6.1. General considerations

Competent authorities should assess and score the risks to capital that have been identified as material for the institution.

The purpose of this title is to provide common methodologies to be considered for assessing individual risks and risk management and controls. It is not intended to be exhaustive and gives leeway to competent authorities to take into account other additional criteria that may be deemed relevant based on their experience and the specific features of the institution.

This title provides competent authorities with guidance for the assessment and scoring of the following risks to capital:

• a. credit and counterparty risk;
• b. market risk;
• c. operational risk;
• d. interest rate risk from non-trading activities (IRRBB).

The title also identifies a set of subcategories within each risk category above, which need to be taken into account when risks to capital are assessed. Depending on the materiality of any these subcategories to a particular institution, they can be assessed and scored individually. Annexes I-IV present non-exhaustive lists of sub-categories for credit risk, market risk, operational risk and IRRBB that competent authorities should consider, when relevant.

The decision on materiality depends on the supervisory judgement. However, for FX lending risk, in light of the ESRB Recommendation on lending in foreign currencies³⁶ , materiality should be determined taking into account the following threshold: loans denominated in foreign currency to unhedged borrowers constitute at least 10% of an institution’s total loan book (total loans to non-financial corporations and households), where such a total loan book constitutes at least 25% of the institution’s total assets.

³⁶ Recommendation of the European Systemic Risk Board of 21 September 2011 on lending in foreign currencies (ESRB/2011/1) (OJC 342, 22.11.2011, p.1).

Competent authorities should also assess other risks that are identified as material to a specific institution but are not listed above (e.g. pension risk, strategic and business risk, step-in risk, intra- and inter-risk concentration). The following may assist with the identification process:

• a. drivers of TREA;
• b. risks identified in the institution’s ICAAP;
• c. risks arising from the institution’s business model (including those identified by other institutions operating a similar business model);
• d. information stemming from the monitoring of key indicators;
• e. findings and observations from internal or external audit reports;
• f. recommendations and guidelines issued by the EBA, as well as warnings and recommendations issued by macroprudential authorities or the ESRB.

The above elements should also be taken into account by competent authorities when they are planning the intensity of their supervisory activity in relation to the assessment of a specific risk.

For credit, market and operational risk, competent authorities should evaluate inter alia the compliance of the institution with the legal acts published separately on the EBA website as referred to in paragraph 12. However, these guidelines extend the scope of the assessment beyond those minimum requirements to allow competent authorities to form a comprehensive view on risks to capital.

When evaluating risks to capital, competent authorities should also consider the potential impact of funding cost risk following the methodology included in Title 8 and may decide on the necessity of measures to mitigate this risk.

In their implementation of the methodologies specified in this title, competent authorities should identify relevant quantitative indicators and other metrics, which could also be used to monitor key indicators, as specified in Title 3, and should also consider, when appropriate, institutions’ internal risk measures.

For each material risk, competent authorities should assess and reflect in the risk score:

• a. inherent risk (risk exposures);
• b. the quality and effectiveness of risk management and controls.

This assessment flow is represented in figure 2 below.

Figure 2. Assessment workflow for risks to capital

When performing their assessments, competent authorities should use available information sources, including regulatory reporting, the institution’s internal metrics and reports (e.g. internal audit report, risk management reports, information from the ICAAP), on-site inspection reports and external reports (e.g. the institution’s communications to investors, rating agencies). Competent authorities should resort to ad-hoc reporting where it is strictly necessary and proportionate to carry out their supervisory tasks, and where the information is not duplicative or otherwise available, in accordance with the second subparagraph of Article 104(2) of the CRD. While the assessment is intended to be institution-specific, comparison with peers should be considered to identify potential exposure to risks to capital. For such purposes, peers should be defined on a risk-by-risk basis and might differ from those identified for BMA or other analyses.

In the assessment of risks to capital, competent authorities should also evaluate the accuracy and prudency of the calculation of minimum own fund requirements to identify situations where minimum own funds calculations may underestimate the actual level of risk. This assessment would inform the determination of the P2R as provided in section 7.2.3.

The outcome of the assessment of each material risk should be reflected in a summary of findings that provides an explanation of the main risk drivers, and a risk score, as specified in the following sections.