6.2. Assessment of credit and counterparty risk

When assessing the credit risk management framework, competent authorities should evaluate the compliance of the institution with the legal acts published separately on the EBA website as referred to in paragraph 12.

Competent authorities should assess credit risk arising from all non-trading book exposures (including off balance sheet items). They should also assess the counterparty credit risk and the settlement risk that could fall under both non-trading and trading books. In order to perform such assessment, competent authorities should consider all the components that determine potential credit losses, and in particular:

• a. the probability of a credit event (i.e. default), or correlated credit events, that mainly concerns the borrowers and their ability to repay relevant obligations;
• b. the size of exposures subject to credit risk;
• c. the recovery rate of the credit exposures in the event of borrowers defaulting.

Competent authorities should take into account the possibility that these components may deteriorate over time and worsen compared to expected outcomes.

Competent authorities should assess the impact of ESG risks on the inherent credit risk as well as the adequacy of the credit risk controls related to ESG risks, giving priority to environmental risks. In particular, competent authorities should consider environmental transition and physical risks when carrying out the assessment of credit concentration risk and real estate risk, as well as when assessing credit risk in specific portfolios or exposure classes considered as materially exposed to environmental risks.

In addition, competent authorities should also pay attention to consideration given to ML/TF risks within the context of the credit-granting process, including whether the institution has systems and controls in place to ensure funds used to repay loans are from legitimate sources.

6.2.2. Assessment of inherent credit risk

Identification of material sources of credit risk

Competent authorities should assess credit risk from both a current and forward-looking perspective, integrating the analysis of the current portfolio’s credit risk with the assessment of the institution’s credit risk strategy, risk appetite and risk limits (potentially as part of the wider assessment of strategy carried out as part of the BMA). Competent authorities should also consider how the expected, as well as the stressed, macro-economic developments could affect those elements.

To assess the inherent credit risk of an institution, competent authorities should first identify its credit risk exposure. To achieve this and ensure consistent identification of the sources of credit risk the institution is or might be exposed to, they should consider the following sources of information:

• a. regulatory reporting templates, such as COREP and FINREP, taking into account the relevant regulatory exposure classes based on the institution’s approach to own funds requirements (i.e., standardised or IRB);
• b. insights gained from the assessment of other SREP elements (such as the BMA) and from prior supervisory activities;
• c. comparisons of the institution’s position with its peers, where available. In particular, for institutions using the internal ratings-based approach, competent authorities should consider the result of the supervisory benchmarking exercise carried in accordance with Article 78 of Directive 2013/36/EU.

Competent authorities should focus their assessment primarily on the most significant identified sources of credit risk, evaluating their materiality for the institution from a prudential perspective. To conduct this assessment, they should consider the following elements:

• a. the credit risk strategy and appetite and relevant limits;
• b. the amount of exposure value for the considered portfolio, compared to the total exposure value of credit exposures, including its growth over time;
• c. the amount of own funds requirement for credit risk for the considered portfolio compared to the total own funds requirement, including its growth over time;
• d. where relevant, the internal capital allocated for credit risk for the considered portfolio by the institution compared to the total internal capital;
• e. the composition and quality of the institution’s on- and off-balance sheet credit-related items in the performing (including forborne exposure) and non-performing portfolio, including the level and change over time of impairments and write-offs and of the default rates of the credit portfolio.

Competent authorities should assess the materiality of the risk in relation to the current portfolio, as well as with an historical and forward-looking perspective (previous change in these figures and forecasts, where available).

As additional source of information for the materiality assessment, competent authorities should – where available and appropriate – consider the internal credit risk parameters used by the institution. This includes assessing their adequacy in accurately quantifying credit risk exposures across different portfolios, with particular attention to evidence from the yearly report produced by the validation function of the institution, and more specifically on backtesting outcomes – that is, comparing estimated parameters with observed outcomes as conducted by the institution. Competent authorities should place emphasis on portfolios where the estimated parameters have underestimated the observed outcomes.

Competent authorities should also consider the results of stress tests performed by the institution to identify any previously unidentified sources of credit risk, such as those emerging from changes in credit quality, credit concentrations, collateral value and credit exposure during a stressed period.

Based on the materiality assessment performed in the previous paragraphs, as well as the size and complexity of the institution’s credit risk and credit portfolio, competent authorities should choose the relevant level of details for the assessment.

Nature, size and composition of the institution’s credit portfolio (on- and off-balance sheet credit-related items)

Competent authorities should assess the nature of the credit exposures (i.e. the types of borrowers and exposures) and analyse the composition of the institution’s credit portfolio. In performing this assessment, competent authorities should also consider how the nature of credit risk exposure can affect the size of exposure (e.g. credit lines/undrawn commitments drawn down by borrowers, foreign currency denomination), taking into consideration the institution’s legal capacity to unilaterally cancel undrawn amounts of committed credit facilities.

To assess the nature of credit risk, competent authorities should consider at least the following subcategories of credit risk by carrying out a more detailed assessment of those subcategories which are considered most relevant for the institution³⁷ :

• a. credit concentration risk;
• b. counterparty credit risk and settlement and delivery risk;
• c. country risk;
• d. credit risk from securitisations;
• e. FX lending risk;
• f. real estate risk;
• g. equity risk in the banking book;
• h. dilution risk;
• i. model risk for regulatory approved models.

³⁷ Please refer to Annex I for a non-exhaustive breakdown of credit risk sub-categories and further details on their assessment.

Where specialised lending exposures are deemed material, competent authorities should assess such exposures separately from other lending activities, given that the risk of such exposures lies in the profitability of the asset or project financed (e.g. commercial real estate, energy plant, shipping, commodities) rather than the borrower (which is generally a special purpose vehicle). In conducting this assessment, competent authorities should consider:

• a. the profitability of the projects and the conservativeness of the assumptions underlying the business plans (including the credit risk of the main customers);
• b. the impact of changes in regulation, especially for subsidised sectors, on future cash flows;
• c. the impact of changing market demand, where relevant, and the existence of a market for the potential future sale of the object financed;
• d. the existence of a syndicate or of other lenders sharing the credit risk;
• e. any form of guarantee pledged by the sponsors;
• f. the potential increase in concentration risk that these activities may entail.

Portfolio credit quality

When assessing portfolio credit quality, competent authorities should pay particular attention to the adequacy of the classification of credit exposures and assess the impact of potential misclassification, with the subsequent delay in the provisioning and recognition of losses by the institution.

Competent authorities should carry out an analysis to distinguish between performing, non-performing and forborne exposure categories, considering both the number of obligors and the relevant amounts/volumes. Competent authorities should assess the overall credit quality at portfolio level and the different quality grades within each of the above categories to determine the institution’s overall credit risk. As part of this assessment, competent authorities should analyse default and migration risk by exposure classes, taking into account trends in the credit quality over time, and they should consider whether the actual portfolio credit quality is consistent with the stated risk appetite and establish reasons for any deviations.

This should result in an overall assessment on the end-to-end credit cycle of the institution, from origination through the monitoring and management of each exposure categories. In conducting these analysis, competent authorities should employ peer comparison and use benchmark portfolios (i.e. portfolios of borrowers common to groups of institutions) where appropriate and possible. This analysis should be carried out taking into account:

• a. asset quality indicators, historical trends and grow rates by types of borrowers, sectors and product, borrowers’ credit grade distribution, historical migration rates across credit grades, delinquency and default rates for different time horizons;
• b. the non-performing rates and coverage per portfolio, sector, geography and changes over time, also taking into account the relevant inflows/outflows from each relevant portfolio, the distribution of the exposures across classes of non-performing exposures (i.e. past-due, doubtful), the level and change over time of impairments and write-offs for each relevant driver, historical recovery rates and the duration of the recovery process, foreclosed assets and changes over time, as well as the time since exposures were classified as non-performing.

Competent authorities should assess whether the level of loan loss provisions and credit valuation adjustments are appropriate for the quality of the exposures and, where relevant, for the level of collateral, assessing in particular whether the level of loan loss provisions is consistent with the level of risk in different portfolios, over time and compared with the institution’s relevant peers as well as relevant macro-economic developments and whether the credit valuation adjustments to derivatives’ market values reflect the creditworthiness of relevant counterparties. Where deemed necessary, competent authorities should use on-site inspections or other appropriate supervisory actions to assess whether or not the level of loan loss provisioning and risk coverage is adequate, by assessing a sample of loans, for example. When conducting such assessment, competent authorities should also consider any findings raised by internal and external auditors, where available.

When evaluating the inherent credit risk of an institution, competent authorities should also take into account the results of stress tests performed by the institution to identify any previously unidentified sources of credit risk, such as those emerging from changes in credit quality, credit concentrations, collateral value and credit exposure during a stressed period.

Level and quality of the credit risk mitigation framework

Competent authorities should consider the level and quality of guarantees (including credit derivatives) and of available collateral that would mitigate credit losses where credit events occur, including those not accepted as eligible credit risk mitigation techniques for own funds calculations. In performing such assessment, competent authorities should consider:

• a. the coverage provided by collateral and guarantees by portfolio, borrower type, rating, sector, and other relevant aspects;
• b. collateral values, for performing and non-performing exposures;
• c. historical recovery ratios by type and amount of collateral and guarantees.

Competent authorities should also assess the materiality of the residual risk (as referred to in Article 80 of Directive 2013/36/EU) and in particular the adequacy and enforceability of collateral agreements and of guarantees, the timing and the ability to realise collateral and execute guarantees under the national legal framework, the liquidity and volatility in asset values for collateral and the recoverable value of collateral under any credit enforcement actions. Competent authorities should also assess the concentration of guarantors and collateral, as well as the correlation with borrowers’ creditworthiness (i.e. wrong-way risk) and the potential impact in terms of the effectiveness of protection.

ESG factors

When assessing the impact of ESG risks and environmental risks in particular on the inherent credit risk, competent authorities should aim at taking into account the specific characteristics of these risks such as their forward-looking nature and distinct impacts over various time horizons, recognising the uncertainties associated with long-term projections while developing their capacity to factor in these characteristics into their assessment.

6.2.3. Assessment of credit risk management and control framework

To achieve a comprehensive understanding of the institution’s credit risk profile, competent authorities should review the institution’s credit risk management and control framework and its adequacy with respect to the inherent credit risk exposures. For this assessment, competent authorities should also rely on the outcome coming from the assessment of other SREP elements (such as the BMA and governance areas). For institutions subject to the application of the NPE (reduction) strategies and the associated governance and operational guidance, competent authorities should also assess whether institutions meet specific requirements set out in the relevant EBA guidelines for such strategies and their operationalisation, including with respect to meeting the consumer protection obligations.

Credit risk strategy and appetite

Competent authorities should assess whether the institution has a sound, clearly formulated and documented credit risk appetite, strategy and limits approved by the management body. For this assessment, among other factors, competent authorities should take into account the role of the management body in setting, approving and reviewing the credit risk strategy and appetite, the proper implementation of this strategy by the senior management as well as its appropriateness for the institution given its business model, overall risk appetite, current and prospective market environment and financial condition.

Organisational and internal control framework

Competent authorities should assess whether the institution has an appropriate organisational framework and governance arrangements to enable effective credit risk taking, management, measurement and control, with sufficient (both qualitative and quantitative) human and technical resources to carry out the required tasks. They should in particular assess whether the institution’s management body and senior management understand the assumptions underlying the credit measurement system. For this assessment, competent authorities should take into account the adequacy of the lines of responsibility, as well as staffs’ skills and experience to perform their tasks, for taking on, measuring, monitoring and reporting credit risk, including management of NPEs, and in particular NPE workout, and finally the existence of a clear separation between risk-takers and risk managers.

Competent authorities should assess whether the institution has appropriate policies and procedures for the credit granting, identification, measurement, reporting and control of credit risk and whether these are consistent with the institution’s credit risk strategy and cover all the main businesses and processes. This includes the assessment of whether these policies are clearly formalised, communicated and applied consistently across the institution and the banking group it belongs to. For this assessment, competent authorities should take into account whether the management body approves these policies and discusses and reviews them regularly, in line with risk strategies as well as whether senior management is responsible for drawing up and implementing the policies and procedures, as defined by the management body.

Competent authorities should assess whether the institution has an appropriate framework for identifying, understanding, measuring, monitoring and reporting credit risk, in line with the institution’s size and complexity. In this regard, competent authorities should consider whether the institution has adequate data infrastructure and whether analytical techniques are appropriate to enable the institution to adequately manage their credit risk, and to fulfil supervisory reporting requirements, and to detect, measure and regularly monitor the credit risk inherent in all on- and off-balance-sheet activities (where relevant at group level).

Competent authorities should assess whether the institution’s management body and senior management understand the assumptions underlying the credit measurement system and whether they are aware of the degree of relevant model risk. They should assess whether the institution has undertaken stress testing to understand the impact of adverse events on its credit risk exposures and on the adequacy of its credit risk provisioning, by considering the stress test frequency, relevant risk factors identified, assumptions underlying the stress scenario; and the internal use of stress testing outcomes for capital planning and credit risk strategies.

Competent authorities should assess whether the institution has defined and implemented continuous and effective monitoring of credit risk exposures (including credit concentration) throughout the institution, amongst others, by means of specific indicators and relevant triggers to provide effective early warning alerts. Competent authorities should assess whether the institution has implemented regular reporting of credit risk exposures, including the outcome of stress testing, to the management body, senior management and the relevant credit risk managers.

Competent authorities should assess whether the institution has a strong and comprehensive internal control framework and sound safeguards to mitigate its credit risk in line with its credit risk strategy and appetite. For this assessment, competent authorities should in particular pay attention to the adequate scope covered by the institution’s control functions (including all consolidated entities, geographical locations and credit activities), to the existence of operating limits and other practices aimed at keeping credit risk exposures within levels acceptable to the institution in accordance with its risk appetite and limits. For this purpose, competent authorities should pay particular attention to whether institution has appropriate internal controls and practices to ensure that breaches of (or exceptions to) policies, procedures and limits are reported in a timely manner to the appropriate level of management for action, including checks to identify, assess and manage ML/TF risks to which the institution is exposed as a result of the credit granting activities.

In conducting this assessment, competent authorities should consider whether the limit system is adequate for the institution’s complexity and its capacity to measure and manage credit risk. This includes assessing whether the limits established are absolute or whether breaches thereof may occur. In the latter case, the institution’s policies should clearly describe the period of time during which and the specific circumstances under which such breaches of limits are possible. Furthermore, competent authorities should assess the adequacy of the procedures in place to keep credit managers informed about their limits, as well as whether such limits are subject to regular review and updates (e.g. to remain aligned with changes in strategy).

Competent authorities should also assess the functionality of the internal audit function in terms of adequacy, scope and frequency of internal audits on the credit risk management framework. These audits should capture the review of the main elements of credit risk management, measurement and controls framework across the institution and the adherence to relevant external regulations of the internal policies and procedures and any deviations from either.

For institutions adopting an internal rating-based approach to determining minimum own funds requirements for credit risk, competent authorities should also assess whether the internal validation process is sound and effective in challenging model assumptions and identifying any potential shortcomings with respect to the credit risk management system. This assessment should be based – where available – on the information stemming from already performed supervisory activities on internal models (such as onsite inspections) and taking into account the supervisory practices detailed in the EBA Supervisory handbook for the validation of internal ratings-based systems³⁸ .

6.2.4. Summary of findings, scoring and supervisory measures

³⁸ EBA/REP/2023/29.

Following the above assessment, competent authorities should form a view on the institution’s credit and counterparty risk. This view should be reflected in a summary of findings, accompanied by a risk score based on the considerations specified in table 6. Where, based on the materiality of certain risk sub-categories, the competent authority decides to assess and score them individually, the guidance provided in this table should be applied, as far as possible, by analogy.

Table 6. Supervisory considerations for assigning a credit and counterparty risk score

The table below presents a non-exhaustive list of supervisory measures that competent authorities may take in case of identified deficiencies in the institution’s credit and counterpart risk management framework. Competent authorities should decide on the type of the measure based on its effectiveness to the specific identified deficiency. Competent authorities may apply additional supervisory measures (including quantitative measures in accordance with Article 104(1)(a) of the Directive 2013/36/EU) or a combination of them if these are deemed more appropriate to address the identified deficiencies.

Table 7. Potential and non-exhaustive supervisory measures for credit and counterparty risk Potential supervisory measures for competent authorities in accordance with Article 104(1)(b), (d), (e), (f), (j), (l), (m), (n) of Directive 2013/36/EU – Competent authorities may require the institution to: A. involve the management body or its committees more actively in relevant credit decisions; B. improve credit risk measurement systems; C. improve controls on credit processes, including credit granting, monitoring and recovery; D. enhance collateral management, evaluation and monitoring; E. enhance the quality and frequency of reporting on credit risk to the management body and senior management; F. apply a specific provisioning policy, and – where permitted by accounting rules and regulations – require it to increase provisions; G. adjust internal risk parameters and/or risk weights used to calculate risk exposure amounts for specific products, sectors or types of obligors; H. apply higher haircuts to the value of collateral; I. reduce large exposures or other sources of credit concentration risk; J. tighten credit-granting criteria for all or some product or obligor categories; K. reduce its exposure to, or acquire protection for, specific types of facilities (e.g. mortgages, export finance, commercial real estate, securitisations), obligor categories, sectors, countries, etc.; L. implement an appropriate strategy to reduce the amount or share of nonperforming exposure; Potential supervisory measures for competent authorities in accordance with Article 104(1)(b), (d), (e), (f), (j), (l), (m), (n) of Directive 2013/36/EU – Competent authorities may require the institution to: M. enhance the credit risk management related to ESG risks, in particular environmental risks, potentially based on one or several actions listed above.