Basel Committee on Banking Supervision

The supervisory review process of the Framework is intended not only to ensure that banks have adequate capital and liquidity to support all the risks in their business, but also to encourage banks to develop and use better risk management techniques in monitoring and managing their risks.

The supervisory review process recognises the responsibility of bank management in developing an internal capital assessment process and setting capital targets that are commensurate with the bank’s risk profile and control environment. In the Framework, bank management continues to bear responsibility for ensuring that the bank has adequate capital to support its risks beyond the core minimum requirements.

Supervisors are expected to evaluate how well banks are assessing their capital needs relative to their risks and to intervene, where appropriate. This interaction is intended to foster an active dialogue between banks and supervisors such that when deficiencies are identified, prompt and decisive action can be taken to reduce risk or restore capital. Accordingly, supervisors may wish to adopt an approach to focus more intensely on those banks with risk profiles or operational experience that warrants such attention.

The Committee recognises the relationship that exists between the amount of capital held by the bank against its risks and the strength and effectiveness of the bank’s risk management and internal control processes. However, increased capital should not be viewed as the only option for addressing increased risks confronting the bank. Other means for addressing risk, such as strengthening risk management, applying internal limits, strengthening the level of provisions and reserves, and improving internal controls, must also be considered. Furthermore, capital should not be regarded as a substitute for addressing fundamentally inadequate control or risk management processes.

There are three main areas that might be particularly suited to treatment under Pillar 2: risks considered under Pillar 1 that are not fully captured by the Pillar 1 process (eg credit concentration risk); those factors not taken into account by the Pillar 1 process (eg interest rate risk in the banking book, business and strategic risk); and factors external to the bank (eg business cycle effects). A further important aspect of Pillar 2 is the assessment of compliance with the minimum standards and disclosure requirements of the more advanced methods in Pillar 1. Supervisors must ensure that these requirements are being met, both as qualifying criteria and on a continuing basis.

Principle 1: Banks should have a process for assessing their overall capital adequacy in relation to their risk profile and a strategy for maintaining their capital levels.

Principle 2: Supervisors should review and evaluate banks’ internal capital adequacy assessments and strategies, as well as their ability to monitor and ensure their compliance with regulatory capital ratios. Supervisors should take appropriate supervisory action if they are not satisfied with the result of this process.

Principle 3: Supervisors should expect banks to operate above the minimum regulatory capital ratios and should have the ability to require banks to hold capital in excess of the minimum.

Principle 4: Supervisors should seek to intervene at an early stage to prevent capital from falling below the minimum levels required to support the risk characteristics of a particular bank and should require rapid remedial action if capital is not maintained or restored.

Banks must be able to demonstrate that chosen internal capital targets are well founded and that these targets are consistent with their overall risk profile and current operating environment. In assessing capital adequacy, bank management needs to be mindful of the particular stage of the business cycle in which the bank is operating. Rigorous, forward-looking stress testing that identifies possible events or changes in market conditions that could adversely impact the bank should be performed. Bank management clearly bears primary responsibility for ensuring that the bank has adequate capital to support its risks.

The five main features of a rigorous process are as follows:

1. board and senior management oversight;¹
2. sound capital assessment;
3. comprehensive assessment of risks;
4. monitoring and reporting; and
5. internal control review.

A sound risk management process is the foundation for an effective assessment of the adequacy of a bank’s capital position. Bank management is responsible for understanding the nature and level of risk being taken by the bank and how this risk relates to adequate capital levels. It is also responsible for ensuring that the formality and sophistication of the risk management processes are appropriate in light of the risk profile and business plan.

The analysis of a bank’s current and future capital requirements in relation to its strategic objectives is a vital element of the strategic planning process. The strategic plan should clearly outline the bank’s capital needs, anticipated capital expenditures, desirable capital level, and external capital sources. Senior management and the board should view capital planning as a crucial element in being able to achieve its desired strategic objectives.

The bank’s board of directors has responsibility for setting the bank’s tolerance for risks. It should also ensure that management establishes a framework for assessing the various risks, develops a system to relate risk to the bank’s capital level, and establishes a method for monitoring compliance with internal policies. It is likewise important that the board of directors adopts and supports strong internal controls and written policies and procedures and ensures that management effectively communicates these throughout the organisation.

Fundamental elements of sound capital assessment include:

1. policies and procedures designed to ensure that the bank identifies, measures, and reports all material risks;
2. a process that relates capital to the level of risk;
3. a process that states capital adequacy goals with respect to risk, taking account of the bank’s strategic focus and business plan; and
4. a process of internal controls, reviews and audit to ensure the integrity of the overall management process.

All material risks faced by the bank should be addressed in the capital assessment process. While the Committee recognises that not all risks can be measured precisely, a process should be developed to estimate risks. Therefore, the following risk exposures, which by no means constitute a comprehensive list of all risks, should be considered.

Credit risk: Banks should have methodologies that enable them to assess the credit risk involved in exposures to individual borrowers or counterparties as well as at the portfolio level. Banks should assess exposures, regardless of whether they are rated or unrated, and determine whether the risk weights applied to such exposures, under the Standardised Approach, are appropriate for their inherent risk. In those instances where a bank determines that the inherent risk of such an exposure, particularly if it is unrated, is significantly higher than that implied by the risk weight to which it is assigned, the bank should consider the higher degree of credit risk in the evaluation of its overall capital adequacy. For more sophisticated banks, the credit review assessment of capital adequacy, at a minimum, should cover four areas:

1. risk-rating systems,
2. portfolio analysis / aggregation;
3. securitisation / complex credit derivatives; and
4. large exposures and risk concentrations.

Internal risk ratings are an important tool in monitoring credit risk. Internal risk ratings should be adequate to support the identification and measurement of risk from all credit exposures, and should be integrated into an institution’s overall analysis of credit risk and capital adequacy. The ratings system should provide detailed ratings for all assets, not only for criticised or problem assets. Loan loss reserves should be included in the credit risk assessment for capital adequacy.

The analysis of credit risk should adequately identify any weaknesses at the portfolio level, including any concentrations of risk. It should also adequately take into consideration the risks involved in managing credit concentrations and other portfolio issues through such mechanisms as securitisation programmes and complex credit derivatives. Further, the analysis of counterparty credit risk should include consideration of public evaluation of the supervisor’s compliance with the Core Principles for Effective Banking Supervision (BCP).

Operational risk: the Committee believes that similar rigour should be applied to the management of operational risk, as is done for the management of other significant banking risks. The failure to properly manage operational risk can result in a misstatement of an institution’s risk/return profile and expose the institution to significant losses.

A bank should develop a framework for managing operational risk and evaluate the adequacy of capital given this framework. The framework should cover the bank’s appetite and tolerance for operational risk, as specified through the policies for managing this risk, including the extent and manner in which operational risk is transferred outside the bank. It should also include policies outlining the bank’s approach to identifying, assessing, monitoring and controlling/mitigating the risk.

Market risk: banks should have methodologies that enable them to assess and actively manage all material market risks, wherever they arise, at position, desk, business line and firm-wide level. For more sophisticated banks, their assessment of internal capital adequacy for market risk, at a minimum, should be based on both value-at-risk (VaR) modelling and stress testing, including an assessment of concentration risk and the assessment of illiquidity under stressful market scenarios, although all firms’ assessments should include stress testing appropriate to their trading activity.

VaR is an important tool in monitoring aggregate market risk exposures and provides a common metric for comparing the risk being run by different desks and business lines. A bank’s VaR model should be adequate to identify and measure risks arising from all its trading activities and should be integrated into the bank’s overall internal capital assessment as well as subject to rigorous on-going validation. A VaR model estimates should be sensitive to changes in the trading book risk profile.

Banks must supplement their VaR model with stress tests (factor shocks or integrated scenarios whether historic or hypothetical) and other appropriate risk management techniques. In the bank’s internal capital assessment it must demonstrate that it has enough capital to not only meet the minimum capital requirements but also to withstand a range of severe but plausible market shocks. In particular, it must factor in, where appropriate:

1. illiquidity / gapping of prices;
2. concentrated positions (in relation to market turnover);
3. one-way markets;
4. non-linear products / deep out-of-the-money positions;
5. events and jumps-to-default;
6. significant shifts in correlations; and
7. other risks that may not be appropriately captured in VaR (eg recovery rate uncertainty, implied correlations or skew risk).

The stress tests applied by a bank and, in particular, the calibration of those tests (e.g. the parameters of the shocks or types of events considered) should be reconciled back to a clear statement setting out the premise upon which the bank’s internal capital assessment is based (eg ensuring there is adequate capital to manage the traded portfolios within stated limits through what may be a prolonged period of market stress and illiquidity, or that there is adequate capital to ensure that, over a given time horizon to a specified confidence level, all positions can be liquidated or the risk hedged in an orderly fashion). The market shocks applied in the tests must reflect the nature of portfolios and the time it could take to hedge out or manage risks under severe market conditions.

Concentration risk should be pro-actively managed and assessed by firms and concentrated positions should be routinely reported to senior management.

Banks should design their risk management systems, including the VaR methodology and stress tests, to properly measure the material risks in instruments they trade as well as the trading strategies they pursue. As their instruments and trading strategies change, the VaR methodologies and stress tests should also evolve to accommodate the changes.

Banks must demonstrate how they combine their risk measurement approaches to arrive at the overall internal capital for market risk.

Interest rate risk in the banking book: the measurement process should include all material interest rate positions of the bank and consider all relevant repricing and maturity data. Such information will generally include current balance and contractual rate of interest associated with the instruments and portfolios, principal payments, interest reset dates, maturities, the rate index used for repricing, and contractual interest rate ceilings or floors for adjustable-rate items. The system should also have well-documented assumptions and techniques.

Regardless of the type and level of complexity of the measurement system used, bank management should ensure the adequacy and completeness of the system. Because the quality and reliability of the measurement system is largely dependent on the quality of the data and various assumptions used in the model, management should give particular attention to these items.

Liquidity risk: liquidity is crucial to the ongoing viability of any banking organisation. Banks’ capital positions can have an effect on their ability to obtain liquidity, especially in a crisis. Each bank must have adequate systems for measuring, monitoring and controlling liquidity risk. Banks should evaluate the adequacy of capital given their own liquidity profile and the liquidity of the markets in which they operate.

Other risks: although the Committee recognises that “other” risks, such as reputational and strategic risk, are not easily measurable, it expects industry to further develop techniques for managing all aspects of these risks.

The bank should establish an adequate system for monitoring and reporting risk exposures and assessing how the bank’s changing risk profile affects the need for capital. The bank’s senior management or board of directors should, on a regular basis, receive reports on the bank’s risk profile and capital needs. These reports should allow senior management to:

1. evaluate the level and trend of material risks and their effect on capital levels;
2. evaluate the sensitivity and reasonableness of key assumptions used in the capital assessment measurement system;
3. determine that the bank holds sufficient capital against the various risks and is in compliance with established capital adequacy goals; and
4. assess its future capital requirements based on the bank’s reported risk profile and make necessary adjustments to the bank’s strategic plan accordingly.

The bank’s internal control structure is essential to the capital assessment process. Effective control of the capital assessment process includes an independent review and, where appropriate, the involvement of internal or external audits. The bank’s board of directors has a responsibility to ensure that management establishes a system for assessing the various risks, develops a system to relate risk to the bank’s capital level, and establishes a method for monitoring compliance with internal policies. The board should regularly verify whether its system of internal controls is adequate to ensure well-ordered and prudent conduct of business.

The bank should conduct periodic reviews of its risk management process to ensure its integrity, accuracy, and reasonableness. Areas that should be reviewed include:

1. appropriateness of the bank’s capital assessment process given the nature, scope and complexity of its activities;
2. identification of large exposures and risk concentrations;
3. accuracy and completeness of data inputs into the bank’s assessment process;
4. reasonableness and validity of scenarios used in the assessment process; and
5. stress testing and analysis of assumptions and inputs.

The supervisory authorities should regularly review the process by which a bank assesses its capital adequacy, risk position, resulting capital levels, and quality of capital held. Supervisors should also evaluate the degree to which a bank has in place a sound internal process to assess capital adequacy. The emphasis of the review should be on the quality of the bank’s risk management and controls and should not result in supervisors functioning as bank management. The periodic review can involve some combination of:

1. on-site examinations or inspections;
2. off-site review;
3. discussions with bank management;
4. review of work done by external auditors (provided it is adequately focused on the necessary capital issues); and
5. periodic reporting.

The substantial impact that errors in the methodology or assumptions of formal analyses can have on resulting capital requirements requires a detailed review by supervisors of each bank’s internal analysis.

Supervisors should assess the degree to which internal targets and processes incorporate the full range of material risks faced by the bank. Supervisors should also review the adequacy of risk measures used in assessing internal capital adequacy and the extent to which these risk measures are also used operationally in setting limits, evaluating business line performance, and evaluating and controlling risks more generally. Supervisors should consider the results of sensitivity analyses and stress tests conducted by the institution and how these results relate to capital plans.

Supervisors should review the bank’s processes to determine that:

1. target levels of capital chosen are comprehensive and relevant to the current operating environment;
2. these levels are properly monitored and reviewed by senior management; and
3. the composition of capital is appropriate for the nature and scale of the bank’s business.

Supervisors should also consider the extent to which the bank has provided for unexpected events in setting its capital levels. This analysis should cover a wide range of external conditions and scenarios, and the sophistication of techniques and stress tests used should be commensurate with the bank’s activities.

Supervisors should consider the quality of the bank’s management information reporting and systems, the manner in which business risks and activities are aggregated, and management’s record in responding to emerging or changing risks.

In all instances, the capital level at an individual bank should be determined according to the bank’s risk profile and adequacy of its risk management process and internal controls. External factors such as business cycle effects and the macroeconomic environment should also be considered.

In order for certain internal methodologies, credit risk mitigation techniques and asset securitisations to be recognised for regulatory capital purposes, banks will need to meet a number of requirements, including risk management standards and disclosures. In particular, banks will be required to disclose features of their internal methodologies used in calculating minimum capital requirements. As part of the supervisory review process, supervisors must ensure that these conditions are being met on an ongoing basis.

The Committee regards this review of minimum standards and qualifying criteria as an integral part of the supervisory review process under Principle 2. In setting the minimum criteria the Committee has considered current industry practice and so anticipates that these minimum standards will provide supervisors with a useful set of benchmarks that are aligned with bank management expectations for effective risk management and capital allocation.

There is also an important role for supervisory review of compliance with certain conditions and requirements set for standardised approaches. In this context, there will be a particular need to ensure that use of various instruments that can reduce Pillar 1 capital requirements are utilised and understood as part of a sound, tested, and properly documented risk management process.

Having carried out the review process described above, supervisors should take appropriate action if they are not satisfied with the results of the bank’s own risk assessment and capital allocation. Supervisors should consider a range of actions, such as those set out under Principles 3 and 4 below.

Pillar 1 capital requirements will include a buffer for uncertainties surrounding the Pillar 1 regime that affect the banking population as a whole. Bank-specific uncertainties will be treated under Pillar 2. It is anticipated that such buffers under Pillar 1 will be set to provide reasonable assurance that a bank with good internal systems and controls, a well-diversified risk profile and a business profile well covered by the Pillar 1 regime, and which operates with capital equal to Pillar 1 requirements, will meet the minimum goals for soundness embodied in Pillar 1. However, supervisors will need to consider whether the particular features of the markets for which they are responsible are adequately covered. Supervisors will typically require (or encourage) banks to operate with a buffer, over and above the Pillar 1 standard. Banks should maintain this buffer for a combination of the following:

1. Pillar 1 minimums are anticipated to be set to achieve a level of bank creditworthiness in markets that is below the level of creditworthiness sought by many banks for their own reasons. For example, most international banks appear to prefer to be highly rated by internationally recognised rating agencies. Thus, banks are likely to choose to operate above Pillar 1 minimums for competitive reasons.
2. In the normal course of business, the type and volume of activities will change, as will the different risk exposures, causing fluctuations in the overall capital ratio.
3. It may be costly for banks to raise additional capital, especially if this needs to be done quickly or at a time when market conditions are unfavourable.
4. For banks to fall below minimum regulatory capital requirements is a serious matter. It may place banks in breach of the relevant law and/or prompt non-discretionary corrective action on the part of supervisors.
5. There may be risks, either specific to individual banks, or more generally to an economy at large, that are not taken into account in Pillar 1.

There are several means available to supervisors for ensuring that individual banks are operating with adequate levels of capital. Among other methods, the supervisor may set trigger and target capital ratios or define categories above minimum ratios (eg well capitalised and adequately capitalised) for identifying the capitalisation level of the bank.

Supervisors should consider a range of options if they become concerned that a bank is not meeting the requirements embodied in the supervisory principles outlined above. These actions may include intensifying the monitoring of the bank, restricting the payment of dividends, requiring the bank to prepare and implement a satisfactory capital adequacy restoration plan, and requiring the bank to raise additional capital immediately. Supervisors should have the discretion to use the tools best suited to the circumstances of the bank and its operating environment.

The permanent solution to banks’ difficulties is not always increased capital. However, some of the required measures (such as improving systems and controls) may take a period of time to implement. Therefore, increased capital might be used as an interim measure while permanent measures to improve the bank’s position are being put in place. Once these permanent measures have been put in place and have been seen by supervisors to be effective, the interim increase in capital requirements can be removed.

Sound risk management processes are necessary to support supervisory and market participants’ confidence in banks’ assessments of their risk profiles and internal capital adequacy assessments. These processes take on particular importance in light of the identification, measurement and aggregation challenges arising from increasingly complex on- and off-balance sheet exposures.

When assessing whether a bank is appropriately capitalised, bank management should ensure that it properly identifies and measures the risks to which the bank is exposed. A financial institution’s internal capital adequacy assessment process (ICAAP) should be conducted on a consolidated basis and, when deemed necessary by the appropriate supervisors, at the legal entity level for each bank in the group.² In addition, the ICAAP should incorporate stress testing to complement and help validate other quantitative and qualitative approaches so that bank management may have a more complete understanding of the bank’s risks and the interaction of those risks under stressed conditions. A bank should also perform a careful analysis of its capital instruments and their potential performance during times of stress, including their ability to absorb losses and support ongoing business operations. A bank’s ICAAP should address both short- and long-term needs and consider the prudence of building excess capital over benign periods of the credit cycle and also to withstand a severe and prolonged market downturn. Differences between the capital assessment under a bank’s ICAAP and the supervisory assessment of capital adequacy made under Pillar 2 should trigger a dialogue that is proportionate to the depth and nature of such differences.

Pillar 1 capital requirements represent minimum requirements. All of a bank’s risks – both on- and off-balance sheet, and particularly those risks related to complex capital market activities – should be adequately covered by capital, including through Pillar 2 in excess of minimum Pillar 1 requirements. This will help ensure that a bank maintains sufficient capital for risks not adequately addressed through Pillar 1 and that it will be able to operate effectively throughout a severe and prolonged period of financial market stress or an adverse credit cycle. This should, in part, include drawing down on the capital buffer built-up during good times. While all banks must comply with the minimum capital requirements during and after such stress events, it is imperative that systemically important banks have the shock absorption capability to adequately protect against severe stress events.

The detail and sophistication of a bank’s risk management programmes should be commensurate with the size and complexity of its business and the overall level of risk that the bank accepts. This guidance, therefore, should be applied to banks on a proportionate basis.

Supervisors should determine whether a bank has in place a sound firm-wide risk management framework that enables it to define its risk appetite and recognise all material risks, including the risks posed by concentrations, securitisation, off-balance sheet exposures, valuation practices and other risk exposures. The bank can achieve this by:

1. adequately identifying, measuring, monitoring, controlling and mitigating these risks;
2. clearly communicating the extent and depth of these risks in an easily understandable, but accurate, manner in reports to senior management and the board of directors, as well as in published financial reports;
3. conducting ongoing stress testing to identify potential losses and liquidity needs under adverse circumstances; and
4. setting adequate minimum internal standards for allowances or liabilities for losses, capital, and contingency funding.

These elements should be adequately incorporated into a bank’s risk management system and ICAAP specifically since they are not fully captured by Pillar 1 of the Basel III framework.

A sound risk management system should have the following key features:

1. active board and senior management oversight;
2. appropriate policies, procedures and limits;
3. comprehensive and timely identification, measurement, mitigation, controlling, monitoring and reporting of risks;
4. appropriate management information systems (MIS) at the business and firm-wide level; and
5. comprehensive internal controls.

It is the responsibility of the board of directors and senior management³ to define the institution’s risk appetite and to ensure that the bank’s risk management framework includes detailed policies that set specific firm-wide prudential limits on the bank’s activities, which are consistent with its risk taking appetite and capacity. In order to determine the overall risk appetite, the board and senior management must first have an understanding of risk exposures on a firm-wide basis. To achieve this understanding, the appropriate members of senior management must bring together the perspectives of the key business and control functions. In order to develop an integrated firm-wide perspective on risk, senior management must overcome organisational silos between business lines and share information on market developments, risks and risk mitigation techniques. As the banking industry has moved increasingly towards market-based intermediation, there is a greater probability that many areas of a bank may be exposed to a common set of products, risk factors or counterparties. Senior management should establish a risk management process that is not limited to credit, market, liquidity and operational risks, but incorporates all material risks. This includes reputational, legal and strategic risks, as well as risks that do not appear to be significant in isolation, but when combined with other risks could lead to material losses.

The board of directors and senior management should possess sufficient knowledge of all major business lines to ensure that appropriate policies, controls and risk monitoring systems are effective. They should have the necessary expertise to understand the capital markets activities in which the bank is involved – such as securitisation and off-balance sheet activities – and the associated risks. The board and senior management should remain informed on an on-going basis about these risks as financial markets, risk management practices and the bank’s activities evolve. In addition, the board and senior management should ensure that accountability and lines of authority are clearly delineated. With respect to new or complex products and activities, senior management should understand the underlying assumptions regarding business models, valuation and risk management practices. In addition, senior management should evaluate the potential risk exposure if those assumptions fail.

Before embarking on new activities or introducing products new to the institution, the board and senior management should identify and review the changes in firm-wide risks arising from these potential new products or activities and ensure that the infrastructure and internal controls necessary to manage the related risks are in place. In this review, a bank should also consider the possible difficulty in valuing the new products and how they might perform in a stressed economic environment.

A bank’s risk function and its chief risk officer or equivalent position should be independent of the individual business lines and report directly to the chief executive officer and the institution’s board of directors. In addition, the risk function should highlight to senior management and the board risk management concerns, such as risk concentrations and violations of risk appetite limits.

Firm-wide risk management programmes should include detailed policies that set specific firm-wide prudential limits on the principal risks relevant to a bank’s activities. A bank’s policies and procedures should provide specific guidance for the implementation of broad business strategies and should establish, where appropriate, internal limits for the various types of risk to which the bank may be exposed. These limits should consider the bank’s role in the financial system and be defined in relation to the bank’s capital, total assets, earnings or, where adequate measures exist, its overall risk level.

A bank’s policies, procedures and limits should:

1. provide for adequate and timely identification, measurement, monitoring, control and mitigation of the risks posed by its lending, investing, trading, securitisation, off-balance sheet, fiduciary and other significant activities at the business line and firm-wide levels;
2. ensure that the economic substance of a bank’s risk exposures, including reputational risk and valuation uncertainty, are fully recognised and incorporated into the bank’s risk management processes;
3. be consistent with the bank’s stated goals and objectives, as well as its overall financial strength;
4. clearly delineate accountability and lines of authority across the bank’s various business activities, and ensure there is a clear separation between business lines and the risk function;
5. escalate and address breaches of internal position limits;
6. provide for the review of new businesses and products by bringing together all relevant risk management, control and business lines to ensure that the bank is able to manage and control the activity prior to it being initiated; and
7. include a schedule and process for reviewing the policies, procedures and limits and for updating them as appropriate.

A bank’s MIS should provide the board and senior management in a clear and concise manner with timely and relevant information concerning their institutions’ risk profile. This information should include all risk exposures, including those that are off-balance sheet. Management should understand the assumptions behind and limitations inherent in specific risk measures.

The key elements necessary for the aggregation of risks are an appropriate infrastructure and MIS that:

1. allow for the aggregation of exposures and risk measures across business lines and
2. support customised identification of concentrations (see SRP30.20 to SRP30.28 on risk concentrations) and emerging risks.

A bank’s MIS should be capable of capturing limit breaches and there should be procedures in place to promptly report such breaches to senior management, as well as to ensure that appropriate follow-up actions are taken. For instance, similar exposures should be aggregated across business platforms (including the banking and trading books) to determine whether there is a concentration or a breach of an internal position limit.

MIS developed to achieve this objective should support the ability to evaluate the impact of various types of economic and financial shocks that affect the whole of the financial institution. Further, a bank’s systems should be flexible enough to incorporate hedging and other risk mitigation actions to be carried out on a firm-wide basis while taking into account the various related basis risks.

To enable proactive management of risk, the board and senior management need to ensure that MIS is capable of providing regular, accurate and timely information on the bank’s aggregate risk profile, as well as the main assumptions used for risk aggregation. MIS should be adaptable and responsive to changes in the bank’s underlying risk assumptions and should incorporate multiple perspectives of risk exposure to account for uncertainties in risk measurement. In addition, it should be sufficiently flexible so that the institution can generate forward-looking bank-wide scenario analyses that capture management’s interpretation of evolving market conditions and stressed conditions (see SRP30.45 to SRP30.47 on stress testing). Third-party inputs or other tools used within MIS (eg credit ratings, risk measures, models) should be subject to initial and ongoing validation.

Risk management processes should be frequently monitored and tested by independent control areas and internal, as well as external, auditors.⁴ The aim is to ensure that the information on which decisions are based is accurate so that processes fully reflect management policies and that regular reporting, including the reporting of limit breaches and other exception-based reporting, is undertaken effectively. The risk management function of banks must be independent of the business lines in order to ensure an adequate separation of duties and to avoid conflicts of interest.

Unmanaged risk concentrations are an important cause of major problems in banks. A bank should aggregate all similar direct and indirect exposures regardless of where the exposures have been booked. A risk concentration is any single exposure or group of similar exposures (eg to the same borrower or counterparty, including protection providers, geographic area, industry or other risk factors) with the potential to produce (i) losses large enough (relative to a bank’s earnings, capital, total assets or overall risk level) to threaten a bank’s creditworthiness or ability to maintain its core operations or (ii) a material change in a bank’s risk profile. Risk concentrations should be analysed on both a bank legal entity and consolidated basis, as an unmanaged concentration at a subsidiary bank may appear immaterial at the consolidated level, but can nonetheless threaten the viability of the subsidiary organisation.

Risk concentrations should be viewed in the context of a single or a set of closely related risk-drivers that may have different impacts on a bank. These concentrations should be integrated when assessing a bank’s overall risk exposure. A bank should consider concentrations that are based on common or correlated risk factors that reflect more subtle or more situation-specific factors than traditional concentrations, such as correlations between market, credit risks and liquidity risk.

The growth of market-based intermediation has increased the possibility that different areas of a bank are exposed to a common set of products, risk factors or counterparties. This has created new challenges for risk aggregation and concentration management. Through its risk management processes and MIS, a bank should be able to identify and aggregate similar risk exposures across the firm, including across legal entities, asset types (eg loans, derivatives and structured products), risk areas (eg the trading book) and geographic regions. The typical situations in which risk concentrations can arise include:

1. exposures to a single counterparty, borrower or group of connected counterparties or borrowers;
2. industry or economic sectors, including exposures to both regulated and nonregulated financial institutions such as hedge funds and private equity firms;
3. geographical regions;
4. exposures arising from credit risk mitigation techniques, including exposure to similar collateral types or to a single or closely related credit protection provider;
5. trading exposures/market risk;
6. exposures to counterparties (eg hedge funds and hedge counterparties) through the execution or processing of transactions (either product or service);
7. funding sources;
8. assets that are held in the banking book or trading book, such as loans, derivatives and structured products; and
9. off-balance sheet exposures, including guarantees, liquidity lines and other commitments.

Risk concentrations can also arise through a combination of exposures across these broad categories. A bank should have an understanding of its firm-wide risk concentrations resulting from similar exposures across its different business lines. Examples of such business lines include subprime exposure in lending books; counterparty exposures; conduit exposures and structured investment vehicles (SIVs); contractual and non-contractual exposures; trading activities; and underwriting pipelines.

While risk concentrations often arise due to direct exposures to borrowers and obligors, a bank may also incur a concentration to a particular asset type indirectly through investments backed by such assets (eg collateralised debt obligations), as well as exposure to protection providers guaranteeing the performance of the specific asset type (eg monoline insurers). A bank should have in place adequate, systematic procedures for identifying high correlation between the creditworthiness of a protection provider and the obligors of the underlying exposures due to their performance being dependent on common factors beyond systematic risk (ie “wrong way risk”).

Procedures should be in place to communicate risk concentrations to the board of directors and senior management in a manner that clearly indicates where in the organisation each segment of a risk concentration resides. A bank should have credible risk mitigation strategies in place that have senior management approval. This may include altering business strategies, reducing limits or increasing capital buffers in line with the desired risk profile. While it implements risk mitigation strategies, the bank should be aware of possible concentrations that might arise as a result of employing risk mitigation techniques.

Banks should employ a number of techniques, as appropriate, to measure risk concentrations. These techniques include shocks to various risk factors; use of business level and firm-wide scenarios; and the use of integrated stress testing and economic capital models. Identified concentrations should be measured in a number of ways, including for example consideration of gross versus net exposures, use of notional amounts, and analysis of exposures with and without counterparty hedges. As set out in SRP30.13, a bank should establish internal position limits for concentrations to which it may be exposed. When conducting periodic stress tests (see SRP30.45 to SRP30.47), a bank should incorporate all major risk concentrations and identify and respond to potential changes in market conditions that could adversely impact their performance and capital adequacy.

The assessment of such risks under a bank’s ICAAP and the supervisory review process should not be a mechanical process, but one in which each bank determines, depending on its business model, its own specific vulnerabilities. An appropriate level of capital for risk concentrations should be incorporated in a bank’s ICAAP, as well as in Pillar 2 assessments. Each bank should discuss such issues with its supervisor.

A bank should have in place effective internal policies, systems and controls to identify, measure, monitor, manage, control and mitigate its risk concentrations in a timely manner. Not only should normal market conditions be considered, but also the potential build-up of concentrations under stressed market conditions, economic downturns and periods of general market illiquidity. In addition, the bank should assess scenarios that consider possible concentrations arising from contractual and non-contractual contingent claims. The scenarios should also combine the potential build-up of pipeline exposures together with the loss of market liquidity and a significant decline in asset values.

Reputational risk can be defined as the risk arising from negative perception on the part of customers, counterparties, shareholders, investors, debt-holders, market analysts, other relevant parties or regulators that can adversely affect a bank’s ability to maintain existing, or establish new, business relationships and continued access to sources of funding (eg through the interbank or securitisation markets). Reputational risk is multidimensional and reflects the perception of other market participants. Furthermore, it exists throughout the organisation and exposure to reputational risk is essentially a function of the adequacy of the bank’s internal risk management processes, as well as the manner and efficiency with which management responds to external influences on bank-related transactions.

Reputational risk can lead to the provision of implicit support, which may give rise to credit, liquidity, market and legal risk – all of which can have a negative impact on a bank’s earnings, liquidity and capital position. A bank should identify potential sources of reputational risk to which it is exposed. These include the bank’s business lines, liabilities, affiliated operations, off-balance sheet vehicles and the markets in which it operates. The risks that arise should be incorporated into the bank’s risk management processes and appropriately addressed in its ICAAP and liquidity contingency plans.

Prior to the 2007 upheaval, many banks failed to recognise the reputational risk associated with their off-balance sheet vehicles. In stressed conditions some firms went beyond their contractual obligations to support their sponsored securitisations and off-balance sheet vehicles. A bank should incorporate the exposures that could give rise to reputational risk into its assessments of whether the requirements under the securitisation framework have been met and the potential adverse impact of providing implicit support.

Reputational risk may arise, for example, from a bank’s sponsorship of securitisation structures such as asset-backed commercial paper conduits and SIVs, as well as from the sale of credit exposures to securitisation trusts. It may also arise from a bank’s involvement in asset or funds management, particularly when financial instruments are issued by owned or sponsored entities and are distributed to the customers of the sponsoring bank. In the event that the instruments were not correctly priced or the main risk drivers not adequately disclosed, a sponsor may feel some responsibility to its customers, or be economically compelled, to cover any losses. Reputational risk also arises when a bank sponsors activities such as money market mutual funds, in-house hedge funds and real estate investment trusts. In these cases, a bank may decide to support the value of shares/units held by investors even though is not contractually required to provide the support.

Reputational risk also may affect a bank’s liabilities, since market confidence and a bank’s ability to fund its business are closely related to its reputation. For instance, to avoid damaging its reputation, a bank may call its liabilities even though this might negatively affect its liquidity profile. This is particularly true for liabilities that are components of regulatory capital, such as hybrid/subordinated debt. In such cases, a bank’s capital position is likely to suffer.

Bank management should have appropriate policies in place to identify sources of reputational risk when entering new markets, products or lines of activities. In addition, a bank’s stress testing procedures should take account of reputational risk so management has a firm understanding of the consequences and second round effects of reputational risk.

Once a bank identifies potential exposures arising from reputational concerns, it should measure the amount of support it might have to provide (including implicit support of securitisations) or losses it might experience under adverse market conditions. In particular, in order to avoid reputational damages and to maintain market confidence, a bank should develop methodologies to measure as precisely as possible the effect of reputational risk in terms of other risk types (eg credit, liquidity, market or operational risk) to which it may be exposed. This could be accomplished by including reputational risk scenarios in regular stress tests. For instance, non-contractual off-balance sheet exposures could be included in the stress tests to determine the effect on a bank’s credit, market and liquidity risk profiles. Methodologies also could include comparing the actual amount of exposure carried on the balance sheet versus the maximum exposure amount held off-balance sheet, that is, the potential amount to which the bank could be exposed.

A bank should pay particular attention to the effects of reputational risk on its overall liquidity position, taking into account both possible increases in the asset side of the balance sheet and possible restrictions on funding, should the loss of reputation result in various counterparties’ loss of confidence (see SRP30.48 to SRP30.52 on the management of liquidity risk).

In order to enhance the supervisory assessment of banks’ valuation practices, the Basel Committee published Supervisory guidance for assessing banks’ financial instrument fair value practices in April 2009.⁵ This guidance applies to all positions that are measured at fair value and at all times, not only during times of stress.

The characteristics of complex structured products, including securitisation transactions, make their valuation inherently difficult due, in part, to the absence of active and liquid markets, the complexity and uniqueness of the cash waterfalls, and the links between valuations and underlying risk factors. The absence of a transparent price from a liquid market means that the valuation must rely on models or proxy-pricing methodologies, as well as on expert judgment. The outputs of such models and processes are highly sensitive to the inputs and parameter assumptions adopted, which may themselves be subject to estimation error and uncertainty. Moreover, calibration of the valuation methodologies is often complicated by the lack of readily available benchmarks.

Therefore, a bank is expected to have adequate governance structures and control processes for fair valuing exposures for risk management and financial reporting purposes. The valuation governance structures and related processes should be embedded in the overall governance structure of the bank, and consistent for both risk management and reporting purposes. The governance structures and processes are expected to explicitly cover the role of the board and senior management. In addition, the board should receive reports from senior management on the valuation oversight and valuation model performance issues that are brought to senior management for resolution, as well as all significant changes to valuation policies.

A bank should also have clear and robust governance structures for the production, assignment and verification of financial instrument valuations. Policies should ensure that the approvals of all valuation methodologies are well documented. In addition, policies and procedures should set forth the range of acceptable practices for the initial pricing, marking-to-market/model, valuation adjustments and periodic independent revaluation. New product approval processes should include all internal stakeholders relevant to risk measurement, risk control, and the assignment and verification of valuations of financial instruments.

A bank’s control processes for measuring and reporting valuations should be consistently applied across the firm and integrated with risk measurement and management processes. In particular, valuation controls should be applied consistently across similar instruments (risks) and consistent across business lines (books). These controls should be subject to internal audit. Regardless of the booking location of a new product, reviews and approval of valuation methodologies must be guided by a minimum set of considerations. Furthermore, the valuation/new product approval process should be supported by a transparent, well-documented inventory of acceptable valuation methodologies that are specific to products and businesses.

In order to establish and verify valuations for instruments and transactions in which it engages, a bank must have adequate capacity, including during periods of stress. This capacity should be commensurate with the importance, riskiness and size of these exposures in the context of the business profile of the institution. In addition, for those exposures that represent material risk, a bank is expected to have the capacity to produce valuations using alternative methods in the event that primary inputs and approaches become unreliable, unavailable or not relevant due to market discontinuities or illiquidity. A bank must test and review the performance of its models under stress conditions so that it understands the limitations of the models under stress conditions.

The relevance and reliability of valuations is directly related to the quality and reliability of the inputs. A bank is expected to apply the accounting guidance provided to determine the relevant market information and other factors likely to have a material effect on an instrument's fair value when selecting the appropriate inputs to use in the valuation process. Where values are determined to be in an active market, a bank should maximise the use of relevant observable inputs and minimise the use of unobservable inputs when estimating fair value using a valuation technique. However, where a market is deemed inactive, observable inputs or transactions may not be relevant, such as in a forced liquidation or distress sale, or transactions may not be observable, such as when markets are inactive. In such cases, accounting fair value guidance provides assistance on what should be considered, but may not be determinative. In assessing whether a source is reliable and relevant, a bank should consider, among other things:

1. the frequency and availability of the prices/quotes;
2. whether those prices represent actual regularly occurring transactions on an arm's length basis;
3. the breadth of the distribution of the data and whether it is generally available to the relevant participants in the market;
4. the timeliness of the information relative to the frequency of valuations;
5. the number of independent sources that produce the quotes/prices;
6. whether the quotes/prices are supported by actual transactions;
7. the maturity of the market; and
8. the similarity between the financial instrument sold in a transaction and the instrument held by the institution.

A bank’s external reporting should provide timely, relevant, reliable and decision-useful information that promotes transparency. Senior management should consider whether disclosures around valuation uncertainty can be made more meaningful. For instance, the bank may describe the modelling techniques and the instruments to which they are applied; the sensitivity of fair values to modelling inputs and assumptions; and the impact of stress scenarios on valuations. A bank should regularly review its disclosure policies to ensure that the information disclosed continues to be relevant to its business model and products and to current market conditions.

Stress testing is a critical element of risk management for banks and a core tool for banking supervisors and macroprudential authorities. It is integral to banks’ risk management and banking supervision, in that stress testing alerts bank management and supervisory authorities to unexpected adverse outcomes related to a broad variety of risks, and provides an indication to banks and supervisory authorities of the financial resources that might be needed to absorb losses should large shocks occur.

Stress testing practices have evolved significantly over time. The increasing importance of stress testing, combined with a significant range of approaches adopted by supervisory authorities and banks, highlight the need for high-level principles to guide all elements of a sound stress testing framework. To this end, the Committee has in place Stress testing principles⁶ that cover sound stress testing practices for application to large, internationally active banks and to supervisory and other relevant financial authorities in Basel Committee member jurisdictions. These principles are set at a high level so that they may be applicable across many banks and jurisdictions and to help ensure their relevance as stress testing practices evolve over time. The Principles set out guidance that focuses on the core elements of stress testing frameworks, such as objectives, governance, policies, processes, methodology, resources, and documentation that may guide stress testing activities and facilitate their use, implementation and oversight. Nevertheless, the Basel Committee expects that for internationally active banks, stress testing is embedded as a critical component of sound risk management and supervisory oversight.

The principles are intended to be applied on a proportionate basis, depending on size, complexity and risk profile of the bank or banking sector for which the authority is responsible. This recognises that smaller banks and authorities in all jurisdictions can benefit from considering in a structured way the potential impact of adverse scenarios on their business, even if they are not using a formal stress testing framework but are instead using simpler methods.

A bank should both assiduously manage its liquidity risk and also maintain sufficient liquidity to withstand a range of stress events.⁷

A bank is expected to be able to thoroughly identify, measure and control liquidity risks, especially with regard to complex products and contingent commitments (both contractual and non-contractual). This process should involve the ability to project cash flows arising from assets, liabilities and off-balance sheet items over various time horizons, and should ensure diversification in both the tenor and source of funding. A bank should utilise early warning indicators to identify the emergence of increased risk or vulnerabilities in its liquidity position or funding needs. It should have the ability to control liquidity risk exposure and funding needs, regardless of its organisation structure, within and across legal entities, business lines, and currencies, taking into account any legal, regulatory and operational limitations to the transferability of liquidity.

A key element in the management of liquidity risk is the need for strong governance of liquidity risk, including the setting of a liquidity risk tolerance by the board. The risk tolerance should be communicated throughout the bank and reflected in the strategy and policies that senior management set to manage liquidity risk. Another facet of liquidity risk management is that a bank should appropriately price the costs, benefits and risks of liquidity into the internal pricing, performance measurement, and new product approval process of all significant business activities.

While banks typically manage liquidity under “normal” circumstances, they should also be prepared to manage liquidity under stressed conditions. A bank should perform stress tests or scenario analyses on a regular basis in order to identify and quantify their exposures to possible future liquidity stresses, analysing possible impacts on the institutions’ cash flows, liquidity positions, profitability, and solvency. The results of these stress tests should be discussed thoroughly by management, and based on this discussion, should form the basis for taking remedial or mitigating actions to limit the bank’s exposures, build up a liquidity cushion, and adjust its liquidity profile to fit its risk tolerance. The results of stress tests should also play a key role in shaping the bank’s contingency funding planning, which should outline policies for managing a range of stress events and clearly sets out strategies for addressing liquidity shortfalls in emergency situations.

Senior management should consider the relationship between liquidity and capital since liquidity risk can impact capital adequacy which, in turn, can aggravate a bank’s liquidity profile.

Interest rate risk in the banking book (IRRBB) refers to the current or prospective risk to the bank’s capital and earnings arising from adverse movements in interest rates that affect the bank’s banking book positions. When interest rates change, the present value and timing of future cash flows change. This in turn changes the underlying value of a bank’s assets, liabilities and off-balance sheet items and hence its economic value. Changes in interest rates also affect a bank’s earnings by altering interest rate-sensitive income and expenses, affecting its net interest income (NII). Excessive IRRBB can pose a significant threat to a bank’s current capital base and/or future earnings if not managed appropriately. A more detailed description of IRRBB and its management techniques can be found in SRP98.

Three main sub-types of IRRBB are defined for the purposes of this chapter. All three sub-types of IRRBB potentially change the price/value or earnings/costs of interest rate-sensitive assets, liabilities and/or off-balance sheet items in a way, or at a time, that can adversely affect a bank’s financial condition.

1. Gap risk arises from the term structure of banking book instruments, and describes the risk arising from the timing of instruments’ rate changes. The extent of gap risk depends on whether changes to the term structure of interest rates occur consistently across the yield curve (parallel risk) or differentially by period (non-parallel risk).
2. Basis risk describes the impact of relative changes in interest rates for financial instruments that have similar tenors but are priced using different interest rate indices.
3. Option risk arises from option derivative positions or from optional elements embedded in a bank’s assets, liabilities and/or off-balance sheet items, where the bank or its customer can alter the level and timing of their cash flows. Option risk can be further characterised into automatic option risk and behavioural option risk.

While the three sub-types listed above are directly linked to IRRBB, credit spread risk in the banking book (CSRBB) is a related risk that banks need to monitor and assess in their interest rate risk management framework. CSRBB refers to any kind of asset/liability spread risk of credit-risky instruments that is not explained by IRRBB and by the expected credit/jump to default risk.

The following principles define supervisory expectations on the management of IRRBB. Principles 1 to 7 are of general application for the management of IRRBB, covering expectations for a bank’s IRRBB management process, in particular the need for effective IRRBB identification, measurement, monitoring and control activities. Principles 8 and 9 set out the expectations for market disclosures and banks’ internal assessment of capital adequacy for IRRBB respectively.
Principles 10 to 12 address the supervisory approach to banks’ IRRBB management framework and capital adequacy.

1. IRRBB is an important risk for all banks that must be specifically identified, measured, monitored and controlled. In addition, banks should monitor and assess CSRBB.
2. The governing body of each bank is responsible for oversight of the IRRBB management framework, and the bank’s risk appetite for IRRBB. Monitoring and management of IRRBB may be delegated by the governing body to senior management, expert individuals or an asset and liability management committee (henceforth, its delegates). Banks must have an adequate IRRBB management framework, involving regular independent reviews and evaluations of the effectiveness of the system.
3. The banks’ risk appetite for IRRBB should be articulated in terms of the risk to both economic value and earnings. Banks must implement policy limits that target maintaining IRRBB exposures consistent with their risk appetite.
4. Measurement of IRRBB should be based on outcomes of both economic value and earnings-based measures, arising from a wide and appropriate range of interest rate shock and stress scenarios.
5. In measuring IRRBB, key behavioural and modelling assumptions should be fully understood, conceptually sound and documented. Such assumptions should be rigorously tested and aligned with the bank’s business strategies.
6. Measurement systems and models used for IRRBB should be based on accurate data, and subject to appropriate documentation, testing and controls to give assurance on the accuracy of calculations. Models used to measure IRRBB should be comprehensive and covered by governance processes for model risk management, including a validation function that is independent of the development process.
7. Measurement outcomes of IRRBB and hedging strategies should be reported to the governing body or its delegates on a regular basis, at relevant levels of aggregation (by consolidation level and currency).
8. Information on the level of IRRBB exposure and practices for measuring and controlling IRRBB must be disclosed to the public on a regular basis.
9. Capital adequacy for IRRBB must be specifically considered as part of the Internal Capital Adequacy Assessment Process (ICAAP) approved by the governing body, in line with the bank’s risk appetite on IRRBB.
10. Supervisors should, on a regular basis, collect sufficient information from banks to be able to monitor trends in banks’ IRRBB exposures, assess the soundness of banks’ IRRBB management and identify outlier banks that should be subject to review and/or should be expected to hold additional regulatory capital.
11. Supervisors should regularly assess banks’ IRRBB and the effectiveness of the approaches that banks use to identify, measure, monitor and control IRRBB. Supervisory authorities should employ specialist resources to assist with such assessments. Supervisors should cooperate and share information with relevant supervisors in other jurisdictions regarding the supervision of banks’ IRRBB exposures.
12. Supervisors must publish their criteria for identifying outlier banks. Banks identified as outliers must be considered as potentially having undue IRRBB. When a review of a bank’s IRRBB exposure reveals inadequate management or excessive risk relative to capital, earnings or general risk profile, supervisors must require mitigation actions and/or additional capital.

The implementation of these principles should be commensurate with the bank’s nature, size and complexity as well as its structure, economic significance and general risk profile. This requires that supervisors gauge their responses where appropriate for banks with low IRRBB profiles. In particular, supervisors will focus on systemic risks that are inherent in large, complex or internationally active banks.

IRRBB is an important risk that arises from banking activities, and is encountered by all banks. It arises because interest rates can vary significantly over time, while the business of banking typically involves intermediation activity that produces exposures to both maturity mismatch (eg long-maturity assets funded by short-maturity liabilities) and rate mismatch (eg fixed rate loans funded by variable rate deposits). In addition, there are optionalities embedded in many of the common banking products (eg non-maturity deposits, term deposits, fixed rate loans) that are triggered in accordance with changes in interest rates.

All banks must be familiar with all elements of IRRBB, actively identify their IRRBB exposures and take appropriate steps to measure, monitor and control it.

Banks must identify the IRRBB inherent in products and activities, and ensure that these are subject to adequate procedures and controls. Significant hedging or risk management initiatives must be approved before being implemented. Products and activities that are new to a bank must undergo a careful preacquisition review to ensure that the IRRBB characteristics are well understood and subject to a predetermined test phase before being fully rolled out. Prior to introducing a new product, hedging or risk-taking strategy, adequate operational procedures and risk control systems must be in place. The management of a bank’s IRRBB should be integrated within its broader risk management framework and aligned with its business planning and budgeting activities.

In identifying, measuring, monitoring and controlling IRRBB, banks should also ensure that CSRBB is properly monitored and assessed.

The governing body⁸ has responsibility for understanding the nature and the level of the bank’s IRRBB exposure. The governing body should approve broad business strategies as well as overall policies with respect to IRRBB. It should ensure that there is clear guidance regarding the acceptable level of IRRBB, given the bank’s business strategies.

Accordingly, the governing body is responsible for ensuring that steps are taken by the bank to identify, measure, monitor and control IRRBB consistent with the approved strategies and policies. More specifically, the governing body or its delegates are responsible for setting:

1. appropriate limits on IRRBB, including the definition of specific procedures and approvals necessary for exceptions, and ensuring compliance with those limits;
2. adequate systems and standards for measuring IRRBB;
3. standards for measuring IRRBB, valuing positions and assessing performance, including procedures for updating interest rate shock and stress scenarios and key underlying assumptions driving the institution’s IRRBB analysis;
4. a comprehensive IRRBB reporting and review process; and
5. effective internal controls and management information systems (MIS).

The governing body or its delegates should oversee the approval, implementation and review of IRRBB management policies, procedures and limits. The governing body should be informed regularly (at least semiannually) on the level and trend of the bank’s IRRBB exposures. It should regularly review timely information that is sufficiently detailed to allow it to understand and assess the performance of its delegates in monitoring and controlling IRRBB in compliance with policies approved by the governing body. Such reviews should be carried out more frequently when the bank runs significant IRRBB exposures or has positions in complex IRRBB instruments.

While governing body members do not need individually to have detailed technical knowledge of complex financial instruments, or of quantitative risk management techniques, they should understand the implications of the bank’s IRRBB strategies, including the potential linkages with and impact on market, liquidity, credit and operational risk. Some of the members should have sufficient technical knowledge to question and challenge the reports made to the governing body. Governing body members are responsible for ensuring that senior management has the capability and skills to understand IRRBB, and that adequate resources are devoted to IRRBB management.

Many governing bodies delegate the task for developing IRRBB policies and practices to senior management, expert individuals or an asset and liability management committee (ALCO). In the case of an ALCO, it should meet regularly and include representatives from each major department connected to IRRBB.

The governing body should clearly identify its delegates for managing IRRBB and, to avoid potential conflicts of interest, should ensure that there is adequate separation of responsibilities in key elements of the risk management process. Banks should have IRRBB identification, measurement, monitoring and control functions with clearly defined responsibilities that are sufficiently independent from risk-taking functions of the bank and that report IRRBB exposures directly to the governing body or its delegates.

The governing body’s delegates for IRRBB should include members with clear lines of authority over the units responsible for establishing and managing positions. There should be a clear communication channel to convey the delegates’ directives to these line units.

The governing body should ensure that the bank’s organisational structure enables its delegates to carry out their responsibilities, and facilitates effective decision-making and good governance. The governing body should encourage discussions between its members and its delegates – as well as between its delegates and others in the bank – regarding the IRRBB management process. The risk management and strategic planning areas of the bank should also communicate regularly to facilitate evaluations of risk arising from future business.

Banks should have adequate internal controls to ensure the integrity of their IRRBB management process. The internal controls should promote effective and efficient operations, reliable financial and regulatory reporting, and compliance with relevant laws, regulations and bank policies.

With regard to IRRBB control policies and procedures, banks should have appropriate approval processes, exposure limits, reviews and other mechanisms designed to provide a reasonable assurance that risk management objectives are being achieved.

In addition, banks should have in place regular evaluations and reviews of their internal control system and risk management processes. This includes ensuring that personnel comply with established policies and procedures. Such reviews should also address any significant changes that may affect the effectiveness of controls (including changes in market conditions, personnel, technology and structures of compliance with exposure limits), and ensure that there are appropriate escalation procedures for any exceeded limits. Banks should ensure that all such evaluations and reviews are conducted regularly by individuals and/or units that are independent of the function they are assigned to review. When revisions or enhancements to internal controls are warranted, there should be an internal review mechanism in place to ensure that these are implemented in a timely manner.

Banks should have their IRRBB identification, measurement, monitoring and control processes reviewed by an independent auditing function (such as an internal or external auditor) on a regular basis. In such cases, reports written by internal/external auditors or other equivalent external parties (such as consultants) should be made available to relevant supervisory authorities.

Banks should have clearly defined risk appetite statements⁹ that are approved by the governing body and implemented through comprehensive risk appetite frameworks, ie policies and procedures for limiting and controlling IRRBB. The risk appetite framework should delineate delegated powers, lines of responsibility and accountability over IRRBB management decisions and should clearly define authorised instruments, hedging strategies and risk-taking opportunities. All IRRBB policies should be reviewed periodically (at least annually) and revised as needed.

Policy limits set by the governing bodies should be consistent with the bank’s overall approach for measuring IRRBB. Aggregate risk limits, clearly articulating the amount of IRRBB acceptable to the governing body, should be applied on a consolidated basis and, as appropriate, at the level of individual affiliates. Limits may be associated with specific scenarios of changes in interest rates and/or term structures, such as an increase or decrease of a particular size or a change in shape. The interest rate movements used in developing these limits should represent meaningful shock and stress situations, taking into account historical interest rate volatility and the time required by management to mitigate those risk exposures.

Policy limits should be appropriate to the nature, size, complexity and capital adequacy of the bank, as well as its ability to measure and manage its risks. Depending on the nature of a bank's activities and business model, sub-limits may also be identified for individual business units, portfolios, instrument types or specific instruments. The level of detail of risk limits should reflect the characteristics of the bank’s holdings, including the various sources of the bank’s IRRBB exposures. Banks with significant exposures to gap risk, basis risk or positions with explicit or embedded options should establish risk tolerances appropriate for these risks.

The governing body or its delegates should approve major hedging or risk-taking initiatives in advance of implementation.¹⁰ A dedicated set of risk limits should be developed to monitor the evolution of hedging strategies that rely on instruments such as derivatives, and to control mark-to-market risks in instruments that are accounted for at market value. Proposals to use new instrument types or new strategies (including hedging) should be assessed to ensure that the resources required to establish sound and effective IRRBB management of the product or activity have been identified, that the proposed activities are in line with the bank’s overall risk appetite, and procedures to identify, measure, monitor and control the risks of the proposed product or activity have been established.

There should be systems in place to ensure that positions that exceed, or are likely to exceed, limits defined by the governing body or its delegates should receive prompt management attention and be escalated without delay. There should be a clear policy on who will be informed, how the communication will take place and the actions which will be taken in response to an exception.¹¹

Banks’ internal measurement systems (IMS) should capture all material sources of IRRBB and assess the effect of market changes on the scope of their activities. In addition to the impact of an interest rate shock on its economic value, a bank’s policy approach should take into account its ability to generate stable earnings sufficient to maintain its normal business operations.

Banks should pay attention to the complementary nature of economic value and earnings-based measures in their risk and internal capital assessments, in particular in terms of:

1. outcomes: economic value measures compute a change in the net present value of the bank’s assets, liabilities and off-balance sheet items subject to specific interest rate shock and stress scenarios, while earnings-based measures focus on changes to future profitability within a given time horizon eventually affecting future levels of a bank’s own equity capital;
2. assessment horizons: economic value measures reflect changes in value over the remaining life of the bank’s assets, liabilities and off-balance sheet items, ie until all positions have run off, while earnings-based measures cover only the short to medium term, and therefore do not fully capture those risks that will continue to impact profit and loss accounts beyond the period of estimation; and
3. future business/production: economic value measures consider the net present value of repricing cash flows of instruments on the bank’s balance sheet or accounted for as an off-balance sheet item (ie a run-off view). Earnings measures may, in addition to a run-off view, assume rollover of maturing items (ie a constant balance sheet view) and/or assess the scenario-consistent impact on the bank’s future earnings inclusive of future business (ie a dynamic view).¹²

While the economic value and earnings-based measures share certain commonalities, the Committee observes that most commercial banks primarily utilise the latter for IRRBB management, whereas regulators tend to endorse the former as a benchmark for comparability and capital adequacy. The Committee acknowledges the importance of managing IRRBB through both economic value and earnings-based measures. If a bank solely minimises its economic value risk by matching the repricing of its assets with liabilities beyond the short term, it could run the risk of earnings volatility.

Banks’ IMS for IRRBB should be able to accommodate the calculation of the impact on economic value and earnings of multiple scenarios, based on:

1. internally selected interest rate shock scenarios addressing the bank’s risk profile, according to its ICAAP;
2. historical and hypothetical interest rate stress scenarios, which tend to be more severe than shock scenarios;
3. the six prescribed interest rate shock scenarios set out in SRP31.90 to SRP31.93; and
4. any additional interest rate shock scenarios required by supervisors.

Banks should measure their vulnerability to loss under stressful market conditions – including the breakdown of key assumptions – and consider those results when establishing and reviewing their policies and limits for IRRBB.

A bank should develop and implement an effective stress testing framework for IRRBB as part of its broader risk management and governance processes. This should feed into the decision-making process at the appropriate management level, including strategic decisions (eg business and capital planning decisions) of the governing body or its delegates. In particular, IRRBB stress testing should be considered in the ICAAP, requiring banks to undertake rigorous, forward-looking stress testing that identifies events of severe changes in market conditions which could adversely impact the bank’s capital or earnings, possibly also through changes in the behaviour of its customer base.

A bank’s stress testing framework for IRRBB should be commensurate with its nature, size and complexity as well as business activities and overall risk profile. The framework should include clearly defined objectives, scenarios tailored to the bank’s businesses and risks, well documented assumptions and sound methodologies. The framework will be used to assess the potential impact of the scenarios on the bank’s financial condition, enable ongoing and effective review processes for stress tests and recommend actions based on the stress test results. IRRBB stress tests should play an important role in the communication of risks, both within the bank and externally with supervisors and the market through appropriate disclosures.

The identification of relevant shock and stress scenarios for IRRBB, the application of sound modelling approaches and the appropriate use of the stress testing results require the collaboration of different experts within a bank (eg traders, the treasury department, the finance department, the ALCO, the risk management and risk control departments and/or the bank’s economists). A stress-testing programme for IRRBB should ensure that the opinions of the experts are taken into account.

Banks should determine, by currency, a range of potential interest rate movements against which they will measure their IRRBB exposures. Management should ensure that risk is measured under a reasonable range of potential interest rate scenarios, including some containing severe stress elements. In developing the scenarios, banks should consider a variety of factors, such as the shape and level of the current term structure of interest rates and the historical and implied volatility of interest rates. In low interest rate environments, banks should also consider negative interest rate scenarios and the possibility of asymmetrical effects of negative interest rates on their assets and liabilities.

A bank should consider the nature and sources of its IRRBB exposures, the time it would need to take action to reduce or unwind unfavourable IRRBB exposures, and its capability/willingness to withstand accounting losses in order to reposition its risk profile. A bank should select scenarios that provide meaningful estimates of risk and include a range of shocks that is sufficiently wide to allow the governing body or its delegates to understand the risk inherent in the bank’s products and activities. When developing interest rate shock and stress scenarios for IRRBB, banks should consider the following:

1. The scenarios should be sufficiently wide-ranging to identify parallel and non-parallel gap risk, basis risk and option risk. In many cases, static interest rate shocks may be insufficient to assess IRRBB exposure adequately. Banks should ensure that the scenarios are both severe and plausible, in light of the existing level of interest rates and the interest rate cycle.
2. Special consideration should be given to instruments or markets where concentrations exist, because those positions may be more difficult to liquidate or offset in a stressful market environment.
3. Banks should assess the possible interaction of IRRBB with its related risks, as well as other risks (eg credit risk, liquidity risk).
4. Banks should assess the effect of adverse changes in the spreads of new assets/liabilities replacing those assets/liabilities maturing over the horizon of the forecast on their NII.
5. Banks with significant option risk should include scenarios that capture the exercise of such options. For example, banks that have products with sold caps or floors should include scenarios that assess how the risk positions would change should those caps or floors move into the money. Given that the market value of options also fluctuates with changes in the volatility of interest rates, banks should develop interest rate assumptions to measure their IRRBB exposures to changes in interest rate volatilities.
6. Banks should specify, in building their interest rate shock and stress scenarios, the term structure of interest rates that will be incorporated and the basis relationship between yield curves, rate indices etc. Banks should also estimate how interest rates that are administered or managed by management (eg prime rates or retail deposit rates, as opposed to those that are purely market-driven) might change. Management should document how these assumptions are derived.

In addition, forward-looking scenarios should incorporate changes in portfolio composition due to factors under the control of the bank (eg the bank’s acquisition and production plans) as well as external factors (eg changing competitive, legal or tax environments); new products where only limited historical data are available; new market information and new emerging risks that are not necessarily covered by historical stress episodes.

Further, banks should perform qualitative and quantitative reverse stress tests¹³ in order to:

1. identify interest rate scenarios that could severely threaten a bank’s capital and earnings; and
2. reveal vulnerabilities arising from its hedging strategies and the potential behavioural reactions of its customers.

Both economic value and earnings-based measures of IRRBB are significantly impacted by a number of assumptions made for the purposes of risk quantification, namely:

1. expectations for the exercise of interest rate options (explicit and embedded) by both the bank and its customers under specific interest rate shock and stress scenarios;
2. treatment of balances and interest flows arising from non-maturity deposits (NMDs);
3. treatment of own equity in economic value measures; and
4. the implications of accounting practices for IRRBB.

Hence, when assessing its IRRBB exposures, a bank should make judgments and assumptions about how an instrument’s actual maturity or repricing behaviour may vary from the instrument’s contractual terms because of behavioural optionalities.

Common products with behavioural optionalities include:

1. Fixed rate loans subject to prepayment risk – Banks should understand the nature of prepayment risk for their portfolios and make reasonable and prudent estimates of the expected prepayments. The assumptions underlying the estimates and where prepayment penalties or other contractual features affect the embedded optionality effect should be documented. There are several factors that are important determinants of the bank’s estimate of the effect of each interest rate shock and stress scenario on the average prepayment speed. Specifically, a bank must assess the expected average prepayment speed under each scenario.
2. Fixed rate loan commitments – Banks may sell options to retail customers (eg prospective mortgage buyers or renewers) whereby, for a limited period, the customers can choose to draw down a loan at a committed rate. Unlike loan commitments to corporates, where drawdowns strongly reflect characteristics of automatic interest rate options, mortgage commitments (ie pipelines) to retail customers are impacted by other drivers.
3. Term deposits subject to early redemption risk – Banks may attract deposits with a contractual maturity term or with step-up clauses that enable the depositor at different time periods to modify the speed of redemption. The classification scheme should be documented, whether a term deposit is deemed to be subject to redemption penalties or to other contractual features that preserve the cash flow profile of the instrument.
4. NMDs – Behavioural assumptions for deposits that have no specific repricing date can be a major determinant of IRRBB exposures under the economic value and earnings-based measures. Banks should document, monitor and regularly update key assumptions for NMD balances and behaviour used in their IMS. To determine the appropriate assumptions for its NMDs, a bank should analyse its depositor base in order to identify the proportion of core deposits (ie NMDs which are unlikely to reprice even under significant changes in interest rate environment). Assumptions should vary according to depositor characteristics (eg retail/wholesale) and account characteristics (eg transactional/non-transactional).

Modelling assumptions should be conceptually sound and reasonable, and consistent with historical experience. Banks must carefully consider how the exercise of the behavioural optionality will vary not only under the interest rate shock and stress scenario but also across other dimensions. For instance, considerations may include those set out in Table 1.

In addition, banks with positions denominated in different currencies can expose themselves to IRRBB in each of those currencies. Since yield curves vary from currency to currency, banks generally need to assess exposures in each currency. Banks with the necessary skills and sophistication, and with material multicurrency exposures, may choose to include, in their IMS, methods to aggregate their IRRBB in different currencies using assumptions about the correlation between interest rates in different currencies.

Further, banks should consider the materiality of the impact of behavioural optionalities within floating rate loans. For instance, the behaviour of prepayments arising from embedded caps and floors could impact the banks’ economic value of equity.

Banks should be able to test the appropriateness of key behavioural assumptions, and all changes to the assumptions of key parameters should be documented (eg by comparing the economic value of equity measured under their IMS with the standardised framework in SRP31.94 to SRP31.129). Banks should periodically perform sensitivity analyses for key assumptions to monitor their impact on measured IRRBB. Sensitivity analyses should be performed with reference to both economic value and earnings-based measures.

The most significant assumptions underlying the system should be documented and clearly understood by the governing body or its delegates. Documentation should also include descriptions on how those assumptions could potentially affect the bank’s hedging strategies.

As market conditions, competitive environments and strategies change over time, the bank should review significant measurement assumptions at least annually and more frequently during rapidly changing market conditions. For example, if the competitive market has changed such that consumers now have lower transaction costs available to them for refinancing their residential mortgages, prepayments may become more sensitive to smaller reductions in interest rates.

Accurate and timely measurement of IRRBB is necessary for effective risk management and control. A bank’s risk measurement system should be able to identify and quantify the major sources of IRRBB exposure. The mix of a bank’s business lines and the risk characteristics of its activities should guide management’s selection of the most appropriate form of measurement system.

Banks should not rely on a single measure of risk, given that risk management systems tend to vary in how they capture the components of IRRBB. Instead, banks should use a variety of methodologies to quantify their IRRBB exposures under both the economic value and earnings-based measures, ranging from simple calculations based on static simulations using current holdings to more sophisticated dynamic modelling techniques that reflect potential future business activities.

A bank’s MIS should allow it to retrieve accurate IRRBB information in a timely manner. The MIS should capture interest rate risk data on all the bank’s material IRRBB exposures. There should be sufficient documentation of the major data sources used in the bank’s risk measurement process.

Data inputs should be automated as much as possible to reduce administrative errors. Data mapping should be periodically reviewed and tested against an approved model version. A bank should monitor the type of data extracts and set appropriate controls.

Where cash flows are slotted into different time buckets (eg for gap analyses) or assigned to different vertex points to reflect the different tenors of the interest rate curve, the slotting criteria should be stable over time to allow for a meaningful comparison of risk figures over different periods.

Banks’ IMS should be able to compute economic value and earnings-based measures of IRRBB, as well as other measures of IRRBB prescribed by their supervisors, based on the interest rate shock and stress scenarios set out in SRP31.30. It should also be sufficiently flexible to incorporate supervisory-imposed constraints on banks’ internal risk parameter estimates.

The validation of IRRBB measurement methods and assessment of corresponding model risk should be included in a formal policy process that should be reviewed and approved by the governing body or its delegates. The policy should specify the management roles and designate who is responsible for the development, implementation and use of models. In addition, the model oversight responsibilities as well as policies including the development of initial and ongoing validation procedures, evaluation of results, approval, version control, exception, escalation, modification and decommission processes need to be specified and integrated within the governance processes for model risk management.

An effective validation framework should include three core elements:

1. evaluation of conceptual/methodological soundness, including developmental evidence;
2. ongoing model monitoring, including process verification and benchmarking; and
3. outcomes analysis, including backtesting of key internal parameters (eg stability of deposits, prepayments, early redemptions, pricing of instruments).

In addressing the expected initial and ongoing validation activities, the policy should establish a hierarchical process for determining model risk soundness based on both quantitative and qualitative dimensions such as size, impact, past performance and familiarity with the modelling technique employed.

Model risk management for IRRBB measures should follow a holistic approach that begins with motivation, development and implementation by model owners and users. Prior to receiving authorisation for usage, the process for determining model inputs, assumptions, modelling methodologies and outputs should be reviewed and validated independently of the development of IRRBB models. The review and validation results and any recommendations on model usage should be presented to and approved by the governing body or its delegates. Upon approval, the model should be subject to ongoing review, process verification and validation at a frequency that is consistent with the level of model risk determined and approved by the bank.

The ongoing validation process should establish a set of exception trigger events that obligate the model reviewers to notify the governing body or its delegates in a timely fashion, in order to determine corrective actions and/or restrictions on model usage. Clear version control authorisations should be designated, where appropriate, to model owners. With the passage of time and due to observations and new information gained over time, an approved model may be modified or decommissioned. Banks should articulate policies for model transition, including change and version control authorisations and documentation.

IRRBB models might include those developed by third-party vendors. Model inputs or assumptions may also be sourced from related modelling processes or sub-models (both in-house and vendor-sourced) and should be included in the validation process. The bank should document and explain model specification choices as part of the validation process.

Banks that purchase IRRBB models should ensure there is adequate documentation of their use of those models, including any specific customisation. If vendors provide input for market data, behavioural assumptions or model settings, the bank should have a process in place to determine if those inputs are reasonable for its business and the risk characteristics of its activities.

Internal audit should review the model risk management process as part of its annual risk assessment and audit plans. The audit activity should not duplicate model risk management processes, but should review the integrity and effectiveness of the risk management system and the model risk management process.

The reporting of risk measures to the governing body or its delegates should be regular and should compare current exposure with policy limits. In particular, reporting should include the results of the periodic model reviews and audits as well as comparisons of past forecasts or risk estimates with actual results to inform potential modelling shortcomings on a regular basis. Portfolios that may be subject to significant mark-to-market movements should be clearly identified within the bank’s MIS and subject to oversight in line with any other portfolios exposed to market risk.

While the types of reports prepared for the governing body or its delegates will vary based on the bank’s portfolio composition, they should include at least the following:

1. summaries of the bank’s aggregate IRRBB exposures, and explanatory text that highlights the assets, liabilities, cash flows, and strategies that are driving the level and direction of IRRBB;
2. reports demonstrating the bank’s compliance with policies and limits;
3. key modelling assumptions such as NMD characteristics, prepayments on fixed rate loans and currency aggregation;
4. results of stress tests, including assessment of sensitivity to key assumptions and parameters; and
5. summaries of the reviews of IRRBB policies, procedures and adequacy of the measurement systems, including any findings of internal and external auditors and/or other equivalent external parties (such as consultants).

Reports detailing the bank’s IRRBB exposures should be provided to the bank’s governing body or its delegates on a timely basis and reviewed regularly. The IRRBB reports should provide aggregate information as well as sufficient supporting detail to enable the governing body or its delegates to assess the sensitivity of the bank to changes in market conditions, with particular reference to portfolios that may potentially be subject to significant mark-to-market movements. The governing body or its delegates should review the bank’s IRRBB management policies and procedures in light of the reports, to ensure that they remain appropriate and sound. The governing body or its delegates should also ensure that analysis and risk management activities related to IRRBB are conducted by competent staff with technical knowledge and experience, consistent with the nature and scope of the bank’s activities.

The level of IRRBB exposure should be measured and disclosed. Disclosure requirements are set out in DIS70.

Banks are responsible for evaluating the level of capital that they should hold, and for ensuring that this is sufficient to cover IRRBB and its related risks. The contribution of IRRBB to the overall internal capital assessment should be based on the bank’s IMS outputs, taking account of key assumptions and risk limits. The overall level of capital should be commensurate with both the bank’s actual measured level of risk (including for IRRBB) and its risk appetite, and be duly documented in its ICAAP report.

Banks should not only rely on supervisory assessments of capital adequacy for IRRBB, but should also develop their own methodologies for capital allocation, based on their risk appetite. In determining the appropriate level of capital, banks should consider both the amount and the quality of capital needed.

Capital adequacy for IRBBB should be considered in relation to the risks to economic value, given that such risks are embedded in the bank’s assets, liabilities and off-balance sheet items. For risks to future earnings, given the possibility that future earnings may be lower than expected, banks should consider capital buffers.

Capital adequacy assessments for IRRBB should factor in:

1. the size and tenor of internal limits on IRRBB exposures, and whether these limits are reached at the point of capital calculation;
2. the effectiveness and expected cost of hedging open positions that are intended to take advantage of internal expectations of the future level of interest rates;
3. the sensitivity of the internal measures of IRRBB to key modelling assumptions;
4. the impact of shock and stress scenarios on positions priced off different interest rate indices (basis risk);
5. the impact on economic value and NII of mismatched positions in different currencies;
6. the impact of embedded losses;
7. the distribution of capital relative to risks across legal entities that form part of a capital consolidation group, in addition to the adequacy of overall capital on a consolidated basis;
8. the drivers of the underlying risk; and
9. the circumstances under which the risk might crystallise.

The outcomes of the capital adequacy for IRRBB should be considered in a bank’s ICAAP and flow through to assessments of capital associated with business lines.

Supervisors should, on a regular basis, collect sufficient information from banks to assess their IRRBB exposures. While the precise information obtained could differ among supervisors, the amount of information collected should at least allow the supervisor to assess the IRRBB exposures of the bank and to identify and monitor outlier banks under Principle 12.

Supervisors should ensure that the collection of information is comparable and consistent across the banks that they supervise. Supervisors should have discretionary powers to collect additional information to assess banks' IRRBB in line with Principle 11, including the sensitivity of their IMS calculations to changes in key assumptions. For example, supervisors may collect information on:

1. the modelling of NMDs for IMS purposes and the sensitivity of a bank's economic value and earnings to changes in NMD assumptions;
2. the impact of assumptions used regarding products with behavioural optionalities;
3. the treatment of own equity in internal calculations and the extent to which this impacts the change in economic value of equity (∆EVE) number disclosed under Principle 8;
4. repricing gaps of cash flows associated with their interest rate-sensitive assets, liabilities and off-balance sheet items (by significiant currencies);
5. exposures to automatic interest rate options;
6. the types of yield curve used for IMS purposes;
7. the level of ∆EVE if calculated using the standardised framework set out in SRP31.94 to SRP31.129; and
8. economic value and earnings-based measures for interest rate shock and stress scenarios in addition to those prescribed in paragraphs SRP31.90 to SRP31.93 (including results based on banks' internally developed or other interest rate shock or stress scenarios).

Jurisdictions that intend to perform an off-site review of their banks’ IRRBB should put in place adequate reporting schemes to enable peer comparison of banks and identification of banks for additional on-site work.

Supervisors should regularly evaluate the adequacy, integrity and effectiveness of a bank’s IRRBB management framework and assess whether its practices comply with the stated objectives and risk tolerances set by its governing body, and with supervisory expectations as set out in Principles 1 to 7. Supervisors should take into account a bank’s size and complexity at the time of assessment.

Supervisors should evaluate whether a bank’s IMS provides a sufficient basis for identifying and measuring IRRBB, taking note particularly of the key assumptions that affect the measurement of IRRBB. Supervisors should request and evaluate information about significant model or policy changes that have occurred between their regular reviews and concentrate their efforts on reviewing the most material models and policies.

Supervisors should review regularly the outputs from the bank’s IMS, including the bank’s IRRBB exposures (both economic value and earnings-based measures) based on the internal calculations using at least the prescribed interest rate shock scenarios specified in SRP31.90 to SRP31.93, as well as any additional interest rate shock and stress scenarios they determine should be assessed. Supervisors may also form their evaluation of a bank’s IMS by applying supervisory estimates which they have developed. Supervisors should also review the information disclosed by banks under Principle 8.

When reviewing the bank’s IRRBB exposures and forming conclusions about the quality of the bank’s IRRBB management, supervisors should at a minimum, consider:

1. the complexity and level of risk posed by the bank’s assets, liabilities and off-balance sheet activities;
2. the adequacy and effectiveness of oversight by the bank’s governing body or its delegates;
3. a bank’s knowledge and ability to identify and manage the sources of IRRBB;
4. the adequacy of internal validation of IRRBB measures, including sensitivity analysis and backtesting, in particular where changes in key modelling parameters have occurred;
5. the adequacy of internal monitoring and of the bank’s MIS;
6. the effectiveness of risk limits and controls that set tolerances on economic value and earnings;
7. the effectiveness of the bank’s IRRBB stress testing programme;
8. the adequacy and frequency of the internal review and audit of the IRRBB management process, including independent model validation and oversight of model risk;
9. the adequacy and effectiveness of IRRBB management practices as evidenced by past and projected financial performance;
10. the effectiveness of hedging strategies used by the bank to control IRRBB; and
11. the appropriateness of the level of IRRBB (including embedded losses) in relation to the bank’s capital, earnings and risk management systems.

Supervisors should assess the adequacy of a bank’s capital relative to its IRRBB exposures (against expectations set out in Principle 9) to determine whether the bank requires more detailed examination and should potentially be subject to additional capital requirements and/or other mitigation actions. This assessment need not be limited to the outlier/materiality test set out in Principle 12.

The supervisory evaluation should be undertaken both on a standalone basis and by making comparisons with peer banks – in particular, supervisors should compare the key behavioural and strategic assumptions being made by banks within their jurisdictions, to determine whether they can be justified with regard to the economic environment and business model. Supervisors should ensure that the information they review is comparable and consistent across the banks that they supervise.

Supervisors should employ specialist resources to assist with the assessment of IRRBB levels and controls in the banks that they supervise. Supervisory bodies should:

1. ensure that line supervisors are appropriately trained and sufficiently knowledgeable to identify all relevant aspects of IRRBB in the banks that they regulate; and
2. employ an adequate number of IRRBB specialists.

Supervisors should cooperate and share information with relevant supervisors in other jurisdictions regarding the supervision of banks’ IRRBB, in particular for banks with operations across multiple jurisdictions. Sharing of such information could take place on a bilateral or multilateral basis (eg through supervisory colleges). The information shared could include supervisory experiences from assessing and monitoring a bank’s IRRBB in different parts of its group, modelling assumptions made by banks, any impediments experienced during the supervision process, rules/criteria established to evaluate the capital that banks would need for IRRBB, and examples of good practices observed in the banks’ management of IRRBB.

Supervisors must publish their criteria for identifying an outlier bank, defined in terms of the outlier/materiality test(s) used by the supervisor. The supervisor should implement at least one outlier/materiality test that compares the bank’s maximum ∆EVE, under the six prescribed interest rate shock scenarios set out in paragraphs SRP31.90 to SRP31.93, with 15% of its Tier 1 capital, computed in line with the disclosure requirements in Principle 8.

Supervisors may also implement additional outlier/materiality tests, provided these tests are applied throughout their jurisdiction in the same form. The additional outlier/materiality tests could use a different capital measure (eg Common Equity Tier 1, or CET1, capital, amount by which regulatory capital exceeds the bank’s minimum requirements) or capture the bank’s IRRBB relative to earnings. For the additional outlier/materiality tests, the threshold for defining an outlier bank should be at least as stringent as 15% of Tier 1 capital.

Banks identified by supervisors under their criteria as outliers must be considered as potentially having undue IRRBB and subject to review.

All banks are expected to hold adequate capital for the risks they undertake. With regard to IRRBB, supervisors should evaluate whether the bank has adequate capital and earnings that are commensurate with its level of short-term and long-term IRRBB exposures, as well as the risk those exposures may pose to its future financial performance. Supervisors should consider the following factors:

1. The ∆EVE under a variety of shocked and stressed interest rate scenarios. Where a bank’s EVE is significantly sensitive to interest rate shocks and stresses, the supervisor should evaluate the impact on its capital levels arising from financial instruments held at market value, and potential impact should banking book positions held at historical cost become subject to market valuation. Supervisors should, in their assessment, consider the impact of key assumptions on the ∆EVE calculated, including those related to the inclusion/exclusion of commercial margins, the bank’s actual equity allocation profile, the stability of NMDs and prepayment optionality.
2. The strength and stability of the earnings stream and the level of income needed to generate and maintain normal business operations. A high level of IRRBB exposure is one that could, under a plausible range of market scenarios, result in the bank reporting losses or curtailing normal dividend distribution and business operations. In such cases, management should ensure that the bank has sufficient capital to withstand the adverse impact of such events until it can implement mitigating actions such as reducing exposures or increasing capital.

When a supervisor determines that a bank’s IMS is deficient in its measurement of IRRBB, the supervisor should require the bank to improve its IMS and/or use the standardised framework set out in SRP31.94 to SRP31.129 to compute its IRRBB in terms of ∆EVE.

A bank could also be considered to have excessive risk relative to earnings if its shocked ΔNII was such that the bank would not have sufficient income to maintain its normal business operations.

When a national supervisor concludes that a bank’s management of IRRBB is inadequate or that it has excessive risk relative to its capital or earnings, or its general risk profile, the supervisor must require the bank to take one or more of the following actions:

1. reduce its IRRBB exposures (eg by hedging);
2. raise additional capital;
3. set constraints on the internal risk parameters used by a bank; and/or
4. improve its risk management framework.

The reduction in IRRBB and/or the expected higher level of capital should be achieved within a specified time frame, to be established taking into consideration prevailing financial and economic conditions, as well as the causes of IRRBB exposure exceeding the supervisory threshold.

Banks should apply six prescribed interest rate shock scenarios to capture parallel and non-parallel gap risks for EVE and two prescribed interest rate shock scenarios for NII. The derivation of these shocks is explained in SRP98.56 to SRP98.63. These scenarios are applied to IRRBB exposures in each currency for which the bank has material positions. In order to accommodate heterogeneous economic environments across jurisdictions, the six shock scenarios reflect currency-specific absolute shocks as specified in Table 2 below. For the purposes of capturing the local rate environment, a historical time series ranging from January 2000 to December 2023 for various maturities¹⁴ was used to derive each scenario for a given currency. Under this approach, IRRBB is measured by means of the following six scenarios:

1. parallel shock up;
2. parallel shock down;
3. steepener shock (short rates down and long rates up);
4. flattener shock (short rates up and long rates down);
5. short rates shock up; and
6. short rates shock down.

   Specified size of interest rate shocks,											Table 2
   	ARS	AUD	BRL	CAD	CHF	CNY	EUR	GBP	HKD	IDR		INR
   Parallel	400	350	400	200	175	225	225	275	225	400		325
   Short	500	425	500	275	250	300	350	425	375	500		475
   Long	300	300	300	175	200	150	200	250	200	300		225

   	JPY	KRW	MXN	RUB	SAR	SEK	SGD	TRY	USD	ZAR
   Parallel	100	225	400	400	275	275	175	400	200	325
   Short	100	350	500	500	375	425	250	500	300	500
   Long	100	225	200	300	250	200	225	300	225	300

Given Table 2, the instantaneous shocks to the risk-free rate for parallel, short and long, for each currency, the following parameterisations of the six interest rate shock scenarios should be applied:

1. Parallel shock for currency c: a constant parallel shock up or down across all time buckets.
2. Short rate shock for currency c: shock up or down that is greatest at the shortest tenor midpoint. That shock, through the shaping scalar , where x = 4, diminishes towards zero at the tenor of the longest point in the term structure.¹⁵
3. Long rate shock for currency c (note: this is used only in the rotational shocks): Here the shock is greatest at the longest tenor midpoint and is related to the short scaling factor as: .
4. Rotation shocks for currency c: involving rotations to the term structure (ie steepeners and flatteners) of the interest rates whereby both the long and short rates are shocked and the shift in interest rates at each tenor midpoint is obtained by applying the following formulas to those shocks:

   

   

The following examples illustrate the scenarios in SRP31.91(2) and SRP31.91(4).

1. Short rate shock: Assume that the bank uses the standardised framework with K = 19 time bands and with t_K = 25 years (the midpoint (in time) of the longest tenor bucket K), and where t_K is the midpoint (in time) for bucket k. In the standardised framework, if k = 10 with t_k = 3.5 years, the scalar adjustment for the short shock would be
   = 0.417. Banks would multiply this by the value of the short rate shock to obtain the amount to be added to or subtracted from the yield curve at that tenor point. If the short rate shock was +100 basis points (bp), the increase in the yield curve at t_k = 3.5 years would be 41.7 bp.
2. Steepener: Assume the same point on the yield curve as above, t_k = 3.5 years. If the absolute value of the short rate shock was 100 bp and the absolute value of the long rate shock was 100 bp (as for the Japanese yen), the change in the yield curve at t_k = 3.5 years would be the sum of the effect of the short rate shock plus the effect of the long rate shock in bp: −0.65 x 100 bp x 0.417 + 0.9 x 100 bp x (1−0.417) = +25.4 bp.
3. Flattener: The corresponding change in the yield curve for the shocks in the example above at t_k = 3.5 years would be: +0.8 x 100 bp x 0.417 – 0.6 x 100 bp x (1−0.417) = −1.6 bp.

The Committee acknowledges that shock sizes of different currencies should reflect local conditions in a timely manner. For this reason, the Committee will review the calibration of the interest rate shock sizes (eg every five years). National supervisors may, at their discretion, set floors for the post-shock interest rates under the six interest rate shock scenarios, provided the floors are not greater than zero.

Supervisors could mandate their banks to follow the framework set out in this section, or a bank could choose to adopt it.

The steps involved in measuring a bank’s IRRBB, based solely on EVE, are:

1. Interest rate-sensitive banking book positions are allocated to one of three categories (ie amenable, less amenable and not amenable to standardisation).
2. Determination of slotting of cash flows based on repricing maturities. This is a straightforward translation for positions amenable to standardisation. For positions less amenable to standardisation, they are excluded from this step. For positions with embedded automatic interest rate options, the optionality should be ignored for the purpose of slotting of notional repricing cash flows.¹⁶ For positions that are not amenable to standardisation, there is a separate treatment for:
   1. NMDs – according to separation of core and non-core cash flows via the approach set out in SRP31.107 to SRP31.112.
   2. Behavioural options (fixed rate loans subject to prepayment risk and term deposits subject to early redemption risk) – behavioural parameters relevant to the position type must rely on a scenario-dependent look-up table set out in SRP31.119 and SRP31.125.
3. Determination of ∆EVE for relevant interest rate shock scenarios for each currency. The ∆EVE is measured per currency for all six prescribed interest rate shock scenarios.
4. Add-ons for changes in the value of automatic interest rate options (whether explicit or embedded) are added to the EVE changes. Automatic interest rate options sold are subject to full revaluation (possibly net of automatic interest rate options bought to hedge sold interest rate options) under each of the six prescribed interest rate shock scenarios for each currency. Changes in values of options are then added to the changes in the EVE measure under each interest rate shock scenario on a per currency basis.
5. IRRBB EVE calculation. The ∆EVE under the standardised framework will be the maximum of the worst aggregated reductions to EVE across the six supervisory prescribed interest rate shocks.

Banks must project all future notional repricing cash flows arising from interest rate-sensitive assets, liabilities and off-balance sheet items on to:

1. 19 predefined time buckets (indexed numerically by k) as set out in Table 3, into which they fall according to their repricing dates, or
2. the time bucket midpoints as set out in Table 3, retaining the notional repricing cash flows’ maturity. This alternative requires splitting up notional repricing cash flows between two adjacent maturity bucket midpoints.

   Maturity schedule with 19 time buckets for notional repricing cash flows repriciting at tCF The number in brackets is the time bucket’s midpoint								Table 3
   	Time bucket intervals (M = months; Y = years)
   Short-term rates	Overnight (0.0028Y)	Overnight < tCF ≤ 1M (0.0417Y)	1M < tCF ≤ 3M (0.1667Y)	3M < tCF ≤ 6M (0.375Y)	6M < tCF ≤ 9M (0.625Y)	9M < tCF ≤ 1Y (0.875Y)	1Y < tCF ≤ 1.5Y (1.25Y)		1.5Y < tCF ≤ 2Y (1.75Y)
   Medium-term rates	2Y < tCF ≤ 3Y (2.5Y)	3Y < tCF ≤ 4Y (3.5Y)	4Y < tCF ≤ 5Y (4.5Y)	5Y < tCF ≤ 6Y (5.5Y)	6Y < tCF ≤ 7Y (6.5Y)
   Long-term rates	7Y < tCF ≤ 8Y (7.5Y)	8Y < tCF ≤ 9Y (8.5Y)	9Y < tCF ≤ 10Y (9.5Y)	10Y < tCF ≤ 15Y (12.5Y)	15Y < tCF ≤ 20Y (17.5Y)	tCF > 20Y (25Y)

For the purpose of this approach, assets are those not deducted from CET1 capital and exclude fixed assets (such as real estate or intangible assets) and equity exposures in the banking book. Liabilities include all non-remunerated deposits but exclude CET1 capital under the Basel III framework.

A notional repricing cash flow CF(k) is defined as:

1. any repayment of principal (eg at contractual maturity);
2. any repricing of principal; repricing is said to occur at the earliest date at which either the bank or its counterparty is entitled to unilaterally change the interest rate, or at which the rate on a floating rate instrument changes automatically in response to a change in an external benchmark; or
3. any interest payment on a tranche of principal that has not yet been repaid or repriced; spread components of interest payments on a tranche of principal that has not yet been repaid and which do not reprice must be slotted until their contractual maturity irrespective of whether the non-amortised principal has been repriced or not.

The date of each repayment, repricing or interest payment is referred to as its repricing date.

Banks have the choice of whether to deduct commercial margins and other spread components from the notional repricing cash flows, using a prudent and transparent methodology.

Floating rate instruments are assumed to reprice fully at the first reset date. Hence, the entire principal amount is slotted into the bucket in which that date falls, with no additional slotting of notional repricing cash flows to later time buckets or time bucket midpoints (other than the spread component which is not repriced).

All notional repricing cash flows associated with interest rate-sensitive assets, liabilities and off-balance sheet items, for each currency, are allocated to the prescribed time buckets or time bucket midpoints (henceforth, denoted by CF_i,c­(k) or CF_i,c(t_k­)under interest rate shock scenario i and currency c) based on their amenability to standardisation.

Notional repricing cash flows can be slotted into appropriate time buckets or time bucket midpoints based on their contractual maturity, if subject to fixed coupons, or into the next repricing period if coupons are floating. Positions amenable to standardisation fall into two categories:

1. Fixed rate positions: such positions generate cash flows that are certain till the point of contractual maturity. Examples are fixed rate loans without embedded prepayment options, term deposits without redemption risk and other amortising products such as mortgage loans. All coupon cash flows and periodic or final principal repayments should be allocated to the time bucket midpoints closest to the contractual maturity.
2. Floating rate positions: such positions generate cash flows that are not predictable past the next repricing date other than that the present value would be reset to par. Accordingly, such instruments can be treated as a series of coupon payments until the next repricing and a par notional cash flow at the time bucket midpoint closest to the next reset date bucket.

Positions amenable to standardisation include positions with embedded automatic interest rate options where the optionality (whether sold or bought) should be ignored for the purpose of slotting of notional repricing cash flows.¹⁷ That is, the stripped-out embedded automatic interest rate option must be treated together with explicit automatic interest rate options. Supervisors may allow banks to categorise other positions as amenable to standardisation and ignore the optionality if it can be shown to be of immaterial consequence.

Some positions are less amenable to standardisation.¹⁸ For explicit automatic interest rate options, as well as embedded automatic interest rate options¹⁹ that are separated or stripped out from the bank’s assets or liabilities (ie the host contract), the methodology for automatic interest rate options is described in SRP31.127 and SRP31.128.

Positions not amenable to standardisation include

1. NMDs,
2. fixed rate loans subject to prepayment risk and
3. term deposits subject to early redemption risk.

Under the standardised framework, banks should first separate their NMDs according to the nature of the deposit and depositor. Banks should then identify, for each category, the core and non-core deposits, up to the limits specified in Table 4. Finally, banks should determine an appropriate cash flow slotting for each category, in accordance with the average maturity limits specified in Table 4.

NMDs must be segmented into retail and wholesale categories. Retail deposits are defined as deposits placed with a bank by an individual person. Deposits made by small business customers and managed as retail exposures are considered as having similar interest rate risk characteristics to retail accounts and thus can be treated as retail deposits (provided the total aggregated liabilities raised from one small business customer are less than €1 million). Retail deposits should be considered as held in a transactional account when regular transactions are carried out in that account (eg when salaries are regularly credited) or when the deposit is non-interest bearing.²⁰ Other retail deposits should be considered as held in a non-transactional account. Deposits from legal entities, sole proprietorships or partnerships are captured in wholesale deposit categories.

Banks should distinguish between the stable and the non-stable parts of each NMD category using observed volume changes over the past 10 years. The stable NMD portion is the portion that is found to remain undrawn with a high degree of likelihood. Core deposits are the proportion of stable NMDs which are unlikely to reprice even under significant changes in the interest rate environment. The remainder constitutes non-core NMDs.

Banks are required to estimate their level of core deposits using this two-step procedure for each deposit category, and then to aggregate the results to determine the overall volume of core deposits subject to imposed caps as shown in Table 4.

NMDs should finally be slotted into the appropriate time bucket or time bucket midpoint. Non-core deposits should be considered as overnight deposits and accordingly should be placed into the shortest/overnight time bucket or time bucket midpoint.

Banks should determine an appropriate cash flow slotting procedure for each category of core deposits, up to the maximum average maturity per category as specified in Table 4.

The treatment set out SRP31.114 to SRP31.126 applies only to behavioural options related to retail customers. Where a wholesale customer has a behavioural option that may change the pattern of notional repricing cash flows, such options must be included within the category of automatic interest rate options.²¹

The standardised framework is applied to fixed rate loans subject to prepayments and term deposits subject to early redemption risk. In each case, the customer has an option, which, if exercised, will alter the timing of a bank’s cash flows. The customer’s exercise of the option is, among other factors, influenced by changes in interest rates. In the case of the fixed rate loan, the customer has an option to repay the loan early (ie prepay); and for a fixed-term deposit, the customer may have an option to withdraw their deposit before the scheduled date.

Under the standardised framework, the optionality in these products is estimated using a two-step approach. Firstly, baseline estimates of loan prepayments and early withdrawal of fixed-term deposits are calculated given the prevailing term structure of interest rates.²²

In the second stage, the baseline estimates are multiplied by scenario-dependent scalars that reflect the likely behavioural changes in the exercise of the options.

Prepayments, or parts thereof, for which the economic cost is not charged to the borrower, are referred to as uncompensated prepayments. For loan products where the economic cost of prepayments is never charged, or charged only for prepayments above a certain threshold, the standardised framework for fixed rate loans subject to prepayments set out below must be used to assign notional repricing cash flows.

Banks must determine or supervisors prescribe the baseline conditional prepayment rate for each portfolio p of homogeneous prepayment-exposed loan products denominated in currency c, under the prevailing term structure of interest rates.

The conditional prepayment rate (CPR) for each portfolio of homogeneous prepayment-exposed loan products denominated in currency c, under interest rate scenario i, is given using the formula that follows, where is the (constant) base CPR of a portfolio pof homogeneous prepayment-exposed loans given in currency c²³ and given the prevailing term structure of interest rates. γ_i is a multiplier applied for scenario i as given in Table 5.

Prepayment speeds vary according to the interest rate shock scenario. The multipliers (γ_i) reflect the expectation that prepayments will generally be higher during periods of falling interest rates and lower during periods of rising interest rates.

The prepayments on the fixed rate loans must ultimately be reflected in the relevant cash flows (scheduled payments on the loans, prepayments and interest payments). These payments can be broken up into scheduled payments adjusted for prepayment and uncompensated prepayments²⁴ according to the following formula, where refers to the scheduled interest and principal repayment, and denotes the notional outstanding at time bucket k–1. The base cash flows (ie given the current interest rate yield curve and the base CPR) are given by i=0, while the interest rate shock scenarios are given for i=1 to 6.

Term deposits lock in a fixed rate for a fixed term and would usually be hedged on that basis. However, term deposits may be subject to the risk of early withdrawal, also called early redemption risk. Consequently, term deposits may only be treated as fixed rate liabilities and their notional repricing cash flows slotted into the time buckets or time bucket midpoints up to their corresponding contractual maturity dates if it can be shown to the satisfaction of the supervisor that:

1. the depositor has no legal right to withdraw the deposit; or
2. an early withdrawal results in a significant penalty that at least compensates for the loss of interest between the date of withdrawal and the contractual maturity date and the economic cost of breaking the contract.²⁵

If neither of these conditions is met, the depositor holds an option to withdraw and the term deposits are deemed to be subject to early redemption risk. Further, if a bank issues term deposits that do not meet the above criteria to wholesale customers, it must assume that the customer will always exercise the right to withdraw in the way that is most disadvantageous to the bank (ie the deposit is classified as an automatic interest rate option).

Banks must determine or supervisors prescribe the baseline term deposit redemption ratio applicable to each homogeneous portfolio p of term deposits in currency c and use it to slot the notional repricing cash flows. Term deposits which are expected to be redeemed early are slotted into the overnight time bucket (k=1) or time bucket midpoint (t₁).

The term deposit redemption ratio for time bucket k or time bucket midpoint t_k applicable to each homogeneous portfolio p of term deposits in currency c and under scenario i is obtained by multiplying by a scalar u_i (set out in Table 6) that depends on the scenario i, as follows:

The notional repricing cash flows which are expected to be withdrawn early under any interest rate shock scenario i are described as follows, where is the outstanding amount of term deposits of type p.

This paragraph and SRP31.128 describe the method for calculating an add-on for automatic interest rate options, whether explicit or embedded.²⁶ This applies to sold automatic interest rate options. Banks have a choice to either include all bought automatic options or include only automatic options used for hedging sold automatic interest rate options:

1. For each sold automatic option o in currency c, the value change, denoted , is calculated for each interest rate shock scenario i. The value change is given by:
   1. an estimate of the value of the option to the option holder,²⁷ given:
      (i)

      a yield curve in currency c under the interest rate shock scenario ; and

      (ii)

      a relative increase in the implicit volatility of 25%; minus

   2. the value of the sold option to the option holder, given the yield curve in currency c at the valuation date.
2. Likewise, for each bought automatic interest rate option q, the bank must determine the change in value of the option between interest rate shock scenario i and the current interest rate term structure combined with a relative increase in the implicit volatility of 25%. This is denoted as .
3. The bank's total measure for automatic interest rate option risk under interest rate shock scenario i in currency c is calculated as follows, where n_c (m_c)is the number of sold (bought) options in currency c.

If the bank chooses to only include bought automatic interest rate options that are used for hedging sold automatic interest rate options, the bank must, for the remaining bought options, add any changes in market values reflected in the regulatory capital measure of the respective capital ratio (ie CET1, Additional Tier 1 or total capital) to the total automatic interest rate option risk measure KAO_i,c.

First, the loss in economic value of equity ΔEVE_i,c under scenario i and currency c is calculated for each currency with material exposures, ie those accounting for more than 5% of either banking book assets or liabilities, as follows:

1. Under each scenario i, all notional repricing cash flows are slotted into the respective time bucket k ⋲ {1, 2, -, K} or time bucket midpoint t_k, k ⋲ {1, 2, -, K}. Within a given time bucket k or time bucket midpoint t_k, all positive and negative notional repricing cash flows are netted²⁸ to form a single long or short position, with the cancelled parts removed from the calculation. Following this process across all time buckets or time bucket midpoints leads to a set of notional repricing cash flows CF_i,c(k) or CF_i,c(t_k), k ⋲ {1, 2, -, K}.²⁹
2. Net notional repricing cash flows in each time bucket k or time bucket midpoint t_k are weighted by a continuously compounded discount factor, described below, that reflects the interest rate shock scenario i in currency c as set out in SRP31.90 to SRP31.93, and where t_k is the midpoint of time bucket k. This results in a weighted net position, which may be positive or negative for each time bucket. The cash flows should be discounted using either a risk-free rate³⁰ or a risk-free rate including commercial margin and other spread components (only if the bank has included commercial margins and other spread components in its cash flows).
3. These risk-weighted net positions are summed to determine the EVE in currency c under scenario i (excluding automatic interest rate option positions):

   (maturity buckets) or

   (maturity bucket midpoints)

4. Then, the full change in EVE in currency c associated with scenario i is obtained by subtracting from the EVE under the current interest rate term structure and by adding the total measure for automatic interest rate option risk KAO_i,c, as follows:

   (maturity buckets) or

   (maturity bucket midpoints)

5. Finally, the EVE losses ΔEVE_i,c>0 are aggregated under a given interest rate shock scenario i and the maximum loss across all interest rate shock scenarios is the EVE risk measure.³¹

A bank should ensure that it has sufficient capital to meet the Pillar 1 requirements and the results (where a deficiency has been indicated) of the credit risk stress test performed as part of the Pillar 1 internal ratings-based (IRB) minimum requirements CRE36.50 to CRE36.53. Supervisors may wish to review how the stress test has been carried out. The results of the stress test will thus contribute directly to the expectation that a bank will operate above the Pillar 1 minimum regulatory capital ratios. Supervisors will consider whether a bank has sufficient capital for these purposes. To the extent that there is a shortfall, the supervisor will react appropriately. This will usually involve requiring the bank to reduce its risks and/or to hold additional capital/provisions, so that existing capital resources could cover the Pillar 1 requirements plus the result of a recalculated stress test.

A bank must use the reference definition of default for its internal estimations of probability of default and/or loss given default and exposure at default (EAD). However, as detailed in CRE36.70, national supervisors will issue guidance on how the reference definition of default is to be interpreted in their jurisdictions. Supervisors will assess individual banks’ application of the reference definition of default and its impact on capital requirements. In particular, supervisors will focus on the impact of deviations from the reference definition according to CRE36.72 (use of external data or historic internal data not fully consistent with the reference definition of default).

The Framework allows banks to offset credit or counterparty risk with collateral, guarantees or credit derivatives, leading to reduced capital charges. While banks use credit risk mitigation (CRM) techniques to reduce their credit risk, these techniques give rise to risks that may render the overall risk reduction less effective. Accordingly these risks (eg legal risk, documentation risk, or liquidity risk) to which banks are exposed are of supervisory concern. Where such risks arise, and irrespective of fulfilling the minimum requirements set out in Pillar 1, a bank could find itself with greater credit risk exposure to the underlying counterparty than it had expected. Examples of these risks include:

1. inability to seize, or realise in a timely manner, collateral pledged (on default of the counterparty);
2. refusal or delay by a guarantor to pay; and
3. ineffectiveness if untested documentation.

Therefore, supervisors will require banks to have in place appropriate written CRM policies and procedures in order to control these residual risks. A bank may be required to submit these policies and procedures to supervisors and must regularly review their appropriateness, effectiveness and operation.

In its CRM policies and procedures, a bank must consider whether, when calculating capital requirements, it is appropriate to give the full recognition of the value of the credit risk mitigant as permitted in Pillar 1 and must demonstrate that its CRM management policies and procedures are appropriate to the level of capital benefit that it is recognising. Where supervisors are not satisfied as to the robustness, suitability or application of these policies and procedures they may direct the bank to take immediate remedial action or hold additional capital against residual risk until such time as the deficiencies in the CRM procedures are rectified to the satisfaction of the supervisor. For example, supervisors may direct a bank to:

1. make adjustments to the assumptions on holding periods, supervisory haircuts, or volatility (in the own haircuts approach);
2. give less than full recognition of credit risk mitigants (on the whole credit portfolio or by specific product line); and/or
3. hold a specific additional amount of capital.

A risk concentration is any single exposure or group of exposures with the potential to produce losses large enough (relative to a bank’s capital, total assets, or overall risk level) to threaten a bank’s health or ability to maintain its core operations. Risk concentrations are arguably the single most important cause of major problems in banks.

Risk concentrations can arise in a bank’s assets, liabilities, or off-balance sheet items, through the execution or processing of transactions (either product or service), or through a combination of exposures across these broad categories. Because lending is the primary activity of most banks, credit risk concentrations are often the most material risk concentrations within a bank.

Credit risk concentrations, by their nature, are based on common or correlated risk factors, which, in times of stress, have an adverse effect on the creditworthiness of each of the individual counterparties making up the concentration. Concentration risk arises in both direct exposures to obligors and may also occur through exposures to protection providers. Such concentrations are not addressed in the Pillar 1 capital charge for credit risk.

Banks should have in place effective internal policies, systems and controls to identify, measure, monitor, and control their credit risk concentrations. Banks should explicitly consider the extent of their credit risk concentrations in their assessment of capital adequacy under Pillar 2. These policies should cover the different forms of credit risk concentrations to which a bank may be exposed. Such concentrations include:

1. significant exposures to an individual counterparty or group of related counterparties. In many jurisdictions, supervisors define a limit for exposures of this nature, commonly referred to as a large exposure limit. Banks might also establish an aggregate limit for the management and control of all of its large exposures as a group;
2. credit exposures to counterparties in the same economic sector or geographic region;
3. credit exposures to counterparties whose financial performance is dependent on the same activity or commodity; and
4. indirect credit exposures arising from a bank’s CRM activities (eg exposure to a single collateral type or to credit protection provided by a single counterparty).

A bank’s framework for managing credit risk concentrations should be clearly documented and should include a definition of the credit risk concentrations relevant to the bank and how these concentrations and their corresponding limits are calculated. Limits should be defined in relation to a bank’s capital, total assets or, where adequate measures exist, its overall risk level.

A bank’s management should conduct periodic stress tests of its major credit risk concentrations and review the results of those tests to identify and respond to potential changes in market conditions that could adversely impact the bank’s performance.

A bank should ensure that, in respect of credit risk concentrations, it complies with the Committee document Principles for the Management of Credit Risk (September 2000) and the more detailed guidance in the Appendix to that paper.

In the course of their activities, supervisors should assess the extent of a bank’s credit risk concentrations, how they are managed, and the extent to which the bank considers them in its internal assessment of capital adequacy under Pillar 2. Such assessments should include reviews of the results of a bank’s stress tests. Supervisors should take appropriate actions where the risks arising from a bank’s credit risk concentrations are not adequately addressed by the bank.

As counterparty credit risk (CCR) represents a form of credit risk, this would include meeting this Framework’s standards regarding their approaches to stress testing, “residual risks” associated with credit risk mitigation techniques, and credit concentrations, as specified in the paragraphs above.

The bank must have counterparty credit risk management policies, processes and systems that are conceptually sound and implemented with integrity relative to the sophistication and complexity of a firm’s holdings of exposures that give rise to CCR. A sound counterparty credit risk management framework shall include the identification, measurement, management, approval and internal reporting of CCR.

The bank’s risk management policies must take account of the market, liquidity, legal and operational risks that can be associated with CCR and, to the extent practicable, interrelationships among those risks. The bank must not undertake business with a counterparty without assessing its creditworthiness and must take due account of both settlement and pre-settlement credit risk. These risks must be managed as comprehensively as practicable at the counterparty level (aggregating counterparty exposures with other credit exposures) and at the firm-wide level.

The board of directors and senior management must be actively involved in the CCR control process and must regard this as an essential aspect of the business to which significant resources need to be devoted. Where the bank is using an internal model for CCR, senior management must be aware of the limitations and assumptions of the model used and the impact these can have on the reliability of the output. They should also consider the uncertainties of the market environment (eg timing of realisation of collateral) and operational issues (eg pricing feed irregularities) and be aware of how these are reflected in the model.

In this regard, the daily reports prepared on a firm’s exposures to CCR must be reviewed by a level of management with sufficient seniority and authority to enforce both reductions of positions taken by individual credit managers or traders and reductions in the firm’s overall CCR exposure.

The bank’s CCR management system must be used in conjunction with internal credit and trading limits. In this regard, credit and trading limits must be related to the firm’s risk measurement model in a manner that is consistent over time and that is well understood by credit managers, traders and senior management.

The measurement of CCR must include monitoring daily and intra-day usage of credit lines. The bank must measure current exposure gross and net of collateral held where such measures are appropriate and meaningful (eg over-the-counter, or OTC, derivatives, margin lending). Measuring and monitoring peak exposure or potential future exposure at a confidence level chosen by the bank at both the portfolio and counterparty levels is one element of a robust limit monitoring system. Banks must take account of large or concentrated positions, including concentrations by groups of related counterparties, by industry, by market, customer investment strategies, etc.

The bank must have a routine and rigorous program of stress testing in place as a supplement to the CCR analysis based on the day-to-day output of the firm’s risk measurement model. The results of this stress testing must be reviewed periodically by senior management and must be reflected in the CCR policies and limits set by management and the board of directors. Where stress tests reveal particular vulnerability to a given set of circumstances, management should explicitly consider appropriate risk management strategies (eg by hedging against that outcome, or reducing the size of the firm’s exposures).

The bank must have a routine in place for ensuring compliance with a documented set of internal policies, controls and procedures concerning the operation of the CCR management system. The firm’s CCR management system must be well documented, for example, through a risk management manual that describes the basic principles of the risk management system and that provides an explanation of the empirical techniques used to measure CCR.

The bank must conduct an independent review of the CCR management system regularly through its own internal auditing process. This review must include both the activities of the business credit and trading units and of the independent CCR control unit. A review of the overall CCR management process must take place at regular intervals (ideally not less than once a year) and must specifically address, at a minimum:

1. the adequacy of the documentation of the CCR management system and process;
2. the organisation of the collateral management unit;
3. the organisation of the CCR control unit;
4. the integration of CCR measures into daily risk management;
5. the approval process for risk pricing models and valuation systems used by front and back-office personnel;
6. the validation of any significant change in the CCR measurement process;
7. the scope of counterparty credit risks captured by the risk measurement model;
8. the integrity of the management information system;
9. the accuracy and completeness of CCR data;
10. the accurate reflection of legal terms in collateral and netting agreements into exposure measurements;
11. the verification of the consistency, timeliness and reliability of data sources used to run internal models, including the independence of such data sources;
12. the accuracy and appropriateness of volatility and correlation assumptions;
13. the accuracy of valuation and risk transformation calculations; and
14. the verification of the model’s accuracy through frequent backtesting.

A bank that receives approval to use an internal model to estimate its exposure amount or EAD for CCR exposures must monitor the appropriate risks and have processes to adjust its estimation of expected positive exposure (EPE) when those risks become significant. This includes the following:

1. Banks must identify and manage their exposures to specific wrong-way risk.
2. For exposures with a rising risk profile after one year, banks must compare on a regular basis the estimate of EPE over one year with the EPE over the life of the exposure.
3. For exposures with a short-term maturity (below one year), banks must compare on a regular basis the replacement cost (current exposure) and the realised exposure profile, and/or store data that allow such a comparisons.

When assessing an internal model used to estimate EPE, and especially for banks that receive approval to estimate the value of the alpha factor, supervisors must review the characteristics of the firm’s portfolio of exposures that give rise to CCR. In particular, supervisors must consider the following characteristics, namely:

1. the diversification of the portfolio (number of risk factors the portfolio is exposed to);
2. the correlation of default across counterparties; and
3. the number and granularity of counterparty exposures.

Supervisors will take appropriate action where the firm’s estimates of exposure or EAD under the internal models method (IMM) or alpha do not adequately reflect its exposure to CCR. Such action might include directing the bank to revise its estimates; directing the bank to apply a higher estimate of exposure or EAD under the IMM or alpha; or disallowing a bank from recognising internal estimates of EAD for regulatory capital purposes.

For banks that make use of the standardised approach to counterparty credit risk (SA-CCR), supervisors should review the bank’s evaluation of the risks contained in the transactions that give rise to CCR and the bank’s assessment of whether the SA-CCR captures those risks appropriately and satisfactorily. If the SA-CCR does not capture the risk inherent in the bank’s relevant transactions (as could be the case with structured, more complex OTC derivatives), supervisors may require the bank to apply the SA-CCR on a transaction-by-transaction basis (ie no netting will be recognised).

A bank’s on- and off-balance-sheet securitisation activities should be included in its risk management disciplines, such as product approval, risk concentration limits and estimates of market, credit and operational risk (as discussed in SRP30).

In light of the wide range of risks arising from securitisation activities, which can be compounded by rapid innovation in securitisation techniques and instruments, minimum capital requirements calculated under Pillar 1 are often insufficient. All risks arising from securitisation, particularly those that are not fully captured under Pillar 1, should be addressed in a bank’s internal capital adequacy assessment process (ICAAP). These risks include:

1. credit, market, liquidity and reputational risk of each exposure;
2. potential delinquencies and losses on the underlying securitised exposures;
3. exposures from credit lines or liquidity facilities to special purpose entities; and
4. exposures from guarantees provided by monolines and other third parties.

Securitisation exposures should be included in the bank’s management information systems (MIS) to help ensure that senior management understands the implications of such exposures for liquidity, earnings, risk concentration and capital. More specifically, a bank should have the necessary processes in place to capture in a timely manner updated information on securitisation transactions including market data, if available, and updated performance data from the securitisation trustee or servicer.

A bank should conduct analyses of the underlying risks when investing in the structured products and must not solely rely on the external credit ratings assigned to securitisation exposures by the credit rating agencies. A bank should be aware that external ratings are a useful starting point for credit analysis, but are no substitute for full and proper understanding of the underlying risk, especially where ratings for certain asset classes have a short history or have been shown to be volatile. Moreover, a bank also should conduct credit analysis of the securitisation exposure at acquisition and on an ongoing basis. It should also have in place the necessary quantitative tools, valuation models and stress tests of sufficient sophistication to reliably assess all relevant risks.

When assessing securitisation exposures, a bank should ensure that it fully understands the credit quality and risk characteristics of the underlying exposures in structured credit transactions, including any risk concentrations. In addition, a bank should review the maturity of the exposures underlying structured credit transactions relative to the issued liabilities in order to assess potential maturity mismatches.

A bank should track credit risk in securitisation exposures at the transaction level and across securitisations exposures within each business line and across business lines. It should produce reliable measures of aggregate risk. A bank also should track all meaningful concentrations in securitisation exposures, such as name, product or sector concentrations, and feed this information to firm-wide risk aggregation systems that track, for example, credit exposure to a particular obligor.

A bank’s own assessment of risk needs to be based on a comprehensive understanding of the structure of the securitisation transaction. It should identify the various types of triggers, credit events and other legal provisions that may affect the performance of its on- and off-balance sheet exposures and integrate these triggers and provisions into its funding/liquidity, credit and balance sheet management. The impact of the events or triggers on a bank’s liquidity and capital position should also be considered.

A bank should consider and, where appropriate, mark-to-market warehoused positions, as well as those in the pipeline, regardless of the probability of securitising the exposures. It should consider scenarios which may prevent it from securitising its assets as part of its stress testing (as discussed in SRP30) and identify the potential effect of such exposures on its liquidity, earnings and capital adequacy.

A bank should develop prudent contingency plans specifying how it would respond to funding, capital and other pressures that arise when access to securitisation markets is reduced. The contingency plans should also address how the bank would address valuation challenges for potentially illiquid positions held for sale or for trading. The risk measures, stress testing results and contingency plans should be incorporated into the bank’s risk management processes and its ICAAP, and should result in an appropriate level of capital under Pillar 2 in excess of the minimum requirements.

A bank that employs risk mitigation techniques should fully understand the risks to be mitigated, the potential effects of that mitigation and whether or not the mitigation is fully effective. This is to help ensure that the bank does not understate the true risk in its assessment of capital. In particular, it should consider whether it would provide support to the securitisation structures in stressed scenarios due to the reliance on securitisation as a funding tool.

Further to the Pillar 1 principle that banks should take account of the economic substance of transactions in their determination of capital adequacy, supervisory authorities will monitor, as appropriate, whether banks have done so adequately. As a result, regulatory capital treatments for specific securitisation exposures might differ from those specified in Pillar 1 of the Framework, particularly in instances where the general capital requirement would not adequately and sufficiently reflect the risks to which an individual banking organisation is exposed.

Amongst other things, supervisory authorities may review where relevant a bank’s own assessment of its capital needs and how that has been reflected in the capital calculation as well as the documentation of certain transactions to determine whether the capital requirements accord with the risk profile (eg substitution clauses). Supervisors will also review the manner in which banks have addressed the issue of maturity mismatch in relation to retained positions in their economic capital calculations. In particular, they will be vigilant in monitoring for the structuring of maturity mismatches in transactions to artificially reduce capital requirements. Additionally, supervisors may review the bank’s economic capital assessment of actual correlation between assets in the pool and how they have reflected that in the calculation. Where supervisors consider that a bank’s approach is not adequate, they will take appropriate action. Such action might include denying or reducing capital relief in the case of originated assets, or increasing the capital required against securitisation exposures acquired.

Securitisation transactions may be carried out for purposes other than credit risk transfer (eg funding). Where this is the case, there might still be a limited transfer of credit risk. However, for an originating bank to achieve reductions in capital requirements, the risk transfer arising from a securitisation has to be deemed significant by the national supervisory authority. If the risk transfer is considered to be insufficient or non-existent, the supervisory authority can require the application of a higher capital requirement than prescribed under Pillar 1 or, alternatively, may deny a bank from obtaining any capital relief from the securitisations. Therefore, the capital relief that can be achieved will correspond to the amount of credit risk that is effectively transferred. The following includes a set of examples where supervisors may have concerns about the degree of risk transfer, such as retaining or repurchasing significant amounts of risk or “cherry picking” the exposures to be transferred via a securitisation.

Retaining or repurchasing significant securitisation exposures, depending on the proportion of risk held by the originator, might undermine the intent of a securitisation to transfer credit risk. Specifically, supervisory authorities might expect that a significant portion of the credit risk and of the nominal value of the pool be transferred to at least one independent third party at inception and on an ongoing basis. Where banks repurchase risk for market-making purposes, supervisors could find it appropriate for an originator to buy part of a transaction but not, for example, to repurchase a whole tranche. Supervisors would expect that where positions have been bought for market making purposes, these positions should be resold within an appropriate period, thereby remaining true to the initial intention to transfer risk.

Another implication of realising only a non-significant risk transfer, especially if related to good quality unrated exposures, is that both the poorer quality unrated assets and most of the credit risk embedded in the exposures underlying the securitised transaction are likely to remain with the originator. Accordingly, and depending on the outcome of the supervisory review process, the supervisory authority may increase the capital requirement for particular exposures or even increase the overall level of capital the bank is required to hold.

As the minimum capital requirements for securitisation may not be able to address all potential issues, supervisory authorities are expected to consider new features of securitisation transactions as they arise. Such assessments would include reviewing the impact new features may have on credit risk transfer and, where appropriate, supervisors will be expected to take appropriate action under Pillar 2. A Pillar 1 response may be formulated to take account of market innovations. Such a response may take the form of a set of operational requirements and/or a specific capital treatment.

Support to a transaction, whether contractual (ie credit enhancements provided at the inception of a securitised transaction) or non-contractual (implicit support) can take numerous forms. For instance, contractual support can include over collateralisation, credit derivatives, spread accounts, contractual recourse obligations, subordinated notes, credit risk mitigants provided to a specific tranche, the subordination of fee or interest income or the deferral of margin income, and clean-up calls that exceed 10 percent of the initial issuance. In contrast to contractual credit exposures, such as guarantees, implicit support is a more subtle form of exposure. Implicit support arises when a bank provides post-sale support to a securitisation transaction in excess of any contractual obligation. Such non-contractual support exposes a bank to the risk of loss, such as loss arising from deterioration in the credit quality of the securitisation’s underlying assets. Examples of implicit support include the purchase of deteriorating credit risk exposures from the underlying pool, the sale of discounted credit risk exposures into the pool of securitised credit risk exposures, the purchase of underlying exposures at above market price or an increase in the first loss position according to the deterioration of the underlying exposures.

The provision of implicit (or non-contractual) support, as opposed to contractual credit support (ie credit enhancements), raises significant supervisory concerns. By providing implicit support, a bank signals to the market that all of the risks inherent in the securitised assets are still held by the organisation and, in effect, had not been transferred. For traditional securitisation structures the provision of implicit support undermines the clean break criteria, which when satisfied would allow banks to exclude the securitised assets from regulatory capital calculations. For synthetic securitisation structures, it negates the significance of risk transference. By providing implicit support, banks signal to the market that the risk is still with the bank and has not in effect been transferred. The institution’s capital calculation therefore understates the true risk. Accordingly, national supervisors are expected to take appropriate action when a banking organisation provides implicit support.

Since the risk arising from the potential provision of implicit support is not captured ex ante under Pillar 1, it must be considered as part of the Pillar 2 process. In addition, the processes for approving new products or strategic initiatives should consider the potential provision of implicit support and should be incorporated in a bank’s ICAAP. When a bank has been found to provide implicit support to a securitisation, it will be required to hold capital against all of the underlying exposures associated with the structure as if they had not been securitised. It will also be required to disclose publicly that it was found to have provided non-contractual support, as well as the resulting increase in the capital charge (as noted above). The aim is to require banks to hold capital against exposures for which they assume the credit risk, and to discourage them from providing non-contractual support.

If a bank is found to have provided implicit support on more than one occasion, the bank is required to disclose its transgression publicly and national supervisors will take appropriate action that may include, but is not limited to, one or more of the following:

1. the bank may be prevented from gaining favourable capital treatment on securitised assets for a period of time to be determined by the national supervisor;
2. the bank may be required to hold capital against all securitised assets as though the bank had created a commitment to them, by applying a conversion factor to the risk weight of the underlying assets;
3. for purposes of capital calculations, the bank may be required to treat all securitised assets as if they remained on the balance sheet;
4. the bank may be required by its national supervisory authority to hold regulatory capital in excess of the minimum risk-based capital ratios.

Supervisors will be vigilant in determining implicit support and will take appropriate supervisory action to mitigate the effects. Pending any investigation, the bank may be prohibited from any capital relief for planned securitisation transactions (moratorium). National supervisory response will be aimed at changing the bank’s behaviour with regard to the provision of implicit support, and to correct market perception as to the willingness of the bank to provide future recourse beyond contractual obligations.

As with credit risk mitigation techniques more generally, supervisors will review the appropriateness of banks’ approaches to the recognition of credit protection. In particular, with regard to securitisations, supervisors will review the appropriateness of protection recognised against first loss credit enhancements. On these positions, expected loss is less likely to be a significant element of the risk and is likely to be retained by the protection buyer through the pricing. Therefore, supervisors will expect banks’ policies to take account of this in determining their economic capital. Where supervisors do not consider the approach to protection recognised is adequate, they will take appropriate action. Such action may include increasing the capital requirement against a particular transaction or class of transactions.

Supervisors expect a bank not to make use of clauses that entitles it to call the securitisation transaction or the coverage of credit protection prematurely if this would increase the bank’s exposure to losses or deterioration in the credit quality of the underlying exposures.

Besides the general principle stated above, supervisors expect banks to only execute clean-up calls for economic business purposes, such as when the cost of servicing the outstanding credit exposures exceeds the benefits of servicing the underlying credit exposures.

Subject to national discretion, supervisory authorities may require a review prior to the bank exercising a call which can be expected to include consideration of:

1. the rationale for the bank’s decision to exercise the call; and
2. the impact of the exercise of the call on the bank’s regulatory capital ratio.

The supervisory authority may also require the bank to enter into a follow-up transaction, if necessary, depending on the bank’s overall risk profile, and existing market conditions.

Date-related calls should be set at a date no earlier than the duration or the weighted average life of the underlying securitisation exposures. Accordingly, supervisory authorities may require a minimum period to elapse before the first possible call date can be set, given, for instance, the existence of up-front sunk costs of a capital market securitisation transaction.

Supervisors should review how banks internally measure, monitor and manage risks associated with securitisations of revolving credit facilities, including an assessment of the risk and likelihood of early amortisation of such transactions. At a minimum, supervisors should ensure that banks have implemented reasonable methods for allocating economic capital against the economic substance of the credit risk arising from revolving securitisations and should expect banks to have adequate capital and liquidity contingency plans that evaluate the probability of an early amortisation occurring and address the implications of both scheduled and early amortisation.

Because most early amortisation triggers are tied to excess spread levels, the factors affecting these levels should be well understood, monitored and managed to the extent possible (see SRP32.44 to SRP32.48 on implicit support) by the originating bank. For example, the following factors affecting excess spread should generally be considered:

1. interest payments made by borrowers on the underlying receivable balances;
2. other fees and charges to be paid by the underlying obligors (eg late-payment fees, cash advance fees, over-limit fees);
3. gross charge-offs;
4. principal payments;
5. recoveries on charged-off loans;
6. interchange income;
7. interest paid on investors’ certificates; and
8. macroeconomic factors such as bankruptcy rates, interest rate movements and unemployment rates.

Banks should consider the effects that changes in portfolio management or business strategies may have on the levels of excess spread and on the likelihood of an early amortisation event. For example, marketing strategies or underwriting changes that result in lower finance charges or higher charge-offs might also lower excess spread levels and increase the likelihood of an early amortisation event.

Banks should use techniques such as static pool cash collection analyses and stress tests to better understand pool performance. These techniques can highlight adverse trends or potential adverse impacts. Banks should have policies in place to respond promptly to adverse or unanticipated changes. Supervisors will take appropriate action where they do not consider these policies adequate. Such action may include, but is not limited to, directing a bank to obtain a dedicated liquidity line or increasing the bank’s capital requirements.

Supervisors expect that the sophistication of a bank’s system in monitoring the likelihood and risks of an early amortisation event will be commensurate with the size and complexity of the bank’s securitisation activities that involve early amortisation provisions.

Clear policies and procedures used to determine the exposures that may be included in, and those that should be excluded from, the trading book for purposes of calculating regulatory capital are critical to ensure the consistency and integrity of a firm’s trading book. Such policies must conform to this framework. Supervisors should be satisfied that the policies and procedures clearly delineate the boundaries of the firm’s trading book, in compliance with the general principles set forth in this framework, and consistent with the bank’s risk management capabilities and practices. Supervisors should also be satisfied that transfers of positions between banking and trading books can only occur in a very limited set of circumstances. A supervisor will require a firm to modify its policies and procedures when they prove insufficient for preventing the booking in the trading book of positions that are not compliant with the general principles set forth in this framework, or not consistent with the bank’s risk management capabilities and practices.

Instruments held in the trading book must be subject to clearly defined policies and procedures, approved by senior management, that are aimed at ensuring active risk management. The application of the policies and procedures must be thoroughly documented. These policies and procedures should, at a minimum, address the following:

1. The activities the bank considers to be trading or hedging of covered instruments;
2. Trading strategies (including expected holding horizon and possible reactions if this limit is breached) for every covered instrument or portfolio;
3. Standards regarding the extent to which a bank’s portfolio of covered instruments must be marked-to-market daily by reference to an active, liquid two-way market;
4. For covered instruments that are marked-to-model, the standards for:
   1. Identifying the material risks of the covered instruments;
   2. Hedging the material risks of the covered instruments and the extent to which hedging instruments would have an active, liquid two-way market; and
   3. Reliably deriving estimates for the key assumptions and parameters used in the model.
5. The extent to which the bank is required to generate valuations for the covered instruments that can be validated externally in a consistent manner;
6. The extent to which instruments may have operational requirements that could impede the bank’s ability to effect an immediate liquidation of the covered instrument;
7. The processes constituting active management of covered instruments, which must include:
   1. The setting of limits and ongoing monitoring for appropriateness;
   2. The requirement that each trading desk have a documented trading strategy and the process for monitoring covered instruments against the bank’s trading strategy, including that:
      (i)

      for any given trading desk, bank senior management assume the responsibility that a given covered instrument or portfolio be managed with trading intent and in accordance with the trading strategy document.

      (ii)

      The monitoring process includes evaluation of turnover and “stale positions” in order to determine compliance with specified holding periods.

   3. The degree of autonomy a trader has to enter into or manage covered instruments within agreed limits and according to the agreed strategy;
   4. The process for reporting to senior management as an integral part of the institution’s risk management process; and
   5. The active monitoring of instruments and risk positions with reference to market information sources, including:
      (i)

      assessment of market liquidity and the ability to hedge instruments, risk positions or the portfolio risk profile;

      (ii)

      analysis of changes in the market values of instruments and sensitivities due to changes in market risk factors; and

      (iii)

      evaluation of the quality and availability of market inputs with respect to the valuation process, the level of market turnover, and the relative size of instruments traded in the market.

The bank must:

1. document all internal risk transfer with its trading book, with respect to the banking book risk being hedged and the amount of such risk;
2. document the details of any external third party matching hedge;
3. submit a list to its supervisor of the procedures and strategies to manage the risks that the internal risk transfer desks undertake. This list must be approved by the bank’s senior management;
4. ensure regular and consistent reporting of its internal risk transfer activities for risk management and control purposes. The bank must report this information to its supervisor on a regular basis.

The trading desks engaged in internal risk transfers must document all actions that have been implemented, along with contributory analysis and independent review in order to manage the risks they undertake.

The bank must have a consistent methodology for identifying and quantifying the banking book risk to be hedged through internal risk transfers. This methodology must be properly integrated in the bank’s risk management framework. The methodology must include all qualitative and quantitative regulatory requirements pertaining to trading book desks. Any material changes in the methodology must be approved by a specialised committee of the bank (eg the asset and liability management committee). The supervisor must be notified of such changes and approve of any material changes beforehand.

A bank must have a set of consistent risk management methods and internal controls in order to ensure and control the effectiveness of risk mitigation for its internal risk transfer transactions. These methods and controls must reflect the amount, types, and risks of the bank’s internal risk transfer activities and must be regularly reviewed by the bank’s risk management and control units.

Prudent valuation policies and procedures form the foundation on which any robust assessment of market risk capital adequacy should be built. For a well diversified portfolio consisting of highly liquid cash instruments, and without market concentration, the valuation of the portfolio, combined with the minimum quantitative standards set out in this framework, may deliver sufficient capital to enable a bank, in adverse market conditions, to close out or hedge its exposures within the liquidity horizon period set out for that exposure in this framework. However, for less well diversified portfolios, for portfolios containing less liquid instruments, for portfolios with concentrations in relation to market turnover, and/or for portfolios which contain large numbers of positions that are marked to model this is less likely to be the case. In such circumstances, supervisors will consider whether a bank has sufficient capital. To the extent there is a shortfall the supervisor will react appropriately. This will usually require the bank to reduce its risks and/or hold an additional amount of capital.

A bank must ensure that it has sufficient capital to meet the minimum capital requirements and to cover the results of its stress testing requirements specified in this framework. Supervisors will consider whether a bank has sufficient capital for these purposes, taking into account the nature and scale of the bank’s trading activities and any other relevant factors such as valuation adjustments made by the bank. To the extent that there is a shortfall, or if supervisors are not satisfied with the premise upon which the bank’s assessment of internal market risk capital adequacy is based, supervisors will take the appropriate measures. This will usually involve requiring the bank to reduce its risk exposures and/or to hold an additional amount of capital, so that its overall capital resources at least cover the Pillar 1 requirements plus the result of a stress test acceptable to the supervisor.

Where supervisors consider that limited liquidity or price transparency undermine the effectiveness of a bank’s model to capture risk, they will take appropriate measures, including requiring the exclusion of positions from the bank’s model. Supervisors should review the adequacy of the bank’s measure of the default risk charge; where the bank’s approach is inadequate, the use of the standardised charges will be required.

Risk management must be embedded in the culture of a bank. It should be a critical focus of the chief executive officer, chief risk officer, chief operating officer, senior management, trading desk and other business line heads and employees in making strategic and day-to-day decisions. For a broad and deep risk management culture to develop and be maintained over time, compensation policies must not be unduly linked to short-term accounting profit generation. Compensation policies should be linked to longer-term capital preservation and the financial strength of the firm, and should consider risk-adjusted performance measures. In addition, a bank should provide adequate disclosure regarding its compensation policies to stakeholders. Each bank’s board of directors and senior management have the responsibility to mitigate the risks arising from remuneration policies in order to ensure effective firm-wide risk management.³²

A bank’s board of directors must actively oversee the compensation system’s design and operation, which should not be controlled primarily by the chief executive officer and management team. Relevant board members and employees must have independence and expertise in risk management and compensation.

In addition, the board of directors must monitor and review the compensation system to ensure the system includes adequate controls and operates as intended. The practical operation of the system should be regularly reviewed to ensure compliance with policies and procedures. Compensation outcomes, risk measurements, and risk outcomes should be regularly reviewed for consistency with intentions.

Staff that are engaged in the financial and risk control areas must be independent, have appropriate authority, and be compensated in a manner that is independent of the business areas they oversee and commensurate with their key role in the firm. Effective independence and appropriate authority of such staff is necessary to preserve the integrity of financial and risk management’s influence on incentive compensation.

Compensation must be adjusted for all types of risk so that remuneration is balanced between the profit earned and the degree of risk assumed in generating the profit. In general, both quantitative measures and human judgment should play a role in determining the appropriate risk adjustments, including those that are difficult to measure such as liquidity risk and reputation risk.

Compensation outcomes must be symmetric with risk outcomes and compensation systems should link the size of the bonus pool to the overall performance of the firm. Employees’ incentive payments should be linked to the contribution of the individual and business to the firm’s overall performance.

Compensation payout schedules must be sensitive to the time horizon of risks. Profits and losses of different activities of a financial firm are realised over different periods of time. Variable compensation payments should be deferred accordingly. Payments should not be finalised over short periods where risks are realised over long periods. Management should question payouts for income that cannot be realised or whose likelihood of realisation remains uncertain at the time of payout.

The mix of cash, equity and other forms of compensation must be consistent with risk alignment. The mix will vary depending on the employee’s position and role. The firm should be able to explain the rationale for its mix.

Supervisory review of compensation practices must be rigorous and sustained, and deficiencies must be addressed promptly with the appropriate supervisory action. Supervisors should include compensation practices in their risk assessment of firms, and firms should work constructively with supervisors to ensure their practices are adequate. Regulations and supervisory practices will naturally differ across jurisdictions and potentially among authorities within a country. Nevertheless, all supervisors should strive for effective review and intervention.

This chapter presents a set of principles to strengthen banks’ risk data aggregation capabilities and internal risk reporting practices (the Principles). The Principles are expected to support a bank’s efforts to:

1. enhance the infrastructure for reporting key information, particularly that used by the board and senior management to identify, monitor and manage risks;
2. improve the decision-making process throughout the banking organisation;
3. enhance the management of information across legal entities, while facilitating a comprehensive assessment of risk exposures at the global consolidated level;
4. reduce the probability and severity of losses resulting from risk management weaknesses;
5. improve the speed at which information is available and hence decisions can be made; and
6. improve the organisation’s quality of strategic planning and the ability to manage the risk of new products and services.

Strong risk management capabilities are an integral part of the franchise value of a bank. Effective implementation of the Principles should increase the value of the bank. The Committee believes that the long-term benefits of improved risk data aggregation capabilities and risk reporting practices will outweigh the investment costs incurred by banks.

For bank supervisors, these Principles will complement other efforts to improve the intensity and effectiveness of bank supervision. For resolution authorities, improved risk data aggregation should enable smoother bank resolution, thereby reducing the potential recourse to taxpayers.

These Principles apply to systemically important banks (SIBs) and apply at both the banking group and on a solo basis.

The Principles and supervisory expectations contained in SRP36 apply to a bank’s risk management data. This includes data that is critical to enabling the bank to manage the risks it faces. Risk data and reports should provide management with the ability to monitor and track risks relative to the bank’s risk tolerance/appetite.

These Principles also apply to all key internal risk management models, including but not limited to, Pillar 1 regulatory capital models (eg internal ratings-based approaches for credit risk and advanced measurement approaches for operational risk), Pillar 2 capital models and other key risk management models (eg value-at-risk).

The Principles apply to a bank’s group risk management processes. However, banks may also benefit from applying the Principles to other processes, such as financial and operational processes, as well as supervisory reporting.

All the Principles are also applicable to processes that have been outsourced to third parties.

The Principles cover four closely related topics:

1. Overarching governance and infrastructure (Principles 1 and 2)
2. Risk data aggregation capabilities (Principles 3, 4, 5 and 6)
3. Risk reporting practices (Principles 7, 8, 9, 10 and 11)
4. Supervisory review, tools and cooperation (Principles 12, 13 and 14)

Risk data aggregation capabilities and risk reporting practices are considered separately in this paper, but they are clearly inter-linked and cannot exist in isolation. High quality risk management reports rely on the existence of strong risk data aggregation capabilities, and sound infrastructure and governance ensures the information flow from one to the other.

Banks should meet all risk data aggregation and risk reporting principles simultaneously. However, trade-offs among Principles could be accepted in exceptional circumstances such as urgent/ad hoc requests of information on new or unknown areas of risk. There should be no trade-offs that materially impact risk management decisions. Decision-makers at banks, in particular the board and senior management, should be aware of these trade-offs and the limitations or shortcomings associated with them. Supervisors expect banks to have policies and processes in place regarding the application of trade-offs. Banks should be able to explain the impact of these trade-offs on their decision-making process through qualitative reports and, to the extent possible, quantitative measures.

A bank should have in place a strong governance framework, risk data architecture and information technology (IT) infrastructure. These are preconditions to ensure compliance with the other Principles included in this chapter. In particular, a bank’s board should oversee senior management’s ownership of implementing all the risk data aggregation and risk reporting principles and the strategy to meet them within a timeframe agreed with their supervisors.

The concept of materiality used in SRP36 means that data and reports can exceptionally exclude information only if it does not affect the decision-making process in a bank (ie decision-makers, in particular the board and senior management, would have been influenced by the omitted information or made a different judgment if the correct information had been known). In applying the materiality concept, banks will take into account considerations that go beyond the number or size of the exposures not included, such as the type of risks involved, or the evolving and dynamic nature of the banking business. Banks should also take into account the potential future impact of the information excluded on the decision-making process at their institutions. Supervisors expect banks to be able to explain the omissions of information as a result of applying the materiality concept.

Banks should develop forward looking reporting capabilities to provide early warnings of any potential breaches of risk limits that may exceed the bank’s risk tolerance/appetite. These risk reporting capabilities should also allow banks to conduct a flexible and effective stress testing which is capable of providing forward-looking risk assessments. Supervisors expect risk management reports to enable banks to anticipate problems and provide a forward looking assessment of risk.

Expert judgment may occasionally be applied to incomplete data to facilitate the aggregation process, as well as the interpretation of results within the risk reporting process. Reliance on expert judgment in place of complete and accurate data should occur only on an exception basis, and should not materially impact the bank’s compliance with the Principles. When expert judgment is applied, supervisors expect that the process be clearly documented and transparent so as to allow for an independent review of the process followed and the criteria used in the decision-making process.

For the purpose of SRP36, the term “risk data aggregation” means defining, gathering and processing risk data according to the bank’s risk reporting requirements to enable the bank to measure its performance against its risk tolerance/appetite. This includes sorting, merging or breaking down sets of data.

In this chapter, the following terms should be interpreted as follows:

1. “Accuracy” means closeness of agreement between a measurement or record or representation and the value to be measured, recorded or represented. This definition applies to both risk data aggregation and risk reports.
2. “Adaptability” means the ability of risk data aggregation capabilities to change (or be changed) in response to changed circumstances (internal or external).
3. “Approximation” means a result that is not necessarily exact, but acceptable for its given purpose.
4. “Clarity” means the ability of risk reporting to be easily understood and free from indistinctness or ambiguity.
5. “Completeness” means availability of relevant risk data aggregated across all firm's constituent units (eg legal entities, business lines, jurisdictions).
6. “Comprehensiveness” means the extent to which risk reports include or deal with all risks relevant to the firm.
7. “Distribution” means ensuring that the adequate people or groups receive the appropriate risk reports.
8. “Frequency” means the rate at which risk reports are produced over time.
9. “Integrity” means freedom of risk data from unauthorised alteration and unauthorised manipulation that compromise its accuracy, completeness and reliability.
10. “Manual workarounds” means employing human-based processes and tools to transfer, manipulate or alter data used to be aggregated or reported.
11. “Precision” means closeness of agreement between indications or measured quantity values obtained by replicating measurements on the same or similar objects under specified conditions.
12. “Reconciliation” means the process of comparing items or outcomes and explaining the differences.
13. “Risk tolerance/appetite” means the level and type of risk a firm is able and willing to assume in its exposures and business activities, given its business and obligations to stakeholders. It is generally expressed through both quantitative and qualitative means.
14. “Timeliness” means the availability of aggregated risk data within such a timeframe as to enable a bank to produce risk reports at an established frequency.
15. “Validation” means the process by which the correctness (or not) of inputs, processing, and outputs is identified and quantified.

The Principles for effective risk data aggregation and risk reporting are summarised as follows.

1. Governance - A bank’s risk data aggregation capabilities and risk reporting practices should be subject to strong governance arrangements consistent with other principles and guidance established by the Basel Committee.³³
2. Data architecture and IT infrastructure – A bank should design, build and maintain data architecture and IT infrastructure which fully supports its risk data aggregation capabilities and risk reporting practices not only in normal times but also during times of stress or crisis, while still meeting the other Principles.
3. Accuracy and Integrity – A bank should be able to generate accurate and reliable risk data to meet normal and stress/crisis reporting accuracy requirements. Data should be aggregated on a largely automated basis so as to minimise the probability of errors.
4. Completeness – A bank should be able to capture and aggregate all material risk data across the banking group. Data should be available by business line, legal entity, asset type, industry, region and other groupings, as relevant for the risk in question, that permit identifying and reporting risk exposures, concentrations and emerging risks.
5. Timeliness – A bank should be able to generate aggregate and up-to-date risk data in a timely manner while also meeting the principles relating to accuracy and integrity, completeness and adaptability. The precise timing will depend upon the nature and potential volatility of the risk being measured as well as its criticality to the overall risk profile of the bank. The precise timing will also depend on the bank-specific frequency requirements for risk management reporting, under both normal and stress/crisis situations, set based on the characteristics and overall risk profile of the bank.
6. Adaptability – A bank should be able to generate aggregate risk data to meet a broad range of on-demand, ad hoc risk management reporting requests, including requests during stress/crisis situations, requests due to changing internal needs and requests to meet supervisory queries.
7. Accuracy – Risk management reports should accurately and precisely convey aggregated risk data and reflect risk in an exact manner. Reports should be reconciled and validated.
8. Comprehensiveness – Risk management reports should cover all material risk areas within the organisation. The depth and scope of these reports should be consistent with the size and complexity of the bank’s operations and risk profile, as well as the requirements of the recipients.
9. Clarity and usefulness – Risk management reports should communicate information in a clear and concise manner. Reports should be easy to understand yet comprehensive enough to facilitate informed decision-making. Reports should include an appropriate balance between risk data, analysis and interpretation, and qualitative explanations. Reports should include meaningful information tailored to the needs of the recipients.
10. Frequency – The board and senior management (or other recipients as appropriate) should set the frequency of risk management report production and distribution. Frequency requirements should reflect the needs of the recipients, the nature of the risk reported, and the speed at which the risk can change, as well as the importance of reports in contributing to sound risk management and effective and efficient decision-making across the bank. The frequency of reports should be increased during times of stress/crisis.
11. Distribution – Risk management reports should be distributed to the relevant parties and while ensuring confidentiality is maintained.
12. Supervisory review – Supervisors should periodically review and evaluate a bank’s compliance with the eleven Principles above.
13. Remedial actions and supervisory measures – Supervisors should have and use the appropriate tools and resources to require effective and timely remedial action by a bank to address deficiencies in its risk data aggregation capabilities and risk reporting practices. Supervisors should have the ability to use a range of tools, including Pillar 2.
14. Home/host cooperation – Supervisors should cooperate with relevant supervisors in other jurisdictions regarding the supervision and review of the Principles, and the implementation of any remedial action if necessary.

A bank’s board and senior management should promote the identification, assessment and management of data-quality risks as part of its overall risk-management framework. The framework should include agreed service-level standards for both outsourced and in-house risk data-related processes, and a firm’s policies on data confidentiality, integrity and availability, as well as risk-management policies.

A bank’s board and senior management should review and approve the bank’s group risk data aggregation and risk reporting framework and ensure that adequate resources are deployed.

A bank’s risk data aggregation capabilities and risk reporting practices should be:

1. Fully documented and subject to high standards of validation. This validation should be independent and review the bank’s compliance with the Principles in this document. The primary purpose of the independent validation is to ensure that a bank's risk data aggregation and reporting processes are functioning as intended and are appropriate for the bank's risk profile. Independent validation activities should be aligned and integrated with the other independent review activities within the bank's risk management program,³⁴ and encompass all components of the bank's risk data aggregation and reporting processes. Common practices suggest that the independent validation of risk data aggregation and risk reporting practices should be conducted using staff with specific IT, data and reporting expertise.³⁵
2. Considered as part of any new initiatives, including acquisitions and/or divestitures, new product development, as well as broader process and IT change initiatives. When considering a material acquisition, a bank’s due diligence process should assess the risk data aggregation capabilities and risk reporting practices of the acquired entity, as well as the impact on its own risk data aggregation capabilities and risk reporting practices. The impact on risk data aggregation should be considered explicitly by the board and inform the decision to proceed. The bank should establish a timeframe to integrate and align the acquired risk data aggregation capabilities and risk reporting practices within its own framework.
3. Unaffected by the bank’s group structure. The group structure should not hinder risk data aggregation capabilities at a consolidated level or at any relevant level within the organisation (eg sub-consolidated level, jurisdiction of operation level). In particular, risk data aggregation capabilities should be independent from the choices a bank makes regarding its legal organisation and geographical presence.³⁶

A bank’s senior management should be fully aware of and understand the limitations that prevent full risk data aggregation, in terms of coverage (eg risks not captured or subsidiaries not included), in technical terms (eg model performance indicators or degree of reliance on manual processes) or in legal terms (legal impediments to data sharing across jurisdictions). Senior management should ensure that the bank’s IT strategy includes ways to improve risk data aggregation capabilities and risk reporting practices and to remedy any shortcomings against the Principles taking into account the evolving needs of the business. Senior management should also identify data critical to risk data aggregation and IT infrastructure initiatives through its strategic IT planning process, and support these initiatives through the allocation of appropriate levels of financial and human resources.

A bank’s board is responsible for determining its own risk reporting requirements and should be aware of limitations that prevent full risk data aggregation in the reports it receives. The board should also be aware of the bank’s implementation of, and ongoing compliance with the Principles.

Risk data aggregation capabilities and risk reporting practices should be given direct consideration as part of a bank’s business continuity planning processes and be subject to a business impact analysis.

A bank should establish integrated³⁷ data taxonomies and architecture across the banking group, which includes information on the characteristics of the data (metadata), as well as use of single identifiers and/or unified naming conventions for data including legal entities, counterparties, customers and accounts.

Roles and responsibilities should be established as they relate to the ownership and quality of risk data and information for both the business and IT functions. The owners (business and IT functions), in partnership with risk managers, should ensure there are adequate controls throughout the lifecycle of the data and for all aspects of the technology infrastructure. The role of the business owner includes ensuring data is correctly entered by the relevant front office unit, kept current and aligned with the data definitions, and also ensuring that risk data aggregation capabilities and risk reporting practices are consistent with firms’ policies.

A bank should aggregate risk data in a way that is accurate and reliable.

1. Controls surrounding risk data should be as robust as those applicable to accounting data.
2. Where a bank relies on manual processes and desktop applications (eg spreadsheets, databases) and has specific risk units that use these applications for software development, it should have effective mitigants in place (eg end-user computing policies and procedures) and other effective controls that are consistently applied across the bank’s processes.
3. Risk data should be reconciled with bank’s sources, including accounting data where appropriate, to ensure that the risk data is accurate.
4. A bank should strive towards a single authoritative source for risk data per each type of risk.
5. A bank’s risk personnel should have sufficient access to risk data to ensure they can appropriately aggregate, validate and reconcile the data to risk reports.

As a precondition, a bank should have a “dictionary” of the concepts used, such that data is defined consistently across an organisation.

There should be an appropriate balance between automated and manual systems. Where professional judgements are required, human intervention may be appropriate. For many other processes, a higher degree of automation is desirable to reduce the risk of errors.

Supervisors expect banks to document and explain all of their risk data aggregation processes whether automated or manual (judgment-based or otherwise). Documentation should include an explanation of the appropriateness of any manual workarounds, a description of their criticality to the accuracy of risk data aggregation and proposed actions to reduce the impact.

Supervisors expect banks to measure and monitor the accuracy of data and to develop appropriate escalation channels and action plans to be in place to rectify poor data quality.

A bank’s risk data aggregation capabilities should include all material risk exposures, including those that are off-balance sheet.

A banking organisation is not required to express all forms of risk in a common metric or basis, but risk data aggregation capabilities should be the same regardless of the choice of risk aggregation systems implemented. However, each system should make clear the specific approach used to aggregate exposures for any given risk measure, in order to allow the board and senior management to assess the results properly.

Supervisors expect banks to produce aggregated risk data that is complete and to measure and monitor the completeness of their risk data. Where risk data is not entirely complete, the impact should not be critical to the bank’s ability to manage its risks effectively. Supervisors expect banks’ data to be materially complete, with any exceptions identified and explained.

A bank’s risk data aggregation capabilities should ensure that it is able to produce aggregate risk information on a timely basis to meet all risk management reporting requirements.

The Basel Committee acknowledges that different types of data will be required at different speeds, depending on the type of risk, and that certain risk data may be needed faster in a stress/crisis situation. Banks need to build their risk systems to be capable of producing aggregated risk data rapidly during times of stress/crisis for all critical risks.

Critical risks include but are not limited to:

1. The aggregated credit exposure to a large corporate borrower. By comparison, groups of retail exposures may not change as critically in a short period of time but may still include significant concentrations;
2. Counterparty credit risk exposures, including, for example, derivatives;
3. Trading exposures, positions, operating limits, and market concentrations by sector and region data;
4. Liquidity risk indicators such as cash flows/settlements and funding; and
5. Operational risk indicators that are time-critical (eg systems availability, unauthorised access).

Supervisors will review that the bank specific frequency requirements, for both normal and stress/crisis situations, generate aggregate and up-to-date risk data in a timely manner.

A bank’s risk data aggregation capabilities should be flexible and adaptable to meet ad hoc data requests, as needed, and to assess emerging risks. Adaptability will enable banks to conduct better risk management, including forecasting information, as well as to support stress testing and scenario analyses.

Adaptability includes:

1. Data aggregation processes that are flexible and enable risk data to be aggregated for assessment and quick decision-making;
2. Capabilities for data customisation to users’ needs (eg dashboards, key takeaways, anomalies), to drill down as needed, and to produce quick summary reports;
3. Capabilities to incorporate new developments on the organisation of the business and/or external factors that influence the bank’s risk profile; and
4. Capabilities to incorporate changes in the regulatory framework.

Supervisors expect banks to be able to generate subsets of data based on requested scenarios or resulting from economic events. For example, a bank should be able to aggregate risk data quickly on country credit exposures³⁸ as of a specified date based on a list of countries, as well as industry credit exposures as of a specified date based on a list of industry types across all business lines and geographic areas.

Risk management reports should be accurate and precise to ensure a bank’s board and senior management can rely with confidence on the aggregated information to make critical decisions about risk.

To ensure the accuracy of the reports, a bank should maintain, at a minimum, the following:

1. Defined requirements and processes to reconcile reports to risk data;
2. Automated and manual edit and reasonableness checks, including an inventory of the validation rules that are applied to quantitative information. The inventory should include explanations of the conventions used to describe any mathematical or logical relationships that should be verified through these validations or checks; and
3. Integrated procedures for identifying, reporting and explaining data errors or weaknesses in data integrity via exceptions reports.

Approximations are an integral part of risk reporting and risk management. Results from models, scenario analyses, and stress testing are examples of approximations that provide critical information for managing risk. While the expectations for approximations may be different than for other types of risk reporting, banks should follow the reporting principles in SRP36 and establish expectations for the reliability of approximations (accuracy, timeliness etc) to ensure that management can rely with confidence on the information to make critical decisions about risk. This includes principles regarding data used to drive these approximations.

Supervisors expect that a bank’s senior management should establish accuracy and precision requirements for both regular and stress/crisis reporting, including critical position and exposure information. These requirements should reflect the criticality of decisions that will be based on this information.

Supervisors expect banks to consider accuracy requirements analogous to accounting materiality. For example, if omission or misstatement could influence the risk decisions of users, this may be considered material. A bank should be able to support the rationale for accuracy requirements. Supervisors expect a bank to consider precision requirements based on validation, testing or reconciliation processes and results.

Risk management reports should include exposure and position information for all significant risk areas (eg credit risk, market risk, liquidity risk, operational risk) and all significant components of those risk areas (eg single name, country and industry sector for credit risk). Risk management reports should also cover risk-related measures (eg regulatory and economic capital).

Reports should identify emerging risk concentrations, provide information in the context of limits and risk appetite/tolerance and propose recommendations for action where appropriate. Risk reports should include the current status of measures agreed by the board or senior management to reduce risk or deal with specific risk situations. This includes providing the ability to monitor emerging trends through forward-looking forecasts and stress tests.

Supervisors expect banks to determine risk reporting requirements that best suit their own business models and risk profiles. Supervisors will need to be satisfied with the choices a bank makes in terms of risk coverage, analysis and interpretation, scalability and comparability across group institutions. For example, an aggregated risk report should include, but not be limited to, the following information: capital adequacy, regulatory capital, capital and liquidity ratio projections, credit risk, market risk, operational risk, liquidity risk, stress testing results, inter- and intra-risk concentrations, and funding positions and plans.

Supervisors expect that risk management reports to the board and senior management provide a forward-looking assessment of risk and should not just rely on current and past data. The reports should contain forecasts or scenarios for key market variables and the effects on the bank so as to inform the board and senior management of the likely trajectory of the bank’s capital and risk profile in the future.

A bank’s risk reports should contribute to sound risk management and decision-making by their relevant recipients, including, in particular, the board and senior management. Risk reports should ensure that information is meaningful and tailored to the needs of the recipients.

Reports should include an appropriate balance between risk data, analysis and interpretation, and qualitative explanations. The balance of qualitative versus quantitative information will vary at different levels within the organisation and will also depend on the level of aggregation that is applied to the reports. Higher up in the organisation, more aggregation is expected and therefore a greater degree of qualitative interpretation will be necessary.

Reporting policies and procedures should recognise the differing information needs of the board, senior management, and the other levels of the organisation (for example risk committees).

As one of the key recipients of risk management reports, the bank’s board is responsible for determining its own risk reporting requirements and complying with its obligations to shareholders and other relevant stakeholders. The board should ensure that it is asking for and receiving relevant information that will allow it to fulfil its governance mandate relating to the bank and the risks to which it is exposed. This will allow the board to ensure it is operating within its risk tolerance/appetite.

The board should alert senior management when risk reports do not meet its requirements and do not provide the right level and type of information to set and monitor adherence to the bank’s risk tolerance/appetite. The board should indicate whether it is receiving the right balance of detail and quantitative versus qualitative information.

Senior management is also a key recipient of risk reports and it is responsible for determining its own risk reporting requirements. Senior management should ensure that it is receiving relevant information that will allow it to fulfil its management mandate relative to the bank and the risks to which it is exposed.

A bank should develop an inventory and classification of risk data items which includes a reference to the concepts used to elaborate the reports.

Supervisors expect that reports will be clear and useful. Reports should reflect an appropriate balance between detailed data, qualitative discussion, explanation and recommended conclusions. Interpretation and explanations of the data, including observed trends, should be clear.

Supervisors expect a bank to confirm periodically with recipients that the information aggregated and reported is relevant and appropriate, in terms of both amount and quality, to the governance and decision-making process.

The frequency of risk reports will vary according to the type of risk, purpose and recipients. A bank should assess periodically the purpose of each report and set requirements for how quickly the reports need to be produced in both normal and stress/crisis situations. A bank should routinely test its ability to produce accurate reports within established timeframes, particularly in stress/crisis situations.

Supervisors expect that in times of stress/crisis all relevant and critical credit, market and liquidity position/exposure reports are available within a very short period of time to react effectively to evolving risks. Some position/exposure information may be needed immediately (intraday) to allow for timely and effective reactions.

Procedures should be in place to allow for rapid collection and analysis of risk data and timely dissemination of reports to all appropriate recipients. This should be balanced with the need to ensure confidentiality as appropriate.

Supervisors expect a bank to confirm periodically that the relevant recipients receive timely reports.

Supervisors should review a bank’s compliance with the Principles in the preceding sections. Reviews should be incorporated into the regular programme of supervisory reviews and may be supplemented by thematic reviews covering multiple banks with respect to a single or selected issue. Supervisors may test a bank’s compliance with the Principles through occasional requests for information to be provided on selected risk issues (for example, exposures to certain risk factors) within short deadlines, thereby testing the capacity of a bank to aggregate risk data rapidly and produce risk reports. Supervisors should have access to the appropriate reports to be able to perform this review.

Supervisors should draw on reviews conducted by the internal or external auditors to inform their assessments of compliance with the Principles. Supervisors may require work to be carried out by a bank’s internal audit functions or by experts independent from the bank. Supervisors must have access to all appropriate documents such as internal validation and audit reports, and should be able to meet with and discuss risk data aggregation capabilities with the external auditors or independent experts from the bank, when appropriate.

Supervisors should test a bank’s capabilities to aggregate data and produce reports in both stress/crisis and steady-state environments, including sudden sharp increases in business volumes.

Supervisors should require effective and timely remedial action by a bank to address deficiencies in its risk data aggregation capabilities and risk reporting practices and internal controls.

Supervisors should have a range of tools at their disposal to address material deficiencies in a bank’s risk data aggregation and reporting capabilities. Such tools may include, but are not limited to, requiring a bank to take remedial action; increasing the intensity of supervision; requiring an independent review by a third party, such as external auditors; and the possible use of capital add-ons as both a risk mitigant and incentive under Pillar 2.

Supervisors should be able to set limits on a bank’s risks or the growth in their activities where deficiencies in risk data aggregation and reporting are assessed as causing significant weaknesses in risk management capabilities.

For new business initiatives, supervisors may require that banks’ implementation plans ensure that robust risk data aggregation is possible before allowing a new business venture or acquisition to proceed.

When a supervisor requires a bank to take remedial action, the supervisor should set a timetable for completion of the action. Supervisors should have escalation procedures in place to require more stringent or accelerated remedial action in the event that a bank does not adequately address the deficiencies identified, or in the case that supervisors deem further action is warranted.

Effective cooperation and appropriate information sharing between the home and host supervisory authorities should contribute to the robustness of a bank’s risk management practices across a bank’s operations in multiple jurisdictions. Wherever possible, supervisors should avoid performing redundant and uncoordinated reviews related to risk data aggregation and risk reporting.

Cooperation can take the form of sharing of information within the constraints of applicable laws, as well as discussion between supervisors on a bilateral or multilateral basis (eg through colleges of supervisors), including, but not limited to, regular meetings. Communication by conference call and email may be particularly useful in tracking required remedial actions. Cooperation through colleges should be in line with the Basel Committee’s Principles for effective supervisory colleges.³⁹

Supervisors should discuss their experiences regarding the quality of risk data aggregation capabilities and risk reporting practices in different parts of the group. This should include any impediments to risk data aggregation and risk reporting arising from cross-border issues and also whether risk data is distributed appropriately across the group. Such exchanges will enable supervisors to identify significant concerns at an early stage and to respond promptly and effectively.

In addition to the Liquidity Coverage Ratio (LCR) and Net Stable Funding Ratio (NSFR) standards, the minimum quantitative standards that banks must comply with, the Committee has developed a set of liquidity risk monitoring tools to measure other dimensions of a bank’s liquidity and funding risk profile. These tools promote global consistency in supervising ongoing liquidity and funding risk exposures of banks, and in communicating these exposures to home and host supervisors. These metrics capture specific information related to a bank’s cash flows, balance sheet structure, available unencumbered collateral and certain market indicators.

These metrics, together with the LCR and NSFR standard, provide the cornerstone of information that aid supervisors in assessing the liquidity risk of a bank. In addition, supervisors may need to supplement this framework by using additional tools and metrics tailored to help capture elements of liquidity risk specific to their jurisdictions. In utilising these metrics, supervisors should take action when potential liquidity difficulties are signalled through a negative trend in the metrics, or when a deteriorating liquidity position is identified, or when the absolute result of the metric identifies a current or potential liquidity problem. Examples of actions that supervisors can take are outlined in the Committee’s Sound Principles (paragraphs 141-143).⁴⁰

Consistent with their broader liquidity risk management responsibilities, bank management will be responsible for collating and submitting the monitoring data for the tools to their banking supervisor.⁴¹ It is recognised that banks may need to liaise closely with counterparts, including payment system operators and correspondent banks, to collate the data. However, banks and supervisors are not required to disclose these reporting requirements publicly. Public disclosure is not intended to be part of these monitoring tools.

The tools in this chapter are for monitoring purposes only. Internationally active banks must apply these tools. These tools may also be useful in promoting sound liquidity management practices for other banks, whether they are direct participants⁴² of a large-value payment system (LVPS)⁴³ or use a correspondent bank to settle payments. National supervisors will determine the extent to which the tools apply to non-internationally active banks within their jurisdictions.⁴⁴

The intraday monitoring tools should be reported monthly, alongside the LCR reporting requirements (see LCR20.7). Banks should agree with their supervisors the scope of application and reporting arrangements between home and host authorities.⁴⁵

The contractual maturity mismatch profile identifies the gaps between the contractual inflows and outflows of liquidity for defined time bands. These maturity gaps indicate how much liquidity a bank would potentially need to raise in each of these time bands if all outflows occurred at the earliest possible date. This metric provides insight into the extent to which the bank relies on maturity transformation under its current contracts. The metric is defined as contractual cash and security inflows and outflows from all on- and off-balance sheet items, mapped to defined time bands based on their respective maturities.

A bank should report contractual cash and security flows in the relevant time bands based on their residual contractual maturity. Supervisors in each jurisdiction will determine the specific template, including required time bands, by which data must be reported. Supervisors should define the time buckets so as to be able to understand the bank’s cash flow position. Possibilities include requesting the cash flow mismatch to be constructed for the overnight, 7 day, 14 day, 1, 2, 3, 6 and 9 months, 1, 2, 3, 5 and beyond 5 years buckets. Instruments that have no specific maturity (non-defined or open maturity) should be reported separately, with details on the instruments, and with no assumptions applied as to when maturity occurs. Information on possible cash flows arising from derivatives such as interest rate swaps and options should also be included to the extent that their contractual maturities are relevant to the understanding of the cash flows.

At a minimum, the data collected from the contractual maturity mismatch should provide data on the categories outlined in the LCR. Some additional accounting (non-dated) information such as capital or non-performing loans may need to be reported separately.

The following assumptions should be made with regard to contractual cash flows.

1. No rollover of existing liabilities is assumed to take place. For assets, the bank is assumed not to enter into any new contracts.
2. Contingent liability exposures that would require a change in the state of the world (such as contracts with triggers based on a change in prices of financial instruments or a downgrade in the bank's credit rating) need to be detailed, grouped by what would trigger the liability, with the respective exposures clearly identified.
3. A bank should record all securities flows. This will allow supervisors to monitor securities movements that mirror corresponding cash flows as well as the contractual maturity of collateral swaps and any uncollateralised stock lending/borrowing where stock movements occur without any corresponding cash flows.
4. A bank should report separately the customer collateral received that the bank is permitted to rehypothecate as well as the amount of such collateral that is rehypothecated at each reporting date. This also will highlight instances when the bank is generating mismatches in the borrowing and lending of customer collateral.

Banks will provide the raw data to the supervisors, with no assumptions included in the data. Standardised contractual data submission by banks enables supervisors to build a market-wide view and identify market outliers vis-à-vis liquidity.

Given that the metric is based solely on contractual maturities with no behavioural assumptions, the data will not reflect actual future forecasted flows under the current, or future, strategy or plans, ie, under a going-concern view. Also, contractual maturity mismatches do not capture outflows that a bank may make in order to protect its franchise, even where contractually there is no obligation to do so. For analysis, supervisors can apply their own assumptions to reflect alternative behavioural responses in reviewing maturity gaps.

As outlined in the Sound Principles, banks should also conduct their own maturity mismatch analyses, based on going-concern behavioural assumptions of the inflows and outflows of funds in both normal situations and under stress. These analyses should be based on strategic and business plans and should be shared and discussed with supervisors, and the data provided in the contractual maturity mismatch should be utilised as a basis of comparison. When firms are contemplating material changes to their business models, it is crucial for supervisors to request projected mismatch reports as part of an assessment of impact of such changes to prudential supervision. Examples of such changes include potential major acquisitions or mergers or the launch of new products that have not yet been contractually entered into. In assessing such data supervisors need to be mindful of assumptions underpinning the projected mismatches and whether they are prudent.

A bank should be able to indicate how it plans to bridge any identified gaps in its internally generated maturity mismatches and explain why the assumptions applied differ from the contractual terms. The supervisor should challenge these explanations and assess the feasibility of the bank’s funding plans.

This metric is meant to identify those sources of wholesale funding that are of such significance that withdrawal of this funding could trigger liquidity problems. The metric thus encourages the diversification of funding sources recommended in the Committee's Sound Principles. It is defined as follows:

1. Funding liabilities sourced from each significant counterparty as a % of total liabilities
2. Funding liabilities sourced from each significant product / instrument as a % of total liabilities
3. List of asset and liability amounts by significant currency

The numerator for SRP50.14(1) and SRP50.14(2) is determined by examining funding concentrations by counterparty or type of instrument/product. Banks and supervisors should monitor both the absolute percentage of the funding exposure, as well as significant increases in concentrations.

The numerator for counterparties is calculated by aggregating the total of all types of liabilities to a single counterparty or group of connected or affiliated counterparties, as well as all other direct borrowings, both secured and unsecured, which the bank can determine arise from the same counterparty⁴⁶ (such as for overnight commercial paper / certificate of deposit (CP/CD) funding).

A “significant counterparty” is defined as a single counterparty or group of connected or affiliated counterparties accounting in aggregate for more than 1% of the bank's total balance sheet, although in some cases there may be other defining characteristics based on the funding profile of the bank. A group of connected counterparties is, in this context, defined in the same way as in the “Large Exposure” regulation of the host country in the case of consolidated reporting for solvency purposes. Intra-group deposits and deposits from related parties should be identified specifically under this metric, regardless of whether the metric is being calculated at a legal entity or group level, due to the potential limitations to intra-group transactions in stressed conditions.

The numerator for type of instrument/product should be calculated for each individually significant funding instrument/product, as well as by calculating groups of similar types of instruments/products.

A “significant instrument/product” is defined as a single instrument/product or group of similar instruments/products that in aggregate amount to more than 1% of the bank's total balance sheet.

In order to capture the amount of structural currency mismatch in a bank’s assets and liabilities, banks are required to provide a list of the amount of assets and liabilities in each significant currency.

A currency is considered “significant” if the aggregate liabilities denominated in that currency amount to 5% or more of the bank's total liabilities.

The above metrics should be reported separately for the time horizons of less than one month, 1-3 months, 3-6 months, 6-12 months, and for longer than 12 months.

In utilising this metric to determine the extent of funding concentration to a certain counterparty, both the bank and supervisors must recognise that currently it is not possible to identify the actual funding counterparty for many types of debt.⁴⁷ The actual concentration of funding sources, therefore, could likely be higher than this metric indicates. The list of significant counterparties could change frequently, particularly during a crisis. Supervisors should consider the potential for herding behaviour on the part of funding counterparties in the case of an institution-specific problem. In addition, under market-wide stress, multiple funding counterparties and the bank itself may experience concurrent liquidity pressures, making it difficult to sustain funding, even if sources appear well diversified.

In interpreting this metric, one must recognise that the existence of bilateral funding transactions may affect the strength of commercial ties and the amount of the net outflow.⁴⁸

These metrics do not indicate how difficult it would be to replace funding from any given source.

To capture potential foreign exchange risks, the comparison of the amount of assets and liabilities by currency will provide supervisors with a baseline for discussions with the banks about how they manage any currency mismatches through swaps, forwards, etc. It is meant to provide a base for further discussions with the bank rather than to provide a snapshot view of the potential risk.

These metrics provide supervisors with data on the quantity and key characteristics, including currency denomination and location, of banks’ available unencumbered assets. These assets have the potential to be used as collateral to raise additional high-quality liquid assets (HQLA) or secured funding in secondary markets or are eligible at central banks and as such may potentially be additional sources of liquidity for the bank. The metrics are defined as:

1. available unencumbered assets that are marketable as collateral in secondary markets; and
2. available unencumbered assets that are eligible for central banks’ standing facilities.

A bank is to report the amount, type and location of available unencumbered assets that could serve as collateral for secured borrowing in secondary markets at prearranged or current haircuts at reasonable costs.

Likewise, a bank should report the amount, type and location of available unencumbered assets that are eligible for secured financing with relevant central banks at prearranged (if available) or current haircuts at reasonable costs, for standing facilities only (ie excluding emergency assistance arrangements). This would include collateral that has already been accepted at the central bank but remains unused. For assets to be counted in this metric, the bank must have already put in place the operational procedures that would be needed to monetise the collateral.

A bank should report separately the customer collateral received that the bank is permitted to deliver or re-pledge, as well as the part of such collateral that it is delivering or re-pledging at each reporting date.

In addition to providing the total amounts available, a bank should report these items categorised by significant currency. A currency is considered “significant” if the aggregate stock of available unencumbered collateral denominated in that currency amounts 5% or more of the associated total amount of available unencumbered collateral (for secondary markets or central banks).

In addition, a bank must report the estimated haircut that the secondary market or relevant central bank would require for each asset. In the case of the latter, a bank would be expected to reference, under business as usual, the haircut required by the central bank that it would normally access (which likely involves matching funding currency – eg European Central Bank for euro-denominated funding, Bank of Japan for yen funding, etc).

As a second step after reporting the relevant haircuts, a bank should report the expected monetised value of the collateral (rather than the notional amount) and where the assets are actually held, in terms of the location of the assets and what business lines have access to those assets.

These metrics are useful for examining the potential for a bank to generate an additional source of HQLA or secured funding. They will provide a standardised measure of the extent to which the LCR can be quickly replenished after a liquidity shock either via raising funds in private markets or utilising central bank standing facilities. The metrics do not, however, capture potential changes in counterparties’ haircuts and lending policies that could occur under either a systemic or idiosyncratic event and could provide false comfort that the estimated monetised value of available unencumbered collateral is greater than it would be when it is most needed. Supervisors should keep in mind that these metrics do not compare available unencumbered assets to the amount of outstanding secured funding or any other balance sheet scaling factor. To gain a more complete picture, the information generated by these metrics should be complemented with the maturity mismatch metric and other balance sheet data.

While the LCR is required to be met in one single currency, in order to better capture potential currency mismatches, banks and supervisors should also monitor the LCR in significant currencies. This will allow the bank and the supervisor to track potential currency mismatch issues that could arise. This metric is defined as follows.⁴⁹

The definition of the stock of high-quality foreign exchange assets and total net foreign exchange cash outflows should mirror those of the LCR for common currencies.⁵⁰

A currency is considered “significant” if the aggregate liabilities denominated in that currency amount to 5% or more of the bank's total liabilities.

As the foreign currency LCR is not a minimum requirement but a monitoring tool, it does not have an internationally defined minimum required threshold. Nonetheless, supervisors in each jurisdiction could set minimum monitoring ratios for the foreign exchange LCR, below which a supervisor should be alerted. In this case, the ratio at which supervisors should be alerted would depend on the stress assumption. Supervisors should evaluate banks’ ability to raise funds in foreign currency markets and the ability to transfer a liquidity surplus from one currency to another and across jurisdictions and legal entities. Therefore, the ratio should be higher for currencies in which the supervisors evaluate a bank’s ability to raise funds in foreign currency markets or the ability to transfer a liquidity surplus from one currency to another and across jurisdictions and legal entities to be limited.

This metric is meant to allow the bank and supervisor to track potential currency mismatch issues that could arise in a time of stress.

High-frequency market data with little or no time lag can be used as early warning indicators in monitoring potential liquidity difficulties at banks.

While there are many types of data available in the market, supervisors can monitor data at the following levels to focus on potential liquidity difficulties:

1. market-wide information;
2. information on the financial sector; and
3. bank-specific information.

Supervisors can monitor information both on the absolute level and direction of major markets and consider their potential impact on the financial sector and the specific bank. Market-wide information is also crucial when evaluating assumptions behind a bank’s funding plan.

Valuable market information to monitor includes, but is not limited to, equity prices (ie overall stock markets and sub-indices in various jurisdictions relevant to the activities of the supervised banks), debt markets (money markets, medium-term notes, long term debt, derivatives, government bond markets, credit default spread indices, etc); foreign exchange markets, commodities markets, and indices related to specific products, such as for certain securitised products (eg the ABX asset-backed securities index).

To track whether the financial sector as a whole is mirroring broader market movements or is experiencing difficulties, information to be monitored includes equity and debt market information for the financial sector broadly and for specific subsets of the financial sector, including indices.

To monitor whether the market is losing confidence in a particular institution or has identified risks at an institution, it is useful to collect information on equity prices, credit default swap (CDS) spreads, money-market trading prices, the situation of roll-overs and prices for various lengths of funding, the price/yield of bank debenture or subordinated debt in the secondary market.

Information such as equity prices and credit spreads are readily available. However, the accurate interpretation of such information is important. For instance, the same CDS spread in numerical terms may not necessarily imply the same risk across markets due to market-specific conditions such as low market liquidity. Also, when considering the liquidity impact of changes in certain data points, the reaction of other market participants to such information can be different, as various liquidity providers may emphasise different types of data.

A bank’s failure to effectively manage intraday liquidity could leave it unable to meet its payment and settlement obligations on a timely basis, which could lead to liquidity dislocations that cascade quickly across many systems and institutions. As such, the bank’s management of intraday liquidity risk should be considered as a crucial part of liquidity risk management. It should also actively manage its collateral positions and have the ability to calculate all of its collateral positions.

For the purpose of this chapter, the following definitions will apply to the terms stated below.

1. intraday liquidity: funds which can be accessed during the business day, usually to enable banks to make payments in real time;⁵¹
2. business day: the opening hours of the LVPS or of correspondent banking services during which a bank can receive and make payments in a local jurisdiction;
3. intraday liquidity risk: the risk that a bank fails to manage its intraday liquidity effectively, which could leave it unable to meet a payment obligation at the time expected, thereby affecting its own liquidity position and that of other parties; and
4. time-specific obligations: obligations which must be settled at a specific time within the day or have an expected intraday settlement deadline.

The following sets out the main constituent elements of a bank’s intraday liquidity sources and usage.⁵² The list should not be taken as exhaustive.

1. Sources
   1. Own sources
      (i)

      Reserve balances at the central bank;

      (ii)

      Collateral pledged with the central bank or with ancillary systems⁵³ that can be freely converted into intraday liquidity;

      (iii)

      Unencumbered assets on a bank’s balance sheet that can be freely converted into intraday liquidity;

      (iv)

      Secured and unsecured, committed and uncommitted credit lines⁵⁴ available intraday;

      (v)

      Balances with other banks that can be used for intraday settlement.

   2. Other sources
      (i)

      Payments received from other LVPS participants;

      (ii)

      Payments received from ancillary systems;

      (iii)

      Payments received through correspondent banking services.

2. Usage
   1. Payments made to other LVPS participants;
   2. Payments made to ancillary systems;⁵⁵
   3. Payments made through correspondent banking services;
   4. Secured and unsecured, committed and uncommitted credit lines offered intraday;
   5. Contingent payments relating to a payment and settlement system’s failure (eg as an emergency liquidity provider).

In correspondent banking, some customer payments are made across accounts held by the same correspondent bank. These payments do not give rise to an intraday liquidity source or usage for the correspondent bank as they do not link to the payment and settlement systems. However, these “internalised payments” do have intraday liquidity implications for both the sending and receiving customer banks and should be incorporated in their reporting of the monitoring tools.

A number of factors influence a bank’s usage of intraday liquidity in payment and settlement systems and its vulnerability to intraday liquidity shocks. As such, no single monitoring tool can provide supervisors with sufficient information to identify and monitor the intraday liquidity risk run by a bank. To achieve this, seven separate monitoring tools have been developed (see Table 1). As not all of the tools will be relevant to all reporting banks, the tools have been classified in three groups to determine their applicability as follows:

1. Category A: applicable to all reporting banks;
2. Category B: applicable to reporting banks that provide correspondent banking services; and
3. Category C: applicable to reporting banks which are direct participants.

   The set of monitoring tools		Table 1
   Tools applicable to all reporting banks
   A(i)	Daily maximum intraday liquidity usage
   A(ii)	Available intraday liquidity at the start of the business day
   A(iii)	Total payments
   A(iv)	Time-specific obligations
   Tools applicable to reporting banks that provide correspondent banking services
   B(i)	Value of payments made on behalf of correspondent banking customers
   B(ii)	Intraday credit lines extended to customers
   Tool applicable to reporting banks which are direct participants
   C(i)	Intraday throughput

Banks generally manage their intraday liquidity risk on a system-by-system basis in a single currency, but it is recognised that practices differ across banks and jurisdictions, depending on the institutional set up of a bank and the specifics of the systems in which it operates. The following considerations aim to help banks and supervisors determine the most appropriate way to apply the tools. Should banks need further clarification, they should discuss the scope of application with their supervisors.

Banks which are direct participants to an LVPS can manage their intraday liquidity in very different ways. Some banks manage their payment and settlement activity on a system-by-system basis. Others make use of direct intraday liquidity “bridges”⁵⁶ between LVPS, which allow excess liquidity to be transferred from one system to another without restriction. Other formal arrangements exist, which allow funds to be transferred from one system to another (such as agreements for foreign currency liquidity to be used as collateral for domestic systems).

To allow for these different approaches, direct participants should apply a ‘bottom-up’ approach to determine the appropriate basis for reporting the monitoring tools. The following sets out the principles which such banks should follow:

1. As a baseline, individual banks should report on each LVPS in which they participate on a system-by-system-basis;
2. If there is a direct real-time technical liquidity bridge between two or more LVPS, the intraday liquidity in those systems may be considered fungible. At least one of the linked LVPS may therefore be considered an ancillary system for the purpose of the tools;
3. If a bank can demonstrate to the satisfaction of its supervisor that it regularly monitors positions and uses other formal arrangements to transfer liquidity intraday between LVPS which do not have a direct technical liquidity bridge, those LVPS may also be considered as ancillary systems for reporting purposes.

Ancillary systems (eg retail payment systems, CLS, some securities settlement systems and central counterparties), place demands on a bank’s intraday liquidity when these systems settle the bank’s obligations in an LVPS. Consequently, separate reporting requirements will not be necessary for such ancillary systems.

Banks that use correspondent banking services should base their reports on the payment and settlement activity over their account(s) with their correspondent bank(s). Where more than one correspondent bank is used, the bank should report per correspondent bank. For banks which access an LVPS indirectly through more than one correspondent bank, the reporting may be aggregated, provided that the reporting bank can demonstrate to the satisfaction of its supervisor that it is able to move liquidity between its correspondent banks.

Banks which operate as direct participants of an LVPS but which also make use of correspondent banks should discuss whether they can aggregate these for reporting purposes with their supervisor. Aggregation may be appropriate if the payments made directly through the LVPS and those made through the correspondent bank(s) are in the same jurisdiction and same currency.

Banks that manage their intraday liquidity on a currency-by-currency basis should report on an individual currency basis.

If a bank can prove to the satisfaction of its supervisor that it manages liquidity on a cross-currency basis and has the ability to transfer funds intraday with minimal delay – including in periods of acute stress – then the intraday liquidity positions across currencies may be aggregated for reporting purposes. However, banks should also report at an individual currency level so that supervisors can monitor the extent to which firms are reliant on foreign exchange swap markets.

When the level of activity of a bank’s payment and settlement activity in any one particular currency is considered de minimis, with the agreement of the supervisor,⁵⁷ a reporting exemption could apply and separate returns need not be submitted.

The appropriate organisational level for each bank’s reporting of its intraday liquidity data should be determined by the supervisor, but it is expected that the monitoring tools will typically be applied at a significant individual legal entity level. The decision on the appropriate entity should consider any potential impediments to moving intraday liquidity between entities within a group, including the ability of supervisory jurisdictions to ring-fence liquid assets, timing differences and any logistical constraints on the movement of collateral.

Where there are no impediments or constraints to transferring intraday liquidity between two (or more) legal entities intraday, and banks can demonstrate this to the satisfaction of their supervisor, the intraday liquidity requirements of the entities may be aggregated for reporting purposes.

For cross-border banking groups, where a bank operates in LVPS and/or with a correspondent bank(s) outside the jurisdiction where it is domiciled, both home and host supervisors will have an interest in ensuring that the bank has sufficient intraday liquidity to meet its obligations in the local LVPS and/or with its correspondent bank(s).⁵⁸ The allocation of responsibility between home and host supervisor will ultimately depend upon whether the bank operating in the non-domestic jurisdiction does so via a branch or a subsidiary.

1. For a branch operation:
   1. The home (consolidated) supervisor should have responsibility for monitoring through the collection and examination of data that its banking groups can meet their payment and settlement responsibilities in all countries and all currencies in which they operate. The home supervisor should therefore have the option to receive a full set of intraday liquidity information for its banking groups, covering both domestic and non-domestic payment and settlement obligations.
   2. The host supervisor should have the option to require foreign branches in their jurisdiction to report intraday liquidity tools to them, subject to materiality.
2. For a subsidiary active in a non-domestic LVPS and/or correspondent bank(s):
   1. The host supervisor should have primary responsible for receiving the relevant set of intraday liquidity data for that subsidiary.
   2. The supervisor of the parent bank (the home consolidated supervisor) will have an interest in ensuring that a non-domestic subsidiary has sufficient intraday liquidity to participate in all payment and settlement obligations. The home supervisor should therefore have the option to require non-domestic subsidiaries to report intraday liquidity data to them as appropriate.

The daily maximum intraday liquidity usage tool will enable supervisors to monitor a bank’s intraday liquidity usage in normal conditions. It will require banks to monitor the net balance of all payments made and received during the day over their settlement account, either with the central bank (if a direct participant) or over their account held with a correspondent bank (or accounts, if more than one correspondent bank is used to settle payments). The largest net negative position during the business day on the account(s), (ie the largest net cumulative balance between payments made and received), will determine a bank’s maximum daily intraday liquidity usage. The net position should be determined by settlement time stamps (or the equivalent) using transaction-by-transaction data over the account(s). The largest net negative balance on the account(s) can be calculated after close of the business day and does not require real-time monitoring throughout the day.

For illustrative purposes only, the calculation of the tool is shown in Figure 1. A positive net position signifies that the bank has received more payments than it has made during the day. Conversely, a negative net position signifies that the bank has made more payments than it has received.⁵⁹ For direct participants, the net position represents the change in its opening balance with the central bank. For banks that use one or more correspondent banks, the net position represents the change in the opening balance on the account(s) with its correspondent bank(s).

Assuming that a bank runs a negative net position at some point intraday, it will need access to intraday liquidity to fund this balance. The minimum amount of intraday liquidity that a bank would need to have available on any given day would be equivalent to its largest negative net position. (In the illustration above, the intraday liquidity usage would be 10 units.)

Conversely, when a bank runs a positive net cumulative position at some point intraday, it has surplus liquidity available to meet its intraday liquidity obligations. This position may arise because the bank is relying on payments received from other LVPS participants to fund its outgoing payments. (In the illustration above, the largest positive net cumulative position would be 8.6 units.)

Banks should report their three largest daily negative net cumulative positions on their settlement or correspondent account(s) in the reporting period and the daily average of the negative net cumulative position over the period. The largest positive net cumulative positions, and the daily average of the positive net cumulative positions, should also be reported. As the reporting data accumulates, supervisors will gain an indication of the daily intraday liquidity usage of a bank in normal conditions.

The available intraday liquidity at the start of the business day tool will enable supervisors to monitor the amount of intraday liquidity a bank has available at the start of each day to meet its intraday liquidity requirements in normal conditions. Banks should report both the three smallest sums by value of intraday liquidity available at the start of each business day in the reporting period, and the average amount of available intraday liquidity at the start of each business day in the reporting period. The report should also break down the constituent elements of the liquidity sources available to the bank.

Drawing on the liquidity sources set out in SRP50.49 and SRP50.50, banks should discuss and agree with their supervisor the sources of liquidity which they should include in the calculation of this tool. Where banks manage collateral on a cross-currency and/or cross-system basis, liquidity sources not denominated in the currency of the intraday liquidity usage and/or which are located in a different jurisdiction, may be included in the calculation if the bank can demonstrate to the satisfaction of its supervisor that the collateral can be transferred intraday freely to the system where it is needed.

As the reporting data accumulates, supervisors will gain an indication of the amount of intraday liquidity available to a bank to meet its payment and settlement obligations in normal conditions.

The total payments tool will enable supervisors to monitor the overall scale of a bank’s payment activity. For each business day in a reporting period, banks should calculate the total of their gross payments sent and received in the LVPS and/or, where appropriate, across any account(s) held with a correspondent bank(s). Banks should report the three largest daily values for gross payments sent and received in the reporting period and the average daily figure of gross payments made and received in the reporting period.

The time-specific obligations tool will enable supervisors to gain a better understanding of a bank’s time specific obligations.⁶⁰ Failure to settle such obligations on time could result in financial penalty, reputational damage to the bank or loss of future business.

Banks should calculate the total value of time-specific obligations that they settle each day and report the three largest daily total values and the average daily total value in the reporting period to give supervisors an indication of the scale of these obligations.

A sample reporting template for banks that use correspondent banks (but do not provide correspondent banking services nor are direct participants), and so report only these monitoring tools, is provided in Table 2.

The value of payments made on behalf of correspondent banking customers⁶² tool will enable supervisors to gain a better understanding of the proportion of a correspondent bank’s payment flows that arise from its provision of correspondent banking services. These flows may have a significant impact on the correspondent bank’s own intraday liquidity management.⁶³

Correspondent banks should calculate the total value of payments they make on behalf of all customers of their correspondent banking services each day and report the three largest daily total values and the daily average total value of these payments in the reporting period.

The intraday credit lines extended to customers⁶⁴ tool will enable supervisors to monitor the scale of a correspondent bank’s provision of intraday credit to its customers. Correspondent banks should report the three largest intraday credit lines extended to their customers in the reporting period, including whether these lines are secured or committed and the use of those lines at peak usage.⁶⁵

A sample reporting template for banks that relates to their provision of correspondent banking services is provided in Table 3.

The intraday throughput tool will enable supervisors to monitor the throughput of a direct participant’s daily payments activity across its settlement account. Direct participants should report the daily average in the reporting period of the percentage of their outgoing payments (relative to total payments) that settle by specific times during the day, by value within each hour of the business day.⁶⁷ Over time, this will enable supervisors to identify any changes in a bank’s payment and settlement behaviour.

A sample reporting template for banks that are direct participants (and which do not use nor provide correspondent banking services) is provided in Table 4.

The monitoring tools in SRP50.64 to SRP50.81 will provide banking supervisors with information on a bank’s intraday liquidity profile in normal conditions. However, the availability and usage of intraday liquidity can change markedly in times of stress. In the course of their discussions on broader liquidity risk management, banks and supervisors should also consider the impact of a bank’s intraday liquidity requirements in stress conditions. As guidance, four possible (but non-exhaustive) stress scenarios have been identified and are described below.⁶⁹ Banks should determine with their supervisor which of the scenarios (or other scenarios) are relevant to their particular circumstances and business model.