Assessment of compliance with requirements to use the Internal Ratings Based Approach
1. Competent authorities shall apply this Regulation for the assessment of the compliance of an institution with the requirements to use the Internal Ratings Based Approach (‘IRB Approach’) as follows:
(a)
for the purposes of assessing initial applications for permission to use the IRB Approach as provided for in Article 144 of Regulation (EU) No 575/2013, competent authorities shall apply all provisions of this Regulation;
(b)
for the purposes of assessing applications for permission to extend the IRB Approach in accordance with the approved sequential implementation plan as provided for in Article 148 of Regulation (EU) No 575/2013, competent authorities shall apply Chapters 4, 5, 7 and 8 and any other part of this Regulation that is relevant to that request;
(c)
for the purposes of assessing applications for prior permission to carry out changes as referred to in Article 143(3) of Regulation (EU) No 575/2013, competent authorities shall apply all parts of this Regulation that are relevant to those changes;
(d)
for the purposes of assessing changes to rating systems and internal models approaches to equity exposures which have been notified in accordance with Article 143(4) of Regulation (EU) No 575/2013, competent authorities shall apply all parts of this Regulation that are relevant to those changes;
(e)
for the purposes of conducting ongoing reviews of the use of the IRB Approach pursuant to Article 101 of Directive 2013/36/EU, competent authorities shall apply all parts of this Regulation that are relevant to that review;
(f)
for the purposes of assessing applications for permission to revert to the use of less sophisticated approaches in accordance with Article 149 of Regulation (EU) No 575/2013, competent authorities shall apply Articles 6 to 8 of this Regulation.
2. In addition to the criteria laid down in the provisions of this Regulation referred to in paragraph 1, the competent authorities shall verify any other relevant criteria necessary for the assessment of the compliance with the requirements to use the IRB Approach.
Methods to be applied by competent authorities
1. For the purposes of assessing initial applications for permission to use the IRB Approach, competent authorities shall apply all compulsory methods set out in this Regulation. They may also apply other methods set out in this Regulation in accordance with paragraph 7 and any other methods in accordance with paragraph 8.
2. For the purposes of assessing applications for permission to extend the IRB Approach in accordance with a sequential implementation plan, competent authorities shall apply all compulsory methods set out in Chapters 4, 5, 7 and 8. They may also apply other methods set out in this Regulation in accordance with paragraph 7 and any other methods in accordance with paragraph 8.
3. For the purposes of assessing applications for prior permission to carry out changes to the IRB Approach, competent authorities shall review the documents required to be submitted by institutions with regards to the change in accordance with Article 8 of Delegated Regulation (EU) No 529/2014. They may also apply any methods set out in this Regulation in accordance with paragraphs 7 and any other methods in accordance with paragraph 8.
4. For the purposes of assessing changes to rating systems and internal models approaches to equity exposures which have been notified, competent authorities shall review the documents required to be submitted by institutions with regard to the change in accordance with Article 8 of Delegated Regulation (EU) No 529/2014 and may apply any methods set out in this Regulation in accordance with paragraph 7 and any other methods in accordance with paragraph 8.
5. For the purposes of conducting ongoing reviews of the use of the IRB Approach, competent authorities may apply any methods set out in this Regulation in accordance with paragraph7 and any other methods in accordance with paragraph 8.
6. For the purposes of assessing the applications to revert to the use of less sophisticated approaches, competent authorities may apply any of the methods set out in Chapter 2 of this Regulation in accordance with paragraph 7 and any other methods in accordance with paragraph 8.
7. Where this Regulation provides for optional use of methods, the competent authorities may apply any of those methods which are suitable and appropriate to the nature, size and degree of complexity of the institution’s business and organisational structure, taking into account:
(a)
the materiality of the types of exposures covered by rating systems;
(b)
the complexity of the rating models and risk parameters and their implementation.
8. In addition to the methods set out in this Regulation, competent authorities may use other methods, which are suitable and appropriate to the nature, size and degree of complexity of the institution's business and organisational structure, where this is necessary for the assessment of compliance with the requirements to use the IRB Approach.
9. When applying the methods set out in this Regulation, competent authorities may take into account results from recent assessments made by themselves or by other competent authorities, if those assessments fulfil both of the following conditions:
(a)
the assessment was based wholly or in part on the compulsory methods;
(b)
the subject of the assessment included the same or a similar rating system in the same class of exposures.
Quality of documentation
1. In order to verify the compliance of the institution with the documentation requirement set out in point (e) of Article 144(1) of Regulation (EU) No 575/2013, competent authorities shall verify that the documentation of the rating systems as defined in point (1) of Article 142(1) of Regulation (EU) No 575/2013 (‘rating systems’):
(a)
is sufficiently detailed and accurate for it to be efficiently used;
(b)
is approved at the appropriate management level of the institution;
(c)
contains, with regard to each document, at least a record of the type of document, the author, the reviewer, the authorising agent, the owner, the dates of development and of approval, the version number and the history of changes to the document;
(d)
allows third parties to examine and confirm the functioning of the rating systems and, in particular, to examine and confirm that:
(i)
the documentation of the rating system design is sufficiently detailed to allow third parties to understand the reasoning behind all aspects of the rating system, including the assumptions, the mathematical formulas and, where human judgement is involved, the decisions, as well as the procedures for the development of the rating system;
(ii)
the documentation of the rating system is sufficiently detailed to allow third parties to understand the operation, limitations and key assumptions of each rating model and each risk parameter and to replicate the model development;
(iii)
the documentation of the rating process is sufficiently detailed to allow third parties to understand the method of assigning exposures to grades or pools and their actual assignment to grades or pools and to replicate the assignment.
2. For the purposes of paragraph 1, the competent authority shall verify that the institution has in place policies outlining specific standards for documentation ensuring:
(a)
that the internal documentation is sufficiently detailed and accurate;
(b)
that specific persons or units are assigned responsibility to ensure that the documentation is complete, consistent, accurate, updated, approved as appropriate and secure;
(c)
that the institution adequately documents its policies, procedures and methodologies relating to the application of the IRB Approach.
Third party involvement
1. In order to assess compliance with the requirement regarding the soundness and the integrity of the rating systems laid down in Article 144(1) of Regulation (EU) No 575/2013 where an institution has delegated tasks, activities or functions relating to the design, implementation and validation of its rating systems to a third party, or has purchased a rating system or pooled data from a third party, the competent authority shall verify that that delegation or purchase does not hinder the application of this Regulation and shall verify that:
(a)
senior management of the institution as defined in point (9) of Article 3(1) of Directive 2013/36/EU (‘senior management’) as well as the management body of the institution or the committee designated by that management body are actively involved in the supervision and decision-making regarding the tasks, activities or functions delegated to the third party or regarding the rating systems obtained from third parties;
(b)
the staff of the institution has sufficient knowledge and understanding of the tasks, activities or functions delegated to third parties and of the structure of data and rating systems obtained from third parties;
(c)
continuity of the outsourced functions or processes is ensured, including by means of appropriate contingency planning;
(d)
internal audit or other control of the tasks, activities and functions delegated to third parties is not limited or inhibited by the involvement of the third party;
(e)
the competent authority is granted full access to all relevant information.
2. Where a third party is involved in the tasks of developing a rating system and risk estimation for an institution, the competent authority shall verify that:
(a)
points (a) to (e) of paragraph 1 are satisfied;
(b)
the validation activities with regard to those rating systems and those risk estimates are not performed by that third party;
(c)
the third party provides the institution with the information necessary for those validation activities to be performed.
3. Where, for the purposes of developing a rating system and risk parameter estimation, the institution uses data that is pooled across institutions, and a third party develops the rating system, the third party may assist the institution in its validation activities by performing those tasks of validation which require access to the pooled data.
4. For the purposes of applying paragraphs 1, 2 and 3, competent authorities shall apply all of the following methods:
(a)
review the agreements with the third party and other relevant documents which specify the tasks of the third party;
(b)
obtain written statements from or interview the relevant staff of the institution or the third party to whom the task, activity or function is delegated;
(c)
obtain written statements from or interview senior management or the management body of the institution or the third party to whom the task, activity or function is delegated, or the committee of the institution designated by the management body;
(d)
review other relevant documents of the institution or of the third party, where necessary.
Temporary non-compliance with the requirements of the IRB Approach
For the purposes of the application of Article 146(a) of Regulation (EU) No 575/2013, the competent authority shall:
(a)
review whether the institution’s plan for a timely return to compliance is sufficient to remedy the non-compliance and whether the time schedule is reasonable taking into account all of the following:
(i)
the materiality of the non-compliance;
(ii)
the extent of the measures required to return to compliance;
(iii)
the resources available to the institution;
(b)
monitor on a regular basis the progress in the realisation of the institution’s plan for a timely return to compliance;
(c)
verify the institution’s compliance with the relevant requirements after the implementation of the plan, by applying the assessment methodologies laid down in this Regulation.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
