vērtējums viedoklis Apsvērumi par piemītošo risku un kontroles atbilstību

Competent authorities should assess the importance of other risks to investment firm’s capital, which are not covered by Pillar 1 own funds requirements, in accordance with Article 36 and 40 of Directive (EU) 2019/2034. In assessing these other risks, competent authorities should take into account the nature and complexity of the investment firm’s activities, having impact on the significance of these risks.

6.6.2 Assessment of inherent risks

Through the assessment of inherent risks not covered by Pillar 1 own funds requirements, competent authorities should determine the main drivers of the investment firm’s risks and evaluate the significance of the impact of these risks for the investment firm. The assessment of such risks should be structured around the following main steps:

• a. preliminary assessment;
• b. assessment of the nature and scale of investment activities that incur a risk for the investment firm not covered by Pillar 1 own funds requirements;
• c. assessment of the systems and processes regarding these activities.

Competent authorities should assess risks not covered by Pillar 1 own funds requirements in both current and prospective terms.

Where relevant, competent authorities should also conduct an assessment of other risks than those listed in this chapter.

Preliminary assessment

To determine the scope of the assessment of risks not covered by Pillar 1 own funds requirements, competent authorities should first identify the sources of risks to which the investment firm is or may be exposed.

As a minimum, competent authorities should consider the following:

• a. the business model and risk appetite;
• b. in-house development or outsourcing of IT solutions;
• c. support functions such as compliance, legal, fiscal (also if outsourced);
• d. cost of lawsuits and litigation;
• e. total operational losses, including the cost of internal and external fraud;
• f. scope of non-trading book activities.

Competent authorities should perform the preliminary analysis considering the change in the above over time to form an informed view of the main drivers of the investment firm’s other risks.

Interest rate risk arising from non ‐ trading book activities

Competent authorities should assess the interest rate risk arising from non-trading book activities to which the investment firm is exposed.

Competent authorities should assess how changes in interest rates can have an adverse impact on the investment firm’s assets, liabilities and off-balance-sheet exposures. To better determine the complexity and the interest rate risk profile of the investment firm, competent authorities should also understand the main features of the investment firm’s assets, liabilities, and off-balance-sheet exposures.

In their quantitative assessment, competent authorities should consider the results of the investment’s firm internal methodologies for measuring interest rate risk arising from non-trading book activities. Moreover, competent authorities should consider appropriate shock scenarios given the nature of the exposure to the interest rate risk arising from non-trading book activities of the investment firm.

Operational risks not covered by Pillar 1

Competent authorities should assess operational risks not covered by minimum own funds requirements in accordance with Regulation (EU) 2019/2033. These risks might lead to direct operational losses and to indirect losses resulting from complaints and litigation. Large operational risks may also lead to a shortage of staff in key positions. The assessment should take into account not only operational losses, but also near misses and operational risk events ended with a gain.

Competent authorities should consider the following sources of inherent risk and, where relevant, focus the assessment on those aspects, which are considered the most significant for the investment firm:

• a. workplace safety;
• b. damage to physical assets;
• c. internal fraud;
• d. external fraud;
• e. ICT risks;
• f. conduct risk;
• g. regulatory, legal and fiscal risks;
• h. model risk, in relation to models used for business purposes;
• i. insufficient (both qualitative and quantitative) human and technical resources in key positions;
• j. reputational risk.

As part of all SREP assessments, competent authorities should form a view on the degree of ICT risk, and the consistency of ICT operations with the business strategy. Competent authorities should include in their assessment all relevant aspects of ICT risk, such as security risk, IT projects risk and ICT management risk, to the extent that this is not already covered by other parts of these guidelines, and having regard to the EBA Guidelines on ICT and security risk²¹ and the ESMA Guidelines on outsourcing to cloud service providers²² ;

²¹ EBA Guidelines on ICT and security risk management (EBA/GL/2019/04).

²² ESMA Guidelines on outsourcing to cloud service providers (ESMA50-164-4285).

Competent authorities should form a view on the degree of conduct risk related to investment and market activities of the investment firm, to the extent that it is not captured by Pillar 1 own funds requirements. Conduct risk should be understood as the current or prospective risk incurred by clients, markets or the firm itself due to an inappropriate behaviour of the firm or its staff. This risk may arise from cases of wilful or negligent misconduct (including inappropriate supply of financial services), to the extent that they might lead to negative financial or reputational impacts. This reputational risk may in turn cause a loss in market shares or key clients, and an increase of clients’ complaints.

Competent authorities should focus on the following sources of inherent conduct risk where relevant:

• a. closure or suspension of a fund;
• b. number of misconduct incidents: mis-selling, market manipulation;
• c. regulatory penalties incurred.

Competent authorities should form a view on regulatory, legal, and fiscal risks arising from non-compliance with laws or regulations. These risks might lead to litigation and penalties for the investment firm. Remedial programmes may also incur large expenses to comply with law and regulations.

Competent authorities should focus on these sources of inherent regulatory, legal, and fiscal risks where relevant:

• a. costs for achieving compliance with applicable regulations;
• b. payment of fines or other sanctions for non-compliance;
• c. tax reassessment or payment of late fees, fines and penalties;
• d. anticipation of regulatory changes relevant for the investment firm.

Competent authorities should assess the risk relating to models used for business purposes, including valuation/pricing models, models for algorithmic trading and other models which may have significant impact on the business decisions and activities of investment firm.

Having regard to the specificities of the investment firm, while performing the assessment of risks not covered by Pillar 1 own funds requirements, competent authorities may consider other sources of risks not included in the abovementioned categories.

Systemic risk

Based on quantitative and qualitative criteria, competent authorities should form a view of the systemic risk of the investment firm. Based on this assessment, competent authorities should determine whether the failure of the investment firm could result in major disruptions of the financial markets in which the investment firm operates.

Where appropriate, the assessment of systemic risk may be performed in an aggregate manner for a group of investment firms with a similar business model and risk profile. When performing such aggregated assessment competent authorities should consider potential impacts of simultaneous failure of a specified number/share of these investment firms on the financial markets in which they operate. For this purpose competent authorities may consider one or more scenarios.

6.6.3 Assessment of risks management and controls

To achieve a comprehensive understanding of the investment firm’s risk profile regarding risks not covered by Pillar 1 own funds requirements, competent authorities should review the governance and risk management framework that reduce the risk arising from other sources of risks. To this end, competent authorities should assess the following elements while taking into account the volume, nature and complexity of the investment firm’s activities:

• a. the investment firm’s strategy properly reflects the investment firm’s appetite for these risks and is consistent with the overall risk appetite;
• b. the investment firm has internal guidelines and policies to ensure a sound risk culture;
• c. the investment firm has appropriate framework for the management, measurement, monitoring and control of interest rate risk arising from non-trading book activities;
• d. the investment firm has an appropriate framework for the management, measurement, monitoring and control of IT risks, with sufficient (both qualitative and quantitative) human and technical resources;
• e. the investment firm has clearly defined policies and procedures for the control of operational risk.

6.6.4 Summary of findings and scoring

Following the above assessment, competent authorities should form a view on the investment firm’s other risks. This view should be reflected in a summary of findings, accompanied by a risk score based on the considerations specified in Table 8. If, based on the materiality of certain risk factors, competent authorities decide to assess and score them individually, the guidance provided in this table should be applied, as far as possible, by analogy.

Competent authorities should consider all these factors in parallel and not in isolation and understand the drivers behind risks not covered by Pillar 1 own funds requirements. Table 8. Supervisory considerations for assigning a score for other risks

Risk Considerations in relation to Supervisory view adequate management and score inherent risk