Basel Committee on Banking Supervision

The Core Principles are conceived as a framework of minimum standards for sound supervisory practices. The Core Principles provide a comprehensive standard for establishing a sound foundation for the regulation, supervision, governance and risk management of the banking sector. They set out the powers that supervisors should have to address safety and soundness concerns, promote a forward-looking and risk-based approach to supervision, and encourage early intervention and timely supervisory actions to mitigate threats to the safety and soundness of banks and the banking system.¹

The Core Principles are considered universally applicable, irrespective of the complexity of banks and banking systems, and should be applied by national authorities in the supervision of banking organisations within their jurisdictions.² A high degree of compliance with the Core Principles should foster overall financial system stability; however, banking supervision cannot, and should not, provide an assurance that banks will not fail.

The Core Principles standard is structured as follows:

1. The remainder of this section explains how to read this document considering the broad objectives of the Core Principles;
2. The "Explanation of certain terms used in the Core Principles" lists common terms and clarifies how these should be interpreted within the context of this standard;
3. The "Assessment methodology" describes how the standard should be used by jurisdictions to gauge their level of adherence to the Core Principles and within the context of the FSAP;
4. The "Preconditions for effective banking supervision" sets out a number of external elements on which effective banking supervision is dependent, but which may not be within the direct jurisdiction of supervisors;
5. "The Core Principles and assessment criteria" sets out the 29 principles and their accompanying essential and additional criteria;
6. The "Update on Committee standards, guidelines and sound practices" lists the new and revised standards, guidelines and sound practices that have been published by the Committee since the last substantive review of the Core Principles; and
7. The "Structure and guidance for assessment reports prepared by the International Monetary Fund and the World Bank" provides practical guidance to jurisdictions and assessors for the purpose of the IMF and World Bank FSAPs.

The banking sector is only one, albeit important, part of a financial system. The Committee has sought to maintain consistency, where possible, between these Core Principles and, for example, the corresponding standards for securities and insurance, as well as the standards for anti-money laundering (AML) and combatting the financing of terrorism (CFT) and transparency. Differences will inevitably remain, however, as key risk areas and supervisory priorities differ from sector to sector.

At a minimum, the Committee expects its members to fully implement the Basel Framework for their internationally active banks. The Core Principles are also a Basel standard, but they are applicable to all banks in all jurisdictions.

Each Core Principle applies to the supervision of all banks and banking groups. The intensity of supervision will need to be commensurate with the risk profile and systemic importance of banks.

In supervising an individual bank which is part of a corporate group, it is essential that supervisors consider the bank and its risk profile from a number of perspectives: on a solo basis (but with both a micro and macro focus); on a consolidated basis (in the sense of supervising the bank as a unit together with the other entities within the "banking group") and on a group-wide basis (taking into account the potential risks to the bank posed by other group entities outside of the banking group). Group entities (whether inside or outside the banking group) may be a source of strength but they may also be a source of weakness capable of adversely affecting the financial condition, reputation and overall safety and soundness of the bank. Supervisors should carefully consider the risks posed to a bank where it is part of a group or financial conglomerate with a mix of regulated and unregulated entities across different sectors. In the discharge of their functions, supervisors must observe a broad canvas of risk, whether arising from an individual bank, from its associated entities (regulated or not) or from the prevailing macro-financial environment.

Banks will from time to time run into difficulties, so effective crisis preparation and management and orderly resolution frameworks and measures are required to minimise the adverse impact on the broader banking and financial sectors. These include measures to be adopted by banks, such as recovery plans, and those to be adopted by supervisory, resolution and other authorities to coordinate the orderly restructuring or resolution of a troubled bank. Compliance with the Core Principles does not require the supervisory authority to also be the resolution authority.

The concept of proportionality ensures that applicable rules and supervision practices are consistent with banks' systemic importance and risk profiles, as well as appropriate for the broader characteristics of a particular financial system. The objective of proportionality is not to dilute the robustness of standards but to reflect jurisdictions' circumstances and supervisory capacity.³

The Core Principles recognise that the appropriate intensity of supervision for banks varies, with more time and resources devoted to larger, more complex or riskier banks. Supervisors should assess the risk profile of banks in terms of the risks they run, the efficacy of their governance and risk management, and the risks they pose to banking and financial systems. This process focuses supervisory resources where they can be utilised optimally, concentrating on outcomes and moving beyond passive assessment of compliance with rules.

To fulfil their purpose, the Core Principles must be capable of application to a wide range of jurisdictions, whose banking sectors may include a broad spectrum of banks (from large internationally active banks to small, non-complex deposit-taking institutions). To accommodate this breadth of application, a proportionate approach is adopted, both in terms of expectations of supervisors in the discharge of their own functions and in terms of the requirements that supervisors impose on banks. The concept of proportionality underpins the assessment and implementation of the Core Principles, even if it is not always directly referenced.

While all banks must observe minimum capital and liquidity standards, and establish effective governance and risk management frameworks and practices, the principle of proportionality allows supervisors to better match the level of regulatory and supervisory requirements to different banks and banking systems. In the context of the Core Principles, this is reflected in the expectation that requirements imposed by supervisors on banks will be commensurate with the risk profile and systemic importance (including, but not limited to, size and complexity) of banks.

The Core Principles allow for different approaches to supervision, as long as the overriding goals are achieved. Specific country circumstances and the context in which supervisory practices are applied should be considered during implementation and assessments, and in the dialogue between assessors and country authorities.

The revised Core Principles reflect regulatory and supervisory developments, structural changes in banking, and lessons learnt in FSAP assessments since the last revision in 2012. The current review has been informed by several thematic topics: (i) financial risks; (ii) operational resilience; (iii) systemic risk and macroprudential supervision; (iv) new risks, such as climate-related financial risks and the digitalisation of finance; (v) non-bank financial intermediation; and (vi) risk management practices.

The post-Great Financial Crisis (GFC) period has seen banks continue to build their resilience to financial risks, underpinned by stronger regulatory and supervisory frameworks, including the Basel III standards. The Core Principles have been strengthened to reflect key elements of many of the post-GFC reforms introduced by the Committee. In particular, the importance of a non-risk-based measure to complement risk-based approaches in constraining leverage in banks and the banking system (eg a leverage ratio); enhancements to credit risk management practices; the introduction of expected credit loss approaches to provisioning; and more stringent requirements for managing large exposures and related party transactions. More recent crises, such as the Covid-19 pandemic and episodes of bank distress, have reinforced the importance of bank and banking system resilience to a range of different shocks, as well as the need for effective supervision.

Beyond financial risks, significant efforts have been directed at strengthening operational resilience to ensure that banks are better able to withstand, adapt to and recover from severe operational risk-related events, such as pandemics, cyber incidents, technology failures and natural disasters. The Core Principles enhance the focus on governance, operational risk management, business continuity planning and testing, the mapping of interconnections and interdependencies, third-party dependency management, incident management, and resilient cyber security and information and communication technology (ICT).

The last 10 years have reaffirmed the importance of applying a system-wide macro perspective to the supervision of banks to assist in identifying and analysing systemic risks and taking pre-emptive action to address them. Adopting a broad financial system perspective is integral to many of the Core Principles, and so the Committee has not included a specific standalone principle on macroprudential issues but has sought to strengthen the existing requirements based on lessons learnt. This includes the value of capital buffers that can be increased or released as risks build and crystallise or dissipate (eg a countercyclical capital buffer).

Climate change may result in physical and transition risks that could affect the safety and soundness of individual banks and have broader implications for the banking system and financial stability. Targeted changes have been introduced to explicitly reference climate-related financial risks and to promote a principles-based approach to improving supervisory practices and banks' risk management. Banks should understand how climate-related risk drivers may manifest through financial risks, recognise that these risks could materialise over varying time horizons (which may go beyond their traditional capital planning horizon), and implement appropriate measures to mitigate these risks. Supervisors are also expected to consider climate-related financial risks in their supervision of banks, to assess banks' risk management processes, and to require banks to submit information that makes it possible to assess the materiality of climate-related financial risks. Both bank and supervisory practices may consider climate-related financial risks in a flexible manner, given the degree of heterogeneity and evolving practices in this area.

Technology-driven innovation and the digitalisation of finance are changing both customer behaviours and the way that banking services are provided. New products, new entrants and the use of new technologies present both opportunities and risks for supervisors, banks and the banking system. Digitalisation may amplify traditional risks (eg liquidity, operational and strategic risks), while digital communication channels can more rapidly propagate banking stress. Banks are also increasingly relying on third parties for the provision of technology services, which creates additional points of cyber risk as well as potential system-wide concentrations and further highlights the importance of operational resilience. For supervision to remain effective, supervisors need to ensure that they can continue to access relevant information (irrespective of where records are located) and review the overall activities of the banking group, including those undertaken by third parties that are supporting critical operations of banks.

Financial intermediation has evolved significantly since the last revision of the Core Principles, prompted by rapid advances in financial technology and the proliferation of non-bank financial intermediation. Non-bank financial institutions supplement banks in providing financial services, but their activities can also affect the stability of the financial system and increase the potential for contagion risks through their interconnections with banks. While the Core Principles are designed to apply to those institutions designated as banks, supervisors should remain alert to the risks arising from non-bank financial institution activities and their potential impact on the banking system. The revised Core Principles reinforce the group-wide approach to supervision and strengthen requirements for supervisors to monitor risks to banks from the range of different non-bank financial institutions and for banks to manage their counterparty risks.

Reflecting evolving risks and broader medium- and long-term trends, it is critical that banks institute a sound risk culture, maintain strong risk management practices and adopt and implement sustainable business models. The concept of bank business model sustainability reflects the expectation that banks design and implement sound and forward-looking strategies that generate sustainable returns over time. Both bank risk management and supervisory approaches have been strengthened in this respect. While responsibility for designing and implementing sustainable business strategies lies with a bank's board, supervisors have an important role to play, as assessing the robustness of banks' risk culture and business models is a key component of effective supervision.