow for risks …
---------+121. When performing their assessments, competent authorities should use available information …
---------+122. In the assessment of risks to capital, competent authorities should also evaluate the accuracy …
---------+123. The outcome of the assessment of each material risk should be reflected in a summary of …
------+6.2. Assessment of credit and counterparty risk
---------+124. When assessing the credit risk management framework, competent authorities should evaluate the …
---------+125. Competent authorities should assess credit risk arising from all non-trading book exposures …
---------+126. Competent authorities should take into account the possibility that these components may …
---------+127. Competent authorities should assess the impact of ESG risks on the inherent credit risk as …
---------+128. In addition, competent authorities should also pay attention to consideration given to ML/TF …
---------+129. Competent authorities should assess credit risk from both a current and forward-looking …
---------+130. To assess the inherent credit risk of an institution, competent authorities should first …
---------+131. Competent authorities should focus their assessment primarily on the most significant …
---------+132. Competent authorities should assess the materiality of the risk in relation to the current …
---------+133. As additional source of information for the materiality assessment, competent authorities …
---------+134. Competent authorities should also consider the results of stress tests performed by the …
---------+135. Based on the materiality assessment performed in the previous paragraphs, as well as the size …
---------+136. Competent authorities should assess the nature of the credit exposures (i.e. the types of …
---------+137. To assess the nature of credit risk, competent authorities should consider at least the …
---------+138. Where specialised lending exposures are deemed material, competent authorities should assess …
---------+139. When assessing portfolio credit quality, competent authorities should pay particular attention …
---------+140. Competent authorities should carry out an analysis to distinguish between performing …
---------+141. This should result in an overall assessment on the end-to-end credit cycle of the institution …
---------+142. Competent authorities should assess whether the level of loan loss provisions and credit …
---------+143. When evaluating the inherent credit risk of an institution, competent authorities should also …
---------+144. Competent authorities should consider the level and quality of guarantees (including credit …
---------+145. Competent authorities should also assess the materiality of the residual risk (as referred to …
---------+146. When assessing the impact of ESG risks and environmental risks in particular on the inherent …
---------+147. To achieve a comprehensive understanding of the institution’s credit risk profile, competent …
---------+148. Competent authorities should assess whether the institution has a sound, clearly formulated …
---------+149. Competent authorities should assess whether the institution has an appropriate organisational …
---------+150. Competent authorities should assess whether the institution has appropriate policies and …
---------+151. Competent authorities should assess whether the institution has an appropriate framework for …
---------+152. Competent authorities should assess whether the institution’s management body and senior …
---------+153. Competent authorities should assess whether the institution has defined and implemented …
---------+154. Competent authorities should assess whether the institution has a strong and comprehensive …
---------+155. In conducting this assessment, competent authorities should consider whether the limit system …
---------+156. Competent authorities should also assess the functionality of the internal audit function in …
---------+157. For institutions adopting an internal rating-based approach to determining minimum own funds …
---------+158. Following the above assessment, competent authorities should form a view on the institution’s …
---------+159. The table below presents a non-exhaustive list of supervisory measures that competent …
------+6.3. Assessment of market risk
---------+160. When assessing the market risk management framework, competent authorities should evaluate …
---------+161. In these guidelines, references to ‘market risk’ will encompass all the following risks, which …
---------+162. Competent authorities may perform a less granular analysis for institutions which meet the …
---------+163. Competent authorities should take into account the impact of ESG risks on the inherent market …
---------+164. Through the assessment of inherent market risk competent authorities should determine the main …
---------+165. To support this analysis, competent authorities should consider, as a minimum, the products …
---------+166. The first step in assessing the nature of the inherent market risk of an institution is to …
---------+167. Competent authorities should base their assessment primarily on the most significant …
---------+168. Competent authorities should also consider: a. the complexity of financial products (e.g. …
---------+169. When appropriate, competent authorities should also consider the internal risk measures of …
---------+170. Competent authorities should also assess the institution’s ability to form a comprehensive …
---------+171. When determining whether P2R should be imposed for the market risk to which the institution is …
---------+172. Competent authorities should identify and analyse in relation to market risk positions and the …
---------+173. Competent authorities should identify the materiality of the transfer pricing in the context …
---------+174. For institutions under paragraph 1733, point (a), where the profits and losses, re-allocated …
---------+175. Competent authorities should analyse the historic profitability, including volatility of …
---------+176. Competent authorities should distinguish between trading and non-trading revenues (such as …
---------+177. For those asset classes and/or exposures generating significant profits or losses, competent …
---------+178. Competent authorities should assess whether an institution has implemented adequate stress …
---------+179. To achieve an adequate understanding of the management of market risk, commensurate to the …
---------+180. Competent authorities should also assess the policies and procedures of institutions to …
---------+181. Competent authorities should assess whether institutions have sound, clearly formulated and …
---------+182. Competent authorities should assess whether the institution has an appropriate organisation …
---------+183. Competent authorities should assess whether the institution has clearly defined policies and …
---------+184. In particular, the assessment should cover the positions to be included/excluded from the …
---------+185. Competent authorities should assess whether the institution has an appropriate framework for …
---------+186. Competent authorities should assess whether institutions have in place an adequate monitoring …
---------+187. Competent authorities should assess whether the institution has a strong and comprehensive …
---------+188. Competent authorities should also assess whether the internal validation process is sound and …
---------+189. Competent authorities should also assess the functionality of the internal audit function in …
---------+190. Following the above assessment, competent authorities should form a view on the institution’s …
---------+191. The table below presents a non-exhaustive list of supervisory measures that competent …
------+6.4. Assessment of operational risk
---------+192. When assessing the operational risk management framework, competent authorities should …
---------+193. Competent authorities should assess operational risk throughout all the business lines and …
---------+194. Competent authorities should assess the materiality of operational risk arising from …
---------+195. When assessing operational risk, competent authorities should assess ICT risk, pursuant to …
---------+196. Competent authorities should assess whether the institution has an adequate operational …
---------+197. When assessing operational risk, competent authorities should assess, if applicable, whether …
---------+198. Competent authorities should assess reputational risk jointly with operational risk as it is …
---------+199. Competent authorities should assess the impact of ESG risks on the inherent operational and …
---------+200. Competent authorities should develop a thorough understanding of the institution’s inherent …
---------+201. To support this assessment, competent authorities should consider the own funds requirement …
---------+202. Competent authorities should consider at minimum key operational risk factors, potential …
---------+203. Competent authorities should determine the nature of operational risk exposures by analysing …
---------+204. Following the identification and analysis of the major sources and drivers of operational …
---------+205. A primary source of information competent authorities should consider it is the institution’s …
---------+206. Competent authorities should focus the assessment of operational risk sub-categories to those …
---------+207. Competent authorities should consider the following when assessing the relevance and …
---------+208. Competent authorities should consider whether the institution may occur any expenses, fines …
---------+209. However, the competent authority should apply a forward-looking approach, also considering the …
---------+210. Under the operational risk, competent authorities should assess model risk, with specific …
---------+211. For the assessment of model risk, competent authorities should consider: a. to what extent and …
---------+212. When models are used for decision-making purposes (e.g. product pricing, AI models, evaluation …
---------+213. When conducting the model risk assessment, competent authorities should consider the …
---------+214. In line with DORA, competent authorities should review the institution’s identification …
---------+215. Competent authorities should review the institution’s relevant documentation, methodology and …
---------+217. Competent authorities should then map the identified material ICT risk into the ICT risk …
---------+218. Competent authorities should assess the framework and arrangements the institution has in …
---------+219. Competent authorities should assess whether the institution has a sound, clearly formulated …
---------+220. Competent authorities should assess the institution’s compliance with Article 323 of the …
---------+221. Competent authorities should assess whether the institution has a strong control framework and …
---------+222. Competent authorities should also assess the functionality of the internal audit function in …
---------+223. Competent authorities should assess the institution’s compliance with the (i) EBA Guidelines …
---------+224. Competent authorities should assess whether the institution has established effective business …
---------+225. Competent authorities should determine whether the institution’s business continuity …
---------+226. Competent authorities should assess whether the institution’s business continuity, response …
---------+227. Competent authorities should also assess whether testing results are documented and reported …
---------+228. Competent authorities should assess the institution’s compliance with the DORA and the EBA …
---------+229. Competent authorities should assess how the roles and responsibilities for all ICT-related …
---------+230. Competent authorities should develop a thorough understanding of the institution’s ICT risk …
---------+231. When assessing ICT risk management, competent authorities should pay particular attention to …
---------+232. Competent authorities should consider whether the internal audit function is effective and …
---------+233. Competent authorities should assess the reputational risk to which the institution is exposed …
---------+234. When assessing the relevance of reputational risk, competent authorities should consider the …
---------+235. Competent authorities should consider both internal and external factors or events that might …
---------+236. Competent authorities should assess the significance of the institution’s reputational risk …
---------+237. In the context of the operational risk analysis, competent authorities should take into …
---------+238. Competent authorities should bear in mind that any institution can be exposed to ML/TF risk …
---------+239. Competent authorities should share relevant information on operational risk issues identified …
---------+240. Competent authorities should assess whether the institution has implemented adequate …
---------+241. Competent authorities should form a holistic view on the ability of the institution to deliver …
---------+242. Competent authorities should consider the attention given by the management body and senior …
---------+243. Following the above assessment, competent authorities should form a view on the institution’s …
---------+244. The table below presents a non-exhaustive list of supervisory measures that competent …
------+6.5. Assessment of interest rate risk and credit spread risk arising from non-trading book activities
---------+245. When assessing the inherent interest rate risk arising from interest rate-sensitive positions …
---------+246. Competent authorities should assess IRRBB, including hedges for these positions, irrespective …
---------+247. Competent authorities should consider the relevance and materiality of at least the following …
---------+248. Assessment of IRRBB should be differentiated from assessment of CSRBB that competent …
---------+249. Based on the overall assessment of the inherent risk of IRRBB and the risk management and …
---------+250. Through the assessment of the inherent level of IRRBB, competent authorities should determine …
---------+251. To determine the scope of the IRRBB assessment, competent authorities should first identify …
---------+252. Competent authorities should form a clear view on how changes in interest rates can have an …
---------+253. For this purpose, competent authorities should analyse and form a clear view on the structure …
---------+254. In addition, competent authorities should review the institution’s hedging strategy and the …
---------+255. Competent authorities should also pay attention to any concentrations (e.g. in the loan or …
---------+256. When analysing the impact on the institution’s earnings, competent authorities should be aware …
---------+257. When analysing the impact on the institution’s economic value and earnings, competent …
---------+258. Where the institution is identified as an outlier by the supervisory outlier test on net …
---------+259. Competent authorities should pay attention to the sensitivity of cash flows to changes in the …
---------+260. In addition to using the supervisory outlier test stipulated in Article 98(5) of Directive …
---------+261. In their quantitative assessment, competent authorities should also consider the results of …
---------+262. When analysing the results of both the impact of the supervisory outlier tests, and the …
---------+263. Competent authorities should assess and take into account the results of the interest rate …
---------+264. If, when the outcome of the institution’s shock scenarios and stress tests is reviewed …
---------+265. To achieve a comprehensive understanding of the institution’s interest rate risk profile in …
---------+266. Competent authorities should assess whether the institution has a sound, clearly formulated …
---------+267. Competent authorities should assess whether the institution has an appropriate organisational …
---------+268. Competent authorities should assess whether the institution has clearly defined policies and …
---------+269. Competent authorities should assess whether the institution has an appropriate framework for …
---------+270. In addition, they should consider whether the information systems and measurement techniques …
---------+271. Competent authorities should assess the institution’s approach to modelling the behaviour of …
---------+272. Competent authorities should consider whether the institution’s internal measurement systems …
---------+273. Competent authorities should assess whether the institution has an appropriate monitoring and …
---------+274. Competent authorities should assess whether the institution has a strong and comprehensive …
---------+275. Through the assessment of the inherent level of CSRBB, competent authorities should understand …
---------+276. To determine the scope of the CSRBB assessment, competent authorities should first identify …
---------+277. Competent authorities should form a clear view on how changes in credit spreads can have an …
---------+278. When analysing the impact on the institution’s earnings, competent authorities should consider …
---------+279. Competent authorities should consider the results of the institution’s methodologies for …
---------+280. To achieve a comprehensive understanding of the institution’s credit spread risk profile in …
---------+281. The review of the institution’s governance of CSRBB should include the following elements: a. …
---------+282. For the assessment of these areas, competent authorities should refer to section 6.5.2.2 on …
---------+283. When analysing the perimeter of assets and liabilities covered by the CSRBB assessment, also …
---------+284. To analyse the institution’s measurement of CSRBB, competent authorities should consider …
---------+285. Competent authorities should check the exclusion of idiosyncratic spread in the institution’s …
---------+286. Competent authorities should assess whether the institution has an appropriate framework for …
---------+287. Competent authorities should consider whether the institution’s internal measurement systems …
---------+288. Competent authorities should assess whether the institution has an appropriate monitoring and …
---------+289. Competent authorities should assess whether the institution has a strong and comprehensive …
---------+290. Following the above assessments, competent authorities should form a view on the institution’s …
---------+291. The table below presents a non-exhaustive list of supervisory measures that competent …
---+7. Title 7. SREP capital assessment
------+7.1. General considerations
---------+292. Competent authorities should determine through the SREP capital assessment whether the own …
---------+293. Competent authorities should do this by determining and setting the quantity (amount) and …
---------+294. When a material impact on institution’s capital profile is or may be expected due to relevant …
---------+295. To address potential capital inadequacies, including in stressed conditions, competent …
---------+296. When setting the P2R and, where relevant, P2G, competent authorities should: a. take into …
---------+297. Competent authorities should assess the adequacy of the institution’s own funds and the impact …
------+7.2. Determining Pillar 2 requirement for risks other than the risk of excessive leverage (P2R)
---------+298. Competent authorities should determine P2R for risks other than the risk of excessive …
---------+299. When setting P2R for the risk of unexpected losses pursuant to point (a) of the following …
---------+300. Competent authorities should determine on a risk-by-risk basis, the amounts of capital …
---------+301. Competent authorities should ensure that the amount of capital considered adequate to cover …
---------+302. When identifying, assessing and quantifying risks to which the institution is exposed …
---------+303. The ICAAP and outcomes of its assessment should be taken into account by competent authorities …
---------+304. For the purposes of Article 98(1), point (f) of Directive 2013/36/EU and the determination of …
---------+305. However, diversification between risks in different categories, including those covered by …
---------+306. Competent authorities should assess the reliability of the ICAAP calculations by assessing …
---------+307. Competent authorities should further assess the reliability of the ICAAP calculations by …
---------+308. An ICAAP calculation should be considered partially reliable where, despite not meeting all …
---------+309. Competent authorities should develop and apply risk-specific supervisory benchmarks as a means …
---------+310. The supervisory benchmarks should be developed to provide a prudent, consistent (i.e. as …
---------+311. When applying supervisory benchmarks, competent authorities should consider the business model …
---------+312. Competent authorities should use other relevant inputs to support the determination of …
---------+313. Other relevant inputs should prompt the competent authority to reassess the …
---------+314. To ensure consistency in determining P2R, competent authorities should use the same peer …
---------+315. When competent authorities take supervisory benchmarks as well as other relevant inputs into …
---------+316. If, during the ongoing review of internal approaches for the calculation of own funds …
---------+317. When an institution becomes bound by the output floor as set out in Article 92(3) of …
---------+318. For the purpose of the previous paragraph, competent authorities should encourage institutions …
---------+319. Competent authorities should perform the review described in paragraph 317 at the time an …
---------+320. Competent authorities should set P2R to cover deficiencies – identified following the risk …
---------+321. Competent authorities should only set P2R to cover funding risk – identified following the …
---------+322. Where an institution repeatedly fails to establish or maintain an adequate level of own funds …
---------+323. Where necessary, and having regard to the institution’s specific circumstances, competent …
------+7.3. Pillar 2 requirements for the risk of excessive leverage (P2R-LR)
---------+324. Where, as a result of the risk of excessive leverage assessment, in accordance with Article …
---------+325. In line with the concept of the leverage ratio (and its stack of requirements) as a backstop …
---------+326. In assessing the risk of excessive leverage, competent authorities should consider all of the …
---------+327. Competent authorities should determine the P2R-LR as the difference between the capital …
---------+328. When setting P2R-LR, competent authorities should consider in particular: a) elements of risk …
---------+329. Competent authorities should identify, assess and quantify the risk of excessive leverage …
---------+330. Competent authorities should add the P2R-LR to the minimum leverage ratio Tier 1 requirement. …
---------+331. Where necessary, and having regard to the institutions’ specific circumstances, competent …
------+7.4. Reconciliation with the capital buffers and any macroprudential requirements
---------+332. In determining Pillar 2 requirements (or other capital measures), competent authorities should …
------+7.5. Determining the TSCR, TSLRR, OCR and OLRR
---------+333. Competent authorities should determine and express the TSCR in terms of CET1 Capital, Tier 1 …
---------+334. Competent authorities should determine the TSLRR (in terms of Tier 1 capital) as the sum of …
---------+335. Where competent authorities require institutions to cover P2R-LR with a higher quality of …
---------+336. Where considering the possibility of requiring a higher quality of capital, competent …
---------+337. Competent authorities should determine the OCR as the sum of: a. TSCR; b. combined capital …
---------+338. Competent authorities should determine the OLRR as the sum of: a. TSLRR; b. G-SII leverage …
---------+339. Competent authorities should not consider items and instruments other than those eligible for …
------+7.6. Meeting requirements in stressed conditions – Use of P2G and P2G-LR to address the quantitative outcomes of stress testing
---------+340. Competent authorities should determine by means of stress testing the adequacy of the …
---------+341. Competent authorities should assess as appropriate the quantitative outcomes of stress tests …
---------+342. Competent authorities should determine P2G and P2G-LR, and, where the determination leads to a …
---------+343. The level of P2G should protect against the potential breach of TSCR in an adverse scenario. …
---------+344. Competent authorities should determine and set P2G and P2G-LR based on the outcomes of the …
---------+345. On the basis of establishing a proportionate approach for non-Category 1 institutions and …
---------+346. Competent authorities should determine and set P2G and P2G-LR in accordance with the minimum …
---------+347. Notwithstanding the previous paragraph, competent authorities: a. should assess whether the …
---------+348. When calibrating the P2G, competent authorities should ensure that it is set at a level …
---------+349. When calibrating the P2G-LR, the maximum stress impact should be calculated based on the …
---------+350. Competent authorities should obtain the P2G starting point specific for each institution by …
---------+351. Where setting the P2G and P2G-LR, competent authorities should ensure an adequate link between …
---------+352. When determining the final P2G and P2G-LR, competent authorities should consider, where …
---------+353. For the purpose of determining P2G, competent authorities should also consider the extent to …
---------+354. In addition, competent authorities should consider the extent to which the existing combined …
---------+355. Where competent authorities determine P2G, they should add this guidance on top of the OCR. …
------+7.7. Summary of findings, scoring and supervisory measures
---------+356. Following the above assessment, competent authorities should form a view on whether existing …
---------+357. In setting the score for capital adequacy, where applicable, competent authorities should …
---------+358. The table below provides a non-exhaustive list of supervisory measures that competent …
---------+359. When competent authorities assess the credibility of the capital plan or the revised capital …
---------+360. Competent authorities should expect institutions to implement the revised capital plan …
---+8. Title 8. Assessing risks to liquidity and funding and SREP liquidity and funding assessment
------+8.1. General considerations
---------+361. Competent authorities should assess the institution’s material liquidity and funding risks and …
---------+362. When assessing the inherent liquidity and funding risk, and the adequacy of the liquidity and …
---------+363. The methodology comprises six main components: a. assessment of inherent liquidity risk …
---------+364. The assessment flow is documented graphically in figure 3. Figure 3. Elements of the …
---------+365. In the assessment of risks to liquidity and funding, competent authorities should review …
---------+366. Competent authorities should ensure the assessment pays attention to how the institution’s …
---------+367. To assist with the quantitative assessment of the institution’s liquidity and funding risks …
---------+368. Competent authorities shall also evaluate any information with a potential impact on liquidity …
---------+369. In reviewing the quality of the institution’s organisational and risk management arrangements …
---------+370. Competent authorities should take into account the impact of ESG risks on the inherent …
---------+371. The outcome of the assessment of each individual risk should be reflected in a summary of …
------+8.2. Assessment of inherent liquidity risk
---------+372. Competent authorities should assess the institution’s short- and medium-term liquidity risk …
---------+373. For the assessment of liquidity needs, buffers and counterbalancing capacity under normal …
---------+374. Competent authorities should assess the institution’s liquidity needs in the short and medium …
---------+375. Competent authorities should support the assessment of short-term liquidity risk by analysing …
---------+376. In evaluating the impact of shocks on the institution’s liquidity needs, competent authorities …
---------+377. Competent authorities should ensure that their assessment of the institution’s short-term …
---------+378. Competent authorities should assess the institution’s exposure to intraday liquidity risk for …
---------+379. For those jurisdictions where reporting on intraday risk is not yet available, competent …
---------+380. Competent authorities should assess the adequacy of the institution’s liquidity buffer and …
---------+381. Competent authorities should consider factors that might reduce the institution’s ability to …
---------+382. Competent authorities should review (where applicable) the appropriateness of the …
---------+383. Competent authorities should run their own liquidity stress tests to independently assess …
------+8.3. Assessment of inherent funding risk
---------+384. Competent authorities should assess the institution’s funding risk and whether the medium- and …
---------+385. Competent authorities should assess the appropriateness of the institution’s funding profile …
---------+386. Competent authorities should consider the impact on the institution’s funding profile of any …
---------+387. Competent authorities should assess whether potential shortcomings arising from the …
---------+388. Competent authorities should consider factors that may reduce the stability of the funding …
---------+389. Competent authorities should assess risks to the sustainability of the funding profile arising …
---------+390. Competent authorities should also assess the risk that asset encumbrance may have an adverse …
---------+391. Competent authorities should be aware of the institution’s actual market access and current …
---------+392. Competent authorities should assess the expected change in funding risks based on the …
------+8.4. Assessment of liquidity and funding risk management and control framework
---------+393. To achieve a comprehensive understanding of the institution’s liquidity and funding risk …
---------+394. Competent authorities should assess whether the institution has a sound, clearly formulated …
---------+395. Competent authorities should assess whether the institution has an appropriate organisational …
---------+396. Competent authorities should assess whether the institution has appropriate policies and …
---------+397. Competent authorities should assess the adequacy of the institution’s approach to maintaining …
---------+398. Competent authorities should assess whether the institution has an appropriate framework and …
---------+399. Competent authorities should assess whether institutions have an appropriate reporting …
---------+400. Competent authorities should assess the adequacy of the process of measuring intraday …
---------+401. Competent authorities should assess whether the institution has an adequate set of liquidity …
---------+402. Institutions should be able to demonstrate that the indicators are adequately documented …
------+Institution’s liquidity- and funding-specific stress testing
---------+403. Competent authorities should assess whether an institution has implemented adequate …
---------+404. Competent authorities should take into account whether the framework permits the institution …
---------+405. Competent authorities should ensure that the institution provides the modelled impact of …
---------+406. An important aspect that competent authorities should consider when assessing the …
---------+407. Competent authorities should also assess whether the institution takes a conservative approach …
---------+408. Competent authorities should assess whether the management framework of the institution’s …
---------+409. Competent authorities should assess whether the institution has a strong and comprehensive …
---------+410. Competent authorities should consider whether the institution has limits to ensure consistency …
---------+411. Competent authorities should assess whether the limits are approved and regularly reviewed by …
---------+412. Competent authorities should assess whether the institution has implemented an adequate …
---------+413. Competent authorities should assess whether the institution has adequate controls regarding …
---------+414. Competent authorities should assess whether the institution’s liquidity contingency plan (LCP) …
---------+415. Competent authorities should assess whether the actions described in the LCP are feasible in …
---------+416. Competent authorities should assess the appropriateness of the institution’s governance …
---------+417. Competent authorities should assess whether the funding plan is feasible and appropriate in …
---------+418. In addition, competent authorities may consider: a. whether the institution adequately …
---------+419. Competent authorities should assess whether the institution’s funding plan is appropriately …
---------+420. In addition, competent authorities may take into account whether the institution is able to …
---------+421. Competent authorities should consider the quality of the institution’s processes for …
------+8.5. Summary of findings, scoring and supervisory measures
---------+422. Following the above assessment, competent authorities should form a view on the institution’s …
---------+423. In setting the liquidity and funding adequacy score, competent authorities should, where …
---------+424. Following the liquidity and funding adequacy scoring of section 8.5, competent authorities …
---------+425. The next table provides a non-exhaustive list of qualitative and quantitative supervisory …
---------+426. Where competent authorities determine that quantitative measures may be necessary, they should …
---------+427. It is relevant to note that part of the measures mentioned in table 18 are of a qualitative …
---------+428. When setting structural, long-term supervisory requirements, competent authorities should …
---------+429. Where competent authorities conclude that there is a high risk that the institution’s cost of …
------+8.6. Benchmarking and setting of quantitative liquidity and funding requirements
---------+430. To support their liquidity and funding adequacy scoring and calibrate specific quantitative …
---------+431. Competent authorities should use the most appropriate benchmark for the institution’s business …
---------+432. Competent authorities should assess the suitability of any benchmarks applied to institutions …
---------+433. A key input to the competent authority’s benchmarks for the quantification of specific …
---------+434. Below are some examples of the possible approaches: a. Example 1: Institution with an initial …
---------+435. Where competent authorities have not developed their own benchmark for the quantification of …
---------+436. To articulate the specific quantitative liquidity requirements, competent authorities should …
---------+437. To articulate the specific quantitative stable funding requirements appropriately, competent …
---------+438. Competent authorities should structure quantitative liquidity or funding requirements in such …
---------+439. Competent authorities should ensure that the institution immediately notifies them if it does …
---------+440. Notwithstanding the above, competent authorities may also set qualitative requirements in the …
---------+441. Below are some examples of the different approaches for the structure of specific quantitative …
---------+Example of specific requirements articulation
---+9. Title 9. Overall SREP assessment and communication
------+9.1. General considerations
---------+442. This title covers how the findings from the assessments of each SREP elements are combined …
------+9.2. Overall SREP assessment
---------+443. In determining the overall SREP assessment, competent authorities should consider the findings …
---------+444. On the basis of these considerations, competent authorities should determine the institution’s …
---------+445. The overall SREP assessment should be reflected in a viability score based on the …
---------+446. When determining that an institution is ‘failing or likely to fail’, as reflected by an …
------+9.3. Communication of the outcome of the SREP assessment
---------+447. Competent authorities should communicate, in accordance with the SREP engagement model set out …
---------+448. The communication of the outcome of the SREP assessment to institutions, and, where relevant …
------+9.4. Supervisory reaction to a situation where TSCR or OCR is not met
---------+449. TSCR as determined in accordance with these guidelines and communicated in the SREP assessment …
---------+450. Competent authorities should also monitor whether the institutions meet the OCR. Where …
------+9.5. Supervisory reaction to a situation where P2G is not met
---------+451. Competent authorities should monitor whether the amount of own funds expected in accordance …
---------+452. There are generally three situations to be considered by a competent authority in which an …
---------+453. Notwithstanding particular supervisory responses in accordance with the previous paragraph …
------+9.6. Interaction between supervisory, early intervention measures and resolution authorities’ assessment
---------+454. In addition to the supervisory measures, competent authorities may apply early intervention …
---------+455. Competent authorities should apply early intervention measures without prejudice to any other …
---------+456. When setting supervisory or early intervention measures, competent authorities should, in …
------+9.7. Interaction between supervisory and macroprudential measures
---------+457. Where an institution is subject to macroprudential measures and the SREP assessment determines …
------+9.8. Interaction between supervisory and AML/CFT measures
---------+458. When applying supervisory measures to address prudential deficiencies related to ML/TF risk …
---------+459. Where competent authorities in the course of exercising their supervisory activities have …
---------+460. Where the competent authorities are notified or become aware of supervisory measures or …
---+10. Title 10. Application of the SREP to cross-border groups
------+461. This title addresses the application of the SREP procedures and methodology as specified in …
------+462. In the SREP, competent authorities should also consider the potential ML/TF risks and risks of …
------+463. When assessing prudential implications of ML/TF risks and risks of non-implementation and …
------+10.1. Application of the SREP to cross-border groups
---------+464. When applying the SREP and these guidelines to cross-border groups, competent authorities …
---------+465. When these guidelines are applied to the subsidiaries of a cross-border group, competent …
---------+466. The results of any such initial assessment of the SREP elements, including, if identified …
---------+467. In accordance with Article 3 of the Commission Implementing Regulation (EU) No 710/2014, prior …
---------+468. Following the discussions within the colleges of supervisors and the outcomes of the joint …
---------+469. Where a competent authority’s assessment revealed specific deficiencies related to intra-group …
---------+470. Competent authorities should discuss and coordinate the following within the colleges of …
---------+471. When preparing the summary of the overall SREP assessment for the cross-border group and its …
------+10.2. SREP capital assessment and institution-specific prudential requirements
---------+472. The determination of capital adequacy, and related requirements and guidance in accordance …
---------+473. For parent or subsidiary institutions of a cross-border group, the application of P2R and …
---------+474. In the context of discussions on the adequacy of the level of own funds and determining P2R …
---------+475. To determine the TSCR as specified in Title 7, competent authorities should consider the same …
---------+476. If the outcome of the supervisory assessment of the risk of excessive leverage for the parent …
---------+477. In the context of the discussions on the adequacy of the level of own funds to cover the risk …
---------+478. All the relevant information regarding the determination of P2G and P2G-LR for parent or …
------+10.3. SREP liquidity assessment and institution-specific prudential requirements
---------+479. The determination of measures to address any significant matters and material findings …
---------+480. For Article 113(1)(b) of Directive 2013/36/EU, competent authorities should consider ‘matters’ …
------+10.4. Application of other supervisory measures
---------+481. Competent authorities responsible for the supervision of cross-border groups and their …
---------+482. Competent authorities responsible for the prudential supervision of entities of a cross-border …
---+11. Title 11. Supervisory stress testing
------+11.1. Use of supervisory stress testing by competent authorities
---------+483. Competent authorities should, also on the basis of Article 100 of Directive 2013/36/EU, use …
---------+484. Furthermore, supervisory stress testing should help competent authorities to assess …
---------+485. Competent authorities should also, where appropriate, use supervisory stress testing outcomes …
------+11.2. Key elements of supervisory stress testing
---------+486. When deciding on the key elements of supervisory stress testing, competent authorities should …
---------+487. When designing and conducting supervisory stress tests for SREP purposes, competent …
------+11.3. Organisational and governance arrangements within competent authorities
---------+488. Competent authorities should establish an effective programme for supervisory stress testing. …
---------+489. The governance, organisation and IT arrangements supporting the supervisory stress testing …
---------+490. As part of governance arrangements, competent authorities should ensure that the supervisory …
---------+491. Competent authorities should ensure that they have processes and arrangements in place for an …
---------+492. When applying supervisory stress testing to cross-border groups, competent authorities should …
---------+493. Competent authorities should also identify what information regarding supervisory stress tests …
------+12. Title 12. Assessing third-country branches
---------+494. This title addresses the application of the SREP procedures and methodology as specified in …
---------+495. When performing the SREP assessment for TCBs, competent authorities should evaluate inter alia …
---------+496. The SREP assessment of a TCB should include an assessment of the branch’s business model …
---------+497. The review should be conducted with a level of frequency and intensity that is proportionate …
---------+498. In addition to assessing the core SREP elements for TCBs, competent authorities should ensure …
---------+499. Where competent authorities exercise their right in accordance with Article 48a of Directive …
---------+500. Competent authorities should use the findings from the assessment of the individual SREP …
---------+12.1. Application of SREP to third-country branches
------------+501. The SREP assessment should focus on the TCB’s material risks and how these are dependent on …
------------+502. To inform the assessment, competent authorities should take into account the results of the …
------------+503. Competent authorities should ensure that the scope of the assessment contains measures to …
------------+504. Where the review of the TCB’s governance, business model, or activities, gives competent …
------------+505. Competent authorities should analyse the TCB’s business model and strategy to understand the …
------------+506. Competent authorities should pay specific attention to the outreach of the TCB activities, to …
------------+507. Competent authorities should consider how the head undertaking’s strategic priorities for the …
------------+508. Competent authorities should assess the adequacy of the TCB’s governance arrangements using …
------------+509. In conducting the assessment of internal governance, competent authorities should consider …
------------+510. Competent authorities should assess whether the persons directing the TCB: a. have sufficient …
------------+511. Where the TCB branch has established a management committee, competent authorities should …
------------+512. Competent authorities should assess the TCB’s relation with the head undertaking, including …
------------+513. Where the TCB engages in back-to-back or intragroup operations, competent authorities should …
------------+514. Competent authorities should assess whether the TCB has robust internal control functions. For …
------------+515. Competent authorities should assess whether the TCB conducts appropriate due diligence and …
------------+516. Competent authorities should assess: a. whether the TCB branch meets the minimum capital …
------------+517. Competent authorities should assess whether the institution holds sufficient liquid and …
------------+518. In conducting the capital endowment and liquidity assessment, competent authorities should …
------------+519. Competent authorities should assess: a. the quality of the engagement between the TCB and head …
------------+520. Competent authorities should assess whether the TCB has an adequate framework for managing and …
------------+521. Competent authorities should assess whether the activities performed by the TCB, its assets …
------------+522. Where the TCB engages in back-to-back booking arrangements, competent authorities should …
------------+523. Competent authorities should assess whether the TCB manages assets and liabilities …
------------+524. Where the TCB originates assets and liabilities for other branches or subsidiaries of the same …
---------+12.2. Summary of findings, scoring and supervisory measures
------------+525. Following the above assessment, competent authorities should form an overall risk on the key …
------------+526. Competent authorities may, on the basis of the vulnerabilities and deficiencies identified in …
------------+527. For TCBs of systemic importance, competent authorities may also consider: a) Requiring the TCB …
------------+528. Competent authorities should communicate the outcomes of the SREP assessment to the management …
---------+Annex I – Credit risk sub-categories
------------+categories assessment areas
------------+categories assessment areas
---------+Annex II – Market risk sub-categories
------------+categories (level 1)
------------+categories (level 1)
------------+categories (level 1)
------------+categories (level 1)
------------+categories (level 1)
------------+adjustment risk
------------+banking books)
------------+categories (level 1)
------------+risk
------------+risk
---------+Annex III – Operational risk sub-categories
------------+categories (level 1) categories (level 2)
------------+categories (level 1) categories (level 2)
---------+Annex IV – IRRBB sub-categories
------------+categories (level 1)
---------+Annex V – Transfer pricing risk measurement

English - European Union - Financial Industry -

Guidelines for common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing (EBA/GL/2026/06)

Guidelines for common procedures and methodologies for the supervisory review and evaluation process (SREP) and supervisory stress testing (EBA/GL/2026/06)

https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/supervisory-review-and-evaluation-process-srep-and-pillar-2/guidelines-common-procedures-and-methodologies-supervisory-review-and-evaluation-process-srep-and – PDF

1. Panoramica

,

Titolo	Regolamentazione
Compliance and reporting obligations	Compliance and reporting obligations
1. Title 1. Subject matter, scope and definitions, and implementation	1. Title 1. Subject matter, scope and definitions, and implementation
2. Title 2. SREP framework	2. Title 2. SREP framework
3. Title 3. Monitoring of key indicators	3. Title 3. Monitoring of key indicators
4. Title 4. Business model analysis (BMA)	4. Title 4. Business model analysis (BMA)
5. Title 5. Assessing internal governance and institution-wide controls	5. Title 5. Assessing internal governance and institution-wide controls
6. Title 6. Assessing risks to capital	6. Title 6. Assessing risks to capital
7. Title 7. SREP capital assessment	7. Title 7. SREP capital assessment
8. Title 8. Assessing risks to liquidity and funding and SREP liquidity and funding assessment	8. Title 8. Assessing risks to liquidity and funding and SREP liquidity and funding assessment
9. Title 9. Overall SREP assessment and communication	9. Title 9. Overall SREP assessment and communication
10. Title 10. Application of the SREP to cross-border groups	10. Title 10. Application of the SREP to cross-border groups
11. Title 11. Supervisory stress testing	11. Title 11. Supervisory stress testing

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Standard correlati

2. Requisiti identificati

Requisiti
Fonte	Requisito

3. Standard correlati

Standard
Fonte	Requisito

EBA - Published by the European Banking Authority at https://www.eba.europa.eu/