Basel Committee on Banking Supervision

The use of internal models for the purposes of determining market risk capital requirements is conditional upon the explicit approval of the bank’s supervisory authority.

The supervisory authority will only approve a bank's use of internal models to determine market risk capital requirements if, at a minimum:

1. the supervisory authority is satisfied that the bank's risk management system is conceptually sound and is implemented with integrity;
2. the bank has, in the supervisory authority's view, a sufficient number of staff skilled in the use of sophisticated models not only in the trading area but also in the risk control, audit and, if necessary, back office areas;
3. the bank's trading desk risk management model has, in the supervisory authority's judgement, a proven track record of reasonable accuracy in measuring risk;
4. the bank regularly conducts stress tests along the lines set out in MAR30.19 to MAR30.23; and
5. the positions included in the bank's internal trading desk risk management models for determining minimum market risk capital requirements are held in trading desks that have been approved for the use of those models and that have passed the required tests described in MAR30.17.

Supervisory authorities may insist on a period of initial monitoring and live testing of a bank’s internal trading desk risk management model before it is used for the purposes of determining the bank’s market risk capital requirements.

The scope of trading portfolios that are eligible to use internal models to determine market risk capital requirements is determined based on a three-prong approach as follows:

1. The bank must satisfy its supervisory authority that both the bank’s organisational infrastructure (including the definition and structure of trading desks) and its bank-wide internal risk management model meet qualitative evaluation criteria, as set out in MAR30.5 to MAR30.16.
2. The bank must nominate individual trading desks, as defined in MAR12.1 to MAR12.6, for which the bank seeks model approval in order to use the internal models approach (IMA).
   1. The bank must nominate trading desks that it intends to be in-scope for model approval and trading desks that are out-of-scope for the use of the IMA. The bank must specify in writing the basis for these nominations.
   2. The bank must not nominate trading desks to be out-of-scope for model approval due to capital requirements for a particular trading desk determined using the standardised approach being lower than those determined using the IMA.
   3. The bank must use the standardised approach to determine the market risk capital requirements for trading desks that are out-of-scope for model approval. The positions in these out-of-scope trading desks are to be combined with all other positions that are subject to the standardised approach in order to determine the bank’s standardised approach capital requirements.
   4. Trading desks that the bank does not nominate for model approval at the time of model approval will be ineligible to use the IMA for a period of at least one year from the date of the latest internal model approval.
3. The bank must receive supervisory approval to use the IMA on individual trading desks. Following the identification of eligible trading desks, this step determines which trading desks will be in-scope to use the IMA and which risk factors within in-scope trading desks are eligible to be included in the bank’s internal expected shortfall (ES) models to determine market risk capital requirements as set out in MAR33.
   1. Each trading desk must satisfy profit and loss (P&L) attribution (PLA) tests on an ongoing basis to be eligible to use the IMA to determine market risk capital requirements. In order to conduct the PLA test, the bank must identify the set of risk factors to be used to determine its market risk capital requirements.
   2. Each trading desk also must satisfy backtesting requirements on an ongoing basis to be eligible to use the IMA to determine market risk capital requirements as set out in MAR32.4 to MAR32.19.
   3. Banks must conduct PLA tests and backtesting on a quarterly basis to update the eligibility and trading desk classification in PLA for trading desks in-scope to use the IMA.
   4. The market risk capital requirements for risk factors that satisfy the risk factor eligibility test as set out in MAR31.12 to MAR31.24 must be determined using ES models as specified in MAR33.1 to MAR33.15.
   5. The market risk capital requirements for risk factors that do not satisfy the risk factor eligibility test must be determined using stressed expected shortfall (SES) models as specified in MAR33.16 to MAR33.17.

In order to use the IMA to determine market risk capital requirements, the bank must have market risk management systems that are conceptually sound and implemented with integrity. Accordingly, the bank must meet the qualitative criteria set out below on an ongoing basis. Supervisors will assess that the bank has met the criteria before the bank is permitted to use the IMA.

The bank must have an independent risk control unit that is responsible for the design and implementation of the bank’s market risk management system. The risk control unit should produce and analyse daily reports on the output of the trading desk’s risk management model, including an evaluation of the relationship between measures of risk exposure and trading limits. This risk control unit must be independent of business trading units and should report directly to senior management of the bank.

The bank’s risk control unit must conduct regular backtesting and PLA assessments at the trading desk level. The bank must also conduct regular backtesting of its bank-wide internal models used for determining market risk capital requirements.

A distinct unit of the bank that is separate from the unit that designs and implements the internal models must conduct the initial and ongoing validation of all internal models used to determine market risk capital requirements. The model validation unit must validate all internal models used for purposes of the IMA on at least an annual basis.

The board of directors and senior management of the bank must be actively involved in the risk control process and must devote appropriate resources to risk control as an essential aspect of the business. In this regard, the daily reports prepared by the independent risk control unit must be reviewed by a level of management with sufficient seniority and authority to enforce both reductions of positions taken by individual traders and reductions in the bank’s overall risk exposure.

Internal models used to determine market risk capital requirements are likely to differ from those used by a bank in its day-to-day internal risk management functions. Nevertheless, the core design elements of both the market risk capital requirement model and the internal risk management model should be the same.

1. Valuation models that are a feature of both models should be similar. These valuation models must be an integral part of the internal identification, measurement, management and internal reporting of price risks within the bank’s trading desks.
2. Internal risk management models should, at a minimum, be used to assess the risk of the positions that are subject to market risk capital requirements, although they may assess a broader set of positions.
3. The construction of a trading desk risk management model must be based on the methodologies used in the bank’s internal risk management model with regard to risk factor identification, parameter estimation and proxy concepts and deviate only if this is appropriate due to regulatory requirements. A bank’s market risk capital requirement model and its internal risk management model should address an identical set of risk factors.

A routine and rigorous programme of stress testing is required. The results of stress testing must be:

1. reviewed at least monthly by senior management;
2. used in the bank’s internal assessment of capital adequacy; and
3. reflected in the policies and limits set by the bank’s management and its board of directors.

Where stress tests reveal particular vulnerability to a given set of circumstances, the bank must take prompt action to mitigate those risks appropriately (eg by hedging against that outcome, reducing the size of the bank’s exposures or increasing capital).

The bank must maintain a protocol for compliance with a documented set of internal manuals, policies, controls and procedures concerning the operation of the internal market risk management model. The bank’s risk management model must be well documented. Such documentation may include a comprehensive risk management manual that describes the basic principles of the risk management model and that provides a detailed explanation of the empirical techniques used to measure market risk.

The bank must receive approval from its supervisory authority prior to implementing any significant changes to its internal models used to determine market risk capital requirements.

The bank’s internal models for determining market risk capital requirements must address the full set of positions that are in the scope of application of the model. All models’ measurements of risk must be based on a sound theoretical basis, calculated correctly, and reported accurately.

The bank’s internal audit and validation functions or external auditor must conduct an independent review of the market risk measurement system on at least an annual basis. The scope of the independent review must include both the activities of the business trading units and the activities of the independent risk control unit. The independent review must be sufficiently detailed to determine which trading desks are impacted by any failings. At a minimum, the scope of the independent review must include the following:

1. the organisation of the risk control unit;
2. the adequacy of the documentation of the risk management model and process;
3. the accuracy and appropriateness of market risk management models (including any significant changes);
4. the verification of the consistency, timeliness and reliability of data sources used to run internal models, including the independence of such data sources;
5. the approval process for risk pricing models and valuation systems used by the bank’s front- and back-office personnel;
6. the scope of market risks reflected in the trading desk risk management models;
7. the integrity of the management information system;
8. the accuracy and completeness of position data;
9. the accuracy and appropriateness of volatility and correlation assumptions;
10. the accuracy of valuation and risk transformation calculations;
11. the verification of trading desk risk management model accuracy through frequent backtesting and PLA assessments; and
12. the general alignment between the model to determine market risk capital requirements and the model the bank uses in its day-to-day internal management functions.

Banks must maintain a process to ensure that their internal models have been adequately validated by suitably qualified parties independent of the model development process to ensure that each model is conceptually sound and adequately reflects all material risks. Model validation must be conducted both when the model is initially developed and when any significant changes are made to the model. The bank must revalidate its models periodically, particularly when there have been significant structural changes in the market or changes to the composition of the bank’s portfolio that might lead to the models no longer being adequate. Model validation must include PLA and backtesting, and must, at a minimum, also include the following:

1. Tests to demonstrate that any assumptions made within internal models are appropriate and do not underestimate risk. This may include reviewing the appropriateness of assumptions of normal distributions and any pricing models.
2. Further to the regulatory backtesting programmes, model validation must assess the hypothetical P&L (HPL) calculation methodology.
3. The bank must use hypothetical portfolios to ensure that internal models are able to account for particular structural features that may arise. For example, where the data history for a particular instrument does not meet the quantitative standards in MAR33.1 to MAR33.12 and the bank maps these positions to proxies, the bank must ensure that the proxies produce conservative results under relevant market scenarios, with sufficient consideration given to ensuring:
   1. that material basis risks are adequately reflected (including mismatches between long and short positions by maturity or by issuer); and
   2. that the models reflect concentration risk that may arise in an undiversified portfolio.

The model validation conducted by external auditors and/or supervisory authorities of a bank’s internal model to determine market risk capital requirements should, at a minimum, include the following steps:

1. Verification that the internal validation processes described in MAR30.17 are operating in a satisfactory manner;
2. Confirmation that the formulae used in the calculation process, as well as for the pricing of options and other complex instruments, are validated by a qualified unit, which in all cases should be independent from the bank’s trading area;
3. Confirmation that the structure of internal models is adequate with respect to the bank’s activities and geographical coverage;
4. Review of the results of both the bank’s backtesting of its internal models (ie comparison of value-at-risk with actual P&L and HPL) and its PLA process to ensure that the models provide a reliable measure of potential losses over time. On request, a bank should make available to its supervisory authority and/or to its external auditors the results as well as the underlying inputs to ES calculations and details of the PLA exercise; and
5. Confirmation that data flows and processes associated with the risk measurement system are transparent and accessible. On request and in accordance with procedures, the bank should provide its supervisory authority and its external auditors access to the models’ specifications and parameters.

Banks that use the IMA for determining market risk capital requirements must have in place a rigorous and comprehensive stress testing programme both at the trading desk level and at the bank-wide level.

Banks’ stress scenarios must cover a range of factors that (i) can create extraordinary losses or gains in trading portfolios, or (ii) make the control of risk in those portfolios very difficult. These factors include low-probability events in all major types of risk, including the various components of market, credit and operational risks. A bank must design stress scenarios to assess the impact of such factors on positions that feature both linear and non-linear price characteristics (ie options and instruments that have option-like characteristics).

Banks’ stress tests should be of a quantitative and qualitative nature, incorporating both market risk and liquidity risk aspects of market disturbances.

1. Quantitative elements should identify plausible stress scenarios to which banks could be exposed.
2. Qualitatively, a bank’s stress testing programme should evaluate the capacity of the bank’s capital to absorb potential significant losses and identify steps the bank can take to reduce its risk and conserve capital.

Banks should routinely communicate results of stress testing to senior management and should periodically communicate those results to the bank’s board of directors.

Banks should combine the use of supervisory stress scenarios with stress tests developed by the bank itself to reflect its specific risk characteristics. Stress scenarios may include the following:

1. Supervisory scenarios requiring no simulations by the bank. A bank should have information on the largest losses experienced during the reporting period and may be required to make this available for supervisory review. Supervisors may compare this loss information to the level of capital requirements that would result from a bank’s internal measurement system. For example, the bank may be required to provide supervisory authorities with an assessment of how many days of peak day losses would have been covered by a given ES estimate.
2. Scenarios requiring a simulation by the bank. Banks should subject their portfolios to a series of simulated stress scenarios and provide supervisory authorities with the results. These scenarios could include testing the current portfolio against past periods of significant disturbance (eg the 1987 equity crash, the Exchange Rate Mechanism crises of 1992 and 1993, the increase in interest rates in the first quarter of 1994, the 1998 Russian financial crisis, the 2000 bursting of the technology stock bubble, the 2007–08 subprime mortgage crisis, or the 2011–12 Euro zone crisis) incorporating both the significant price movements and the sharp reduction in liquidity associated with these events. A second type of scenario would evaluate the sensitivity of the bank’s market risk exposure to changes in the assumptions about volatilities and correlations. Applying this test would require an evaluation of the historical range of variation for volatilities and correlations and evaluation of the bank’s current positions against the extreme values of the historical range. Due consideration should be given to the sharp variation that at times has occurred in a matter of days in periods of significant market disturbance. For example, the above-mentioned situations involved correlations within risk factors approaching the extreme values of 1 or –1 for several days at the height of the disturbance.
3. Bank-developed stress scenarios. In addition to the scenarios prescribed by supervisory authorities under MAR30.23(1), a bank should also develop its own stress tests that it identifies as most adverse based on the characteristics of its portfolio (eg problems in a key region of the world combined with a sharp move in oil prices). A bank should provide supervisory authorities with a description of the methodology used to identify and carry out the scenarios as well as with a description of the results derived from these scenarios.