Sub-Section 2

Member States shall ensure that the management body approves and periodically reviews the strategies and policies for taking up, managing, monitoring and mitigating the risks the institution is or might be exposed to, including those posed by the macroeconomic environment in which it operates in relation to the status of the business cycle. Member States shall ensure that the management body devotes sufficient time to consideration of risk issues. The management body shall be actively involved in and ensure that adequate resources are allocated to the management of all material risks addressed in this Directive and in Regulation (EU) No 575/2013 as well as in the valuation of assets, the use of external credit ratings and internal models relating to those risks. The institution shall establish reporting lines to the management body that cover all material risks and risk management policies and changes thereof. Member States shall ensure that institutions that are significant in terms of their size, internal organisation and the nature, scope and complexity of their activities establish a risk committee composed of members of the management body who do not perform any executive function in the institution concerned. Members of the risk committee shall have appropriate knowledge, skills and expertise to fully understand and monitor the risk strategy and the risk appetite of the institution. The risk committee shall advise the management body on the institution's overall current and future risk appetite and strategy and assist the management body in overseeing the implementation of that strategy by senior management. The management body shall retain overall responsibility for risks. The risk committee shall review whether prices of liabilities and assets offered to clients take fully into account the institution's business model and risk strategy. Where prices do not properly reflect risks in accordance with the business model and risk strategy, the risk committee shall present a remedy plan to the management body. Competent authorities may allow an institution which is not considered significant as referred to in the first subparagraph to combine the risk committee with the audit committee as referred to in Article 41 of Directive 2006/43/EC. Members of the combined committee shall have the knowledge, skills and expertise required for the risk committee and for the audit committee. Member States shall ensure that the management body in its supervisory function and, where a risk committee has been established, the risk committee have adequate access to information on the risk situation of the institution and, if necessary and appropriate, to the risk management function and to external expert advice. The management body in its supervisory function and, where one has been established, the risk committee shall determine the nature, the amount, the format, and the frequency of the information on risk which it is to receive. In order to assist in the establishment of sound remuneration policies and practices, the risk committee shall, without prejudice to the tasks of the remuneration committee, examine whether incentives provided by the remuneration system take into consideration risk, capital, liquidity and the likelihood and timing of earnings. Member States shall, in accordance with the proportionality requirement laid down in Article 7(2) of Commission Directive 2006/73/EC Commission Directive 2006/73/EC of 10 August 2006 implementing Directive 2004/39/EC of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive (OJ L 241, 2.9.2006, p. 26). , ensure that institutions have a risk management function independent from the operational functions and which shall have sufficient authority, stature, resources and access to the management body. Member States shall ensure that the risk management function ensures that all material risks are identified, measured and properly reported. They shall ensure that the risk management function is actively involved in elaborating the institution's risk strategy and in all material risk management decisions and that it can deliver a complete view of the whole range of risks of the institution. Where necessary, Member States shall ensure that the risk management function can report directly to the management body in its supervisory function, independent from senior management, and can raise concerns and warn that body, where appropriate, where specific risk developments affect or may affect the institution, without prejudice to the responsibilities of the management body in its supervisory and/or managerial functions pursuant to this Directive and Regulation (EU) No 575/2013. The head of the risk management function shall be an independent senior manager with distinct responsibility for the risk management function. Where the nature, scale and complexity of the activities of the institution do not justify a specially appointed person, another senior person within the institution may fulfil that function, provided there is no conflict of interest. The head of the risk management function shall not be removed without prior approval of the management body in its supervisory function and shall be able to have direct access to the management body in its supervisory function where necessary. The application of this Directive shall be without prejudice to the application of Directive 2006/73/EC to investment firms. Competent authorities shall encourage institutions that are significant in terms of their size, internal organisation and the nature, scale and complexity of their activities to develop internal credit risk assessment capacity and to increase use of the internal ratings based approach for calculating own funds requirements for credit risk where their exposures are material in absolute terms and where they have at the same time a large number of material counterparties. This Article shall be without prejudice to the fulfilment of criteria laid down in Part Three, Title I, Chapter 3, Section 1 of Regulation (EU) No 575/2013. Competent authorities shall, taking into account the nature, scale and complexity of institutions' activities, monitor that they do not solely or mechanistically rely on external credit ratings for assessing the creditworthiness of an entity or financial instrument. Competent authorities shall encourage institutions, taking into account their size, internal organisation and the nature, scale and complexity of their activities, to develop internal specific risk assessment capacity and to increase use of internal models for calculating own funds requirements for specific risk of debt instruments in the trading book, together with internal models to calculate own funds requirements for default and migration risk where their exposures to specific risk are material in absolute terms and where they have a large number of material positions in debt instruments of different issuers. This Article shall be without prejudice to the fulfilment of the criteria laid down in Part Three, Title IV, Chapter 5, Sections 1 to 5, of Regulation (EU) No 575/2013. EBA shall develop draft regulatory technical standards to further define the notion 'exposures to specific risk which are material in absolute terms' referred to in the first subparagraph of paragraph 3 and the thresholds for large numbers of material counterparties and positions in debt instruments of different issuers. EBA shall submit those draft regulatory technical standards to the Commission by 1 January 2014. Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. Competent authorities shall ensure that institutions permitted to use internal approaches for the calculation of risk weighted exposure amounts or own fund requirements except for operational risk report the results of the calculations of their internal approaches for their exposures or positions that are included in the benchmark portfolios. Institutions shall submit the results of their calculations, together with an explanation of the methodologies used to produce them, to the competent authorities at an appropriate frequency, and at least annually. Competent authorities shall ensure that institutions submit the results of the calculations referred to in paragraph 1 in accordance with the template developed by EBA in accordance with paragraph 8 to the competent authorities and to EBA. Where competent authorities choose to develop specific portfolios, they shall do so in consultation with EBA and ensure that institutions report the results of the calculations separately from the results of the calculations for EBA portfolios. Competent authorities shall, on the basis of the information submitted by institutions in accordance with paragraph 1, monitor the range of risk weighted exposure amounts or own funds requirements, as applicable, except for operational risk, for the exposures or transactions in the benchmark portfolio resulting from the internal approaches of those institutions. At least annually, competent authorities shall make an assessment of the quality of those approaches paying particular attention to: those approaches that exhibit significant differences in own fund requirements for the same exposure; approaches where there is particularly high or low diversity, and also where there is a significant and systematic under-estimation of own funds requirements. EBA shall produce a report to assist the competent authorities in the assessment of the quality of the internal approaches based on the information referred to in paragraph 2. Where particular institutions diverge significantly from the majority of their peers or where there is little commonality in approach leading to a wide variance of results, competent authorities shall investigate the reasons therefor and, if it can be clearly identified that an institution's approach leads to an underestimation of own funds requirements which is not attributable to differences in the underlying risks of the exposures or positions, shall take corrective action. The competent authorities shall ensure that their decisions on the appropriateness of corrective actions as referred to in paragraph 4 comply with the principle that such actions must maintain the objectives of an internal approach and therefore do not: lead to standardisation or preferred methods; create wrong incentives; or cause herd behaviour. EBA may issue guidelines and recommendations in accordance with Article 16 of Regulation (EU) No 1093/2010 where it considers them necessary on the basis of the information and assessments referred to in paragraphs 2 and 3 of this Article in order to improve supervisory practices or practices of institutions with regard to internal approaches. EBA shall develop draft regulatory technical standards to specify: the procedures for sharing assessments made in accordance with paragraph 3 between the competent authorities and with EBA; the standards for the assessment made by competent authorities referred to in paragraph 3. EBA shall submit those draft regulatory technical standards to the Commission by 1 January 2014. Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. EBA shall develop draft implementing technical standards to specify: the template, the definitions and the IT-solutions to be applied in the Union for the reporting referred to in paragraph 2; the benchmark portfolio or portfolios referred to in paragraph 1. EBA shall submit those draft implementing technical standards to the Commission by 1 January 2014. Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 15 of Regulation (EU) No 1093/2010. The Commission shall, by 1 April 2015 and after consulting EBA, submit a report to the European Parliament and to the Council on the functioning of the benchmarking of internal models including the scope of the model. Where appropriate, the report shall be followed by a legislative proposal. Competent authorities shall ensure that: credit-granting is based on sound and well-defined criteria and that the process for approving, amending, renewing, and re-financing credits is clearly established; institutions have internal methodologies that enable them to assess the credit risk of exposures to individual obligors, securities or securitisation positions and credit risk at the portfolio level. In particular, internal methodologies shall not rely solely or mechanistically on external credit ratings. Where own funds requirements are based on a rating by an External Credit Assessment Institution (ECAI) or based on the fact that an exposure is unrated, this shall not exempt institutions from additionally considering other relevant information for assessing their allocation of internal capital; the ongoing administration and monitoring of the various credit risk-bearing portfolios and exposures of institutions, including for identifying and managing problem credits and for making adequate value adjustments and provisions, is operated through effective systems; diversification of credit portfolios is adequate given an institution's target markets and overall credit strategy. Competent authorities shall ensure that the risk that recognised credit risk mitigation techniques used by institutions prove less effective than expected is addressed and controlled including by means of written policies and procedures. Competent authorities shall ensure that the concentration risk arising from exposures to each counterparty, including central counterparties, groups of connected counterparties, and counterparties in the same economic sector, geographic region or from the same activity or commodity, the application of credit risk mitigation techniques, and including in particular risks associated with large indirect credit exposures such as a single collateral issuer, is addressed and controlled including by means of written policies and procedures. Competent authorities shall ensure that the risks arising from securitisation transactions in relation to which the credit institutions are investor, originator or sponsor, including reputational risks, such as arise in relation to complex structures or products, are evaluated and addressed through appropriate policies and procedures, to ensure that the economic substance of the transaction is fully reflected in the risk assessment and management decisions. Competent authorities shall ensure that liquidity plans to address the implications of both scheduled and early amortisation exist at institutions which are originators of revolving securitisation transactions involving early amortisation provisions. Competent authorities shall ensure that policies and processes for the identification, measurement and management of all material sources and effects of market risks are implemented. Where the short position falls due before the long position, competent authorities shall ensure that institutions also take measures against the risk of a shortage of liquidity. The internal capital shall be adequate for material market risks that are not subject to an own funds requirement. Institutions, which have, in calculating own funds requirements for position risk in accordance with Part Three, Title IV, Chapter 2, of Regulation (EU) No 575/2013, netted off their positions in one or more of the equities constituting a stock-index against one or more positions in the stock-index future or other stock-index product shall have adequate internal capital to cover the basis risk of loss caused by the future's or other product's value not moving fully in line with that of its constituent equities. Institutions shall also have such adequate internal capital where they hold opposite positions in stock-index futures which are not identical in respect of either their maturity or their composition or both. Where using the treatment in Article 345 of Regulation (EU) No 575/2013, institutions shall ensure that they hold sufficient internal capital against the risk of loss which exists between the time of the initial commitment and the following working day. Competent authorities shall ensure that institutions implement systems to identify, evaluate and manage the risk arising from potential changes in interest rates that affect an institution's non-trading activities. Competent authorities shall ensure that institutions implement policies and processes to evaluate and manage the exposure to operational risk, including model risk, and to cover low-frequency high-severity events. Institutions shall articulate what constitutes operational risk for the purposes of those policies and procedures. Competent authorities shall ensure that contingency and business continuity plans are in place to ensure an institution's ability to operate on an ongoing basis and limit losses in the event of severe business disruption. Competent authorities shall ensure that institutions have robust strategies, policies, processes and systems for the identification, measurement, management and monitoring of liquidity risk over an appropriate set of time horizons, including intra-day, so as to ensure that institutions maintain adequate levels of liquidity buffers. Those strategies, policies, processes and systems shall be tailored to business lines, currencies, branches and legal entities and shall include adequate allocation mechanisms of liquidity costs, benefits and risks. The strategies, policies, processes and systems referred to in paragraph 1 shall be proportionate to the complexity, risk profile, scope of operation of the institutions and risk tolerance set by the management body and reflect the institution's importance in each Member State in which it carries out business. Institutions shall communicate risk tolerance to all relevant business lines. Competent authorities shall ensure that institutions, taking into account the nature, scale and complexity of their activities, have liquidity risk profiles that are consistent with and, not in excess of, those required for a well-functioning and robust system. Competent authorities shall monitor developments in relation to liquidity risk profiles, for example product design and volumes, risk management, funding policies and funding concentrations. Competent authorities shall take effective action where developments referred to in the second subparagraph may lead to individual institution or systemic instability. Competent authorities shall inform EBA about any actions carried out pursuant to the third subparagraph. EBA shall make recommendations where appropriate in accordance with Regulation (EU) No 1093/2010. Competent authorities shall ensure that institutions develop methodologies for the identification, measurement, management and monitoring of funding positions. Those methodologies shall include the current and projected material cash-flows in and arising from assets, liabilities, off-balance-sheet items, including contingent liabilities and the possible impact of reputational risk. Competent authorities shall ensure that institutions distinguish between pledged and unencumbered assets that are available at all times, in particular during emergency situations. They shall also ensure that institutions take into account the legal entity in which assets reside, the country where assets are legally recorded either in a register or in an account and their eligibility and shall monitor how assets can be mobilised in a timely manner. Competent authorities shall ensure that institutions also have regard to existing legal, regulatory and operational limitations to potential transfers of liquidity and unencumbered assets amongst entities, both within and outside the European Economic Area. Competent authorities shall ensure that institutions consider different liquidity risk mitigation tools, including a system of limits and liquidity buffers in order to be able to withstand a range of different stress events and an adequately diversified funding structure and access to funding sources. Those arrangements shall be reviewed regularly. Competent authorities shall ensure that institutions consider alternative scenarios on liquidity positions and on risk mitigants and review the assumptions underlying decisions concerning the funding position at least annually. For those purposes, alternative scenarios shall address, in particular, off-balance sheet items and other contingent liabilities, including those of Securitisation Special Purpose Entities (SSPE) or other special purpose entities, as referred to in Regulation (EU) No 575/2013, in relation to which the institution acts as sponsor or provides material liquidity support. Competent authorities shall ensure that institutions consider the potential impact of institution-specific, market-wide and combined alternative scenarios. Different time periods and varying degrees of stress conditions shall be considered. Competent authorities shall ensure that institutions adjust their strategies, internal policies and limits on liquidity risk and develop effective contingency plans, taking into account the outcome of the alternative scenarios referred to in paragraph 8. Competent authorities shall ensure that institutions have in place liquidity recovery plans setting out adequate strategies and proper implementation measures in order to address possible liquidity shortfalls, including in relation to branches established in another Member State. Competent authorities shall ensure that those plans are tested by the institutions at least annually, updated on the basis of the outcome of the alternative scenarios set out in paragraph 8, reported to and approved by senior management, so that internal policies and processes can be adjusted accordingly. Institutions shall take the necessary operational steps in advance to ensure that liquidity recovery plans can be implemented immediately. For credit institutions, such operational steps shall include holding collateral immediately available for central bank funding. This includes holding collateral where necessary in the currency of another Member State, or the currency of a third country to which the credit institution has exposures, and where operationally necessary within the territory of a host Member State or of a third country to whose currency it is exposed. Competent authorities shall ensure that institutions have policies and processes in place for the identification, management and monitoring of the risk of excessive leverage. Indicators for the risk of excessive leverage shall include the leverage ratio determined in accordance with Article 429 of Regulation (EU) No 575/2013 and mismatches between assets and obligations. Competent authorities shall ensure that institutions address the risk of excessive leverage in a precautionary manner by taking due account of potential increases in the risk of excessive leverage caused by reductions of the institution's own funds through expected or realised losses, depending on the applicable accounting rules. To that end, institutions shall be able to withstand a range of different stress events with respect to the risk of excessive leverage.

← art_75__para_3__text_1 · All articles · Artikel 76 →

Source: EUR-Lex (Cellar) · retrieved 2026-09-25 · Text as adopted (Official Journal); later amendments are not incorporated in this text.