1. When verifying an institution’s compliance with the requirements set out in Articles 325bh, 325bi, 325bn, 325bo, and 325bp of Regulation (EU) No 575/2013, competent authorities shall assess:
(a)
the governance aspects, in accordance with Chapter 2 of this Regulation;
(b)
aspects relating to the internal risk-measurement model used to compute the expected shortfall measure and the stress scenario risk measure, in accordance with Chapter 3 of this Regulation;
(c)
aspects relating to the internal default risk model used to compute the additional own funds requirement for default risk, in accordance with Chapter 4 of this Regulation.
For the purposes of the first subparagraph, competent authorities shall apply the principles related to proportionality in accordance with Article 2, the quality of the documentation in accordance with Article 3, and the outsourcing arrangements in accordance with Article 4.
2. A competent authority that identifies, as part of the assessment performed in accordance with this Regulation, significant deficiencies in the internal risk-measurement model in relation to some product classes in a given trading desk, or that cannot confirm that that model has a proven track record of being reasonably accurate in measuring the risks corresponding to those product classes, may do either of the following:
(a)
require the institution to remove the positions corresponding to those product classes from that trading desk;
(b)
refuse to grant permission to calculate the own funds requirements in accordance with the internal model approach for that trading desk.
3. A competent authority that comes to the conclusion that product classes in a given trading desk are booked back-to-back with those of another entity of the group that is outside the scope of the highest level of consolidation within the Union, and that such back-to-back booking hinders the competent authority to assess whether the internal risk-measurement model has a proven track record of being reasonably accurate in measuring risks corresponding to those product classes, may do either of the following:
(a)
require the institution to remove the positions corresponding to those product classes from that trading desk;
(b)
refuse to grant the permission to calculate the own funds requirements in accordance with the internal model approach for that trading desk.
4. Where the market risk of positions corresponding to some product classes is transferred to another entity of the group that is outside the scope of the highest level of consolidation within the Union, and where the effects of such a transfer de facto resemble those of positions booked back-to-back, the competent authority may apply paragraph 3.
Proportionality – product categories and model complexities
Competent authorities shall apply the assessment methodology set out in this Regulation in a manner that is proportionate to the size and complexity of the trading activities included in the internal model, based on the following categories of financial instruments in increasing order of complexity:
(a)
simple instruments without optionality;
(b)
instruments, other than those referred to in point (a), without path-dependent features, on a single underlying, including indices, with a continuous payoff in the same currency as the underlying;
(c)
instruments with path-dependent features, instruments on multiple underlyings, instruments with payoffs in currencies that are different to that of the underlying, and any other instruments that are not referred to in points (a) or (b).
Competent authorities shall verify that the documentation submitted by an institution in support of its application for permission to use an internal model for the calculation of own funds requirements for market risk is of sufficient quality and is sufficiently detailed and accurate to allow for examination by qualified third parties.
Competent authorities shall in particular verify that:
(a)
the documentation concerned is approved at the appropriate management level of the institution with sufficient authority delegated by the management body for the purposes of internal models;
(b)
the institution has established policies which ensure high-quality standards for internal documentation, including internal accountability to ensure that the documentation concerned is complete, consistent, accurate, updated, approved in accordance with point (a), and secure;
(c)
the documentation set out in the policies referred to in point (b) provides for the identification of the type of document, the author, the reviewer, the authorising agent, the owner, the dates of development and approval, the version number, and the history of amendments;
(d)
the institution accurately and diligently documents the policies, procedures, and methodologies it applies pursuant to this Regulation;
(e)
the documentation concerned is sufficiently detailed to enable qualified third parties to understand all aspects of the internal risk-measurement model.
1. Competent authorities shall verify that the outsourcing by an institution of any tasks, activities or functions related to the design, implementation, and validation of internal models does not prevent or hinder the application of the assessment methodology set out in this Regulation.
2. For the purposes of paragraph 1, competent authorities shall verify whether:
(a)
tasks and responsibilities reserved for the risk control unit are not outsourced;
(b)
the senior management and the management body are actively involved in the supervision of any tasks outsourced by the institution, and in the acquisition of any IT risk management tool solutions from third parties;
(c)
the institution itself has sufficient knowledge about any outsourced tasks, activities or functions and of the structure of any data and methodologies obtained from a third party, and is able to verify the quality of the work performed by the third party to which it outsources its tasks, as well as the results of that work;
(d)
the internal audit and the ongoing monitoring by the institution of any outsourced tasks, activities and functions are not limited or inhibited by such outsourcing;
(e)
full access to all relevant information is granted to competent authorities.
3. Competent authorities shall verify that third parties involved in the development of methodologies for assessing market risk used by the institution are not involved in the initial or ongoing internal validation of the model by the institution.
4. For the purposes of paragraphs 1, 2 and 3, competent authorities shall review the outsourcing agreement between the institution and the third party. Where appropriate, competent authorities may also:
(a)
interview or require the submission of written statements from any of the following:
(i)
staff and senior management of the institution;
(ii)
the management body of the institution;
(iii)
the third party to whom the task, activity or function have been outsourced;
(b)
review other relevant documents of the institution or the third party.
