6.3. Assessment of market risk

When assessing the market risk management framework, competent authorities should evaluate inter alia the compliance of the institution with the legal acts published separately on the EBA website as referred to in paragraph 12.

In these guidelines, references to ‘market risk’ will encompass all the following risks, which should be assessed by competent authorities:

• a. the market risk arising from all on- and off-balance-sheet positions which are subject to losses arising from movements in market prices, i.e. risks in trading book positions as well as the foreign-exchange and commodity risk in the non-trading book;
• b. the risk of losses arising from changing CVA amounts in response to changes in counterparty credit spreads and/or market prices, impacting the fair value of derivative transactions and, if applicable, of security financing transactions (SFTs);
• c. the risk linked to the valuation of fair-valued instruments in the sense of Article 105 of Regulation (EU) 575/2013.

Competent authorities may perform a less granular analysis for institutions which meet the conditions of the small trading book as set out in Article 94 of Regulation (EU) 575/2013. For institutions with immaterial exposures, the assessment should focus on the adequacy of the risk management and governance structure and the quality and effectiveness of systems and controls.

Competent authorities should take into account the impact of ESG risks on the inherent market risk as well as the adequacy of the market risk management framework and controls related to ESG risks, giving priority to environmental risks.

6.3.2. Assessment of inherent market risk

Through the assessment of inherent market risk competent authorities should determine the main drivers of the institution’s risk exposures and evaluate the risk of significant prudential impact on the institution. To develop such an understanding, competent authorities should first identify the market risks to which the institution is or may be exposed and focus their attention on the subcategories and drivers deemed the most material for the institution.

To support this analysis, competent authorities should consider, as a minimum, the products, activities and business lines of the institution. They should compare the own funds requirements for market and CVA risk and the additional valuation adjustment deducted from the institution own funds, against the total own funds requirements. Where relevant they should compare the internal capital allocated to those risks by the institution against the total internal capital. They may also consider the relative weight of market risk positions in terms of total assets, the relative weight of net gains on market risk positions to total operating income and the historical changes in these figures and forecasts. Also, the strategy of the institution as regards market activities and the related risk appetite should be taken into account. When considering market activities, competent authorities should refer to the risks mentioned in paragraph 161 which may encompass the trading and non-trading book.

Nature and composition of the institution’s risk activities

The first step in assessing the nature of the inherent market risk of an institution is to identify its market risk exposures consistently and comprehensively. Competent authorities should use available regulatory reporting templates, such as COREP and FINREP, internal reporting, insights gained from the assessment of other SREP elements (such as the BMA) or prior supervisory activities, and comparisons with the institution’s peers, where available.

Competent authorities should base their assessment primarily on the most significant identified sources of risk, evaluating their materiality for the institution from a prudential perspective. To assess the nature of market risk, competent authorities should consider at least the following subcategories³⁹ :

• a. interest rate risk (trading book);
• b. credit spread for non-securitisation, credit spread for securitisation (trading book);
• c. equity risk (trading book);
• d. migration risk (for business subject to a default risk charge)⁴⁰ ;
• e. default risk (for business subject to a default risk charge);
• f. foreign exchange risk, including translation risk (both in the trading and banking book);
• g. commodities risk (trading and banking book);
• h. CVA risk (trading and banking book);
• i. valuation risk (fair-valued instruments in the trading and non-trading books).

³⁹ Please refer to Annex II for a non-exhaustive breakdown of market risk sub-categories.

⁴⁰ Migration risk is treated as part of credit spread risk under the Fundamental Review of the Trading Book.

Competent authorities should also consider:

• a. the complexity of financial products (e.g. products valued using mark–to-model techniques, products bearing non-delta risks and basis risks). Competent authority may assess this by using as an indicator the add-on resulting from residual risks as per Article 325u of Regulation 575/2013/EU;
• b. the liquidity of the institution’s exposure. The competent authority can do so by assessing whether the institution is exposed to subcategories with high liquidity horizons in accordance with table 2 of Article 325bd of Regulation 575/2013/EU;
• c. the concentration of market risk towards specific names, sectors, economies, risk-classes;
• d. the employment of specific market operations the risk of which may not be fully represented by the market risk own funds requirements (e.g. high-frequency trading).

When appropriate, competent authorities should also consider the internal risk measures of institutions. These could include the internal VaR or expected shortfall not used in the calculations of own funds requirements or sensitivities of the market risk to different risk factors and potential losses.

Competent authorities should also assess the institution’s ability to form a comprehensive view on the degree of market concentration risk to which it is exposed, either from exposures to a single risk factor or from exposures to multiple risk factors that are correlated, thereby paying specific attention to concentrations in complex and illiquid products. They should review the firm’s own assessment of concentrations and illiquid positions. Competent authorities should require institutions to reduce exposure towards a given CCP in case of excessive concentration risk, or to realign exposures across their clearing accounts in accordance with Article 7(a) of Regulation 648/2012.

When determining whether P2R should be imposed for the market risk to which the institution is exposed, in line with paragraph 300, competent authorities should consider whether the Pillar 1 methodology adequately captures the risk, taking into account that:

• a. institutions employing the alternative standardised approach are required under Pillar 1 to calculate an add-on (residual risk add-on) for the risks inherent in complex financial products that are not sufficiently captured in the sensitivity-based method and the default risk charge;
• b. institutions employing the internal model approach or the alternative internal model approach are required to capture all material risks in those internal models;
• c. the risk-weights provided in the alternative standardised approach, the expected shortfall measures referred to in Article 325bb of Regulation 575/2013/EU and the stress scenario risk measures referred to in Article 325bk of Regulation 575/2013/EU in the alternative internal model approach are designed to cater for the positions’ liquidity in line with liquidity horizon referred to in table 2 of Article 325bd of Regulation 575/2013/EU.

Competent authorities should identify and analyse in relation to market risk positions and the corresponding governance arrangements, any transfer pricing arrangements between institutions established in the Union that are part of a third-country group and other entities of that group established outside of the Union and not consolidated by the EU parent undertaking. The analysis should include:

• a. a quantitative component to identify the materiality of the transfer pricing arrangements relative to the trading book total P&L and the own funds of the institution;
• b. a qualitative component to assess if the effect of these arrangements is transparent to the institution’s management board and appropriately reflected in the risk management governance;
• c. a qualitative component to assess how the transfer pricing arrangement affects the business decisions of the institution, including how the dynamics of the transfer pricing arrangement potentially affect the decisions of front-office desks, and the potential conflicts of interest that the arrangement may create.

Competent authorities should identify the materiality of the transfer pricing in the context of trading book items by focusing on the transfer pricing arrangements that meet the following conditions:

• a. they involve at least one entity of the group that is established outside of the Union and for which the highest level of consolidation is outside the Union;
• b. they are based on a transaction profit method (TPM) – or any similar practice that would be economically equivalent – in accordance with which the profits and losses relating to positions owned by several entities are re-distributed across those entities on the basis of the marginal contribution ‘m’ of each entity towards key -metrics set out in the pricing arrangement.

For institutions under paragraph 1733, point (a), where the profits and losses, re-allocated as a result of transfer pricing arrangements based on transaction profit methods, are material (e.g. account for more than 5% of the P&L generated by the institution) and this risk is not covered or fully covered by P1R, competent authorities should:

• a. consider this risk for the determination of P2R;
• b. consider the results of the components listed in paragraph 1722, such as the materiality of the transfer pricing arrangements, in relation to the market risk capital requirements of the portfolio whose profits and losses are used to determine the amount to be transferred to the institution as well as potential weaknesses in the related governance arrangements;
• c. determine P2R that sufficiently cover the market risks not captured under P1R which are generated under the transfer pricing arrangement. To that end, competent authorities may use the calculation method as laid down in Annex V or an alternative methodology that provides accurate measurement of the risk not covered in P1R and identifies the consequent P2R, considering as a reference the methodology in Annex V.

Profitability analysis and stress testing

Competent authorities should analyse the historic profitability, including volatility of profits, of market activities to gain a better understanding of the institution’s risk profile for market risk. This analysis could be performed at portfolio level as well as being broken down by business line, asset class or desk depending on the materiality and complexity of the institution’s exposures (as emerging from the BMA or other supervisory insight).

Competent authorities should distinguish between trading and non-trading revenues (such as commissions, clients’ fees, etc.) on one hand and realised and unrealised profits/losses on the other hand.

For those asset classes and/or exposures generating significant profits or losses, competent authorities should assess profitability in comparison to the level of risk assumed by the institution (e.g. VaR/net gains on financial assets and liabilities held for trading) to identify and analyse possible inconsistencies. Where possible, competent authorities should compare the institution’s figures to its historical performance and its peers.

Competent authorities should assess whether an institution has implemented adequate stress tests that complement its risk measurement system. For this purpose, they should take into account the following elements:

• a. stress test frequency;
• b. whether relevant risk drivers are identified (e.g. illiquidity/gapping of prices, concentrated positions, one-way markets);
• c. assumptions underlying the stress scenario;
• d. internal use of stress testing outcomes for capital planning and market risk strategies.

6.3.3. Assessment of the market risk management and control framework

To achieve an adequate understanding of the management of market risk, commensurate to the institution’s risk profile, competent authorities should review the institution’s risk management and control framework and its adequacy with respect to inherent risk exposures. For this assessment, the competent authority should use the paragraphs set out in this section, while also leveraging on:

• a. the outcome of the assessment of other SREP elements (such as the BMA and governance areas);
• b. the outcome of the assessment referred to in Article 325c of Regulation 575/2013/EU for institutions using the alternative standardised approach, and the outcome of the assessment performed in accordance with Delegated Regulation (EU) 2024/1085, especially in relation to the requirements referred to in Articles 104b, 325bi, and 325bj of Regulation 575/2013/EU.

Competent authorities should also assess the policies and procedures of institutions to allocate the positions to the trading book and to the banking book, as described by Title 1 of Chapter 3 of Regulation 575/2013/EU.

Market risk strategy and risk appetite

Competent authorities should assess whether institutions have sound, clearly formulated and documented risk appetite, strategy and limits approved by their management body. For this assessment, among other factors, competent authorities should take into account the role of the management body in setting, approving and reviewing the risk strategy and appetite, the proper implementation of this strategy by the management body as well as its appropriateness for the institution given its business model, overall risk appetite, current and perspective market environment and financial condition.

Organisational and internal control framework

Competent authorities should assess whether the institution has an appropriate organisation framework for identifying, understanding, measuring, monitoring and controlling market risk, with sufficient (both qualitative and quantitative) human and technical resources to carry out the required tasks. For this assessment, competent authorities should take into account the adequacy of the lines of responsibility for taking, monitoring, reporting and controlling market risk, their coverage of the entire institution, the existence of a clear separation between the front office and back office and between the risk-taking and the control functions, and the skills and expertise of staff involved.

Competent authorities should assess whether the institution has clearly defined policies and procedures for the identification, management, measurement and control of market risk and whether these are sound and consistent with the institution’s risk strategy and cover all the main businesses and processes. This includes the assessment of whether these policies and procedures are clearly formalised, communicated and applied consistently across the institution.

In particular, the assessment should cover the positions to be included/excluded from the trading book for regulatory purposes, the policies on internal hedges and the procedures for new market activities and/or products.

Competent authorities should assess whether the institution has an appropriate framework for identifying, understanding and measuring market risk, in line with the institution’s size and complexity, and that this framework is compliant with relevant minimum requirements in accordance with the applicable legal and regulatory framework.

Competent authorities should assess whether institutions have in place an adequate monitoring and reporting framework for market risks that ensures there will be prompt action at the appropriate level of the institution’s senior management or management body in case of breaches. The monitoring system should include specific indicators and relevant triggers to provide effective early warning alerts and should inform the management body and senior management about current exposures and measures compared to policy limits.

Competent authorities should assess whether the institution has a strong and comprehensive limit systems and control framework with sound safeguards to mitigate its risks in line with its risk strategy and appetite. For this assessment, competent authorities should pay particular attention to the adequate scope covered by the institution’s control functions (including all consolidated entities, geographical locations and market activities), to the existence of operating limits (including individual limits at desk or business-unit level which should be daily monitored) and other practices aimed at keeping market risk exposures within levels acceptable to the institution in accordance with its risk appetite and limits.

Competent authorities should also assess whether the internal validation process is sound and effective in challenging model assumptions and identifying any potential shortcomings with respect to the market risk management system. For institutions adopting an internal approach to determining minimum own funds requirements for market risk, this assessment should be based – where available – on the information stemming from already performed supervisory activities on internal models (such as on-site inspections).

Competent authorities should also assess the functionality of the internal audit function in terms of adequacy, scope and frequency of internal audits on the market risk management framework. This should comprise the review of the main elements of risk management, measurement and controls framework across the institution and the adherence to relevant external regulations of the internal policies and procedures and any deviations from either.

6.3.4. Summary of findings, scoring and supervisory measures

Following the above assessment, competent authorities should form a view on the institution’s market risk. This view should be reflected in a summary of findings, accompanied by a risk score based on the considerations specified in table 8. Where, based on the materiality of certain risk sub-categories, the competent authority decides to assess and score them individually, the guidance provided in this table should be applied, as far as possible, by analogy.

Table 8. Supervisory considerations for assigning a market risk score

The table below presents a non-exhaustive list of supervisory measures that competent authorities may take in case of identified deficiencies in the institution’s market risk management framework. Competent authorities should decide on the type of the measure based on its effectiveness to the specific identified deficiency. Competent authorities may apply other supervisory measures (including quantitative measures in accordance with Article 104(1)(a) of the Directive 2013/36/EU) or a combination of them if these are deemed more appropriate to address the identified deficiencies. Table 9. Potential and non-exhaustive supervisory measures for market risk Potential supervisory measures for competent authorities in accordance with Article 104(1)(b), (d), (e), (f), (j), (l) (m), (n) of Directive 2013/36/EU – Competent authorities may require the institution to: A. enhance the quality and frequency of the market risk reporting to the institution’s management body and senior management; B. enhance the performance of the institution’s internal approaches, or of its back -testing or stress testing capacity; C. perform more frequent and in-depth internal audits of market activity; D. restrict investment in certain products when the institution’s policies and procedures do not ensure that the risk from those products will be adequately covered and controlled; E. divest financial products when the valuation processes of the institution do not produce conservative valuations that comply with the standards of Regulation (EU) No 575/2013; F. reduce the level of inherent market risk (e.g. through hedging or sale of assets or increase of derivatives settled through central counterparties (CCPs)) when significant shortcomings have been found in the institution’s measurement or control systems ; G. present a plan to reduce its exposures to distressed assets and/or illiquid positions gradually.