## INTRODUCTION AND METHODOLOGY (cr18233)

## Source details

**Canonical URL:** [INTRODUCTION AND METHODOLOGY (cr18233)](https://www.imf.org/-/media/files/publications/cr/2018/cr18233.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/cr/2018/cr18233.pdf.md)
- [Structured JSON version](/-/media/files/publications/cr/2018/cr18233.pdf.json)

---

### Summary and main findings (points 1–10)
- SSM set up a little over three years ago and has developed into a coherent banking supervision mechanism across the 19 Euro Area Member States.
- ECB banking supervision: clear mandate and operational independence; well‑defined supervisory methodology and processes (SREP, RAS, SEP, SSM Supervisory Manual).
- Operational challenges:
  - Decision‑making processes are complex and can impede timely supervisory action; emergency procedures work.
  - Gaps and asymmetries in the EU regulatory framework; supervisory powers insufficiently harmonized for consistent supervision across the Euro Area.
  - Volume, quality, and availability of resources for SI supervision are variable and largely beyond ECB control (NCAs provide bulk of staff).
- Progress and tensions:
  - Supervisory Board has taken steps to streamline decision‑making and harmonize options/discretions for SIs, but further harmonization requires EU law changes.
  - ECB has raised supervisory intensity and intrusiveness; strengthened risk‑based capital and liquidity buffers; NPL ratios showing winding back but remain a material profitability and legacy issue.
- Communication and expectations:
  - ECB publishes supervisory guides and a condensed SSM Supervisory Manual (March 2018); recommended to publish expectations where EU law is silent (major acquisitions, loan classification and provisioning, concentration, country/transfer risk, related‑party risk, operational risk).

### A. Main findings (responsibility, objectives, powers, independence, accountability)
- Legal and institutional allocation:
  - ECB has broad powers under the CRR and SSMR and may apply CRD IV powers as transposed into national law; many options/discretions remain with NCAs or Member States.
  - Harmonization of Member State options/discretions requires amendments to EU law.
- Perimeter gaps and asymmetries:
  - Investment firms undertaking “bank like” business often remain supervised nationally even when significant and cross‑border.
  - Euro Area branches of non‑EU/EEA banks are not subject to ECB authorization/supervision nor to CRD IV/CRR at EU level.
- Independence and delegation:
  - ECB banking supervision independence is enshrined in law; decision making routed to Governing Council often via “no objections” with a 10 working day window. A delegation framework shortens timetables for routine decisions.
- Resourcing:
  - SEP structures resource needs but ECB lacks full control over NCA staff allocation and availability; NCA staff generally not full‑time on SI supervision.
- Licensing and approvals:
  - ECB is licensing authority for credit institutions but NCAs are fully integrated in the authorization process and national laws apply; gaps remain for third‑country branches and large bank‑like investment firms.
- Acquisitions and third countries:
  - No harmonized EU requirements or assessment criteria for major acquisitions outside the EU; ECB cannot require ex ante review/approval in all cases.
- Methodological fundamentals:
  - SREP, RAS, SEP are firmly in place, refined since 2015, and forward‑looking and risk‑based; SREP supports early intervention and interaction with SRB/NRAs.

### Supervisory approach, methodology, tools, and execution (CPs 8–10, 9)
- Core elements and stance:
  - SREP is forward‑looking and proportionate to systemic importance; combines quantitative analysis and “constrained judgment.”
  - Mix of offsite analysis and onsite inspections focused on horizontal themes and institution‑specific risk assessments.
  - TRIM: targeted review of internal models (2017–2019), about 200 onsite investigations planned; objective to cover at least 60 percent of IRB EAD and RWA of SIs.
- Planning and SEP:
  - SEP and MELs determine supervisory activities for each SI; typical time horizon one year; SEPs are calibrated to risk profile and supervisory resources.
- Onsite inspections:
  - Multiple types (full scope, targeted, thematic, follow‑up); lifecycle: planning → pre‑inspection → investigation → exit meeting → reporting → consistency review → follow‑up.
  - Head of Mission (HoM) normally NCA staff; HoM cannot be a JST member and signs the final report.
  - Exit meeting: institution has 2 weeks to comment; HoM attaches comments and responses to final report.
- Data and reporting:
  - EBA ITS is “maximum harmonization” and not always sufficiently granular for offsite supervision. ECB supplements ITS via Short‑term Exercises (STE) and other surveys (e.g., assets and liabilities by repricing date, IRRBB, concentration, liquidity, operational risk).
  - ESCB initiatives: BIRD and IReF aim to improve harmonization/flexibility.
- Use of external experts:
  - ECB may appoint external experts under Article 12(2) SSMR; external experts cannot be HoM and are subject to confidentiality and conflict‑of‑interest checks.
- Principle 9 assessment: Compliant.

### Transparency and public guidance
- Recommendation: increase publication of supervisory guides and a condensed SSM Supervisory Manual to clarify expectations and improve compliance by SIs.
- Positive example: ECB draft guide to onsite inspections and internal model investigations; condensed manual published March 2018 (with operational details removed).
- Assessors endorse continued publication of topic guides to enhance transparency.

### Supervisory reporting, data quality, and harmonization (Principle 10)
- Core reporting frameworks:
  - ITS No 680/2014 covers COREP/FINREP and other templates; frequency varies (monthly → annual).
  - STE supplements ITS where harmonized reporting is insufficient; STEs are less structured for validation and quality control.
- Data quality and IT:
  - BSDD and DG‑Statistics handle data consistency and quality checks; IMAS used for supervisory casework.
  - Reporting of maturity ladder broken down by significant currency started March 2018.
- Recommendation: streamline and expedite processes to amend ITS; promote BIRD and IReF adoption to reduce reliance on STEs and improve data agility.
- Principle 10 assessment: Largely Compliant.

### Corrective and sanctioning powers (Principle 11)
- Supervisory approach:
  - Progressive remedial process: operational acts (non‑binding) → formal Decisions (binding) → sanctions/enforcement.
  - Article 16.2 SSMR lists wide corrective powers (capital, governance, provisioning treatment, business restrictions, distribution limits, reporting).
- Enforcement limits and gaps:
  - Legal framework fragmented; ECB’s direct enforcement and sanctioning powers limited and rely on NCAs for many national law measures.
  - ECB may impose pecuniary penalties on legal entities (Article 18 SSMR) but generally cannot directly sanction natural persons — NCAs must act for many non‑pecuniary or national law sanctions.
  - Recommendation: grant explicit authority for non‑pecuniary supervisory sanctions (e.g., enforceable cease‑and‑desist orders with affirmative covenants) and harmonize enforcement framework.
- Sanction activity (statistics):
  - 2015: 4 proceedings initiated (3 sanctioning, 1 enforcement; 2 sanctioning completed).
  - 2016: 41 sanctioning proceedings launched and 1 enforcement proceeding; total 44 proceedings handled in 2016 (42 sanctioning, 2 enforcement).
  - Of 42 sanctioning proceedings in 2016: 30 related to suspected breaches of directly applicable EU law (26 SIs; areas: own funds, reporting, public disclosure, liquidity, large exposures); 12 related to suspected breaches of national law transposing CRD IV.
  - Backlog noted: 35 remaining sanctioning cases with few successful conclusions in early period.
- Principle 11 assessment: Materially Non‑Compliant.

### Cooperation, consolidated and cross‑border supervision, and resolution (CPs 3, 12–13)
- SSM and JST model:
  - Day‑to‑day supervision by JSTs led by ECB staff with NCA sub‑coordinators; average JST composition around 25 percent ECB staff and 75 percent NCA staff (variation by cluster).
  - Onsite inspection teams: <10 percent ECB staff and >90 percent NCA staff on average; ECB led around 10 percent of inspections due to resource constraints.
- Colleges, MoUs, and third countries:
  - ECB participates in 45 supervisory colleges; consolidating supervisor for 30 colleges; 16 WCCAs concluded by end‑February 2018.
  - Progress on finalizing MoUs with third‑country authorities slower than expected; “step in” arrangements expanded ECB participation in existing MoUs (49 third countries as of September 2017).
  - Concluded MoUs include Banco Central do Brazil and Comisión Nacional Bancaria y de Valores (Mexico). Accession agreement by Estonia, Iceland, Latvia, Lithuania (April 2017).
- Resolution cooperation:
  - SRM/SRB: SRB responsible for resolution planning and decision‑making for SIs; SRF target initially estimated EUR 55 billion over eight years (1 percent of covered deposits); fund consists of national compartments progressively mutualized over eight years.
  - ECB–SRB MoU (December 2015) governs cooperation; information sharing automated for certain SREP ratings.
  - ECB made “failing or likely to fail” determinations in three institutions (2017) triggering SRB actions; experience used to refine MoU and coordination.
- Confidentiality and information sharing:
  - CRD IV confidentiality, Article 54 limits use; Article 55 allows cross‑border sharing only with equivalent confidentiality regimes; where equivalence not met, summaries/aggregates or negotiated restrictions used.
- Assessments:
  - Principle 3: Compliant.
  - Principle 12: Largely Compliant.
  - Principle 13: Largely Compliant.
- Recommendations: finalize MoUs with third countries and SRB MoU revisions, enhance early automatic information sharing, strengthen JST staffing and incentives, and address legal gaps for shell banks and booking offices.

### Corporate governance, fit‑and‑proper, and internal control (Principles 14–15, 26)
- Governance and fit‑and‑proper:
  - CRD IV Articles 74–95, EBA guidelines, ECB Guides (Fit‑and‑Proper May 2017), SSM supervisory statements guide expectations.
  - ECB conducts thematic governance reviews and specific fit‑and‑proper assessments; fit‑and‑proper process remains complex and partly dependent on national law.
  - Recommendation: harmonize fit‑and‑proper framework and grant ECB greater discretion to object to persons lacking independence.
- Internal control and audit:
  - Internal audit, compliance, and risk management expectations integrated into SREP; ECB assesses internal audit functions and may rely on internal audit work where appropriate.
  - Principle 26 assessment: Compliant.
- Risk management and models:
  - Requirements for ICAAP/ILAAP and risk governance set in CRD IV/CRR; ECB issued letters and draft SSM Guides; TRIM ongoing.
  - Recommendation: ECB to issue a consolidated risk management document and promote Board/senior management awareness of model uncertainty; consider CRO removal disclosure/consultation rules.
- Principle 14 assessment: Compliant. Principle 15 assessment: Largely Compliant.

### Prudential requirements, capital adequacy, leverage, and internal models (Principles 16, 22–23)
- Capital minima and buffers (prescribed minima referenced exactly):
  - CET1 capital ratio: 4.5 percent
  - Tier 1 capital ratio (including additional Tier 1): 6.0 percent
  - Total capital ratio (including Tier 2 capital): 8.0 percent
  - Capital conservation buffer (CET1): 2.5 percent
  - Systemic buffers: G‑SII and O‑SII buffers up to 2.0 percent of total risk exposure
- Deviations and RCAP findings:
  - Basel Committee RCAP (December 2014) found EU prudential framework “materially non‑compliant” with minimum Basel standards.
  - RCAP: eight components compliant; four largely compliant; one materially non‑compliant (IRB credit risk); one non‑compliant (CCR).
- ECB powers:
  - ECB can require additional capital under Pillar 2 via SREP (Article 97 CRD IV; EBA Guidelines).
  - ECB Guide on National Options and Discretions (March 16, 2016) harmonizes ONDs for SIs.
- Internal models and TRIM:
  - Prior permission required for internal models (CRR Articles cited); TRIM planned 2017–2019 with approximately 200 missions; supervisory monitoring and on‑site investigations ongoing.
- Leverage ratio and other metrics:
  - Institutions must calculate, report, and disclose leverage ratio (Articles 429, 430, 451(1) CRR); legislative initiative to introduce binding leverage ratio.
- Principle 16 assessment: Materially Non‑Compliant (due to deviations from Basel and IRB/CCR issues).
- Principle 22 (Market risk): Compliant.
- Principle 23 (IRRBB): Compliant; ECB ran an IRRBB sensitivity exercise in 2017.

### Credit risk, problem assets, NPL guidance, provisioning, and loan reviews (Principles 17–18)
- Credit risk supervision:
  - Article 79 CRD IV and EBA SREP Guidelines provide expectations for credit‑granting, monitoring, and value adjustments.
  - AnaCredit launched 2016; reporting threshold EUR 25,000; monthly collection from November 2018 planned.
- NPLs and provisioning:
  - ECB Guidance on NPLs (March 2017) sets supervisory expectations on governance, operations, classification, provisioning, write‑offs, and collateral valuation.
  - “High NPL banks” required to submit NPL strategy and annual operational plan templates (first quarter each calendar year).
  - Limitations:
    - Guidance is non‑binding and cannot override national statutory provisions.
    - ECB cannot always require reclassification as NPL where exposure does not meet Article 178 CRR “default” conditions; European Commission clarified ECB can require prudential adjustments to own funds calculations where accounting treatment is not prudent.
  - Onsite methodology:
    - Credit file reviews with statistical extrapolation to be employed; limited ECB inspector numbers constrain direct ECB onsite participation (ECB staff <10 percent of inspection teams).
- Supervisory expectations (exact text citation preserved):
  - Section 6.7.2: “Banks should maintain internal supporting documentation, which may be made available for review by supervisory authorities upon request.”
  - EC7: supervisor may require adjustments to classifications, provisioning, reserves, capital and other remedial measures if classifications/provisions inadequate.
- Principle 17 assessment: Largely Compliant.
- Principle 18 assessment: Largely Compliant (guidance advanced but non‑binding and legal powers incomplete).

### Concentration risk, related‑party transactions, and country/transfer risk (Principles 19–21)
- Concentration and large exposures:
  - CRR Articles 387–403 set large exposure regime; Article 393 requires internal procedures for large exposures; supervisory monitoring includes largest 10/20/50 exposures and Herfindahl indices where available.
  - Gaps: EU definition narrower than CP expectations (market and other concentration types not fully covered); LEI adoption incomplete; Article 400(2) exemptions may weaken limits.
  - Principle 19 assessment: Largely Compliant.
- Related‑party transactions:
  - No harmonized EU framework; national laws vary. Reporting under FINREP via accounting standards is not sufficient for CP requirements.
  - Principle 20 assessment: Materially Non‑Compliant.
- Country and transfer risk:
  - Not specifically mentioned in CRD IV/CRR; treated as a subcategory of credit risk in EBA SREP Guidelines. No EU‑wide framework or SSM expectations; JSTs perform ad hoc assessments.
  - Principle 21 assessment: Materially Non‑Compliant.

### Liquidity, funding, and contingency planning (Principle 24)
- Framework and standards:
  - LCR adopted in EU (Article 412 CRR); minimum rolled to 100 percent from January 1, 2018 (80 percent in 2017).
  - RCAP (2017) found EU LCR broadly largely compliant but with deviations on HQLA definitions and certain inflow/outflow treatments.
- Supervisory practice:
  - ILAAP guidance implemented 2016; supervisors meet treasury staff and receive monthly LCR monitoring.
  - Reporting of maturity ladder by currency started March 2018.
- Gaps and concerns (assessors’ recommendations preserved):
  - LCR and HQLA definitions in EU contain less stringent elements than Basel (wider HQLA definition).
  - Deposit outflow assumptions for stress testing should be revised in light of recent resolution events.
  - Information on unencumbered assets may be insufficient to gauge emergency liquidity capacity in rapid deterioration.
  - No explicit EU requirement for Board to review liquidity strategy at least annually or for supervisors to analyze liquidity per significant currency (recommendations made).
- Principle 24 assessment: Materially Non‑Compliant (assessors disagree with ECB on this point; ECB contests the MNC rating).

### Operational risk, IT and cybersecurity (Principle 25)
- Supervisory activity:
  - Thematic reviews on IT and cyber, pilot cyber incident reporting, IT outsourcing questionnaires, and operational risk benchmarking (IDRA).
  - Mandatory cyber incident reporting pilot from Q3 2017; 113 operational risk onsite inspections (2015–2017) and 75 IT risk onsite inspections.
- Gaps and recommendations:
  - Strengthen cybersecurity awareness, business continuity, vendor management, and crisis information sharing mechanisms.
  - Recommend ECB/EBA publish non‑confidential cybersecurity best practice; develop intra‑industry incident sharing and mutual assistance data vault concepts.
  - AML risk: legal barriers to mandatory AML information exchange restrict supervisory effectiveness; recommend removing barriers and allowing supervisory measures based on AML deficiencies.
- Principle 25 assessment: Largely Compliant.

### Financial reporting, external audit, and disclosure (Principles 27–28)
- External audit and accounting:
  - Regulation 1606/2002 mandates IFRS for consolidated accounts of listed companies; Directive 2014/56/EU and Regulation No 537/2014 strengthen audit framework for PIEs.
  - ECB has limited EU law scope to engage in external audit assessments; it assumes national‑law powers where NCAs hold them and seeks amendments to EU law to clarify additional supervisory powers over external auditors.
  - AC1 (access to auditors’ working papers) not widely available in EU/national law; some national exceptions (Luxembourg, Spain).
  - Principle 27 assessment: Largely Compliant.
- Disclosure and transparency:
  - Part Eight CRR prescribes Pillar 3 disclosures; EBA templates/Guidelines standardize disclosures; Pillar 3 generally not audited but may be part of financial statement notes that are audited.
  - Aggregate supervisory statistics and ECB consolidated banking data expanded (November 2016) to include NPLs, coverage ratios, capital, leverage etc. for SIs.
  - Gaps: related‑party exposures not mandatorily disclosed in Pillar 3; end‑of‑period reporting (leverage/LCR) may distort market behavior; assessors recommend disclosure of average/over‑the‑period measures for certain ratios.
  - Principle 28 assessment: Largely Compliant.

### Key statistics and scope (exact figures from source)
- SIs: 118 banking groups (with around 1,000 banks), including 8 G‑SIBs, covering more than 80 percent of Euro Area banking assets.
- NCAs supervise LSIs: around 3,100 banks.
- ECB directly supervises 118 banking groups in 19 Member States, including 1,108 banks representing EUR 21,400 billion of aggregated assets.
- NCAs supervise more than 3,100 banks representing EUR 4,900 billion of aggregated assets.
- SRF: target initially estimated EUR 55 billion over eight years (1 percent of covered deposits).
- DGSD deposit protection: EUR 100,000 coverage; each DGS to reach at least 0.8 percent of covered deposits by July 3, 2024.
- Euro Area macro context at assessment:
  - Growth: estimated 2.5 percent in 2017 (18 consecutive quarters of expansion).
  - Unemployment: 8.9 percent in September 2017.
  - Inflation: 1.4 percent year‑on‑year in October 2017.
  - Wage growth: below 2 percent for the last five years.
- Supervisory decision volumes: around 2,000 supervisory decisions per year.
- Capital minima and buffers (prescribed figures preserved):
  - CET1 capital: 4.5 percent
  - Tier 1 capital (including additional Tier 1): 6.0 percent
  - Total capital (including Tier 2): 8.0 percent
  - Capital conservation buffer (CET1): 2.5 percent
  - O‑SII buffer: up to 2.0 percent of total risk exposure.
- Enforcement activity: 44 sanctioning/enforcement proceedings handled in 2016 (42 sanctions, 2 enforcement); 41 sanctioning proceedings launched in 2016.

### Principal recommendations (condensed, by theme)
- Legal and perimeter reforms
  - Amend EU law to harmonize options/discretions and grant ECB supervisory powers over all significant forms of credit intermediation in the Euro Area (including large bank‑like investment firms and certain third‑country branches).
  - Grant explicit ECB powers for enforcement/sanctions on natural persons and non‑pecuniary administrative measures (e.g., enforceable cease‑and‑desist orders).
  - Introduce EU requirements for prior notification/approval of material acquisitions (within and outside the EU).
- Decision making and resourcing
  - Streamline ECB decision‑making and internal reporting lines; formalize staffing commitments from NCAs (consider binding 75 percent availability target if collaboration fails).
  - Increase ECB onsite staff presence and reduce reliance on NCA availability for critical inspections.
- Supervisory transparency and reporting
  - Publish further supervisory guides and a fuller but user‑friendly SSM Supervisory Manual.
  - Streamline processes to amend ITS and adopt BIRD/IReF for harmonized, granular, flexible data.
  - Convert STE items into ITS where appropriate to reduce ad hoc collections.
- Prudential supervision and risk coverage
  - Conform CRR/CRD IV to Basel standards where material deviations exist; monitor effects of deviations on capital ratios.
  - Strengthen supervisory expectations and explicit rules on related‑party exposures, country/transfer risk, concentration reporting to Boards, and NPL provisioning/write‑off criteria.
  - Require banks to disclose related‑party exposures in Pillar 3 and to publish average‑period measures for certain ratios (leverage, LCR).
- Crisis preparedness and resolution
  - Finalize and deepen MoUs with third countries and SRB; enhance automatic early information sharing and operational guidance for recovery and resolution.
  - Ensure close ECB–SRB cooperation on liquidity and crisis communications.
- Operational resilience and AML/cyber
  - Intensify supervisory focus on IT/cyber security, third‑party outsourcing concentration, and AML information sharing and remedial measures.

*Source: INTRODUCTION AND METHODOLOGY (cr18233) — IMF PDF chapter/section.*

### INTRODUCTION AND METHODOLOGY _______________________________________________________ 15

### INTRODUCTION AND METHODOLOGY

### Summary and main findings (points 1–10)
- 1. The SSM (SSM) has made a solid start. Set up a little over three years ago, the SSM has developed into a coherent banking supervision mechanism operating across the 19 Euro Area Member States. Banking supervision at the European Central Bank (ECB) is underpinned by a clear mandate and independence from government or industry interference in individual supervisory decisions. Its well-defined supervisory methodology and processes—complemented by committed staff—have laid the foundations for more forward-looking, pre-emptive, and evenhanded supervision. This is a noteworthy achievement for the Euro Area.
- 2. The good start nonetheless confronts several important operational challenges. Decision-making processes are complex and not necessarily conducive to timely supervisory action, although emergency procedures have been successfully tested. Significant gaps remain in the European Union (EU) regulatory framework while the suite of supervisory powers needed for consistent supervision of Euro Area banks is inadequate as it stands to address Brexit and other challenges. Furthermore, the volume, quality, and availability of resources for the supervision of Significant Institutions (SIs) are not fully under the ECB’s control. Addressing these constraints, some of which are inherent in the design of the SSM, will shape the SSM’s agenda over the immediate period ahead.
- 3. The ECB’s Supervisory Board has taken several steps to streamline some of the decision-making processes. Its large membership, and the influence of national interests, can make it difficult to reach an agreed position on complex and time-sensitive issues. This runs the risk of “inaction bias” that needs to be countered in view of the continuing supervisory challenges of dealing with weak banks, and in the long-run interests of the Banking Union. That said, the Supervisory Board and Governing Council have demonstrated they can act expeditiously in emergency situations. In the same vein, the ECB should strive to further improve its internal processes to ensure timely decision-making. The process for how decisions are made and how those decisions are communicated to staff and SIs should be kept under review. Simplification and streamlining of procedures and reporting lines, where work is under way in the ECB, would free up needed resources and ensure the timely communication of supervisory and other information to staff and SIs.
- 4. The ECB has also made progress in clarifying its supervisory powers, particularly by harmonizing many supervisory options and discretions in the prudential framework and by assuming the powers available to National Competent Authorities (NCAs) in certain areas. However, further harmonization is needed, and this requires changes in the legal and regulatory framework. The European Commission has proposed amendments to the Capital Requirements Directive/Regulations (CRD/CRR); if implemented, some of these would remove or mitigate the legal uncertainty around the exercise of the ECB’s supervisory powers, but others would constrain supervisory discretion in the setting of prudential capital requirements. The proposed revision provides the opportunity to ensure that the ECB has supervisory powers that apply to all significant forms of banking intermediation in the Euro Area. This is an essential requirement to deal with Brexit, and to minimize opportunities for regulatory and supervisory arbitrage created by current gaps in the regulatory perimeter. A harmonized approach is also currently lacking in some key risk areas, particularly major acquisitions, transactions with related parties, and country risk.
- 5. ECB banking supervision must execute many of its tasks according to national laws, which can vary considerably in scope and detail. The inconsistencies hinder efficiency and contribute to a time-consuming supervisory decision-making process. For instance, licensing applications and fit-and-proper reviews must first be conducted by NCAs in compliance with national legislation, before submission and further analysis by the ECB. Supervisory decisions in these and other areas require approval by the ECB’s Governing Council, generally on a “no objections” basis. However, a new delegation framework has truncated decisions on fit-and-proper and the significance of institutions at the senior management level. Similarly, the ECB’s enforcement and sanctioning powers are largely based on what is available to NCAs under national legislation. Although the ECB has some direct enforcement and sanctioning powers, it mostly needs to act by giving instructions to NCAs to take action. Harmonization and strengthening of the legal framework for enforcement and sanctions should be a priority.
- 6. The ECB has generally raised the level of supervisory intensity and intrusiveness in respect of SIs. Its supervisory approach is based on a thorough but resource-intensive process of risk assessment, the formal Supervisory Review and Evaluation Process (SREP), onsite inspections, a quality assurance review, and a comprehensive SSM Supervisory Manual. This has helped lay the foundations for a comprehensive and consistent supervisory approach across the Euro Area, but it will be important that, once consistency is more fully embedded, the focus on methods and processes does not discourage supervisors from the pursuit of risk instincts, or from astute supervisory judgments.
- 7. Heightened supervisory intensity within the SSM has reflected in strengthened risk-based capital and liquidity buffers—although capital and liquidity requirements do not conform fully with the Basel framework—and the winding back of nonperforming loan (NPL) ratios. Nonetheless, NPLs continue to undermine Euro Area bank profitability and remain a challenge to the ECB’s determination to resolve legacy issues. The European Commission’s recent clarification of the ECB’s powers in this area provides the basis for pursuit of more realistic provisioning levels, though these powers should be formalized in EU law.
- 8. For some SIs, the shift from NCA to ECB supervision has represented a significant change in supervisory approach. Changes have taken place in terms of reporting burden, minimum levels of engagement with supervisors, intrusiveness, and prudential requirements, including capital add-ons from the SREP. For larger SIs, some of which were already under intensive supervision, the supervisory approach has benefitted from a broader SSM perspective and cross-country benchmarking, although concerns have been expressed about slower supervisory response times.
- 9. The sharing of responsibilities between the ECB and the NCAs, which provide the bulk of supervisory resources to the SSM, is still evolving. Day-to-day supervision is conducted by Joint Supervisory Teams (JSTs) led by ECB staff with sub-coordinators from NCAs where the parent entity is located (and from NCAs where the bank has significant subsidiaries). The coordination and integration of JSTs staffed by supervisors with very different backgrounds, supervisory cultures, and languages have presented operational and motivational challenges. Levels of cooperation between ECB banking supervision and NCAs have been improving, assisted by a range of staff networks, but remain uneven, and JSTs cannot always be confident about the availability of NCA staff members. Consequently, staff resources in some JSTs have been stretched while the staffing of onsite missions, particularly with cross-border and ECB staff, has faced difficulties. The responsibilities, incentives, and performance assessment of individual NCA staff members of JSTs, who currently serve two masters, need to be better articulated.
- 10. It is crucial that the SSM banking supervision clearly communicate to SIs its expectations for prudent risk management. Clear expectations provide a consistent basis for supervisory action and, in particular, for supervisory decisions in the SREP. The ECB has made a good start in this direction with the publication of supervisory guides on select topics; the European Banking Authority (EBA) has also published a range of guidelines. The ECB’s decision to publish a condensed public version of the SSM Supervisory Manual, setting out its expectations for prudent risk management practices and processes, is welcome. The ECB should also publish its expectations in areas where the EU regulatory framework is silent or provides only general rules. These areas include major acquisitions, loan classification parameters and provisioning, concentration risk, country and transfer risk, related-party risk, and operational risk.

### A. Main findings (Responsibility, objectives, powers, independence, accountability — CPs 1–2; Ownership, licensing, structure — CPs 4–7; Methods of ongoing supervision — CPs 8–10)
- 11. The SSM has established a clear allocation of responsibilities for the supervision of Euro Area credit institutions between the ECB and the NCAs in participating Member States. However, the legal underpinnings of the SSM are complex. The ECB has a broad range of powers provided for in the CRR and the SSM Regulation (SSMR) and can apply the powers set out in CRD IV as transposed into national legislation, but the EU legislation also makes a considerable number of options and discretions available to either the NCAs or the Member States. The ECB has harmonized a range of options and discretions granted to NCAs in the SSM, but harmonization of options granted to Member States would require changes in EU law.
- 12. The SSM legislative framework, reflecting the uneven coverage of national laws, leaves the ECB facing gaps and asymmetries in its supervisory powers. For example, the ECB does not have supervisory powers that apply to all significant forms of credit intermediation in the Euro Area. In particular, investment firms undertaking “bank like” business in the Euro Area are subject to many of the same regulations as banks, including for capital and liquidity, but are currently supervised nationally even when they are of significant size and very active in cross-border business. The European Commission’s proposals for an extensive revision of EU law related to prudential supervision provide an opportunity to remedy this. In addition, Euro Area branches of non-EU or EEA banks are not subject to authorization or supervision by the ECB, nor to CRD IV/CRR (and related EBA standards and guidelines). The regulatory and supervisory framework applicable to such third-country branches needs to be harmonized.
- 13. The independence of the ECB’s banking supervision function is enshrined in law, and the ECB performs its supervisory tasks in an operationally independent manner. Decision-making processes are complex and time-consuming. A substantial volume of routine supervisory decisions requires Governing Council approval. However, a new delegation framework, which truncates decision-making for certain routine decisions at the level of ECB Senior Manager, has considerably shortened timetables, and further delegation of decisions is under discussion.
- 14. The aggregate resources available to ECB banking supervision to supervise SIs are variable and largely beyond its control. With its Supervisory Examination Programme (SEP), the ECB has a well-structured process for determining and prioritizing its resource needs, but it has only limited control over the levels and allocation of NCA staff dedicated to the supervision of SIs, or over their suitability and performance. Since NCA staff are generally not committed full-time to SI supervision, their availability at any particular point cannot always be assured. The ECB has experienced varying levels of cooperation from NCAs in making up supervisory teams, but collaboration is improving for offsite supervision.
- 15. EU legislation, as transposed into national laws, protects the special status of credit institutions, with the necessary powers residing in most cases with NCAs. The ECB is the licensing authority for credit institutions in the Euro Area, but the NCAs are fully integrated in the authorization process and authorization decisions are taken on the basis of applicable national laws, which are not fully harmonized. The legal framework, though fragmented, and various supporting the EBA, EBA/European Securities and Market Authority (ESMA), and ECB guidance provide a comprehensive basis for supervisory assessments of applications for authorization. As discussed above, the ECB does not have authority to authorize and supervise Euro Area branches of non-EU or EEA banks, or investment firms undertaking “bank like” activities in the Euro Area. These gaps in the regulatory perimeter raise concerns about regulatory and supervisory arbitrage and, in the case of large investment firms, can pose increased financial stability risks. The gaps can only be closed through legislative changes.
- 16. The SSM legislative framework establishes a clear basis for approving acquisitions or disposals of qualifying holdings in a credit institution by the ECB, the competent authority in this area. As with authorizations, the NCAs are fully integrated in the approval process, which is supported by recent EBA/ESMA/EIOPA joint guidelines and ECB internal rules and detailed procedures. However, there are no specific EU requirements for credit institutions to notify the supervisor as soon as they become aware of any material information that may negatively affect the suitability of a major shareholder, while notification requirements in national law are not consistent.
- 17. In contrast, EU law does not provide an adequate or consistent supervisory regime for major acquisitions by a credit institution. Some national laws require the approval of acquisitions in third countries by the relevant NCA, and the ECB has confirmed that it is competent to decide on such approvals. However, there are no explicit requirements in EU law on the acquisition of holdings in credit institutions outside the EU, nor are there harmonized assessment criteria at EU level, including whether acquisitions expose the credit institution to undue risks or hinder effective supervision. While the ECB may impose higher capital requirements or even require disinvestment in the case of an unsound acquisition, it cannot require ex ante review and approval. The ECB is seeking amendments to EU law that include a clear reference to additional supervisory powers in relation to material acquisitions in third countries.
- 18. The fundamentals of the ECB’s methodological framework for supervision are sound. The main elements of the supervision methodology—SREP, risk assessment system (RAS), and SEP—are firmly in place. The methodology has been refined through the experience gained since its initial launch in 2015. This process of continual assessment and improvement should continue as the SREP, RAS, and SEP mature over time. The greater emphasis on quantitative analysis is consistent with the EBA’s SREP guidance. The SREP is a forward-looking risk-based assessment of individual banks and banking groups, proportionate to their systemic importance. The ECB’s supervisory approach identifies risks within banks and the banking system. The ECB, in conjunction with the Single Resolution Board (SRB) and NRBs, is a key participant in the Euro Area’s early intervention and resolution framework.

*Source: INTRODUCTION AND METHODOLOGY (cr18233) — IMF PDF chapter/section.*

### 19.      ECB banking supervision uses a mix of offsite analysis and onsite inspections that

### 19.      ECB banking supervision uses a mix of offsite analysis and onsite inspections that

### Supervisory approach and methodology
- ECB banking supervision uses a mix of offsite analysis and onsite inspections that focus on both horizontal risk themes and vertical assessments of institution-specific risks.
- Techniques and tools are appropriately designed as evidenced by the (confidential) SSM Supervisory Manual and Appendices.
- SEPs and onsite inspections are calibrated according to institutions’ risk profiles, including systemic importance, and the ECB’s supervisory resources.
- Recommendation: Further refinements in methodology and technique should be adopted as the ECB gains additional experience over time.

### Transparency and public guidance
- Assessors recommend greater transparency about supervisory approach and techniques.
- Positive example: ECB’s draft guide to onsite inspections and internal model investigations is a good primer for public consumption.
- ECB practice of publishing guides on important supervisory topics should be continued.
- A condensed version of the SSM Supervisory Manual was published in March 2018; the published manual removed much of the detail on internal processes and methodologies.
- Rationale: Such transparency may help credit institutions comply with ECB expectations and assure the public that the SSM operates under well-designed supervisory processes.

### Supervisory reporting, data, and harmonization
- Supervisory reporting at EU level is not sufficiently granular to adequately support offsite supervision; “maximum harmonization” does not allow sufficient flexibility and agility.
- Not all data needs are covered by reporting under the EBA’s implementing technical standards (ITS).
- The ECB complements ITS via Short-term Exercises (STE) data collections and surveys covering data needs for SREP (e.g., assets and liabilities by repricing date, interest rate risk in the banking book (IRRBB), concentration, liquidity, and operational risk).
- Timely and accurate data is fundamental to effective supervision.
- The process for amending and augmenting EU-wide harmonized supervisory reporting based on the ITS is lengthy and cumbersome and should be streamlined and expedited.
- ESCB initiatives related to the Banks’ Integrated Reporting Dictionary (BIRD) and the Integrated Reporting Framework (IReF) may contribute to harmonization while allowing more flexibility.

### Corrective and sanctioning powers (CP 11)
- ECB adopts a progressive remedial process to address unsafe and unsound practices using SREP and SEP to identify issues early.
- Ongoing supervision recommends corrective actions within defined time periods, informally and in writing.
- Written communications from JSTs are “operational acts” with significant moral suasion weight though not legally binding.
- Escalation: Matters are escalated to the Supervisory Board for a formal decision if an SI does not comply with an operational act; that decision is legally binding and enforceable, and noncompliance is subject to sanctions.
- Article 16.2 of the SSMR lists a broad range of powers used by the ECB regarding affirmative obligations and significant consequences to correct deficiencies.
- Legal framework concerns:
  - Enforcement and sanctions framework is complex and fragmented, containing substantive and procedural gaps that should be addressed.
  - Complexity may make it operationally difficult and time-consuming for the ECB to impose formal enforcement actions and sanctions in some countries, particularly where such powers are not available under national laws.
  - ECB’s direct enforcement and sanctions powers are limited; ECB can use powers available to NCAs but lack harmonization exists in scope and approach to enforcement of sanctions between ECB and NCAs.
  - ECB may impose sanctions only on legal entities; it does not have power to directly impose sanctions on natural persons.
  - Recommendation: Express authority to impose non-pecuniary sanctions, such as enforceable administrative “cease and desist” orders with affirmative covenants, would provide an additional supervisory tool.

### Cooperation, consolidated, and cross-border supervision (CPs 3, 12–13)
- ECB has an extensive and effective framework for cooperation and collaboration internally with Euro Area NCAs, starting from the Supervisory Board.
- Outside the SSM, ECB has sought to build on communication channels inherited from NCAs under “step in” arrangements.
- Progress on finalizing Memoranda of Understanding (MoUs) with third-country authorities has been slower than expected, though absence of formal arrangements has not precluded effective working relationships.
- ECB-led supervisory colleges appear to serve their intended purpose for recovery plans, early intervention measures, and coordinated supervisory responses.
- SSM preparations for Brexit involved heightened interaction with other supervisory authorities.
- Legal gaps and limits:
  - ECB lacks authority to review activities of certain affiliates and parent companies that are unsupervised entities; no specific legal requirements authorizing ECB or NCAs to prohibit shell banks or their continued operation.
  - Where such powers are not provided under national law, this gap may hinder ECB’s ability to assess material impacts and take appropriate supervisory action.
  - Mixed financial holding companies are not included in the definition of conglomerates under FICOD, possibly constraining capacity to identify related parties or nonfinancial entities that may impact the conglomerate.
  - While ECB will not authorize shell banks that only serve as a booking office, there is no clear mandate to prohibit shell banks or limit use of foreign branches as mere booking offices.

### Corporate governance (CP 14)
- SIs operate under corporate governance legal structures governed by disparate national law requirements supplemented by EBA guidelines and ECB explanatory guides.
- ECB uses supervisory process to identify weaknesses in management bodies and to recommend and effect changes.
- ECB thematic review of governance and risk appetite provided a horizontal baseline and focused supervision on internal governance, resulting in recommendations and actions to make supervisory board involvement more robust.
- ECB has defined processes for fit-and-proper determinations of management body members; dependence on national law makes the process complex, time consuming, and not fully harmonized.
- Recommendation: ECB should be granted greater legal discretion to object to persons whose prior work experience and relationships may render them not fully independent from management.
- Internal governance standards for financial conglomerates could be enhanced beyond general risk considerations in the SSM Supervisory Manual.

### Prudential requirements, regulatory framework, accounting, and disclosure (CPs 15–28)
- ECB supervisors have adopted an extensive interpretation of their role to overcome hurdles of a fragmented regulatory framework.
- A more complete and harmonized regulatory framework on risk management would mitigate unnecessary distractions and improve supervisory dialogue.
- Deviations of the EU capital framework from international standards are material, though ECB has powers to impose additional requirements:
  - Basel Committee RCAP assessment found potentially significant deviations in calculation of risk-weighted assets (e.g., sovereign exposures under permanent and temporary partial use of the standardized approach, lower risk weights for covered bonds, treatment of participation in insurance, and the counterparty credit risk (CCR) framework).
  - Some deficiencies are addressed via banks’ internal capital adequacy assessments and supervisory action under SREP.
  - ECB can require banks to hold capital in excess of minima under Pillar 2.
  - ECB’s Regulation and Guide on National Options and Discretions attempts harmonization though material deviations exist (example: capital treatment of insurance interests).
  - Overall, deviations cited in the RCAP continue to exist.

### Nonperforming loans (NPLs) and provisioning
- Supervisory activity on problem assets and provisioning has progressed significantly since ECB’s guidance to banks on NPLs.
- Guidance sets supervisory expectations on governance, operations, classification (forbearance and nonperforming status), provisioning, write-off, and collateral valuation.
- Banks with high NPLs are requested to define an NPL strategy and are subject to ad hoc reporting requests.
- Follow-up and monitoring of banks’ NPL reduction plans is intense and producing positive results in banks’ increased proactivity.
- Limitations:
  - NPL guidance is non-binding and cannot override national provisions where these are contained in laws or regulations.
  - Recommendation: ECB should introduce explicit supervisory expectations for NPL provisioning and write-offs.
- Legal powers and adjustments:
  - European Commission has clarified ECB’s power to require banks to apply specific adjustments (deductions, filters, or similar measures) where a bank’s accounting treatment is considered not prudent from a supervisory perspective.
  - An explicit grant of these powers in EU law would represent a firmer legal basis.
  - ECB still lacks explicit power to require banks to classify an exposure as NPL when it does not fully meet all conditions to be considered defaulted.

### Onsite review of problem loans and resources
- Onsite review relies on a structured methodology including detailed indications on credit file reviews but suffers from limited resources.
- New statistical procedures that extrapolate results from loan file samples will be employed soon.
- Limited number of ECB inspectors constrains direct participation in onsite missions, requiring substantial support from NCA inspectors.
- Risk: Stretched onsite resources across the SSM could weaken capacity to maintain pressure on banks for decisive action on NPLs.

### Market risk, IRRBB, concentration, and related-party risks
- Market risk management standards are generally sound; supervisors take an active approach with greater intensity for larger, systemic, trading-biased banks.
- Market risk was a focus in 2014 and 2015; a targeted review of banks’ internal models is under way.
- Valuation opaqueness of Level 3 products and uncertainties in classification of Level 2 assets/liabilities require intense supervisory scrutiny.
- IRRBB:
  - IRRBB has received significant supervisory attention and is a key priority for SIs.
  - A stress-test exercise on IRRBB conducted on SIs in 2017 gathered granular information on banks’ exposure after years of low interest rates; qualitative information was also collected for broader assessment and JST follow-up.
- Concentration and country risk:
  - Should be viewed more comprehensively and deserve more supervisory attention.
  - Definition of concentration risk is limited to credit exposures and does not include broader types of exposures.
  - Supervisory expectations for concentration and country risk management are not clearly communicated to banks.
  - No requirement that all material concentrations be regularly reviewed and reported to the bank’s supervisory board.
  - Recommendation: Improve reporting and monitoring of country risk and concentrations and require their inclusion in banks’ stress tests.
- Related-party transactions:
  - Framework is weak: no requirement that related-party exposures be monitored and controlled separately and in aggregate, and no regular reporting of such exposures.
  - Supervision of related-party risk is mostly carried out by external auditors whose analysis is very limited.
  - While some national laws provide limits to transactions with related parties, there is no harmonized approach at EU level.

### Liquidity, funding, and reporting in non-Euro currencies
- Supervisors increased frequency and intensity of interaction with credit institutions on liquidity risk, contingency plans, and funding requirements.
- Supervisors have built in-depth understanding of liquidity and funding risks at individual institutions; funding plans and stress test results are reported and evaluated periodically.
- Guidance for assessing ILAAPs implemented in 2016 strengthened liquidity risk assessment in SREP.
- Supervisors periodically meet with treasury staff and receive monthly monitoring of Liquidity Coverage Ratio (LCR) data.
- Concerns:
  - LCR adopted in the EU contains elements less stringent than the Basel standard, notably a wider definition of high-quality liquid assets (HQLA).
  - Assumptions on outflows of deposit categories over various time horizons should be revised for banks’ and supervisors’ stress testing.
  - Availability of supposedly liquid assets should be kept under review; information on unencumbered assets available to ECB banking supervision might not be sufficient to gauge residual capacity to obtain emergency liquidity in a rapidly deteriorating environment.
  - For internationally active banks with sizeable currency transformation and presence in non-Euro markets, ECB needs adequately granular and frequent information on cash flows in material non-Euro currencies and by jurisdiction for JST monitoring.
  - Reporting of the maturity ladder broken down by significant currencies started in March 2018.

### Operational risk and internal control
- Operational risk has undergone several enhancements but more attention is needed on monitoring effective implementation of operational risk management frameworks.
- ECB initiated several reviews on operational risk, involving IT and cybersecurity risk, conduct risk, an IT outsourcing questionnaire, and a pilot exercise on cyber incidents reporting.
- Recommendations:
  - Enhance cybersecurity awareness, business continuity, recovery planning, and third-party vendor management for significant outsourced functions.
- Operational risk is a major SSM risk area.
- Onsite examination process for Advanced Measurement Approaches (AMA) model accreditation appeared robust.
- Ongoing monitoring of AMA models strengthened by reporting for banks’ validation functions and the operational risk benchmarking tool (IDRA).

### Internal governance and supervisory expectations
- European law and EBA guidelines, particularly revised Guidelines on Internal Governance, provide comprehensive requirements and supervisory expectations for internal control frameworks.
- Revised Guidelines clarify supervisory board responsibilities in relation to internal control and emphasize direct reporting lines from heads of compliance and internal audit to the supervisory function.
- Reinforcements:
  - ECB’s June 2016 “SSM supervisory statement on governance and risk appetite” and detailed assessments of internal governance as part of SREP have reinforced expectations and supervisory scrutiny.

*Source: cr18233 - 19.      ECB banking supervision uses a mix of offsite analysis and onsite inspections that*

### 40.      ECB banking supervision has only limited scope under EU law to engage in

### 40.      ECB banking supervision has only limited scope under EU law to engage in 

### Main findings
- ECB banking supervision has only limited scope under EU law to engage in assessments of the integrity and external audit of financial statements of SIs prepared in accordance with relevant accounting standards.
- Responsibilities under EU directives in this area lie with other competent authorities.
- The overall EU framework appears robust and ensures broad consistency with international standards.
- The ECB is stepping up its involvement in the external audit process by:
  - assuming any powers granted by national laws to NCAs in relation to the appointment/replacement of external auditors, and
  - heightened engagement with external auditors, although engagement at the individual and collective level is already active.
- The ECB is seeking amendments to EU law that include a clear reference to additional supervisory powers regarding external auditors.

### Legal scope and responsibilities
- Supervisory scope is defined by EU directives; in the area of external audit and integrity of financial statements of SIs, EU law allocates responsibilities to competent authorities other than the ECB.
- Directive and regulation references noted in the framework:
  - Regulation 1606/2002 mandatorily applies IFRS to the consolidated accounts of publicly traded companies.
  - Directive 2014/56/EU sets out the framework for all statutory audits and strengthens public oversight of the audit profession.
  - Regulation No 537/2014 specifies requirements for statutory audits of public interest entities (PIEs), such as listed companies, banks and insurance undertakings.
- Member States retain some flexibility: Member States may apply national auditing standards, procedures or requirements as long as the Commission has not adopted an international auditing standard covering the same topic; additional national audit requirements may exist.

### ECB engagement with external auditors
- Current ECB actions:
  - Assuming national-law powers granted to NCAs for appointment/replacement of external auditors where available.
  - Heightened engagement with external auditors at both individual and collective levels.
- ECB policy objective:
  - Seek amendments to EU law to include a clear reference to additional supervisory powers regarding external auditors, to strengthen its legal mandate.

### Assessment methodology and scope
- This assessment was part of the FSAP mission undertaken by the IMF during November 2017 and February 2018, at the request of the Euro Area authorities.
- The assessment focused on the ECB and is limited to direct supervision by the ECB of SIs.
- The assessment used the Revised BCP Methodology issued by the Basel Committee of Banking Supervision in September 2012.
- The ECB chose to be assessed and rated against both the essential criteria (EC) and the additional criteria (AC) of the BCP.
- Rating categories used: compliant, largely compliant, materially noncompliant, noncompliant, and non-applicable.
- The assessment team comprised John Laker, Thomas Curry, and Pierpaolo Grippa, coordinated by Fabiana Melo (IMF).

### Context: SSM structure and Euro Area financial environment
- Since November 2014, banking supervision in the Euro Area has been conducted in the context of the SSM, which comprises the ECB and the NCAs of the 19 Euro Area Member States.
- Within the SSM:
  - SIs currently comprise 118 banking groups (with around 1,000 banks), including 8 global systemically important banks (G-SIBs), which cover more than 80 percent of Euro Area banking assets.
  - NCAs directly supervise LSIs (around 3,100 in number), under the general oversight of the ECB.
- SSM is one of 3 pillars intended to sustain European banking union; the other 2 pillars are an SRM for banks covered by the SSM (effective from January 1, 2015) and harmonized arrangements for national deposit insurance schemes (still under development).
- Macro and economic context at time of assessment:
  - The Euro Area had seen 18 consecutive quarters of expansion and growth accelerated to an estimated 2.5 percent in 2017.
  - Unemployment rate was 8.9 percent in September 2017.
  - Inflation was 1.4 percent year-on-year in October.
  - Core inflation had remained sticky; wage growth had remained below 2 percent for the last five years.

### Standards and accounting/auditing practice
- International Financial Reporting Standards (IFRS) are required for publicly traded companies per Regulation 1606/2002; Member States may permit listed entities to prepare solo financial statements based on IFRS and may allow other entities to apply IFRS; entities not applying IFRS use national GAAP.
- The EU adopted new rules regarding auditing standards in 2014 (Directive 2014/56/EU and Regulation No 537/2014).
- Based on an EBA survey across Member States in EU in 2015, the scope of the audit varies across Member States.

*Source: IMF FSAP assessment of implementation of the Basel Core Principles for Effective Banking Supervision in the Euro Area (assessment completed November 2017–February 2018).*

### 60.      The EU supervisory framework significantly changed in 2011, with the set-up of

### The EU supervisory framework significantly changed in 2011, with the set-up of

### EU supervisory agencies and mandate
- On January 1, 2011, the EBA was created, along with ESMA and EIOPA.
- Objectives of the ESAs:
  - Enhance mechanisms to coordinate cross-border supervision.
  - Facilitate cooperation between supervisors.
  - Promote convergence of supervisory practices.
  - Monitor implementation of the Single Rule Book.
- Legal and institutional characteristics:
  - The ESAs are regulatory agencies of the Commission accountable to the European Parliament and the Council of the European Union.
  - They have legal personality as well as administrative and financial autonomy.
- Relationship with the ECB:
  - The ECB is obliged to cooperate with and support the work of the ESAs.
  - This cooperation includes implementation of ESA guidelines and recommendations.

### Capital Markets Union (CMU) action plan and implementation to mid-2017
- The European Commission adopted an action plan to promote a Capital Markets Union (CMU) in 2015.
- CMU objectives:
  - Create a true single market for capital within the member states.
  - Enhance investment.
  - Better channel savings.
  - Make the financial system more stable.
  - Deepen financial integration.
  - Increase competition.
- Mid-2017 implementation review finding:
  - A review in mid-2017 indicated that significant progress toward its targets had been made.
- Measures adopted under the action plan include:
  - Revised prospectus guidelines.
  - Steps to revitalize securitization.
  - Proposed rules for preventive restructuring procedures.
  - Agreement in principle to establish a venture capital fund in partnership with the private sector.

### Persistent fragmentation of European capital markets
- Despite progress, capital markets in Europe continue to be highly fragmented.
- Sources of fragmentation:
  - National legal frameworks continue to differ in ways that affect unification of capital markets.
  - A number of issues impeding free movement of capital have not been resolved.
- Practical consequences:
  - Prospective borrowers in different countries face divergent national legislation and practices governing issuance, listing, and trading of securities.
  - Rules can vary significantly depending on the point of origination of a new transaction.
  - Domestic contractual requirements vary markedly among countries, as do rules on potential conflicts of interest, credit guidelines, and ongoing provision of company information.
  - The investor side of the market is marked by a high degree of domestic bias, particularly within the insurance and pensions sectors, which continue to be supervised largely on an individual national basis.

### Banking Recovery and Resolution Directive (BRRD) and related reforms
- The BRRD (2014/59/EU) was enacted to establish a common European framework for recovery and resolution of failing banks and to implement the Financial Stability Board key attributes of effective resolution regimes into EU Law.
- Regulation (EU) No 806/2014:
  - Establishes uniform rules and a uniform procedure for the resolution of credit institutions and certain investment firms in the framework of a Single Resolution Mechanism (SRM) and a Single Resolution Fund (SRF).
- Regulation (EU) 2015/81 of December 19, 2014:
  - Specifies uniform conditions of application of Regulation (EU) No 806/2014 with regard to ex ante contributions to the SRF (EU) 2015/81.
- Deposit guarantee schemes reform:
  - The reform of the deposit guarantee schemes directive (2014/49/EU, recast DGSD) was enacted in 2014.

### Single Resolution Mechanism (SRM) and Single Resolution Board (SRB)
- Scope and responsibilities:
  - Bank resolution within the Banking Union falls under the scope of the SRM.
  - A new agency, the SRB, has been established and vested with direct responsibility for resolution planning and resolution decision-making for:
    - All SIs directly supervised by the ECB.
    - All cross-border banks established in the Euro Area.
    - Any other LSI where resolution requires the use of the SRF.
- Decision-making and implementation framework:
  - The SRM centralizes decision-making for resolution actions.
  - The SRM relies on joint SRB/National Resolution Authorities (NRA) teams (internal resolution teams or “IRTs”) for resolution planning for SIs and cross-border banks.
  - Resolution implementation—even for institutions that fall within the purview of the SRB—is primarily the responsibility of the NRAs.
  - The NRA is responsible for resolution planning, resolution decision-making and implementation with respect to LSIs not covered by the SRB.
  - The SRB maintains back-up authority to intervene and directly implement a resolution if necessary to ensure high resolution standards or to ensure that resolution objectives are being met.

### Single Resolution Fund (SRF) design and funding
- Ownership and administration:
  - The SRF is owned and administered by the SRB.
- Funding mechanism:
  - Funded by regular ex ante and, potentially, extraordinary ex post contributions by banks.
- Target and timeline:
  - The fund will be built up to an initially estimated target amount of EUR 55 billion over eight years (1 percent of covered deposits of all banks within the member states participating in the SRM).
- Structure and mutualization:
  - The fund consists of national compartments, which can be used to fund resolution measures with respect to banks in the contributing jurisdiction.
  - The contributions will be progressively mutualized over a period of eight years.
  - The mutualized compartments are available to fund resolution measures in any SRM jurisdiction.
- Use of funds:
  - The SRF may fund the losses, costs or other expenses associated with resolution measures only to the extent necessary to ensure the effective application of the resolution tools.

*Source: cr18233 - 60. The EU supervisory framework significantly changed in 2011, with the set-up of (cr18233.pdf).*

### 66.      The DGSD harmonized deposit insurance coverage across the EU. The DGSD also

### cr18233 - 66.      The DGSD harmonized deposit insurance coverage across the EU. The DGSD also

### Deposit Guarantee and Deposit Insurance Framework
- The DGSD harmonized deposit insurance coverage across the EU and maintained the level of protection of deposits at EUR 100,000.
- The DGSD extended coverage to deposits of large nonfinancial companies, introduced faster pay-outs and ex-ante funding arrangements.
- The DGDS requires that, by July 3, 2024, each DGS shall reach a target level of at least 0.8 percent of the amount of covered deposits.
- The EC announced in 2015 a proposal to implement a European Deposit Insurance Scheme for Banking Union members by 2024:
  - National DGS would be gradually mutualized over time and in three stages.
  - Stage 1: reinsurance stage — support financed by contributions from the national DGS to a national DGS that has first exhausted its national fund.
  - After three years, move to a co-insurance scheme with progressively increasing contributions until full mutualization in 2024.

### Single Supervisory Mechanism (SSM): Responsibilities and Legal Framework
- The ECB, in cooperation with NCAs, supervises credit institutions in participating Member States; the SSM became operational on November 4, 2014.
- Objectives and responsibilities of ECB banking supervision and NCAs are defined in the SSMR and supplemented by the SSM Framework Regulation (SSMFR).
- Classification of banks into Significant (SIs) or Less Significant (LSIs) is based on criteria in Article 6 of the SSMR (size, importance for the economy of the Union or a Member State, importance of cross-border activities).
- Significant banks/banking groups are under direct ECB supervision; LSIs are directly supervised by NCAs with ECB oversight responsibility.
- The ECB may, when necessary and after consulting NCAs or upon request, decide to exercise directly all relevant powers for one or more credit institutions (prerogative not exercised to date).
- Publication and transparency:
  - SSMR and SSMFR published in the Official Journal of the EU and available on the ECB website.
  - ECB published Guide to banking supervision at SSM establishment.

Key statistics and scope:
- The ECB directly supervises 118 banking groups in 19 Member States, which include 1,108 banks representing EUR 21,400 billion of aggregated assets.
- The NCAs, under ECB oversight, supervise more than 3,100 banks, which represent EUR 4,900 billion of aggregated assets.

### Legal Instruments, Harmonization, and Options/Discretions
- ECB prudential tools derive from SSMR and EU supervisory law: CRR, CRD IV, SRMR, BRRD, FICOD.
- In November 2016 the European Commission proposed extensive revisions to CRR, CRD IV, SRMR, and BRRD; ECB published opinion CON/2017/46 in November 2017.
- CRR and CRD IV contain options and discretions (around 30 for Member States and around 130 for NCAs). ECB harmonization efforts:
  - 2015: ECB harmonized application of options and discretions for SIs via published Regulation (entered into force October 1, 2016) and a consolidated Guide.
  - April 2017: ECB issued recommendation and guideline to harmonize around 60 options/discretions for LSIs.
- Harmonization of options/discretions that reside with Member States requires amendments to EU legislation.

### Prudential Requirements, SREP, and Supervisory Powers
- Minimum regulatory capital requirements (Article 92 of the CRR):
  - CET1 capital ratio: 4.5 percent
  - Tier 1 capital ratio: 6.0 percent
  - Total capital ratio: 8.0 percent
- Capital conservation buffer of CET1 as per Article 129 of CRD IV applies.
- From January 1, 2016, systemic risk buffers apply:
  - G-SII buffer and O-SII buffer (up to 2.0 percent of the total risk exposure).
- ECB can increase capital requirements for individual banks/groups based on risk profile and systemic importance via the SSM SREP (Article 97 of CRD IV; EBA Guidelines).
- SREP assesses:
  - risks to which institutions are or might be exposed;
  - risks institutions pose to the financial system;
  - risks revealed by stress testing, considering nature, scale, complexity.
- Since 2016 SREP capital requirements have two parts:
  - Pillar 2 requirements (binding)
  - Pillar 2 guidance (non-binding but expected to be met; failure requires immediate notification to ECB banking supervision).

Supervisory powers and corrective tools:
- ECB powers include requiring reinforcement of arrangements, requiring restoration plans with deadlines, specific provisioning treatments, restricting/limiting business or requiring divestments, reducing risk in activities/products/systems, limiting variable remuneration, requiring use of net profits to strengthen own funds, restricting/prohibiting distributions, imposing additional reporting.
- Early intervention measures under Article 27 of the BRRD and supervisory measures per Article 16 of the SSMR are available.
- ECB can take early intervention measures and, under conditions, remove senior management or appoint temporary administrators (Articles 27–29 BRRD).
- Resolution cooperation: ECB assesses "failing or likely to fail" criterion for SIs and communicates to SRB and Commission; SRB adopts resolution scheme when conditions met; ECB provides advice and information to support resolution actions.

### Governance, Separation from Monetary Policy, and Decision-Making
- Article 25 SSMR establishes separation between supervisory and monetary policy functions; supervisory decisions prepared by independent Supervisory Board before submission to Governing Council for final adoption (mainly via "non-objection procedure").
- Non-objection time window for Governing Council is no more than 10 working days.
- A Mediation Panel established per Article 25(5) SSMR to resolve differences of views expressed by NCAs regarding Governing Council objections.
- Volume of supervisory decisions ~2,000 per year; delegation framework introduced to delegate certain routine decisions to nominated ECB managers to streamline processes.
- Fast-track procedures (teleconferences, shortened time limits) enable emergency decisions within a day when necessary.
- Supervisory Board Code of Conduct adopted in 2014; Ethics Framework revised in 2014; Compliance and Governance Office monitors compliance.

### Accountability, Transparency, and External Review
- ECB accountability primarily to European Parliament and European Council (Article 20 SSMR); practical arrangements in Interinstitutional Agreement and MoU with European Council.
- ECB submits annual report on banking supervision to national parliaments; Chair participates in public hearings.
- ECB subject to audits by European Court of Auditors; first such review published November 2016.
- Commission to publish every three years a report on application of SSMR (first report October 2017 concluded SSMR works well in practice).

### Resourcing, NCAs Role, and Staff Allocation
- ECB supervisory resources financed via supervisory fee borne by supervised entities (SSMR).
- Governing Council adopts ECB’s annual budget; BUCOM assists; Supervisory Board does not control budget directly.
- Since establishment, Governing Council agreed to augment SSM headcount (September 2015); additional headcount approved for Brexit-related preparation over 2018 and 2019.
- JST composition average: around 25 percent ECB staff and 75 percent NCA staff; substantial variation across clusters.
- Onsite inspection teams average: less than 10 percent ECB staff and more than 90 percent NCA staff; ECB staff led around 10 percent of inspections due to resource constraints.
- NCAs commit to provide staff availability 80 percent of time (90 percent for some NCAs); in practice staff can be allocated away by NCAs, availability may fall to as low as 25 percent of time for some JST members.
- ECB has training curriculum for SSM and can commission external consultants under confidentiality rules.

### Cooperation and International Relations
- SSM fosters structured cooperation via Supervisory Board and JSTs; common procedures fully integrate NCAs in key procedures (authorization, lapsing/withdrawal, acquisition of qualifying holdings).
- No MoUs concluded yet with non-SSM NCAs despite Article 3 SSMR mandate; ECB has not signed MoUs/close cooperation agreements with non-SSM NCAs as of the report.
- ECB cooperates with EBA, ESMA, EIOPA, ESRB; has non-voting membership on EBA Board of Supervisors; concluded MoUs with ESMA and signed Template MoUs with several NMAs (Italy, Netherlands, BaFin).
- ECB participates in 45 supervisory colleges; consolidating supervisor for 30 colleges and negotiating Written Coordination and Cooperation Arrangements (WCCAs); 16 WCCAs concluded by end-February 2018.
- Under "step in" arrangements ECB became principal in MoUs between NCAs and third countries; as of September 2017 the ECB became part of MoUs/arrangements that 49 third countries had in place.
- ECB negotiating MoUs with third-country authorities including US, Canada, Hong Kong, Japan, Singapore, Switzerland; in December 2016 signed MoU with authorities of Denmark, Finland, Norway, Sweden.

### Assessment Outcomes and Key Evaluations
- Principle 1 (Responsibilities, objectives, and powers) — Assessment: Largely Compliant
  - Comments: Clear allocation of responsibilities between ECB and NCAs; complex legal underpinnings with gaps and asymmetries due to national law differences; ECB has broad powers but faces limitations where options/discretions belong to Member States; investment firms undertaking “bank like” business are supervised nationally even when large/cross-border; Euro Area branches of non-EU/EEA banks are neither subject to CRD/CRR nor to consolidated supervision at EU level.
  - Recommendation highlighted: Harmonization of national options/discretions would require amendments to EU legislation and should be pursued as a priority.

- Principle 2 (Independence, accountability, resourcing, and legal protection) — Assessment: Largely Compliant
  - Comments: ECB banking supervision independence is enshrined in law; accountability arrangements to European institutions are robust; decision-making processes are complex and time-consuming but mitigated by delegation and fast-track procedures; resource constraints relate both to ECB budgetary allocation (Governing Council control) and to variable NCA staff availability and suitability; suggested option: consider binding commitment that NCA staff for SI supervision be available for at least 75 percent of their time if collaborative arrangements fail.

### Notable Legal and Procedural References (as cited in source)
- Council Regulation (EU) No 1024/2013; Regulation (EU) No 468/2014; Regulation (EU) No 575/2013; Directive 2013/36; Regulation (EU) No 806/2014; Directive 2014/59/EU; Decision ECB/2014/NP20; EBA Guidelines EBA/GL/2014/3; Article references: SSMR Articles 1, 4, 6, 9(1), 10–12, 14, 16, 18, 19, 21, 25, 32; CRR Article 92; CRD IV Article 97; BRRD Articles 27–29 and Article 36; Protocol (No 7) on privileges and immunities.

*Source: IMF staff report text from cr18233 - 66.      The DGSD harmonized deposit insurance coverage across the EU. The DGSD also*

### conclusion of a cooperation agreement on the supervision of significant cross-border

### conclusion of a cooperation agreement on the supervision of significant cross-border branches.

### Cross‑border cooperation agreements and MoUs
- An accession agreement to this MoU by the competent authorities of Estonia, Iceland, Latvia, and Lithuania was signed in April 2017.
- The ECB has signed an MoU with Banco Central do Brazil and with the Mexican supervisory authority, Comisión Nacional Bancaria y de Valores.
- Negotiations with supervisory authorities of South‑eastern European countries (Albania, Kosovo, Serbia, Montenegro, Bosnia Herzegovina/Republika Srpska, FYRO Macedonia) have been finalized and the MoUs will be signed shortly.
- Trilateral meetings between ECB banking supervision, the Bank of England’s Prudential Regulation Authority (PRA) and the U.S. Federal Reserve Board occur two or three times a year to share information at senior level on supervisory issues, practices, and detailed developments in individual G‑SIBs and other banks.
- ECB banking supervision’s progress in finalizing MoUs with third country authorities, within and outside the EEA, has been slower than expected due to complexities in negotiations arising from substantial differences between legal systems and national legal requirements.

### Confidentiality and information sharing (EC3 and EC4)
- Legal and regulatory framework:
  - CRD IV establishes a duty of cooperation within the EEA (Article 56) and a strict obligation of professional secrecy for staff of competent authorities and persons working on their behalf (Article 53).
  - For ECB staff, confidentiality is also laid down in Article 27 of the SSMR and in Article 37 of the Statute of the ESCB and of the ECB.
- Restrictions on use and onward sharing:
  - Confidential information may only be used for specified supervisory purposes (Article 54 of CRD IV).
  - Information exchange with a number of other institutions is limited to specified purposes (Articles 56–59 of CRD IV).
  - CRD IV allows information sharing with authorities outside the EEA only if the receiving authority is subject to a confidentiality duty at least equivalent to that in the EU (Article 55).
  - Where equivalence is not met, disclosure may be only in summary or aggregate form, or in certain judicial or administrative proceedings where this does not concern third parties involved (Article 53(1)).
  - Onward sharing of information received from one authority must be authorized beforehand.
- ECB practice with third countries:
  - Participation in colleges with third‑country authorities can only occur if those authorities have an equivalent confidentiality regime; the ECB complies with the EBA Recommendations identifying equivalent third country authorities.
  - Where third‑country authorities are not deemed equivalent, the ECB negotiates specific clauses, where legally feasible, restricting onward sharing except with the ECB’s consent.
  - The data protection officer is kept informed during MoU negotiations and identifies clauses required for conformity with EU data protection legislation.
- Duties of recipient supervisors (EC4):
  - Confidential information received can be used only for bank‑specific or system‑wide supervisory purposes and may not be disclosed to third parties without the permission of the originating supervisor.
  - If legally compelled to disclose confidential information received from another supervisor, the recipient promptly notifies the originating supervisor, indicating what information it is compelled to release and the circumstances.
  - Forward sharing of information originating in another Member State can only occur with the express agreement of the originating authority (Articles 55–59).
  - By virtue of the primacy of EU law, these provisions take priority over incompatible national legislation.

### Cooperation with resolution authorities and the Single Resolution Board (EC5)
- Framework and roles:
  - Supervision and resolution are key components of the Banking Union; the EU crisis management framework creates a duty to cooperate between supervisory and resolution authorities.
  - The primary partner of the ECB for crisis cooperation is the SRB, which involves relevant NRAs according to the SRB‑NRA cooperation framework.
  - Interaction is structured around complementary institutional roles, mutual cooperation, and strong coordination.
- Phase‑specific cooperation:
  - Preparation and planning:
    - ECB banking supervision requests recovery plans from SIs and assesses them, cooperating closely with the SRB, whose focus is on obstacles to resolution.
    - The SRB is responsible for resolution planning, determination of Minimum Requirements for Own Funds and Eligible Liabilities, and assessment of resolvability, cooperating closely with ECB banking supervision.
  - Early intervention:
    - ECB banking supervision leads early intervention for SIs and must notify the SRB without delay once preconditions for early intervention are met.
    - In practice, an SRB Board Member is invited as observer to relevant ECB supervisory meetings; ECB banking supervision must inform the SRB about crisis prevention measures and specific requirements imposed on an institution pursuant to Article 104 of CRD IV.
  - Determination that an institution is failing or likely to fail:
    - If ECB banking supervision determines, after consultation with the SRB, that an SI is failing or likely to fail, it must notify the SRB; the failing or likely to fail determination triggers transfer of responsibilities to the SRB.
    - The SRB may also make a failing or likely to fail determination but must inform the ECB and allow the ECB three calendar days to assess viability.
    - Since its establishment, ECB banking supervision has made a failing or likely to fail determination in respect of three institutions.
  - Conduct of resolution actions:
    - The SRB decides on resolution tools and ECB banking supervision provides support as needed.
    - Supervisory tasks under BRRD may need to be performed (e.g., assessment of acquisitions or qualifying holdings within resolution timelines).
    - If a bridge institution is set up, it may request temporary exemption of conditions for authorization; ECB banking supervision could grant authorization and become the competent authority if the bridge institution is classified as an SI.
    - The resolution authority may request the ECB to publish a copy of the resolution order or instrument or a summary note, including effects on retail customers and terms/period of suspension or restriction on activities.
- Memorandum of Understanding between the ECB and SRB:
  - The MoU signed in December 2015 covers cooperation and exchange of information with respect to all institutions directly supervised by the ECB and cross‑border LSIs under direct responsibility of the SRB as far as “common procedures” are concerned.
  - The MoU contains arrangements for cooperation and information exchange across phases of supervisory and crisis management activities, and provisions on communication, knowledge exchange, confidentiality, data protection, and cooperation with non‑participating Member States and third‑country authorities.
  - ECB banking supervision shares all relevant supervisory information with the SRB for resolution planning; the SRB has access to supervisory reporting data and recovery plans.
  - The ECB granted the SRB shared access to parts of its supervisory information platform in 2016 to support SRB tasks and facilitate information exchange.
  - Information sharing with the SRB is now automatic once an SI is assigned a certain SREP rating.
  - To strengthen coordination, the ECB designates a permanent observer to participate in SRB executive and plenary sessions; the SRB Chair participates as observer in Supervisory Board meetings for items relating to SRB tasks and responsibilities.
- Review and recommendations:
  - The ECA’s Special Report 02/2018, The operational efficiency of the ECB’s crisis management for banks (January 2018), recommended the ECB improve information exchange with the SRB, noting absence of a pre‑specified package of information to be provided in crisis situations; the ECB has accepted this recommendation.
  - An early review of the MoU’s effectiveness is underway and is expected to lead to an increase in the amount of information automatically shared with the SRB.
- Practical experience:
  - Cooperation arrangements between ECB banking supervision and the SRB were tested in three episodes of bank distress in 2017 where ECB banking supervision made a failing or likely to fail determination; this experience informs the current MoU review and is viewed by ECB staff as confirming effectiveness, though assessors note room for improvement.

### Assessment and compliance (Principle 3 and start of Principle 4)
- Assessment of Principle 3: Compliant.
- Comments:
  - ECB banking supervision has an extensive and effective framework for cooperation and collaboration within the SSM and with Euro Area NCAs, with the Supervisory Board at the apex.
  - Outside the SSM, the ECB has built on communication channels inherited under “step in” arrangements.
  - The absence of formal arrangements with some third‑country authorities has not precluded effective working relationships; confidentiality of supervisory information has been covered in exchanges of letters where necessary.
  - SSM preparations for Brexit have involved heightened interaction with other supervisory authorities and regular contact with the EBA, the PRA, and other third‑country supervisors to exchange information and promote alignment on operational issues.
  - The effectiveness of cooperation with the SRB has been “road tested” and will feed into the MoU review expected to enhance information sharing.

*cr18233 - conclusion of a cooperation agreement on the supervision of significant cross-border branches.*

### Annex I provides a list of activities that can be performed by credit institutions authorized in

### cr18233 - Annex I provides a list of activities that can be performed by credit institutions authorized in

### Mutual recognition of activities and authorization scope
- Annex I provides a list of activities that can be performed by credit institutions authorized in one of the Member States without acquiring additional authorization from the host authorities (‘List of activities subject to mutual recognition’), although this does not restrict a Member State from allowing credit institutions to perform fewer or other activities in the jurisdiction.
- National laws define whether a credit institution is allowed to undertake activities other than the taking of deposits or other repayable funds from the public and the granting of credits for its own account.
  - Austria: banking activities requiring authorization as a credit institution include building savings and loan business, investment fund business and real estate investment fund business.
  - Greece: credit institutions may be allowed to carry out financial or secondary activities additional to those listed in CRD IV Annex I.
- The ECB’s authorization procedure applies to all activities that credit institutions are allowed to undertake, including activities subject to mutual recognition as well as other regulated activities that require authorization under national laws.
- The authorization procedure covers extensions of authorization where a credit institution that already has a banking license requires authorization to undertake a new regulated activity.
- Article 104(1)(e) of CRD IV: competent authorities shall have the power to restrict or limit the business, operations, or network of institutions or to request the divestment of activities that pose excessive risks to the soundness of an institution.
  - The ECB can directly exercise this power with respect to SIs or, where such power was not conferred on the ECB, can require the NCA to make use of this power by way of instructions.

### Use of the word “bank” (EC3)
- The use of the word “bank” and any derivations such as “banking” in a name, including domain names, is limited to licensed and supervised institutions in all circumstances where the general public might otherwise be misled.
- Description and findings:
  - There are no EU-level restrictions regarding the use of the word “bank” and any derivations. The ECB has no powers in relation to the restrictive and designated use of the word “bank” that are designed to ensure that the general public is not misled.
  - Restrictions regarding the use of the term “bank” are imposed at the national level.
    - Broadly, the term “credit institution” is a protected designation, but in some Euro Area Member States the use of the term "bank" and any derivations by other enterprises may be permitted on a grandfathered basis (Germany) or if the activities of these enterprises preclude the impression that they conduct banking business (Germany, Greece).
    - 2016 Detailed Assessment Report for Germany: assessors had access to several cases where the use of the term “bank” or similar by unlicensed institutions was investigated and sanctioned by the NCA, including for a domain name.
  - Article 19 of CRD IV: “for the purposes of exercising their activities, credit institutions may, notwithstanding any provisions in the host Member State concerning the use of the words 'bank,' 'savings bank,' or other banking names, use throughout the territory of the Union the same name that they use in the Member State in which their head office is situated,” and “in the event of there being any danger of confusion, the host Member State may, for the purposes of clarification, require that the name be accompanied by certain explanatory particulars.”

### Taking of deposits reserved (EC4)
- The taking of deposits from the public is reserved for institutions that are licensed and subject to supervision as banks.
- Description and findings:
  - Article 9 of CRD IV: “Member States shall prohibit persons or undertakings that are not credit institutions from carrying out the business of taking deposits or other repayable funds from the public” and “Such restriction shall not apply to the taking of deposits or other funds repayable by a Member State, or by a Member State's regional or local authorities, by public international bodies of which one or more Member States are members, or to cases expressly covered by national or Union law, provided that those activities are subject to regulations and controls intended to protect depositors and investors.”
  - The ECB has no powers to enforce the general prohibition on taking deposits or other repayable funds from the public by institutions that are not authorized as credit institutions. The prohibition has been transposed into national laws.

### Publication of licensed banks (EC5)
- The supervisor or licensing authority publishes or otherwise makes available a current list of licensed banks, including branches of foreign banks, operating within its jurisdiction in a way that is easily accessible to the public.
- Description and findings:
  - Article 20(2) of CRD IV requires the EBA to publish on its website, and update regularly, a list of the names of all credit institutions that have been granted authorization. This information is available under the Credit Institution Register on the EBA website, which contains names of:
    - (a) institutions set up in the Member States;
    - (b) branches of institutions established in EEA countries that have the right to passport their activities; and
    - (c) branches of other foreign banks.
  - The Credit Institution Register is updated on a real-time basis with notifications of newly licensed institutions or withdrawal of authorization by competent authorities.
  - The ECB publishes on its website a list of the SIs it directly supervises as well as a list of the LSIs supervised by the NCAs. The ECB lists are updated regularly, based on decisions taken with regard to authorizations and the withdrawal or lapsing of authorizations, decisions amending the significance of supervised institutions, or relevant notifications received from the NCAs.
- Assessment of Principle 4: Largely Compliant
  - European law as transposed into national laws covers the main elements of this Core Principle, with the necessary powers residing in most cases with NCAs.
  - The ECB has not been conferred powers in relation to the restrictive and designated use of the word “bank,” nor to enforce the prohibition on the taking of deposits from the public by nonbanks; these matters are generally pursued at the national level.
  - Commission concerns: growth of “bank-like” activities in the EU, complex structures of third-country groups operating through entities that escape ECB supervision, and large investment firms that are bank-like but supervised at the national level — potential for regulatory and supervisory arbitrage. Commission’s report suggested consultations on proposed amendments to the CRR/CRD IV framework could address this concern.
  - ECB opinion (November 2017): large and complex bank-like investment firms with cross-border operations can pose increased financial stability risks; suggested consideration of amending the CRR/CRD IV to ensure that large cross-border investment firms carrying out bank-like activities are authorized and supervised as credit institutions, while preserving current differentiation for other investment firms.

### Licensing criteria (Principle 5) — Essential criteria EC1–EC7
- Principle 5 summary: The licensing authority has the power to set criteria and reject applications for establishments that do not meet the criteria. At a minimum, the licensing process consists of an assessment of the ownership structure and governance (including the fitness and propriety of Board members and senior management) of the bank and its wider group, and its strategic and operating plan, internal controls, risk management, and projected financial condition (including capital base). Where the proposed owner or parent organization is a foreign bank, the prior consent of its home supervisor is obtained.

- EC1: Authority for granting and withdrawing a banking license
  - Article 4(1)(a) of the SSMR: the ECB is the exclusive competent authority for the authorization of credit institutions in Euro Area Member States and for withdrawal of such authorizations.
  - NCAs are fully integrated in the authorization process; authorization decisions are taken on the basis of applicable national law.
  - Process: NCAs are entry point, perform initial analysis, forward viable applications to the ECB; NCA prepares a draft decision for the Governing Council, deemed adopted unless the Governing Council objects within ten working days (extendable once).
  - Withdrawals: ECB must consult the NCA at least 25 working days before the decision; in urgent cases timeframe can be reduced to five working days. Resolution authorities may object to ECB’s intention to withdraw an authorization of an institution entering resolution if they consider it would affect resolution or financial stability.
  - Article 6(2) of the SSMR: ECB and NCAs subject to duty of cooperation in good faith and an obligation to exchange information.

- EC2: Power to set licensing criteria and reject applications
  - Minimum conditions for authorization set out in Articles 10 to 14 of CRD IV: program of operations, structural organization, initial capital, fit-and-proper requirements for management and shareholders, absence of “close links,” co-location requirements.
  - Member States may specify additional criteria provided they do not assess economic need (Article 11 prohibits assessing economic need).
    - Example: Ireland requires compliance with the Corporate Governance Code for Credit Institutions and Insurance Undertakings.
  - Power to reject implied by Articles 11 to 15 of CRD IV; information on a rejection must be communicated within 12 months.
  - Both NCA and ECB can reject; ECB may only object to NCA draft proposals where EU law conditions are not met.
  - Information requirements covered by Articles 8, 10, and 14 of CRD IV. EBA RTS (July 2017) specifies information to be provided to NCAs in applications for authorization.
  - Power to revoke authorization granted on false information set out in Article 18(b) of CRD IV.
  - ECB issued for public consultation (September 2017) a guide to the assessment of license applications from fintech credit institutions; fintech entities meeting legal definition of a credit institution under CRR/CRD IV must seek authorization and are subject to same requirements.

- EC3: Consistency of licensing and ongoing supervision criteria
  - Criteria for authorization are generally consistent with those applied in ongoing supervision.
  - Article 18 of CRD IV: one possible reason for withdrawing an authorization is that the credit institution “no longer fulfils the conditions under which authorization was granted.”
  - Conditions for a license (including national law conditions) need to be fulfilled on an ongoing basis (except program of operations).
  - ECB may withdraw an authorization in cases set out in EU law, on its own initiative following consultation with the NCA, or on a proposal from the NCA.

- EC4: Assessment of structures for effective supervision and corrective measures
  - CRD IV conditions include fitness and propriety of management and a direct link between Member States of incorporation and supervision.
  - Authorization will be refused if:
    - licensing authority is not satisfied as to suitability of shareholders or members;
    - any close links prevent effective exercise of supervisory functions;
    - third country laws or enforcement difficulties prevent effective exercise of supervisory functions.
  - These conditions broadly transposed into national law; Italy noted implementation gap for fit-and-proper assessments, and ECB supervision has worked with the NCA to address gaps.
  - EBA RTS on information to be provided in authorization applications addresses identification of obstacles preventing effective supervision (including close links and interactions with third-country authorities).

- EC5: Suitability of major shareholders and transparency of ownership
  - Article 14 of CRD IV addresses suitability of major shareholders, including reputation, knowledge, skills and experience, and financial soundness.
  - Applicants must identify prospective shareholders with qualifying holdings or the 20 largest shareholders if no qualifying holdings.
  - Background checks include suitability, financial soundness, and checks for money laundering or terrorist financing risk.
  - EBA RTS requires applicants to explain available funding sources for capital and provide evidence where available.
  - Supervisory practice: NCAs and the ECB assess whether shareholder financial soundness is sufficient to ensure sound and prudent operation for the first three years of business.

- EC6: Minimum initial capital
  - Article 12 of CRD IV specifies a minimum initial capital amount for an authorized credit institution of EUR 5 million. The initial capital must be held in the form of common equity tier 1.
  - In a small number of cases (mainly grandfathering), minimum capital is EUR 1 million, but a ratchet applies until capital exceeds EUR 5 million.
  - National higher minima examples:
    - Luxembourg: EUR 8.7 million
    - Spain: EUR 18 million
    - Greece: EUR 18 million (Bank of Greece can reduce threshold to EUR 5 million)
    - Slovakia: EUR 20 million (EUR 30 million for mortgage banks)
  - ECB policy stance on authorizations: generally requires new credit institutions to have initial capital covering CRD IV minimum plus losses over the first three years projected on the basis of a severe but plausible adverse scenario in the business plan. Where national legislation sets higher minima, the “add on” may be limited to one year’s losses.

- EC7: Fit-and-proper assessments for Board members and senior management
  - Article 13 of CRD IV: authorization requires at least two persons effectively directing the business to ensure separation between risk-taking and risk management.
  - Article 91 of CRD IV: establishes fit-and-proper requirements for members of the management body (strategy, oversight, accountability).
  - Authorization refused if management body members are not of sufficiently good repute or lack sufficient knowledge, skills and experience.
  - Member States must ensure management body defines, oversees and is accountable for governance arrangements, segregation of duties, and prevention of conflicts of interest.
  - EBA/ESMA joint Guidelines on assessment of suitability of management body and key function holders apply from June 30, 2018; Guideline 8 addresses reputation, honesty, and integrity; Guideline 6 addresses knowledge, skills, and experience; Guidelines discuss collective suitability.
  - NCAs and the ECB evaluate proposed directors for fitness and propriety; ECB decides on appointment of management body members of SIs and LSIs in licensing or qualifying holdings cases.
  - ECB issued a Guide to fit-and-proper assessments in May (date not specified in this excerpt).

*Source: cr18233 - Annex I provides a list of activities that can be performed by credit institutions authorized in*

### 2017. This serves as a guide for the suitability assessment of board members conducted by

### cr18233 - 2017. This serves as a guide for the suitability assessment of board members conducted by 

### Fit-and-proper guidance and licensing (overview)
- Guide covers assessment criteria for board members: (1) reputation, (2) time commitment, (3) experience, (4) independence of mind/conflicts of interest, and (5) collective suitability of the management body.
- Guide covers conditional approvals and interviews with candidates; an SSM methodology for fit-and-proper interviews has been approved by the Supervisory Board.
- In its opinion of November 2017, the ECB recommended that EU law be amended to further harmonize the processes for fit-and-proper assessments.

### Licensing authority reviews (EC8–EC11)
- EC8: Licensing authority reviews proposed strategic and operating plans, including corporate governance, risk management, internal controls (including detection/prevention of criminal activities), oversight of proposed outsourced functions, and operational structure reflecting scope and sophistication of proposed activities.
  - Applications must include a program of operations covering the first three years on a base case and stress scenario basis (Article 6 of EBA’s July 2017 RTS).
  - Program must include geographical distribution, viability of business model, organizational structure, internal control framework, and budgetary and human resources for compliance, risk management, and internal audit functions.
- EC9: Licensing authority reviews pro forma financial statements and projections.
  - Applications must include: forecasts (base case and stress) of balance sheets, profit and loss accounts and cash flow statements for first three complete business years; planning assumptions; forecast calculations of own funds requirements; funding profile and diversification; internal liquidity adequacy assessment; and outline of indebtedness prior to commencement (Article 5 of July 2017 RTS).
  - Information on suitability of principal shareholders specified in Article 11 of the RTS (reputation and financial soundness).
- EC10: For foreign banks establishing branch or subsidiary, host supervisor must establish whether no objection from home supervisor has been received and whether home supervisor practices global consolidated supervision.
  - Under Article 17 of CRD IV, no authorization is required for branches established in another Member State; home supervisor may oppose passporting (Article 35.3).
  - For subsidiaries, Article 16 requires host authority to consult home supervisor before granting authorization.
  - Euro Area branches of non-EU or EEA banks are not subject to CRD IV/CRR nor to consolidated supervision at EU level; they are regulated and supervised by national laws and NCAs and not by the ECB.
  - As at end-March 2017, there were 77 third-country branches in the Euro Area, belonging to 54 third-country banking groups; 17 of these groups were operating via branches in more than one Euro Area country.
- EC11: Monitoring progress of new entrants:
  - For SIs, ongoing supervision follows the SEP set up by the relevant JST. SEP determines minimum activities and may address newness of institution though no specific SSM Supervisory Manual requirement.

### Assessment of Principle 5 (licensing authority)
- Assessment: Largely Compliant.
- Key findings:
  - Since establishment of the SSM, the ECB has granted 49 authorizations of credit institutions and withdrawn 108 authorizations.
  - Legal framework and complementary material (EBA/EBA-ESMA/ECB guidance and SSM Supervisory Manual) provide a comprehensive basis for supervisory assessments.
  - ECB does not have authority to authorize/supervise Euro Area branches of non-EU or EEA banks—creates regulatory and supervisory arbitrage opportunities.
  - Commission proposed that third country banking groups with two or more institutions established in the EU be required to establish intermediate EU parent undertakings; ECB suggested broader application to include branches and re-establishment of branches as authorized credit institutions when thresholds exceeded.

### Transfer of significant ownership (Principle 6) — framework and findings
- Principle summary: Supervisor can review, reject, and impose prudential conditions on proposals to transfer significant ownership or controlling interests.
- EC1: Definitions
  - Under CRR, a “qualifying holding” is a direct or indirect holding representing 10 percent or more of capital or voting rights or enabling significant influence; includes controlling interest.
  - “Control” defined as parent–subsidiary relationship or similar.
  - EBA/ESMA/EIOPA December 2016 Joint Guidelines (effective October 2017) set factors to assess significant influence and indirect qualifying holdings.
- EC2: Notification/approval requirements
  - Articles 22 and 25 of CRD IV set notification/approval for acquisitions reaching/exceeding 20 percent, 30 percent, 50 percent thresholds or resulting in subsidiary status.
  - National laws transpose requirements; NCAs assess and coordinate with ECB; strict timelines apply.
  - ECB internal rules clarify conditions, timeline effects, and right to be heard.
- EC3: Power to reject proposals
  - Article 23(2) of CRD IV permits rejection based on five criteria in Article 23(1): (i) reputation of acquirer; (ii) reputation/skills of proposed new managers; (iii) financial soundness of acquirer; (iv) prudential impact on target; (v) suspicion of money laundering or terrorist financing.
  - ECB applies more stringent assessment for complex acquirers (private equity, hedge funds, sovereign funds, large nonbank groups, third country acquirers).
  - Possible conditions: minimum holding periods, dividend restrictions, commitments to provide funding, simplification of holding chain, independence of supervisory board members.
  - No specific EU-wide measures for false information; national legislation may provide for suspension of voting rights or disposal.
- EC4: Information on significant shareholders
  - Article 26(1) CRD IV: listed credit institutions must inform competent authorities at least annually of names and size of qualifying holdings.
  - Identification of ultimate beneficial owners not always required depending on national law; AML Directive (Directive (EU) 2015/849) requires companies to obtain and hold beneficial ownership information.
  - Assessments of applications require disclosure of all beneficial owners, limited partners, intermediaries; participants above 5 percent in acquiring funds asked for detailed information.
- EC5: Power to address unauthorized changes
  - Article 26(2) CRD IV provides measures: injunctions, penalties, suspension of voting rights; annulment of votes where applicable. Article 66(1) CRD IV mandates administrative penalties for breaches.
  - No specific EU requirements relating to modification or reversal of change of control; measures depend on national law.
- EC6: Notification of material information by banks
  - No specific CRR/CRD IV requirement for banks to notify supervisor as soon as they become aware of material information affecting suitability of a major shareholder.
  - National practices vary: Latvia explicit bank obligation; Netherlands obligation applies to shareholder; Spain requires banks to ensure suitability at all times; Germany and Austria rely on auditor reporting obligations; other Member States have general notification requirements.
- Assessment of Principle 6: Largely Compliant.
  - Comments: Clear basis for approving acquisitions/disposals of qualifying holdings; NCAs integrated in process; supported by Joint Guidelines and SSM procedures.
  - Gaps: no EU requirement for banks to promptly notify supervisors of material information affecting major shareholders; inconsistent national notification rules; inconsistent periodic reporting of ultimate beneficial owners; no consistent administrative penalties for modification/reversal of unauthorized change of control.

### Major acquisitions (Principle 7) — framework, findings, and assessment
- Principle summary: Supervisor powers to approve/reject and impose conditions on major acquisitions or investments by a bank to prevent undue risks and hindered supervision.
- EC1: Definitions and thresholds
  - Acquisitions outside financial sector: CRR Articles 89–91 apply; no supervisory approval/notification if a single significant ownership ≤ 15 percent of eligible capital or total such ownerships ≤ 60 percent of eligible capital (Tier 1 plus Tier 2 limited to 1/3 of Tier 1).
  - For amounts above thresholds, risk weight of 1,250 percent applies or amounts must be deducted from Common Equity Tier 1.
  - Acquisitions in EU financial sector entities: Articles 22–27 CRD IV (qualifying holding rules described in CP 6).
  - Acquisitions of non-EU banks: not covered by CRR/CRD IV; majority of Member States provide powers but coverage is uneven.
  - As from January 1, 2017, Supervisory Board clarified ECB directly exercises supervisory powers related to acquisitions of holdings in non-credit institutions or credit institutions (including outside EU) for SIs where national law provides such power.
- EC2: Assessment criteria
  - No harmonized EU procedures/criteria for assessment of acquisitions; assessment criteria exist in a few Member States (e.g., Ireland, Slovenia).
  - Where target is EU supervised entity, assessment criteria set out in Article 23(1) CRD IV.
- EC3: Objective criteria to avoid undue risks and hindered supervision
  - No harmonized EU criteria; national approaches differ.
  - ECB requires SIs to inform it of transactions materially affecting risk profile prior to completion; ECB can take measures under Article 16(2) SSMR (capital/liquidity add-ons, governance/organizational reinforcements, require divestment).
  - Impact figures prominently in SREP and may lead to SREP requirements.
- EC4: Adequacy of bank resources for acquisition
  - No specific EU requirement to assess adequacy of financial, managerial, organizational resources prior to acquisition.
  - 15/60 thresholds manage risks for nonfinancial sector investments; no requirement/limit for acquisitions of non-EU banks.
  - National laws in some countries require adequate organizational structure and risk management relative to size/complexity.
  - ECB communicates need to be aware of transactions that materially affect risk profile and seeks comprehensive assessment (capital, liquidity, governance).
- EC5: Nonbanking activities risks
  - ECB aware of nonbanking activity risks; assessments part of SREP and ECB can use full range of qualitative and quantitative measures.
  - National examples: Austria limits acquisition up to certain own funds amount; Spain can limit activities based on solvency; Ireland uses license conditions.
- AC1 (acquisitions by other group entities)
  - No specific EU authorization procedure for acquisitions by other entities in banking group.
  - Some Member States require notification by unregulated group members (Belgium, Finland, Ireland); other Member States apply direct/indirect participating interest rules to subsidiaries.
- Assessment of Principle 7: Materially Non-Compliant.
  - Key reasons:
    - No prior notification/approval requirements for acquisitions outside the financial sector at EU level.
    - Acquisition rules for qualifying holdings focus on safeguarding target, not acquiring institution.
    - No explicit EU requirements for acquisitions of holdings in credit institutions outside the EU.
    - No harmonized procedures/criteria at EU level for assessing major acquisitions by credit institutions.
  - Comment: ECB can assess against general Article 16(1)(c) SSMR requirement but absence of pre-notification means no assurance of ex ante influence on acquisition.
  - ECB recommendation in opinion on Commission proposals: EU law should include clear reference requiring notification in writing in advance of material acquisitions/investments within or outside the Union and grant competent authorities power to approve or reject proposed transactions.

### Supervisory approach (Principle 8) — methodology and operations
- Principle summary: Supervisor must maintain forward-looking risk assessment, identify/address system-wide risks, have early intervention framework, and coordinate resolution planning.
- EC1: Methodology to assess ongoing risks
  - Main tool: SREP; ECB required to carry out SREP and take decisions for SIs at consolidated, sub-consolidated, and single-entity levels.
  - SSM SREP built along EBA Guidelines (EBA/GL/2014/13); proportionate application by nature, scale, complexity, cross-border significance.
  - SREP methodology combines quantitative and qualitative analysis under “constrained judgment.”
  - SSM SREP elements:
    - business model and profitability assessment;
    - internal governance and risk management assessment;
    - risk-by-risk assessment of risks to capital;
    - risk-by-risk assessment of risks to liquidity and funding.
  - SREP decisions documented in IMAS; at least once a year a SREP decision is taken.
- EC2: Forward-looking processes
  - SREP provides forward-looking view: assesses viability at 12-month horizon, medium term (3 to 5 years), and over the cycle.
  - ECB’s RAS supports JST work (evaluating risk levels, business model, governance, capital and liquidity adequacy).
  - Supervisors can challenge ICAAP/ILAAP using supervisory proxies and supervisory stress tests (EBA/ECB).
  - SEP defines supervisory activities and MELs; onsite inspections and internal model investigations planned (typically one year horizon).
  - Onsite inspections authorized under Regulation 468/2014 (SSMFR Articles 143–144).
- EC3: Compliance with prudential regulations
  - ECB assesses compliance with CRD IV/CRR requirements (own funds, securitization, large exposures, liquidity, leverage, reporting, governance, fit-and-proper, ICAAP/ILAAP, IRB models).
  - Written SREP decisions tell institutions whether they implemented required arrangements; early powers under Article 16(2) SSMR where likely to breach requirements within next 12 months.
  - TRIM exercise launched in 2017: planned until 2019, about 200 onsite investigations, reviewing all internal models for market and CCR risk and most material credit risk models; target coverage at least 60 percent of total IRB Exposure at Default and risk-weighted assets of SIs.
  - Resource constraints for onsite supervision remain a challenge.
- EC4: Macroeconomic and cross-sectoral considerations
  - Article 97 CRD IV requires evaluation of risks and stress-testing.
  - Strategic planning exercise (DG MS IV Planning Division with Risk Analysis Division) includes macroprudential input and external bodies (ESRB, EBA, IMF).
  - JST assesses stressed capital needs using internal stressed projections, supervisory proxies, supervisory stress tests; EBA 2016 EU-wide stress test reflected in capital guidance.
  - Risk Analysis Division conducts cross-sectoral quantitative impact studies and cooperates with ECB macroprudential function.
  - Cooperation arrangements exist with other regulators and supervisory colleges.
- EC5: System-wide risk identification and communication
  - SREP performed simultaneously across SIs enabling identification of common trends; horizontal analyses by MSD and RIA divisions feed Supervisory Board.
  - ECB should consider risk management, operational risk, and liquidity impacts of high-risk business models even if activities fall under NCAs or national authorities (AML-related).
  - Assessors identified a gap in ECB’s identification of build-up of risks in some areas.
- EC6: Resolvability assessment and measures
  - Resolution planning is responsibility of resolution authority (SRB/NRAs) under SRM Regulation and BRRD; ECB has consultative role for SIs and cooperates with SRM.
  - SRB consults ECB and notifies institutions and authorities of impediments; institutions must propose measures within four months.
  - SRB powers include requiring revisions of intragroup financing, limiting exposures, imposing information requirements, divestment, limiting/ceasing activities, changes to legal/operational structures, requiring issuance of eligible liabilities, among others.
  - SRB must consult ECB and consider proportionality and financial stability effects.
  - Recommendation: ECB should continue work with SRB to refine operational policies and procedures for resolution planning.
- EC7: Framework for handling banks in stress and crisis management
  - ECB crisis management framework ranges from preparatory supervision to advisory role in resolution; main decision-makers in resolution are SRB and NRAs.
  - Early identification and remediation, recovery plan assessment, stress tests, and escalation processes in place.
  - Crisis Management Division monitors deterioration; institution-specific Crisis Management Teams (IS CMTs) can be established to coordinate supervisory actions.
  - IS CMT composition includes Chair/Vice-Chair of Supervisory Board, JST coordinator, Head of Division, Director General, Head of CRM Division, DG MS IV, Secretariat, affected NCA Supervisory Board members, and others as needed.
  - Emergency and fast-track decision-making procedures exist; Supervisory Board proposes complete draft decisions to Governing Council which approves or objects; non-objection procedure available.
  - Audit (Special Report No. 02/2018) found design flaws and inefficient implementation; recommended better use of recovery plan assessments, operational guidance, and enhanced reporting.
  - Recommendation: ECB and SRB should forge closer working relationships; conclude MoU revisions; establish earlier automatic information sharing and pre-notification discussions for recovery and resolution planning.
- EC8: Activities outside regulatory perimeter
  - If ECB becomes aware of bank-like activities outside regulatory perimeter or restructuring to avoid perimeter, it draws matter to attention of responsible authority.
  - ECB lacks express authority to legally constrain activities outside its remit and cannot directly enforce national law or licensing gaps without Union powers.
  - Where SIs breach Union law, ECB may impose administrative pecuniary penalties or require NCAs to impose sanctions (Article 18(1)/(5) SSMR); ECB may impose enforcement measures or instruct NCAs to use national enforcement powers when available.
- Assessment of Principle 8: Largely Compliant.
  - Comments: Fundamentals of methodological framework (SREP, RAS, SEP) are sound and refined since 2015; further improvement recommended in certain operational and coordination areas (notably ECB–SRB cooperation and resource allocation for onsite supervision).

*Italicized source: cr18233 - 2017. This serves as a guide for the suitability assessment of board members conducted by*

### 2015. This process of continual assessment and improvement should continue as the SREP,

### cr18233 - 2015. This process of continual assessment and improvement should continue as the SREP,

### ECB supervisory approach — overall character
- The methodology is a forward-looking risk-based assessment of individual banks and banking groups, proportionate to their systemic importance and consistent with CP 8 and the EBA’s SREP Guidelines.
- The ECB’s supervisory approach identifies risks within banks and the banking system as a whole and should seek a balance between thematic and ongoing supervision as level-setting efforts mature.
- The greater emphasis on quantitative analysis is consistent with the EBA’s SREP Guidelines.

### Decision-making, resources, and crisis management — findings
- ECB decision-making processes are complex and may impede timely supervisory action in the ordinary course.
- The volume, quality and availability of resources for supervision of SIs are in some instances beyond the ECB’s control.
- In exigent circumstances the Supervisory Board and the Governing Council have demonstrated an ability to act using emergency procedures that have been successfully tested in recent resolutions.
- Additional work is required in recovery and resolution planning; internal ECB processes should be reviewed in light of recent resolution experience.
- Timeliness and the level of coordination and collaboration between the ECB and the SRB could be improved.
- The crisis management function could make better use of recovery plan assessments, develop operational guidance for crisis management activities, and enhance management reporting systems.
- Reference: Special Report No. 02/2018: The Operational Efficiency of the ECB’s Crisis Management for Banks, 16/01/2018.

### Recommendations on SRB cooperation and information sharing
- The assessors recommend that the ECB and SRB forge closer working relationships in recovery and resolution planning at the earliest possible time.
- Ongoing negotiations to revise the existing MoU should conclude as soon as possible.
- Automatic information sharing with the SRB has been established at the assignment of certain SREP ratings.
- Informal discussions about information gaps, liquidity and preliminary resolution strategies should occur early in the process, well before formal “early intervention” and “failure or likely to fail” processes are required, to facilitate seamless recovery and resolution planning.

### Principle 9 — Supervisory techniques and tools (overview)
- Principle 9: The supervisor uses an appropriate range of techniques and tools to implement the supervisory approach and deploys supervisory resources on a proportionate basis, taking into account the risk profile and systemic importance of banks.

### EC1 — mix of onsite and offsite supervision: description and findings
- Relevant EU legislation: Articles 97, 98 and 99 of CRD IV; EBA SREP guidelines (under review/consultation).
- Article 99 CRD IV minimum expectations for NCAs: annual supervisory assessment program including:
  - paragraph 1(a): plan for activities and resources;
  - paragraph 1(b): identification of institutions for enhanced supervision;
  - paragraph 1(c): plan for onsite examinations.
- CRD IV permits adjustment of supervision intensity, including permanent onsite presence (paragraph 3(b)), more frequent reporting (paragraph 3(c)), and thematic inspections (paragraph 3(e)).
- ECB powers: (i) carry out offsite supervision per Article 4 of the SSMR; (ii) adopt supervisory measures per Article 16 SSMR; (iii) carry out onsite inspections per Article 12 SSMR and Articles 143 to 146 of the SSMFR.
- ECB communicated three 2017 priority risk areas: business models and profitability drivers; credit risk, with a focus on NPLs and concentrations; and risk management.
- SEP (Supervisory Examination Program) defines tasks and activities related to offsite ongoing supervision and onsite missions, in line with available resources.
- Offsite ongoing supervision activities evaluate compliance, risk profile via SREP, and adoption of capital, liquidity or qualitative measures; for SIs these tasks fall under JSTs.
- Thematic reviews examples: 2015–2016 Governance and Risk Appetite; 2017–2019 Internal Model (TRIM) reviews and investigations.
- Supervisory measures are operational acts directed to the SI; final decisions are taken by the Supervisory Board and the Governing Council.
- SIs grouped into five different categories (five clusters) with different supervisory engagement levels; categorization updated annually or when developments occur.
- Step 1 (impact) dimensions: size, complexity and geographical diversification, substitutability, interconnectedness, and implicit groups. Size and complexity are leading indicators; additional specific information is incorporated.
- Step 2 combines Step 1 cluster with “riskiness” based on last available RAS overall rating assigned by the JST; Planning Division within DG MS IV provides an assessment matrix.
- Engagement level determines minimum supervisory activities and resources; de facto engagement may differ from ex-ante required engagement in unforeseen developments.
- For significant subsidiaries two engagement levels have been defined according to the SREP approach.

### EC2 — planning and execution of onsite/offsite activities: description and findings
- The process for planning and executing onsite and offsite activities is defined in the confidential SSM Supervisory Manual.
- JSTs set up individual SEPs for each SI, typically with a predetermined time horizon of one year for ongoing activities and for onsite inspections/internal model investigations.
- SEPs align with Supervisory Priorities and principles of risk-based approach and proportionality using MELs (minimum engagement level activities) established by the Planning and Coordination of SEP Division.
- Draft SEP process:
  - Planning and Coordination formulates first draft on-going SEP proposal including MEL activities for each SI.
  - JSTs assess on a comply or explain basis and add “additional SEP” activities as needed.
  - JSTs draft onsite SEP proposals considering available resources.
  - Amendments to SEPs throughout the year are possible following unforeseen developments.
- SEPs may be subject to ex post reviews by DG MS IV SQA Division; operating units responsible for compliance with SSM Manual.
- Resource allocation: draft SEPs include task allocation and resource estimates, including onsite inspection team size and specialized expertise needs; additional resources may be supplied by ECB or NCAs’ horizontal functions.
- ECA 2016 review noted indications that staffing levels in ECB banking supervision were insufficient and recommended increased ECB staff presence in onsite inspections; ECB accepted this recommendation.
- Clearance and consolidation steps: JST internal clearance → Planning and Coordination review for MEL compliance → Centralized Onsite Inspections (COI) and Internal Models Divisions quality checks → consolidated SEP submitted for information to Supervisory Board → list of onsite inspections/internal model investigations submitted for approval to Supervisory Board and adoption by Governing Council under non-objection.
- Monthly proposals for adjustments to the approved list may be submitted to the Supervisory Board to adapt to new priorities.
- Monitoring: Planning and Coordination, COI and Internal Models Divisions monitor execution semi-annually and coordinate back-up measures when issues arise.

### EC3 — information sources and data reliability: description and findings
- Legal powers: Article 10 SSMR empowers ECB to require necessary information; additional legal support in Articles 73, 97, 98, and 99 of CRD IV.
- Key quantitative information sources include:
  - (i) risk indicators based on FINREP and COREP data (consolidated level since mid-2014);
  - (ii) risk indicators from sources other than FINREP/COREP (e.g., ECB’s STE data collection);
  - (iii) indicators on economic and market conditions (GDP, sector NPL, market volatility etc.);
  - (iv) other regulatory data, not harmonized (central credit register, etc.);
  - (v) a bank’s internal estimates (ICAAP, ILAAP, stress tests, internal reports);
  - (vi) financial statements, Pillar 3 disclosures;
  - (vii) peer group indicators;
  - (viii) supervisory stress test results; and
  - (ix) market views (external ratings, investors’ quantitative analyses, etc.).
- Quantitative reporting to ECB banking supervision management and senior management is managed in cooperation with ECB’s DG-Statistics, responsible for data consistency and quality checks.
- Qualitative information sources include:
  - (i) supervisory findings (onsite inspection reports, meeting reports, etc.);
  - (ii) institutions’ internal documents (ICAAPs/ILAAPs, financial statements, board memos, organizational charts, internal audit reports, whistle-blower reports, etc.);
  - (iii) business and risk management reports (dashboards, limit reports, etc.);
  - (iv) reports on the environment (risk trends, new areas of focus, analysts’ reports, rating agencies’ reports, equity analyst recommendations, news, etc.).
- Note: CP 10 discusses the ECB’s Supervisory Reporting Manual and possible data gaps.

### EC4 — supervisory tools and analyses: description and findings
- The supervisor uses multiple tools including:
  - (a) analysis of financial statements and accounts;
  - (b) business model analysis;
  - (c) horizontal peer reviews;
  - (d) review of the outcome of stress tests undertaken by the bank; and
  - (e) analysis of corporate governance, including risk management and internal control systems.
- SREP is the main tool for regular review and assessment, harmonized on the basis of EBA SREP guidelines and applied proportionately based on nature, scale and complexity.
- SREP relies on quantitative and qualitative analysis combining data and expert “constrained judgment” to ensure fit-for-purpose and consistent decisions.
- SREP results underpin supervisory actions including capital, liquidity, or qualitative/quantitative measures and directly link to the SEP.
- Frequencies of various assessments are defined by SREP in SEP MELs; JSTs update assessments and remediation actions when warranted by new information.
- Financial statement analysis: JSTs perform ongoing analysis; FINREP provides harmonized quarterly financial reporting; nGAAP reporting framework introduced on solo since March 2014 and consolidated since September 2014.
- Business model assessment split into:
  - (i) business model viability: ability to generate an acceptable return over the next 12 months;
  - (ii) business model sustainability: ability to generate an acceptable return over the next three years;
  - (iii) sustainability over a full business/economic cycle: ability to generate an acceptable return over periods longer than three years.
- Horizontal peer review is integral to SREP and used for benchmarking, thematic reviews (e.g., governance) and deriving recommendations or measures.
- Data inputs for analysis include consolidated annual accounts of at least the past three years and recent monthly/quarterly management reports; FINREP, COREP, IMAS data, and external data from SNL Financial.
- Stress testing expectations:
  - Supervisors expect institutions to analyze at least a baseline scenario and a stressed scenario with projections of main balance sheet, profit and loss, and off-balance sheet items aligned with strategic plans.
  - Stress tests should be part of ICAAP; at least one comprehensive adverse scenario reflecting severe but plausible adverse developments should be used for capital planning.
  - JSTs should assess whether assumptions are sufficiently severe and plausible and evaluate stressed capital and risk projections over at least the upcoming three years; embedded management actions should be scrutinized.
- Onsite inspections:
  - In-depth investigations of risks, risk controls, and governance following SSM Supervisory Manual procedures.
  - Inspections complement ongoing supervision and are carried out by independent inspection teams, while permitting JST members to participate (but JSTs may not head inspection teams).
  - Inspections may be conducted at group level or at individual subsidiary level, including subsidiaries located within SSM, EU non-SSM Member States, or third-party countries.
  - Rationale: gain in-depth knowledge via interaction with key management, access and testing of documentation, verification in situ to inform challenge to senior management.
  - Inspections follow predefined scope, timeline and resources and produce inspection reports (report outcomes beyond the provided excerpt).

*Source: cr18233 - 2015. This process of continual assessment and improvement should continue as the SREP,*

### executive summary, the list of facts and findings, and the body of the report. Appendices

### cr18233 — executive summary, the list of facts and findings, and the body of the report. Appendices

### Onsite inspections: purpose, design, and life cycle
- Objectives of onsite inspections:
  - Examine and assess the level, nature and features of the inherent risks, including risk culture.
  - Examine and assess the appropriateness and quality of the institution's corporate governance and internal control framework in view of the nature of its business and risks.
  - Assess control systems and risk management processes, focusing on detecting weaknesses or vulnerabilities that can impact the institution’s own funds.
  - Examine the quality of balance sheet items and the financial situation of the institution.
  - Assess compliance with banking regulation.
- Supervisory principles: inspections are risk-based, proportional, intrusive, and forward-looking.
- Classification and types of inspections:
  - Full scope vs. targeted inspection.
  - Thematic inspections.
  - Program versus ad hoc inspections.
  - Follow-up inspections.
  - More than one type may apply to a single mission.
- Alignment and scope:
  - Inspections must align with RAS and SREP concepts and JST assessment and division of work; alignment is ensured by the respective Directorates General of the ECB.
  - Main topics that inspections can cover (following RAS): business model and profitability; internal governance and risk management; credit risk and counterparty credit risk; market risk; operational risk; IRRBB; capital adequacy; liquidity and funding risk.
  - Inspections frequently cover several topics and should assess how reviewed areas affect liquidity, capital, profit, and regulatory compliance.
- Inspection life cycle phases:
  - Planning, pre-inspection, investigation, reporting, consistency review, follow-up.
- Team composition and leadership:
  - Teams are, in principle, led by NCA staff but the ECB may take the lead of any inspection.
  - Head of Mission (HoM) cannot be a JST member or an external expert to ensure independence.
  - HoM selection based on technical and non-technical competences, managerial capabilities, soft skills; general principle of rotation of HoMs should be respected.
  - Team size and composition commensurate with the inspection; at least two persons, including the HoM.
  - IPCS Division appoints team members after consultation with concerned parties and is informed of available resources.
  - COI Division may appoint its own staff; JST members may join upon request of the JST Coordinator but should be under the functional authority of the HoM during the mission.
  - Teams may include NCA professionals, ECB staff, and external experts.

### Onsite reporting, exit meetings, consistency reviews, and follow-up
- Reporting and exit process:
  - Draft report prepared by inspection team based on individual notes; HoM leads preparation and ensures clarity and conciseness.
  - Draft report is sent 3–5 days in advance of the exit meeting to allow the institution to prepare.
  - Exit meeting presents facts and findings; institution granted a 2-week period to submit written comments on a standardized template (3-column-table).
  - HoM assesses comments and may revise report; feedback template and HoM’s answers are attached as an annex to the final report.
  - Reports must contain an executive summary, findings, and overall assessment; length commensurate with scope and magnitude of inspection.
  - Reports are produced in English; annexes may remain in original languages when produced by the bank.
- Finding structure:
  - A finding contains: Criteria (What should be); Condition (What is); Root Cause(s) (Why did it happen); Effect (What are the consequences and the potential risks).
  - Deficiencies corrected during the inspection must be documented but flagged as findings; no findings for deficiencies already corrected before inspection began (may be mentioned).
- Consistency review:
  - Prior to the exit meeting, HoM sends draft report for consistency review to the ECB’s COI Division.
  - Consistency review focuses on internal consistency, comparability with other reports, alignment with SSM Supervisory Manual and relevant legislation.
  - Joint consistency reviews include NCA personnel not previously on the inspection team.
  - If HoM disagrees with COI recommendations, a reasoned rationale must be provided.
  - HoM signs the final report and sends to JST Coordinator, COI Division, and NCAs concerned.
- Follow-up:
  - JST drafts follow-up letter with recommendations and action plan, including deadlines or supervisory measures; closing meeting held by JST Coordinator.
  - Institution required to send official response with proposed action plan within specific timeframes.
  - JST assesses responses (consulting HoM if needed); follow-up steps may include requests for additional information, additional corrective measures, readjustment requests, or draft decision for Supervisory Board / Governing Council.
  - Follow-up closes once JST verifies mitigation measures have been implemented.
  - Supervisory measures are monitored through a dedicated IT tool; JSTs decide monitoring approaches and include follow-up in supervisory calendar.

### SREP, stress testing, and horizontal risk analysis (EC5)
- SREP framework:
  - Sets out risk factors, topics to be included, and supervisory measures to be implemented; includes risks to the bank and risks to the system as required by Article 97 and Article 99(2) of CRD IV.
- EU-wide risk identification:
  - EBA mandated to monitor/assess market developments, identify trends, risks and vulnerabilities from the microprudential level.
  - EU-wide stress test exercise coordinated by the EBA in cooperation with the ESRB to assess resilience and contribute to systemic risk assessment.
- ECB horizontal risk analysis:
  - Supports DGs, horizontal divisions, and JSTs by providing up-to-date information on risks and vulnerabilities affecting the SSM; conducts regular in-depth risk and microprudential analysis and research; identifies trends and emerging risks for supervisory review and action.
- Use of stress testing in SREP:
  - Element 3 (Assessment of risks to capital): JST assesses institution’s capacity to cover capital needs forward-looking under stressed scenarios using institution’s internal stressed projections, ECB stressed supervisory proxies, and supervisory stress tests (bottom-up/top-down) when available.
  - Element 4 (Assessment of risks to liquidity and funding): JST assesses capacity to cover liquidity needs forward-looking under stressed scenarios (e.g., deposit run, no access to wholesale markets) using similar inputs.
  - Since 2016, ECB introduced a pillar 2 capital guidance to take account of system-wide supervisory stress test outcomes in the SREP.
- Communication of outcomes:
  - ECB communicates risk assessment outcomes via informal supervisory dialogue and organizes horizontal communications and annual workshops with CEOs.
  - Key aspects of SSM SREP methodology and SREP cycle outcomes are published on the ECB website.
- Comprehensive assessments:
  - Assets quality reviews and stress tests performed on new SIs or periodically if deemed appropriate.

### Internal audit, governance engagement, and supervisory communications (EC6–EC8)
- Internal audit (EC6):
  - Articles 97 and 98 of CRD IV provide legal basis for supervisors to evaluate independent audit function.
  - Internal audit evaluated within Element 2—Internal governance and risk management—of the SREP (See CP 26).
  - Internal audit reports are key qualitative inputs; internal audit function may be subject to onsite inspection to verify adherence to generally accepted internal audit principles.
  - JSTs determine whether, and to what extent, they may rely on internal auditors’ work.
- Contacts with boards and management (EC7):
  - Article 98 of CRD IV underpins supervisory review of governance, corporate culture, and fit-and-proper assessments.
  - JSTs maintain ongoing and effective communication with SI Board, non-executive members, senior and middle management.
  - Meetings used to understand strategy, group structure, governance, performance, capital, liquidity, asset quality, risk management systems, and internal controls.
  - Top-level meetings with supervisory/management board heads and risk managers discuss strategic/operational perspectives, governance, risk management, capital, and organizational safeguards.
  - JSTs may challenge adequacy of strategies and business models, request further information, and may participate in board meetings.
  - Mid-level management meetings focus on technical and operational topics (risk methodologies, ICAAP, control systems).
- Communication of supervisory findings (EC8):
  - Onsite reporting phase culminates in exit meeting and draft report circulation; institutions get 2-week comment period on findings.
  - Offsite: decisions on capital and liquidity levels and additional supervisory measures communicated following formal ECB decision-making process (Article 104 CRD IV and Article 16 SSMR); draft decision sent to institution with right to be heard (Article 31 SSMFR).
  - Before formal decision, JST coordinator organizes dialogue on decisions with SSM area parent institution management and relevant subsidiaries; JSTs may meet independent Board members as needed.

### Follow-up, escalation, and enforcement (EC9–EC11)
- Follow-up (EC9):
  - Supervisory measures monitored through dedicated IT tool; JSTs decide monitoring and reporting approaches and include follow-up in the supervisory calendar.
  - Time allowed for corrective measures depends on nature and complexity.
  - If non-compliance occurs, JST considers additional action ranging from informal notifications to enforcement measures or sanctions.
  - Monitoring may involve periodical or ad hoc reports, meetings, or follow-up inspections.
  - JSTs produce regular follow-up notes describing implementation progress and forward information to ECB horizontal divisions, Supervisory Board, Governing Council, and NCAs as relevant.
- Notifications of substantive changes (EC10):
  - The ECB expects but does not require banks to notify it in advance of substantive changes in activities, structure, overall condition, or material adverse developments including breaches of legal or prudential requirements.
  - Breaches of legally required notifications are subject to mandatory referral to ECB’s Enforcement and Sanctions unit if institution-related (Article 18 SSMR); breaches regarding individuals or national law transpositions referred to the appropriate NCA.
  - Assessors recommend the ECB seek a mandatory notification requirement rather than the current expectation.
- Use of external third parties (EC11):
  - ECB onsite function operates under joint ECB and NCA staffing; ECB can use external experts when appropriate.
  - External experts appointed as ECB team members and carry out tasks under HoM lead; cannot be HoM.
  - External experts used in TRIM internal model investigations; Article 12(2) SSMR permits external experts.
  - Appointment requires HoM rationale and approval; audit firm must disclose relationships and self-assess conflict of interest; COI Division clears firms prior to contracting.
  - External consultants perform tasks under HoM supervision, apply SSM methodology, and their presence is transparently communicated to the institution.
  - ECB quality assurance and HoM oversight permits reliance on external work product.

### Supervisory reporting framework, data collections, and IT systems (Principle 10; EC1–EC7, EC9–EC10)
- Legal and harmonized reporting framework (EC1):
  - Core framework established in the CRR and Commission Implementing Regulation (ITS) No 680/2014 on supervisory reporting (maximum harmonization).
  - The EBA Q&A clarifies competent authorities cannot add/delete data or require different formats beyond ITS scope.
  - Harmonized reporting covers: Solvency/COREP; Financial information/FINREP; Large exposures; Losses from immovable property; Leverage ratio; Liquidity (LCR and NSFR); Asset encumbrance; Supervisory benchmarking; Funding plans; Remuneration policies.
  - Reporting required on consolidated and solo bases; frequency varies (monthly to annual depending on template).
- Extensions and proportionality:
  - Regulation (EU) 2015/534 extends FINREP to non-IFRS reporters and on a solo level gradually.
  - Proportionality principle allows less complex institutions to submit fewer data points.
  - Approximately 250 supervised entities belonging to SI groups have been granted a waiver for reporting of own funds on a solo basis; most of these are also exempted from FINREP.
- Short-term Exercise (STE) data collection:
  - Launched in 2015 to support SSM activities leading to SREP with data not available in ITS.
  - Legal basis: Article 10 SSMR and Article 141 SSMFR.
  - STE covers SIs plus some significant subsidiaries and includes data on: Profitability; Credit Risk breakdowns; Concentration risk (100 largest exposures); Market risk sensitivities; IRRBB; Sovereign risk; Liquidity risk (NSFR, funding plans); Operational risk.
  - STE needs reviewed yearly; templates discontinued when ITS reporting covers the data.
  - ECB aims to propose amendments to ITS to reduce STE over medium to long term.
- ESCB initiatives:
  - BIRD and IReF initiatives could lead to single, common, ultra-granular data source and reduce reporting burden over time.
- Accounting standards and reporting instructions (EC2–EC3):
  - Article 24 CRR: valuation according to applicable accounting framework.
  - SIs preparing consolidated accounts under IFRS required to provide FINREP; national GAAP (nGAAP) reporting templates harmonize where applicable.
  - Eight member states allow SIs with no securities traded on regulated markets to report consolidated according to nGAAP; currently 11 SIs (representing 3 percent of total assets and 2 percent of RWAs in the SSM) use nGAAP for consolidated reporting.
  - Article 24(2) CRR allows ECB to require non-IFRS SIs to apply IFRS at consolidated level but would require dual accounting regimes.
  - For valuation/prudential adjustments, the RTS for prudential valuation (EBA/RTS/2014/06/rev1) establishes approaches for prudential valuation adjustments as required by CRR.
  - EU-wide legislation does not cover supervisor’s power to require specific accounting provisions, but ECB can influence provisioning policy within accounting limits and require specific adjustments for own funds calculations for prudential purposes.
- Reporting frequency and comparability (EC4–EC6):
  - Minimum ITS frequencies:
    - Solvency/COREP: quarterly (some templates semi-annually).
    - Financial information/FINREP: quarterly (some templates semi-annually or annually).
    - Large exposures: quarterly.
    - Losses from immovable property: semi-annually.
    - Leverage ratio: quarterly.
    - Liquidity: monthly.
    - Asset encumbrance: quarterly.
    - Supervisory benchmarking: annually.
    - Funding plans: annually.
    - Remuneration policies: annually.
  - Approximately 50 SIs are subject to additional reporting requirements (including increased frequency).
  - Most STE data collected quarterly.
  - Competent authorities ensure comparable reporting dates; Article 2 of ITS No 680/2014 allows adjustment for entities with non-calendar year-ends; currently eight entities allowed to report at non-calendar year-end dates.
  - ECB supervisory perimeter follows CRR prudential consolidation rules.
- Powers to request information and access records (EC6–EC7):
  - Article 4 CRD IV and Article 10 SSMR give legal basis for supervisors to obtain necessary information from institutions and wider groups, including internal management information.
  - Article 11 SSMR allows ECB to examine books and records and obtain written/oral explanations from persons in Article 10(1) scope (credit institutions, financial holding companies, mixed financial holding companies, mixed-activity holding companies, persons belonging to those entities, and third parties to whom functions are outsourced).
- Enforcement of reporting obligations (EC8):
  - Article 67 CRD IV provides capacity for competent authority to enforce accurate and timely reporting.
  - ECB Decision of July 2, 2014 (ECB/2014/29) specifies remittance dates and requires NCAs to monitor data quality per EBA ITS validation rules and additional ECB checks.
  - Article 18(1) SSMR empowers ECB to open infringement proceedings and impose administrative pecuniary penalties on SIs for breaches of reporting obligations; Article 18(5) allows ECB to request NCAs to open proceedings for non-pecuniary penalties.
  - ECB may directly impose national enforcement measures for supervisory tasks and may impose periodic penalty payments (PPPs) and fines under Article 122 SSMFR when ECB decisions/regulations are breached.
  - Data quality process allows resubmission requests; no EU-level specification of which bank senior management level is responsible for accuracy of returns.
- Data validation, quality control, and IT systems (EC9, EC12):
  - EBA ITS defines data items and binding validation rules; EBA developed additional quality checks for NCAs.
  - Article 140(4) SSMFR: ECB organizes processes for collection and quality review of data reported by supervised entities in compliance with Union law and EBA ITS.
  - Banking Supervision Data Division (BSDD) responsible for ensuring reliable and accurate supervisory data; cooperates with NCAs via a sequential approach; ensures adherence to reporting deadlines and forwards reports overnight to end-users.
  - BSDD produces supervisory statistics, KRIs, reports and dashboards; plans and executes its tasks independently.
  - DG Statistics checks completeness and data accuracy of each report, monitors submission deadlines, keeps databases updated, and informs end-users of updates.
  - IMAS system used jointly by ECB banking supervision and NCAs as an integrated supervisory tool to facilitate analysis, prioritization, monitoring of tasks, and SREP performance.
  - DG Information Systems provides and maintains information and communications systems and information governance and security.
  - STE reporting subject to data quality controls but with fewer validation rules and a less structured process.

### Use, selection, and oversight of external experts in supervisory tasks (EC10)
- Procurement and selection:
  - External experts procured via contract notices in the Official Journal of the EU to ensure availability of highly qualified providers.
  - Selection conducted under ECB procurement rules (e.g., Decision ECB/2007/5 for the 2015 process) to select economically most advantageous tenders (best price/quality ratio).
  - Framework agreements elaborate on conflict-of-interest conditions and exclusion criteria; tenderers asked to certify absence of conflicts of interest.
- Mandate, scope, and oversight:
  - Contracts require external experts to work according to SSM methodologies and in close collaboration with ECB staff and head of supervisory assignment.
  - External experts’ quality of work is closely monitored and assessed by ECB/SSM staff before consideration in supervisory work.
  - External contractors cannot act as HoM; conflict-of-interest checks required and COI Division clearance necessary.

### Quality assurance, internal control, and external reviews (AC1)
- Internal three-lines-of-defense:
  - Operational management: first line of defense to establish internal controls.
  - Risk management, control, compliance, and oversight functions: second line of defense.
  - Directorate Internal Audit (D/IA): third line of defense providing independent assurance and consulting.
- Supervisory Quality Assurance (SQA) Division:
  - Provides regular feedback on supervisory output quality via desk reviews, interviews, factual checks and analysis.
  - Issues a yearly “lessons learned” report for Supervisory Board discussion.
- External oversight and reviews:
  - ECB supervisory activities reviewed by European Commission and European Court of Auditors (ECA).
  - Commission report (October 11, 2017) gave overall positive assessment of SSMR application and initial ECB supervisory years.
  - ECA Special Report No. 29/2016 (November 18, 2016) assessed SSM governance, accountability, offsite and onsite programs and reliance on NCA resources.
  - ECA Special Report No. 02/2018 (16/01/2018) reviewed operational efficiency of ECB crisis management and recommended improvements; ECB formally responded.
  - Assessors conclude ECB supervisory functions operate under effective internal control environment augmented by external oversight (European Parliament, European Commission, ECA).

### Assessors’ compliance assessment and recommendations (Principle 9 and related)
- Assessment:
  - Principle 9 assessed as: Compliant.
  - ECB uses a mix of offsite analysis and onsite inspections focusing on horizontal themes and institution-specific risks via SREP.
  - Techniques and tools appropriately designed, supported by SSM Supervisory Manual and appendices; SEPs and onsite inspections calibrated by risk profile and systemic importance.
- Recommendations and comments:
  - Further refinements to supervision program should be adopted incrementally as ECB gains experience.
  - ECB should consider streamlining internal reporting lines to ensure timely communication of supervisory and other information.
  - Assessors recommend ECB seek mandatory notification requirement for substantive changes in institutions’ activities, structure, overall condition, or material adverse developments (instead of current expectation).
  - Assessors recommend greater transparency about supervisory expectations, approaches, and techniques via publication of supervisory guides; July 2017 Guide to onsite inspections and internal model investigations highlighted as a good primer.
  - Publication of a condensed SSM Supervisory Manual in March 2018 is noted; further elements of the Supervisory Manual are under review for later publication.

*Source: cr18233 — executive summary, the list of facts and findings, and the body of the report. Appendices*

### conclusions. External contractors would be subject to the same professional secrecy

### cr18233 - conclusions. External contractors would be subject to the same professional secrecy

### External contractors and professional secrecy
- External contractors providing services related to the discharge of supervisory duties are contractually required to work under the instructions of ECB staff and are subject to the same professional secrecy requirements as ECB staff members.
- Use of external contractors is guided by the principle of prudent management of resources and by the goal of finding effective and cost-efficient solutions.
- External contractors are to be used only in limited circumstances. Over the past two years they have been used in support of onsite missions and internal model investigations, in support of the preparatory and execution phases of TRIM, and in support of the preparatory and execution phases of EBA and SREP stress test exercises.
- In onsite missions or internal model investigations:
  - A central ECB team together with the SSM HoMs assesses the suitability of each proposed external expert for the specific task.
  - The SSM HoM reviews output delivered by the expert team(s) and remains in charge and responsible for the mission team’s deliverables.
  - Feedback from the HoMs is collected centrally and regularly for each mission and discussed in regular meetings with the experts’ employers.
- EC11 requirement: The supervisor requires that external experts bring to its attention promptly any material shortcomings identified during the course of any work undertaken by them for supervisory purposes.

### Supervisory reporting, data collections, and Principle 10 (EC12)
- Representation and coordination:
  - The SSM is represented in bodies establishing reporting requirements (EBA Reporting Subgroup, EBA Standing Committee on Accounting, Reporting, and Auditing for EBA ITS data; ECB Statistical Committee for statistical data).
  - SSM networks (e.g., ‘User requirements of Supervisory Reporting’) discuss users’ needs and additional data gaps for possible EBA ITS enhancements.
- EBA ITS and periodic review gaps:
  - There is no EU-wide framework for competent authorities to periodically review the information collected from banks and to determine whether it still satisfies supervisory needs; no framework has been established for competent authorities to perform an assessment of the information that has been collected to meet supervisory needs.
  - Article 99(7) of the CRR allows competent authorities to notify the EBA whenever they believe additional information should be included in the ITS on supervisory reporting; accordingly, the EBA ITS is periodically updated.
- ECB supplementary collections:
  - For information not included in the EBA ITS collected by the ECB, reporting requirements are periodically discussed in SSM networks and groups (e.g., STE reviewed yearly for Pillar 2 needs and areas entering EBA ITS scope).
  - STE reporting and surveys give the ECB flexibility to address data needs for SREP (e.g., assets and liabilities by repricing date for IRRBB estimation).
  - STE data are not subject to the same quality control routines as ITS reporting, which is likely to lead to lower data quality.
- Constraints and recommendations:
  - The ITS is a “maximum harmonization” instrument; competent authorities cannot add/delete or require different formats outside CRR/CRD procedures, which can limit the ECB’s ability to promptly address substantial data gaps in areas already covered by the ITS.
  - The only way to obtain new standardized data in ITS-covered areas is via ITS revision — a lengthier and more complex process.
  - The ECB should streamline and expedite the process to amend and integrate harmonized supervisory reporting to reduce reliance on long-lived supplementary collections.
  - Longer-term initiatives (BIRD and IReF) could contribute to harmonization while allowing more flexible uses; the ECB should further promote their development and widespread adoption.
- Specific reporting notes:
  - Regular reporting of a maturity ladder with a breakdown also by significant currency started in March 2018. The ECB should ensure ITS include adequately granular and frequent breakdowns of internationally active banks’ cash flows in material non-Euro currencies and that JSTs monitor it regularly.
- Assessment of Principle 10: Largely Compliant.

### Corrective and sanctioning powers — Principle 11 (findings, powers, and limitations)
- Supervisory process and remedial approach:
  - The ECB employs a progressive remedial process beginning with non-binding routine/ad hoc requests, letters, statements, meetings, or letters of intervention (collectively “operational acts”), escalating to formal supervisory measures (Decisions) when appropriate.
  - Decisions (legal acts) and operational acts are the main supervisory tools; SREP decisions are the most used Decisions.
  - Referral to the ECB’s Enforcement and Sanctions Division is mandatory if supervisors suspect a breach of prudential requirement or of an ECB regulation or decision.
- Powers available to the ECB (Article 16(2) SSMR examples):
  - require institutions to hold additional own funds;
  - require reinforcement of arrangements, processes, mechanisms and strategies;
  - require presentation of a plan to restore compliance;
  - require specific provisioning policy or treatment of assets for own funds calculations;
  - restrict or limit business, operations or network, request divestment of activities;
  - require reduction of risky activities/products/systems;
  - require limits on variable remuneration as a percentage of net revenues;
  - require use of net profits to strengthen own funds; restrict distributions and AT1 interest payments;
  - impose specific liquidity requirements; require additional disclosures; remove members of management body who do not fulfil requirements.
  - Article 14(5) SSMR authorizes the ECB to withdraw a credit institution’s authorization if circumstances warrant.
- Enforcement and sanctioning powers — allocation and limits:
  - Allocation depends on: type of regulation allegedly infringed; entity to be penalized (entity vs natural person); and sanction to be imposed (pecuniary vs non-pecuniary).
  - Where SIs intentionally or negligently breach directly applicable Union law for which administrative penalties are available, the ECB may impose administrative pecuniary penalties of twice the amount of profits gained or losses avoided where determinable or up to 10 percent of total annual turnover in the preceding business year (Article 18(1) SSMR).
  - For breaches of ECB regulations or decisions, the ECB may impose fines of the same maximum amount (Article 18(7) SSMR).
  - The ECB may impose periodic penalty payments of up to five percent of the average daily turnover per day of infringement to enforce ECB decisions or regulations; upper limit of PPPs is five percent of average daily turnover per day for a maximum period of six months (Council Regulation (EC) No 2532/98).
  - In general the ECB can only apply non-pecuniary sanctions on natural persons through an NCA (Article 18.5 SSMR).
  - The ECB can require NCAs to open proceedings for penalties under national law transposing EU Directives, for penalties against natural persons, or for non-pecuniary penalties (Article 18(5) SSMR, Article 134 SSMFR).
- Enforcement measures available:
  - The ECB can directly impose Periodic Penalty Payments and, under Article 9(1) paragraph 2 SSMR, may directly exercise powers that NCAs have under relevant Union law where those powers are considered enforcement measures in national legislation (e.g., cease-and-desist orders depending on national implementation).
  - For “pure national enforcement measures” not related to the transposition of directives, the ECB must instruct NCAs to exercise those powers.
- Operational and legal impediments:
  - Formal imposition of sanctions is not expeditious due to complex legal framework, substantive and procedural limitations, and national law differences (varying procedural processes and thresholds across Member States).
  - Some national laws require procedural approvals before ECB may exercise a national law tool (e.g., Cyprus requires agreement of Minister of Finance for national law sanctions).
  - Differences in national laws may produce inconsistent outcomes for similar breaches, hindering a level playing field.
  - CRD IV powers do not cover all breaches of the CRR (e.g., misreporting of financial statements not covered in some jurisdictions).
- Sanctions statistics and trends:
  - Only four proceedings were initiated in 2015 (3 sanctioning proceedings and 1 enforcement proceeding; 2 sanctioning proceedings were completed in 2015).
  - In 2016 the ECB launched 41 sanctioning proceedings and one enforcement proceeding.
  - The ECB handled 44 proceedings in 2016 (including two ongoing 2015 proceedings): 42 regarding sanctions and 2 related to enforcement measures.
  - Of the 42 sanctioning proceedings handled in 2016, 30 relate to suspected breaches of directly applicable EU law (ECB decisions and regulations included) concerning 26 SIs and relating to own funds, reporting, public disclosure, liquidity and large exposures.
  - The remaining 12 sanctioning proceedings relate to suspected breaches of national law transposing CRD IV and concern SIs or natural persons (areas: governance, internal control, management body functions, remuneration).
  - During 2016, the ECB addressed three requests to NCAs to open sanctioning proceedings within national competences.
  - Two enforcement proceedings in 2016 concerned suspected breach of national remuneration rules and non-compliance with an ECB supervisory decision.
  - Assessment note: The ECB initiated 44 sanctioning cases since 2015 as of year-end 2016; assessors noted a backlog of 35 remaining sanctioning cases and that only two matters were brought to successful conclusion during this period and only three cases were referred to NCAs to open proceedings under national law.
- Assessment and recommendations:
  - Assessment of Principle 11: Materially Non-Compliant.
  - Comments / recommendations from assessors:
    - The ECB’s enforcement powers are limited and misaligned with supervisory objectives; pecuniary penalties are the only enforcement tool directly and universally available to the ECB.
    - The legal enforcement and sanctioning framework is complex and contains substantive and procedural gaps; these should be addressed to meet CP 11 standards.
    - The ECB’s enforcement and sanctioning powers should be fully aligned to its supervisory responsibilities, including direct power to impose sanctions for breaches of national law implementing EU directives and to sanction managers (natural persons).
    - The ECB’s toolkit should be completed with non-pecuniary measures (e.g., enforceable cease-and-desist orders with affirmative covenants).
    - The ECB should consider measures to reduce the backlog of sanctioning cases and streamline internal processes to achieve timelier resolution of referred breaches.

### Consolidated supervision — Principle 12 (findings and assessment)
- Scope and responsibilities:
  - The ECB is the consolidated supervisor for Significant Institutions (SIs) and conducts supervision at consolidated, sub-consolidated, and single-entity levels unless waivers apply (Articles 7, 8, 10 CRR).
  - SREP decisions take into account supplementary supervision for financial conglomerates where required by FICOD.
- JST model and coordination:
  - Day-to-day supervision of each supervised group is carried out by a Joint Supervisory Team (JST) comprised of ECB and NCA staff and coordinated by an ECB JST coordinator.
  - Consolidated supervision is carried out by the JST with high involvement of ECB staff; solo/sub-consolidated supervision follows the same supervisory model with greater local JST involvement.
  - For parent entities established in non-participating Member States or third countries, sub-consolidated/solo supervision is conducted on entities in participating Member States; for third-country entities the model is MoUs and, if possible, colleges as set out in CRD IV.
  - Core JST reviews consolidated assessment and acts as first level of mediation in case of conflict between NCAs or between NCAs and the ECB.
- Mapping and supervisory intensity:
  - The JST maps subsidiaries along axes: degree of relevance, degree of significance, degree of centralization/decentralization, and level of perceived risk.
  - Two subsets identified for supervisory intensity:
    - material subsidiaries (significant/relevant/autonomous/riskier) — warrant level of supervisory intensity comparable to consolidated level;
    - non-material subsidiaries — may have lower supervisory intensity.
  - Annual review of mapping is JST coordinator’s responsibility.
- Financial conglomerates and data:
  - SREP for financial conglomerates (FICOD) includes assessment of nonbanking activities’ impact on the banking part (capital adequacy, contagion, concentration, conflict of interest, complexity).
  - Lack of common databases across banking and other regulated financial activity may impede effective consolidated supervision; LEI adoption gaps noted (sample of 29 SIs: 6 had, on average, two-thirds of group financial entities not identifiable through a LEI).
  - MFHCs (mixed financial holding companies) do not require authorization; thresholds for conglomerate definition based on fixed balance-sheet percentages may omit off-balance-sheet assets and offer limited supervisory discretion.
- Powers and limits:
  - The ECB can require SIs to take corrective measures and may restrict business or require divestments; but the ECB’s ability to rely on national law is limited where national laws do not permit NCAs to review or limit parent/affiliate activities.
  - No framework exists for resolution of an international conglomerate.
- Assessment of Principle 12: Largely Compliant.

### Home-host relationships and cross-border cooperation — Principle 13
- JST integration and supervisory colleges:
  - The SSM integrates NCAs into SI supervision through JSTs rather than traditional Member State colleges; each JST includes ECB and NCA staff (Article 3 SSMFR).
  - The ECB establishes colleges of supervisors for subsidiaries of SIs located outside the SSM, with NCAs participating as observers; ECB currently participates in 45 supervisory colleges and chairs 26.
  - College structures include European College, Core College, Crisis Management Group, Cross Border Stability Groups, Resolution Colleges, and subgroups (e.g., Liquidity Subgroup).
  - WCCAs specify arrangements for information exchange and observers’ participation in colleges.
- Information sharing and MoUs:
  - Home and host supervisors share appropriate information bilaterally and through colleges; WCCA framework coordinates gathering and dissemination in going concern and emergency situations.
  - Confidentiality governed by Article 54 CRD IV; ECB has become part of MoUs that 49 third countries had in place as of September 2017 under “step in” arrangements.
  - The ECB has not finalized agreements with all international supervisors of globally significant institutions; coordination with these supervisors exists under ad hoc arrangements; assessors recommend concluding international MoUs as quickly as possible.
- Coordination of supervisory activities and crisis cooperation:
  - Colleges agree on college SEP content (areas of joint work, planned supervisory activities, SEPs of consolidating supervisor and members, responsible members, timelines).
  - Host supervisors are informed of planned activities; the home supervisor shares and discusses its SEP with host supervisor; planned onsite missions are discussed bilaterally and at college level.
  - Framework for cross-border crisis cooperation improved by SSM, SRM, and BRRD; ECB and SRB have MoU (December 22, 2015) for cooperation and information exchange; SRB and ECB coordination includes group resolution plans and early notification/consultation procedures.
  - Resolution planning: BRRD/Regulation 2014/806/EU framework places group resolution plan responsibility with group-level resolution authority (SRB) after consulting competent authority; ECB required to cooperate and provide relevant information; group resolution plans adopted through joint decision of resolution college within four months and reviewed at least annually.
- Onsite access and booking offices:
  - Legal basis for ECB onsite inspections: Article 12 SSMR and Title 5 SSMFR; ECB empowered to conduct onsite inspections at business premises of entities included in consolidated supervision.
  - Home supervisor informs host supervisor of intended visits; host may allow home supervisor to conduct checks directly but is not obliged to.
  - ECB states it does not permit shell banks that only serve as booking offices, but there is no express EU legal requirement expressly prohibiting shell banks or requiring supervision of booking offices consistent with BCBS 2003 booking office/shell bank guidance.
  - Assessment recommendation: ECB should seek express authority to prohibit shell banks or to limit the use of foreign branches as mere booking offices.
- Assessment of Principle 13: Largely Compliant.

### Corporate governance — Principle 14 (summary and assessment)
- Legal and guidance framework:
  - CRD IV Articles 74–95 set internal governance, remuneration, management body requirements, committees, and fit-and-proper principles.
  - EBA and ECB guidance: EBA revised Guidelines on Internal Governance (EBA/GL/2017/11), EBA/ESMA joint guidelines on suitability, ECB Guide to Fit-and-Proper Assessments (May 15, 2017), ECB Guide on OND (May 2016), SSM Supervisory Statement on Governance and Risk Appetite (June 2016).
- Supervisory approach:
  - Corporate governance is assessed continuously via SREP (Internal Governance and Risk Management block) with sub-categories including management body and outsourcing; ratings from 1 to 4.
  - The ECB is building a database of governance practices across 19 SSM countries via JST survey.
  - 2015 thematic review of governance and risk appetite identified deficiencies; follow-up included “Standard” and “Enhanced” actions, deep-dives for 24 institutions with follow-up letters in June/July 2017.
  - Fit-and-proper assessments are ongoing and feed into supervision; ECB Guide aims to harmonize supervisory practices while national transposition differences remain.
- Board composition, remuneration, and oversight:
  - SREP assesses Board committees (Audit, Risk, Remuneration), nomination and appointment processes, independence, and effectiveness.
  - ECB expects SIs to have remuneration committees and remuneration linked to risk (implementation of EBA/CRD IV requirements); SREP added a remuneration sub-category in 2016 and JSTs surveyed remuneration policies in October 2016.
- Powers and gaps:
  - ECB has power to remove members of management bodies (Article 16(2)(m) SSMR).
  - Fit-and-proper process is complex and depends on national law; delegation framework approved to reduce direct Supervisory Board burden but intensity remains high.
  - Potential gaps where national laws vary (e.g., Germany two-tier board, Italy incomplete CRD IV fit-and-proper implementation).
- Assessment of Principle 14: Compliant.

### Risk management — Principle 15 (summary and assessment)
- Legal basis and supervisory framework:
  - CRD IV Articles 73–76, 88, 91, 92, 95, and related CRR Articles set ICAAP/ILAAP and governance requirements.
  - SREP Element 2 (internal governance and risk management) assesses: (i) internal governance; (ii) risk management framework and risk culture; (iii) risk infrastructure, data and reporting. Internal governance assessment is conducted in three phases: information gathering, compliance check, supervisory assessment.
  - ECB issued letters (January 2016) on ICAAP/ILAAP expectations and draft SSM Guides (February 2017) with public consultation planned; Guides to be implemented for SREP 2019.
  - The ECB conducted a 2015 thematic review on governance and risk appetite and a BCBS 239 thematic review on risk data aggregation and reporting, including “fire drills.”
- Risk management function and CRO expectations:
  - SIs must appoint a Chief Risk Officer (CRO) at management committee level; CRO should have independence, resources, direct access to management body/risk committee, and responsibility for RAF.
  - Article 76(5) CRD IV requires independent risk management function with sufficient authority, stature, resources, and access to the management body.
  - No EU-wide requirement that removal of CROs be discussed with supervisor or disclosed publicly; national practices vary.
- Models, TRIM, and model validation:
  - ECB assesses banks’ models as part of SREP; model outputs and limitations are part of supervisory review.
  - TRIM (Targeted Review of Internal Models) is an SSM-wide project to enhance credibility and confirm adequacy of approved Pillar I internal models across SIs; planned to run three years (preparatory phase completed Q1.2017; targeted onsite investigations started Q2.2017 and continue until 2019).
  - Internal Model Division (INM) and NCAs launched ongoing monitoring and validation reporting pilot in April 2017.
- IT, data, and reporting:
  - JSTs assess risk data aggregation, MIS, and reporting capabilities; risk reporting must be timely, accurate, and adequate in stress conditions.
  - BCBS 239 implementation review highlighted importance of Chief Data Officer and data quality assurance assignments.
- Gaps and recommendations:
  - Standards on specific risk categories are issued at national level during CRD IV transposition, leading to non-harmonized codification and possible gaps.
  - Missing EU-level elements include explicit Board awareness of measurement uncertainties (EC 1/4), CRO removal consultation/disclosure (EC 10), certain stress testing program elements (EC 13), and explicit requirement to account for risks in new product approval (EC 14).
  - Two suggested interventions:
    - assign responsibility to competent authorities (e.g., move CRD IV Articles 79–87 into CRR) to define standards in binding form; and
    - ECB to issue a comprehensive document consolidating and expanding existing guidance and expectations on risk management.
- Assessment of Principle 15: Largely Compliant.

### Capital adequacy — beginning of Principle 16 (context)
- Legal framework and thresholds:
  - CRR establishes requirements for calculating prescribed capital requirements (Part Three, Articles 92–386), defines components of capital (Part Two), and deduction requirements; Delegated Regulations (EU) No. 241/2014, 2015/850, and 2015/923 and RTS on own funds Parts 1–4 and delegated acts of the EU Commission further specify requirements.
  - Article 54 CRR provides for write-down or conversion of Additional Tier 1 instruments when CET1 ratio falls below 5.125 percent.
  - CRD IV gives Member States discretion on macroprudential buffers; for SSM members the ECB is empowered to apply higher capital buffer requirements (Article 5(2) SSMR).
- Note: the source text continues beyond this point but the provided content ends at the start of detailed CRR/CRD capital thresholds and requirements.

*Source: cr18233 - conclusions. External contractors would be subject to the same professional secrecy requirements as ECB staff members when they provide services related to the discharge of supervisory duties.*

### 4.5 percent, Tier 1 capital (including additional Tier 1) 6 percent, and total capital (including

### 4.5 percent, Tier 1 capital (including additional Tier 1) 6 percent, and total capital (including

### Capital adequacy framework (EC2, EC4)
- Prescribed minimums referenced in the source: CET1 capital 4.5 percent, Tier 1 capital (including additional Tier 1) 6 percent, and total capital (including Tier 2 capital) 8 percent; capital conservation buffer by CET1 capital 2.5 percent.
- CRR and CRD IV provisions on capital adequacy are based on the applicable Basel standards but the Basel Committee RCAP (December 2014) concluded the EU prudential framework was “materially non-compliant” with minimum Basel standards.
- RCAP findings cited:
  - Eight of the 14 components assessed were compliant.
  - Four components were deemed largely compliant (including definition of capital and calculation of minimum requirements).
  - One component (IRB approach for credit risk) was materially non-compliant.
  - One component (CCR component) was rated non-compliant.
- National discretions exist via transitional provisions of Article 481 ff. of the CRR; some Member States exercised discretions (example: Article 89 paragraph 3 qualifying holdings implemented via a general decree in one Euro Area country).
- ECB explanatory memorandum example: full deduction of insurance holdings would have resulted in a 100 bp average drop in CET1 ratios from 11.41 percent to 10.41.
- Article 124(2) and Article 164(5) permit competent authorities to set higher risk weights or LGD values for immovable property exposures on financial stability grounds; Article 458 allows Member States to set higher capital for macroprudential or systemic risks.
- Leverage ratio:
  - Institutions must calculate, report, and disclose leverage ratio (Articles 429, 430, 451(1) of CRR).
  - Leverage ratio requirement under legislative initiative by the European Commission to introduce a binding leverage ratio for all institutions subject to CRD IV.

### Supervisory powers and SREP (EC3, EC6)
- ECB empowered under Articles 97–98 of CRD IV and Article 16 of the SSMR to require own funds in excess of CRR and buffer requirements where risks are not covered or institution’s risk-bearing capacity is insufficient.
- ECB applies SREP methodology with Element 3-Block 3 specifically assessing capital adequacy under stressed assumptions; results used to quantify Pillar 2 capital requirements.
- ECB guidance and tools:
  - Detailed guidance for JSTs on assessing significant risk transfer for securitizations (building on EBA guidelines and CRR articles).
  - ECB’s Guide on National Options and Discretions under Union Law (March 16, 2016) harmonizes exercise of capital-related options/discretions for SIs.
- The supervisor has power to impose specific capital charges and/or limits on all material risk exposures, including risks not adequately transferred or mitigated (e.g., securitizations).
- ECB should monitor effects of deviations from Basel capital and liquidity requirements and continue to require consistent application of internal model requirements.

### Internal models, approvals and oversight (EC5)
- CRR requires prior permission by competent authority before using internal assessments (Articles 143, 221, 225, 259, 283, 312, 363, 377).
- ECB approvals for SIs based on Article 9(1) of the SSMR; ECB uses EBA/CEBS Guidelines (CEBS GL 10, EBA/GL/2012/2, EBA/GL/2012/3) as reference for decisions.
- Internal model investigation process:
  - Five phases: pre-application, investigation, reporting, draft decision, final decision.
  - Consistency reviews performed by NCA and ECB Internal Model Division.
- TRIM (Targeted Review of Internal Models):
  - Conducted in 2017–2019 to collect information and assess model practices and deviations from ECB Guide for General Topics.
  - SIs with deviations required to submit corrective action plans.
  - ECB planned about 200 TRIM missions.
- Model change, cessation, reversion:
  - Material changes and cessation require prior permission (Articles 143(3), 149, 225(1), 259(5), 283(5), 312, 313, 363(3)).
  - For IMA, reversion to standardized approach considered a material change; Advanced-CVA permission linked to IMAS/IMM (Article 383(1)).
- Resources and capacity:
  - SEP planning cycles match resources to expected internal model approvals.
  - Pool of experts assembled from JSTs, ECB horizontal functions, NCAs; project managers and HoMs appointed.
  - ECB senior staff stated sufficient quantity and quality of staff to conduct model reviews.
- Supervisory actions for non-compliance:
  - Article 101(4) CRD IV requires institution to demonstrate immateriality or present plan for timely restoration of compliance.
  - ECB can impose terms and conditions or revoke approvals (Article 16 SSMR).
  - Ongoing model monitoring described in SSM Supervisory Manual.

### Credit risk supervision (Principle 17)
- Legal and supervisory requirements:
  - Article 79 CRD IV requires credit-granting based on sound and well-defined criteria; internal methodologies to assess credit risk at obligor, security, and portfolio levels; ongoing administration and monitoring to identify/manage problem credits and make adequate value adjustments; adequate diversification.
  - EBA SREP guidelines (paragraphs 179–195) set supervisory expectations for credit risk management assessment.
- Key findings and limitations:
  - CRD IV and EBA SREP guidelines set many requirements but not all elements envisaged by the Principle; some Member States have more explicit national rules (Belgium, Germany, Spain, Ireland, Italy).
  - No EU-wide explicit requirement for banks to make credit decisions on an arm’s-length basis (EC5), though some national laws do.
  - No EU-wide requirement for Board or senior management approval of exposures exceeding a specific threshold (EC6); some jurisdictions have such thresholds (Austria, Germany, Latvia).
- Supervisory practices and tools:
  - JST monitoring reports and onsite inspections assess internal governance and credit risk policies.
  - SSM Supervisory Manual provides investigative suggestions for onsite inspections across the lending lifecycle.
  - Credit risk included as a sub-element of the capital element in the RAS.
- Data and reporting developments:
  - AnaCredit project launched in 2016 to collect loan-to-loan information on banks’ credit exposures to all legal entities in the Euro Area.
    - Starting from November 2018 (reference to September 2018 data) AnaCredit will collect monthly entity identifiers and several data attributes from banks (both SIs and LSIs, with some exemptions for the smallest ones).
    - Reporting threshold: EUR 25,000.
  - AnaCredit together with Security Holding Statistics aims to provide comprehensive picture of legal entities’ indebtedness and support supervisory needs (NPL monitoring, early warning signals).
- Assessment: Principle 17 rated Largely Compliant.
  - Observations: supervisory manuals and guidance supplement the framework but are not binding regulatory requirements shared with all supervised entities.

### Problem assets, provisions and reserves (Principle 18)
- Legal and guidance framework:
  - Article 79(c) CRD IV requires effective systems for identifying and managing problem credits and making adequate value adjustments and provisions.
  - EBA SREP Guidelines require assessment of policies for identification, management, measurement and controls of credit risk (paragraphs cited).
  - ECB Guidance to banks on NPLs (March 2017) provides supervisory expectations on NPL governance, operations, early warning mechanisms, monitoring, impairment measurement, and write-offs.
  - EBA ITS on supervisory reporting defines NPE and forborne assets including off-balance sheet items; FINREP template F18 classifies exposures by days in arrears and template F19 covers forborne exposures.
- Specific supervisory expectations (ECB NPL guidance excerpts):
  - Section 3: NPL governance and operations, early warning mechanisms (section 3.6), monitoring (section 3.5), customer engagement and cash collections (section 3.5.2).
  - Section 6: impairment methodologies and processes; collective estimation should consider macroeconomic variables (GDP, unemployment, property prices) and business conditions (sections 6.2 and 6.3).
  - Section 6.5 on NPL write-offs; Section 6.6 on timeliness of provisioning and write-offs.
- Supervisory activity and resources:
  - Approximately 120 onsite inspections of SIs for credit risk in the past two years.
  - ECB may use external experts to support onsite inspections.
  - Supervisory reporting: templates F18 (NPE) and F19 (forborne exposures) reported quarterly.
- Assessment elements:
  - Supervisory actions include regular monitoring, deep dives, onsite inspections, and follow-ups to verify adequacy of banks’ classification and provisioning policies.
  - ECB guidance should be followed by more detailed and explicit supervisory expectations on criteria for NPL write-offs.

*Source: IMF staff report text extracted from the provided PDF content unit.*

### Section 6 of the ECB guidance on NPLs states the supervisory expectations for the

### cr18233 - Section 6 of the ECB guidance on NPLs states the supervisory expectations for the

### Supervisory expectations for provisioning and documentation
- Section 6 states the supervisory expectations for the calculation of provisioning levels.  
- Section 6.7.2 highlights that “Banks should maintain internal supporting documentation, which may be made available for review by supervisory authorities upon request.”
- EC7: The supervisor assesses whether the classification of the assets and the provisioning is adequate for prudential purposes. If asset classifications are inaccurate or provisions are deemed to be inadequate for prudential purposes (e.g., if the supervisor considers existing or anticipated deterioration in asset quality to be of concern or if the provisions do not fully reflect losses expected to be incurred), the supervisor has the power to require the bank to:
  - adjust its classifications of individual assets,
  - increase its levels of provisioning, reserves or capital,
  - and, if necessary, impose other remedial measures.

### Reporting, monitoring, and NPL strategy for High NPL banks
- SIs identified by the ECB guidance on NPLs as “High NPL banks” are required to:
  - report their NPL strategy—including the operational plan—to their JSTs in the first quarter of each calendar year,
  - provide a standard template summarizing the quantitative targets and the level of progress made in the past 12 months against plan.
- The follow-up and monitoring of banks’ NPL reduction plans is intense and is producing positive results in terms of banks’ increased proactivity in addressing their issues.
- As of June 2017, almost half of the SIs showed a high degree of convergence, with no difference between the reported NPLs and defaulted loans.

### Use of national credit registries and data sources
- In some jurisdictions (e.g., Germany, Austria, Spain, Italy), supervisors can rely on additional, detailed credit information drawn from national central credit registries that provide loan-by-loan information according to different data models and subject to different reporting thresholds.

### Legal and supervisory powers; asset reclassification scope
- The ECB’s supervisory powers in this area are established by Article 104 of CRD IV and Article 16(2)(d) of the SSMR; they include the power to require institutions to apply a specific provisioning policy or treatment of assets in terms of own funds requirements.
- The ECB does not have the power in all cases to require banks to adjust their classifications of individual assets; asset reclassifications can be required where the NCA has also accounting powers in relation to banks (like in Spain); otherwise, the adjustment can be required only for the purpose of capital requirement calculations.
- The European Commission clarified that Article 16(2)(d) of the SSMR “allows the ECB to require credit institutions to apply specific adjustments (deductions, filters or similar measures) to own funds calculations where the accounting treatment applied by the bank is considered not prudent from a supervisory perspective” (EC, Report on the SSM, October 2017).
- The clarification implies the ECB can require a bank to reclassify an exposure when it is deemed defaulted (as defined by Article 178 CRR, i.e., 90 days past due or belonging to an ‘unlikely to pay’ obligor), not necessarily when it is considered nonperforming (as defined by the ITS on Forbearance and NPEs); the latter is a wider concept.
- The ECB has expressed its expectation that banks should use the NPE concept for all purposes and the EBA is working at a regulation that will clarify the ‘default’ concept, by more closely aligning it with the ‘NPE’ one and providing indications on how to identify ‘unlikely to pay’ obligors.
- Until the EBA regulation is issued and enters into force, the ECB cannot impose a reclassification as NPL in those cases where an exposure does not fully meet all the conditions to be considered defaulted.

### Nature of the guidance and supervisory follow-up
- The guidance on NPLs constitutes ECB banking supervision’s expectations including all the elements of the management of problem assets. It is not binding in nature, but banks should explain and substantiate any deviations upon supervisory request and non-compliance may trigger supervisory measures.

### Valuation of risk mitigants and collateral (EC8)
- EC8: The supervisor requires banks to have appropriate mechanisms in place for regularly assessing the value of risk mitigants, including guarantees, credit derivatives, and collateral. The valuation of collateral reflects the net realizable value, taking into account prevailing market conditions.
- Part II, Chapter 4 of the CRR on credit risk mitigation (Articles 192–217) establishes requirements on risk mitigants.
- The EBA SREP Guidelines require competent authorities to:
  - assess whether the institution has appropriate policies for the identification, management, measurement, and controls of credit risk, including the criteria for assessing collateral evaluation and frequency for its review (paragraph 182c); and
  - assess the appropriateness of the bank’s information systems and analytical techniques also with regard to the collateral coverage (including netting agreements) and eligibility of this coverage (paragraph 184c).
- Supervisory expectations are stated in section 7 of the ECB guidance on NPLs, specifically for real estate collateral. The guidance covers governance, procedures, and controls in the collateral valuation; the frequency of the valuations; and the methodology for valuation of collateral. Immovable property collateral should be valued according to European and international standards.

### Definitions of problem assets, NPE, default, and reclassification criteria (EC9)
- EC9: Laws, regulations or the supervisor establish criteria for assets to be:
  - (a) identified as a problem asset (e.g., a loan is identified as a problem asset when there is reason to believe that all amounts due, including principal and interest, will not be collected in accordance with the contractual terms of the loan agreement); and
  - (b) reclassified as performing (e.g., a loan is reclassified as performing when all arrears have been cleared and the loan has been brought fully current, repayments have been made in a timely manner over a continuous repayment period and continued collection, in accordance with the contractual terms, is expected).
- (a) The definition of problem asset can be found in two different sources:
  - Article 178 of the CRR provides the definition of default, which is used by IRB banks for capital requirement calculation purposes.
  - the EBA ITS on Supervisory Reporting introduces the definition of nonperforming exposure, used for supervisory reporting (instructions for template F18 in Annex V). The definition of nonperforming exposure (NPE) is potentially broader than the concept of default.
- The ECB guidance (section 5.1) encourages SIs to use the NPE definition in their internal risk management and public financial reporting, and not only for supervisory reporting purposes. As of June 2017, almost half of the SIs showed a high degree of convergence, with no difference between the reported NPLs and defaulted loans.
- The ECB guidance (section 1.3) covers NPEs, foreclosed assets and certain performing exposures such as “watch-list” and performing forborne exposures.
- (b) Reclassification of an asset as performing is regulated by:
  - Article 178(5) of the CRR for capital requirement calculations of IRB banks (“If the institution considers that a previously defaulted exposure is such that no trigger of default continues to apply, the institution shall rate the obligor or facility as they would for a non-defaulted exposure. Where the definition of default is subsequently triggered, another default would be deemed to have occurred”); and
  - the EBA ITS on Supervisory Reporting (instructions for template F18 in Annex V).
- The CRR is unspecific as regards the discontinuation of the default status (Article 178.5). The criteria for discontinuation of the qualification of nonperforming and forborne exposures are to be applied by institutions for supervisory reporting on top of the criteria they already apply for the discontinuation of the quality of defaulted exposure, as per Article 178 of the CRR.
- In accordance with paragraph 176 of Annex V of the EBA ITS on Supervisory Reporting, forborne exposure can be performing or nonperforming. Specific requirements in paragraph 157 for reclassifying nonperforming forborne exposures comprise:
  - the completion of a “cure period” of one year from the date the forbearance measures were extended,
  - and a requirement for the debtor’s behavior to demonstrate that concerns regarding full repayment no longer exist.
- Institutions are required to perform a financial analysis of the debtor to establish the absence of such concerns. The EBA ITS establishes: “Exposures shall be considered to have ceased being nonperforming when all of the following conditions are met: (a) the exposure meets the exit criteria applied by the reporting institution for the discontinuation of the impairment and default classification; (b) the situation of the debtor has improved to the extent that full repayment, according to the original or when applicable the modified conditions, is likely to be made; (c) the debtor does not have any amount past-due by more than 90 days. An exposure shall remain classified as nonperforming while those conditions are not met, even though the exposure has already met the discontinuation criteria applied by the reporting institution for the impairment and default classification according to the applicable accounting framework and Article 178 of CRR respectively.”
- The ECB guidance on NPLs (Section 5) also provides guidance on the classification of forborne performing and NPEs.

### Board reporting, governance, and KPIs (EC10)
- EC10: The supervisor determines that the bank’s Board obtains timely and appropriate information on the condition of the bank’s asset portfolio, including classification of assets, the level of provisions and reserves and major problem assets. The information includes, at a minimum, summary results of the latest asset review process, comparative trends in the overall quality of problem assets, and measurements of existing or anticipated deterioration in asset quality and losses expected to be incurred.
- Section 3.2 of the ECB guidance on NPLs requires the management body of the bank to approve and monitor the institution’s strategy regarding NPLs.
- Section 3.5 requires: “A framework of key performance indicators needs to be developed to allow the management body and other relevant managers to measure progress.” Those indicators are to be monitored on a periodic basis.
- The guidance applies to NPEs more broadly, not only loans.

*Source: cr18233 - Section 6 of the ECB guidance on NPLs states the supervisory expectations for the*

### Section 3.5 also identifies a minimum set of indicators, which should cover, among others:

### cr18233 - Section 3.5 also identifies a minimum set of indicators, which should cover, among others:

### Nonperforming loans (NPLs), provisioning, and supervisory expectations
- Minimum set of indicators to be covered includes: NPL ratios and coverage; NPL flows and default rates; customer engagement and cash collection; forbearance activity; and liquidation activity.
- EC11: Supervisor requires that valuation, classification and provisioning, at least for significant exposures, are conducted on an individual item basis.
  - Supervisors require banks to set an appropriate threshold for identifying significant exposures and to regularly review the threshold.
  - Classification of exposures as nonperforming shall be done on an individual basis or for the overall exposure to a given debtor, following the definition in the EBA ITS on Supervisory Reporting (instructions for table F18 in Annex V).
  - According to IAS 39, exposures that are individually significant should be subject to individual assessment of impairment; not individually significant exposures may be assessed individually or collectively.
  - ECB guidance on NPLs (Section 6.2.1) expects banks to define internal policy criteria for individual provisioning decisions.
- EC12: Supervisor regularly assesses trends and concentrations in risk related to banks’ problem assets and considers adequacy of provisions and reserves at bank and system level.
  - Article 81 of CRD IV requires competent authorities to ensure concentration risk is addressed and controlled, including by means of written policies and procedures.
  - Within the ECB, horizontal functions identify key risks for SIs and adapt supervisory planning (e.g., horizontal in-depth reviews, a task force for NPE analysis).
  - Aggregated system-wide data based on bank-specific reporting is limited; most information is collected ad hoc. Problem assets (watch list) are collected for FINREP reporting banks but without breakdowns by severity.
- Assessment and supervisory follow-up:
  - Guidance on NPLs is non-binding; banks with high NPLs must define an NPL strategy and are subject to ad hoc reporting and intense monitoring.
  - An addendum (consultation October 2017) proposes quantitative supervisory expectations on minimum prudential provisions for NPEs applied to the flow of NPLs; deviations could trigger supervisory dialogue and possibly Pillar II measures.
  - ECB clarified power to require adjustments to own funds calculations where accounting treatment is not prudent; a firmer explicit legal grant would be preferable.
  - ECB cannot impose reclassification as NPL if exposure does not meet default conditions.
  - Onsite credit file review methodology exists and will be complemented by statistical extrapolation to portfolios; ECB inspectors’ limited numbers (less than 10 percent of missions’ staffing) constrains direct participation, increasing reliance on NCA inspectors.

*Assessment snapshot: supervisory expectations on individual provisioning, enhanced monitoring of NPL strategies, but data gaps and non-binding nature of guidance limit full harmonization and enforcement.*

### Principle 19 — Concentration risk and large exposure limits
- Principle: Supervisor ensures banks have policies/processes to identify, measure, evaluate, monitor, report, and control/mitigate concentrations; supervisors set prudential limits on single counterparties/groups of connected counterparties.
- Legal and guidance framework:
  - Article 393 CRR: institutions must have procedures/internal controls for identifying, managing, monitoring, reporting, and recording large exposures (exposures equal or in excess of 10 percent of eligible capital); Article 389 CRR defines “exposure” to include off-balance sheet items.
  - Articles 76 and 81 CRD IV require authorities to address and control concentration risk via written policies and procedures.
  - CEBS Guideline GL31 and EBA SREP guidelines require institutions to identify risk drivers and ensure systems to detect, measure and monitor credit concentration risks.
  - ECB requires SIs to have a concise definition of credit concentration covering counterparties, groups of connected counterparties, sectoral/geographic/commodity/currency concentrations, and indirect exposures.
- Supervisory practice and indicators:
  - JSTs continuously assess compliance with large exposures regime (Articles 387–403 CRR) and take immediate action on breaches (Article 395).
  - JSTs monitor: largest 10/20/50 exposures, Herfindahl index where available, granularity adjustments for single-name concentration, sectoral Herfindahl (NACE), breakdowns of loans and NPEs by country/type, forborne exposures by country/type.
  - JSTs can require deeper analysis for sectoral or counterparty concentration (e.g., shipping, CCPs).
- Gaps and limitations:
  - The EU-wide definition does not fully cover concentration forms in the CP (e.g., market and other risk concentrations to asset classes, products, collateral, currencies); some national frameworks (e.g., Germany) are more encompassing.
  - Aggregate system-wide concentrated problem asset information is limited; incomplete LEI reporting: sample of 29 SIs showed for 12 SIs an average of 30 percent of entities with exposures exceeding 1 percent of eligible capital lacked an LEI code.
  - Exemptions under Article 400(2) CRR (covered bonds, certain regional claims, intra-group, promotional loans, mutual guarantee schemes, mortgage guarantees, exposures to recognised exchanges) can weaken limits; ECB harmonized certain options (20 percent floor for Articles 400(2)(a),(b); full exemptions for others), but Member State discretion allowed until 2028 (Article 493(3)).
  - No stricter large exposure limits for G-SIBs compared with Basel expectation.
- Assessment: Largely Compliant.
  - Comments: CRR broadly aligned with Basel but gaps exist (Article 400(1) exceptions, eligible capital differences). Supervisors should monitor consequences of deviations and improve reporting quality (LEIs) and explicit supervisory expectations on broader concentration risk.

### Principle 20 — Transactions with related parties
- Principle: Supervisor requires related-party transactions to be on an arm’s length basis, monitored, controlled/mitigated, and related-party exposures written off in accordance with standard policies.
- Findings:
  - No EU-wide framework for related-party exposures; some Member States (Belgium, Cyprus, Finland, Germany, Estonia, Greece, Italy, Latvia, Malta, Portugal, Slovakia, Spain) have definitions/restrictions.
  - ECB considers itself responsible for exercising powers related to related parties under national laws for SIs and has communicated this to SIs.
  - National laws in several countries require arm’s-length treatment, monitoring, and mitigation (e.g., Germany, Italy, Slovenia, Malta).
  - No EU-wide requirement that related-party transactions or write-offs exceeding specified amounts require prior Board approval; national laws sometimes set limits or approval thresholds (e.g., Portugal, Spain, Ireland).
  - No EU-wide reporting requirement for related-party transactions beyond FINREP (which follows accounting standards and does not meet CP definition requirements); some NCAs require regular reporting.
- Assessment: Materially Non-Compliant.
  - Comments: Absence of harmonized EU/Euro Area framework; supervisory practice can address individual cases but lacks common approach. Supervisors need a regulatory framework ensuring identification, aggregated reporting, and powers to impose safeguards, preferential-term prohibitions, and exclusions of conflicted Board members from approvals.

### Principle 21 — Country and transfer risks
- Principle: Supervisor ensures banks have policies/processes to identify, measure, evaluate, monitor, report, and control/mitigate country and transfer risk.
- Findings:
  - Country and transfer risk are not specifically mentioned in CRD IV/CRR; EBA SREP Guidelines treat country risk as a subcategory of credit risk.
  - No EU-wide framework or explicit SSM-specific expectations for banks on country/transfer risk identification, measurement, monitoring, reporting, and mitigation.
  - A few national frameworks exist with specific requirements (e.g., Ireland).
  - Supervisory practice: SSM SREP methodology provides indications for JSTs; JSTs have performed country risk work for specific SIs with cross-border exposures, assessing policies, limits by country, and country perspective in strategic plans.
  - Data sources: COREP and FINREP geographical breakdowns; some jurisdictions require additional reporting (Germany, Ireland, Latvia, Spain).
- Assessment: Materially Non-Compliant.
  - Comments: Need for EU-wide framework and upgraded SSM methodological approach with explicit supervisory expectations; explicit requirement to incorporate country/transfer risk into bank stress tests and provisioning schemes is lacking.

### Principle 22 — Market risk
- Assessment: Compliant.
- Key elements:
  - Article 83 CRD IV requires banks implement policies/processes for identification, measurement, and management of material market risks.
  - EBA SREP Guidelines and SSM Supervisory Manual set expectations for market risk strategy, governance, MIS, limits, model controls, and trading-book allocation.
  - Article 105 CRR requires prudent valuation of trading-book items (daily revaluation, mark-to-market preferred, marking-to-model controls, independent price verification, valuation adjustments).
  - EBA RTS on prudent valuation (2014) applies to all fair-valued positions; simplified and core approaches exist (EUR 15 billion threshold).
  - ECB conducts targeted onsite inspections and deep dives for Level 2/3 assets; TRIM guidance used for delineating trading book.
  - Supervisory activities include SREP assessments, quarterly reports, and inspections on front-office pricing models and value-at-risk breaches.
- Comments: Supervisory scrutiny on Level 2/3 valuation should continue and be extended; more granularity in harmonized reporting could aid monitoring of fair-value hierarchy.

### Principle 23 — Interest rate risk in the banking book (IRRBB)
- Assessment: Compliant.
- Legal and supervisory framework:
  - Article 84 CRD IV requires systems to identify/evaluate/manage IRRBB; Article 98(5) mandates supervisory assessment in SREP, with supervisory measures when economic value declines by more than 20 percent of own funds from a 200 bps shock.
  - EBA Guidelines on IRRBB provide methodology, stress testing, governance, and internal capital guidance.
  - EBA SREP Guidelines set out supervisory assessment elements (strategy, governance, models, limits, reporting).
  - ECB collects quarterly banks’ estimates of +/-200 bps shock impacts on EVE and one-year NIM projections; supervisory proxies used to verify/challenge bank ICAAP estimates.
  - ECB conducted an IRRBB sensitivity analysis in 2017 across SIs using six heuristic interest rate shocks; results inform Pillar II guidance and SREP.
- Additional criteria:
  - AC1: supervisory collection of standardized shock results and Article 98(5) threshold noted; BCBS April 2016 guideline reduced outlier threshold from 20 percent of total capital to 15 percent of Tier 1 capital—EU legislation should be amended to reflect this.
  - AC2: supervisors assess whether internal capital measurement captures IRRBB; ECB uses supervisory proxies and verify-and-challenge approach.
- Comments: Evidence of offsite and onsite supervisory activity; 2017 stress exercise informative; recommendation to align EU legislation with BCBS April 2016 standard.

### Principle 24 — Liquidity risk
- Assessment: Materially Non-Compliant.
- Legal and framework highlights:
  - LCR requirement effective for all credit institutions since October 2015 (Article 412(1) CRR; DA Delegated Regulation); minimum ratio raised to 100 percent from January 1, 2018 (80 percent in 2017).
  - ECB may waive LCR application on an individual basis (Article 8 CRR). Article 414 CRR requires institutions to inform competent authority if LCR falls below 100 percent and submit restoration plan.
  - BCBS RCAP (2017) found EU LCR broadly largely compliant with Basel LCR but identified one material deviation and four potential deviations; treatment of HQLA and some inflows/outflows differs from Basel.
  - EBA LCR impact assessment (December 2016) sample of 139 banks found overall LCR 133.1 percent under both EU and Basel frameworks but dispersion exists (smaller banks often benefit more from EU treatment; some banks move from below to above 100 percent under EU rules).
- Supervisory practice:
  - LCR used in SREP; additional liquidity monitoring metrics and qualitative ILAAP assessment complement quantitative metrics.
  - ECB collects funding plans per ECB decision (June 27, 2017) and supervisory stress tests are used to challenge bank internal stress tests.
  - Some national liquidity requirements supplement EU LCR.
- Gaps and concerns:
  - No explicit EU-wide requirement for Board to conduct at least annual review and adjustment of liquidity strategy/policies in light of changing risk profile and market conditions (EC4).
  - No explicit EU-wide requirement for supervisors to conduct separate analysis/monitoring of liquidity needs by significant currency and evaluate cross-currency liquidity transferability (EC8); regular maturity-ladder reporting by currency started March 2018.
  - No explicit recommendation for supervisors to require banks to set limits to mitigate excessive asset encumbrance (AC1).
  - Assumptions on deposit outflows in stress testing may need revision in light of recent bank resolution episodes with exceptional deposit flight; assessors saw no evidence of revision.
  - Information on unencumbered assets available to ECB banking supervision might be insufficient to gauge emergency liquidity capacity in rapidly deteriorating environments.
- Recommendations and supervisory shortfalls:
  - Revise supervisory stress test deposit outflow assumptions reflecting recent resolution events.
  - Ensure ITS include granular/frequent cash flow breakdowns in material non-euro currencies and jurisdictions; JSTs to monitor these regularly.
  - Consider explicit EU/SSM-level requirements for Board review frequency of liquidity strategy and for supervisor analysis of currency-specific liquidity transformation.

### Principle 25 — Operational risk
- Assessment: Largely Compliant.
- Legal and supervisory framework:
  - Article 312 CRR establishes standardized approach and AMA for operational risk (Articles 320–321 set qualitative requirements).
  - EBA SREP Guidelines guide JST activities; supervisory tools include analysis of COREP Templates 16–17, financial statements, internal documentation, audits, meetings, thematic reviews (IT, cyber), model approval, benchmarking, deep-dives, onsite inspections, ICAAP/SREP assessments.
  - ECB developed IDRA operational risk benchmarking tool and an operational risk dashboard for ITS data and peer comparisons.
- Supervisory activities and findings:
  - The ECB conducted thematic reviews and questionnaires on IT risk, cyber security, risk data aggregation, and outsourcing; cyber incident reporting became mandatory Q3 2017.
  - From 2015–2017, ECB conducted 113 onsite inspections focusing on operational risk and 75 IT risk onsite inspections.
  - ECB has deprioritized AMA model investigations as AMA is expected to be removed from the regulatory framework; resources redirected to TRIM.
- Gaps and recommendations:
  - Need for enhanced collection and use of loss data and verification onsite to ensure banks use loss data to remediate controls.
  - AML is a major operational risk; legal barriers to mandatory exchange of AML information among ECB and NCA AML supervisors should be removed. ECB should take supervisory measures promptly when AML-related deficiencies exist, potentially beyond capital/liquidity measures (e.g., business restrictions).
  - Cybersecurity: supervisory intensity should be strengthened; intra-industry and inter-governmental information sharing and crisis management mechanisms should be formalized; ECB/EBA should publish nonconfidential cybersecurity best practices; promote mutual assistance data vaults; strengthen review of third-party vendors and SI due diligence in IT/cyber context.
- Comments: Supervisory capabilities improved but further focus on cyber risk, data quality, outsourcing concentration, and effective implementation verification is needed.

### Principle 26 — Internal control and audit
- Assessment: Compliant.
- Legal and guidance framework:
  - CRD IV/CRR and EBA Guidelines on internal governance provide comprehensive requirements (roles/responsibilities, accounting, segregation of duties, remuneration, internal audit, compliance).
  - EBA revised Guidelines on Internal Governance (applying from June 30, 2018) emphasize supervisory board duties, status of risk management, access and independence of heads of control functions, and group governance.
  - SSM Supervisory Manual and SREP incorporate internal governance assessments; thematic reviews and deep dives (e.g., June 2016 SSM supervisory statement on governance and risk appetite) inform JST action.
- Supervisory practice:
  - Supervisors assess role balance between business origination and control functions, resource adequacy, independence, reporting lines (direct access to supervisory board/audit committee), audit plans, internal audit methodology and frequency (audit universe not to exceed three years), and compliance function adequacy.
  - Evidence of regular meetings with CEOs/CROs/CFOs and oversight of remediation actions.
- Comments: Legal and supervisory frameworks and practices provide robust expectations; ECB and NCAs are aligning to EBA revised guidelines with “comply-or-explain” process and supervisory follow-up.

### Principle 27 — Financial reporting and external audit
- Assessment: Compliant.
- Key legal and supervisory points:
  - Listed entities must prepare consolidated financial statements in accordance with IFRS; Member States may allow/require IFRS for stand-alone statements or other entities; Article 24(2) CRR empowers competent authorities to require IFRS regulatory reporting but ECB does not use this power generally.
  - Transparency and Accounting Directives and Audit Directive/Audit Regulation set responsibilities for boards, audit committees, audit oversight, auditor independence, rotation limits, and audit report content.
  - Article 105 CRR and EBA RTS on prudent valuation govern valuation and independent verification for prudential purposes.
- External audit oversight and interaction:
  - Audit Directive/Regulation require Member State competent authorities for auditor approval/oversight; Member States have powers to withdraw approvals and impose sanctions (Article 30 Audit Directive).
  - ECB had clarified that, from January 1, 2017, supervisory powers related to appointment/replacement of external auditors of SIs granted to NCAs are to be directly exercised by the ECB.
  - Audit Regulation and EBA Guidelines encourage ongoing dialogue between supervisors and auditors; ECB and JSTs meet auditors collectively and individually; EBA Guidelines on communication implemented in SSM Supervisory Manual.
  - Article 17 Audit Regulation sets rotation limits: maximum audit engagement less than 10 years (or 20/24 years subject to conditions); key audit partners cease participation after seven years with a three-year cooling-off.
  - Article 12 Audit Regulation obliges auditors to report material information promptly to prudential supervisors; disclosure in good faith is protected from confidentiality breach.
- Supervisory findings:
  - National adoption of ISA standards is near-universal; France, Germany, Portugal awaiting formal adoption but substantively compliant.
  - ECB meets auditors, engages in dialogue, and has intervened where rotation limits were breached.
- Comments: Framework for financial reporting and audit is comprehensive; ECB engages with auditors and uses supervisory tools to enforce auditor independence and reporting.

*Italic: Summary based only on the supplied IMF text (cr18233 - Section 3.5 and related excerpts).*

### Section III of CRD IV establishes duties of auditors similar to the ones referred to above.

### Section III of CRD IV establishes duties of auditors similar to the ones referred to above.

### Duties of auditors (Article 63)
- Article 63(1): the auditor has a duty to report promptly to the competent authorities any fact or decision concerning that institution of which that person has become aware while carrying out that task, which is liable to:
  - constitute a material breach of the laws, regulations, or administrative provisions which lay down the conditions governing authorization or which specifically govern pursuit of the activities of institutions;
  - affect the ongoing functioning of the institution; and/or
  - lead to refusal to certify the accounts or to the expression of reservations.
- Article 63(2): “disclosure in good faith” to the competent authorities by auditors (of any fact or decision referred to in Article 63(1) above) does not constitute a breach of any restriction on disclosure of information imposed by contract or by any legislative, regulatory or administrative provision and does not involve such persons in any liability. Such disclosure is to be made simultaneously to the management body of the institution unless there are compelling reasons not to do so.
- Assessors observed examples of reports from external auditors to supervisors on matters thought to be of material significance.

### Additional Criterion (AC1): Access to external auditors’ working papers
- AC1 statement: The supervisor has the power to access external auditors’ working papers, where necessary.
- Description and findings:
  - No EU-wide requirements grant supervisors this power.
  - Article 56 of CRD IV allows information exchange between the supervisor and the auditor, subject to professional secrecy.
  - National laws generally do not provide this power either.
  - Examples where access exists in national law:
    - Luxembourg: supervisor may access external auditors' working papers.
    - Spain: supervisor may access documentation on each audit.
    - Italy and the Netherlands: the power to access external auditors' working papers resides with another competent authority.
- Assessment consequence: Absence of the power to access auditors' working papers in EU law and most national laws, and the lack of routine practice for informal requests, is the basis for a Largely Compliant overall rating for this Core Principle.

### Assessment of Principle 27 — Integrity and external audit of financial statements
- Overall assessment: Largely Compliant.
- Comments and supervisory practice:
  - ECB banking supervision has only limited scope under EU law to engage in assessments of the integrity and external audit of financial statements of SIs prepared in accordance with relevant accounting standards.
  - The ECB has no accounting powers nor powers to establish the scope of external audits of credit institutions; responsibilities under EU directives lie with other competent authorities.
  - The overall EU framework appears robust and ensures broad consistency with a number of ECs in this Core Principle.
  - The ECB has clarified that where national laws grant NCAs supervisory powers relating to appointment/replacement of external auditors, the ECB is exclusively and directly competent to exercise these powers and has become active in this area.
  - The ECB advocated that EU law should include a clear reference to additional supervisory powers regarding the replacement of external auditors to avoid legal uncertainty and to promote a level playing field across the Banking Union.
  - Implementation of the EBA’s Guidelines on communication between competent authorities and auditors will increase engagement with external auditors. Assessors saw examples of supervisory interactions, regular meetings between ECB banking supervision and audit firms, and agendas/supporting materials.
  - The Additional Criterion under this Core Principle represents best international practice rather than a requirement; non-compliance with AC1 led to the Largely Compliant rating.

### Principle 28 — Disclosure and transparency (overview)
- Principle statement: The supervisor determines that banks and banking groups regularly publish information on a consolidated and, where appropriate, solo basis that is easily accessible and fairly reflects their financial condition, performance, risk exposures, risk management strategies, and corporate governance policies and processes.
- Overall assessment: Largely Compliant.

### Essential Criterion 1 (EC1): Periodic public disclosures and standards
- Requirements and instruments:
  - Part Eight of the CRR requires disclosure of various quantitative and qualitative information on capital, capital requirements, risk management, credit risk, market risk, counterparty credit risk, securitization risk, equities risk, interest rate risk, asset encumbrance, leverage, operational risk, and remuneration.
  - CEBS April 2010 principles for disclosures in times of stress recommended application in public disclosures (Pillar 3, financial statements and ad hoc disclosures).
  - Articles 6 and 13 of the CRR require disclosure by all banks and investment firms on an individual and, where relevant, consolidated basis; Article 13 governs solo disclosures for consolidated entities within a group.
  - Regulation 1606/2002 mandatorily applies IFRS to consolidated accounts of publicly traded companies (Article 4); Article 5 allows Member States discretion on IFRS application to solo financial statements.
  - IAS 1.10 and IAS 1.112 make notes a required component of financial statements; IFRS 7.1, .7, and .31 require disclosure of significance and risks from financial instruments.
  - EBA technical standards and guidelines introduced specific formats/templates for Pillar 3 (examples include Article 437, Regulation (EU) 1423/2013; Article 451; Article 440; Article 441 and Regulation 1030/2014; Article 443).
- Auditing and verification:
  - Pillar 3 information is not required to be audited under EU law; practice in some jurisdictions requires external auditor assurance at least annually.
  - Pillar 3 information disclosed in the notes to the financial statements is required to be audited per Directive 2006/43 and relevant national auditing standards.
  - Article 433 of the CRR requires Pillar 3 disclosures at least annually in conjunction with financial statements; institutions must assess need to publish more frequently, guided by EBA Guidelines especially for G-SIBs and institutions with a balance sheet higher than EUR 30 billion.
  - Article 106 of CRD IV empowers supervisors to require more frequent publication and specific deadlines.
- Materiality and supplementary disclosures:
  - Article 431 CRR: institutions shall disclose supplementary information necessary if CRR requirements are insufficient, subject to materiality and confidentiality rules; EBA Guidelines outline permitted nondisclosure instances.
  - IAS 1.17, IAS 1.112, and IFRS7.32 require presentation and additional disclosures where necessary for understanding.

### Essential Criterion 2 (EC2): Scope, content, and commensurateness of disclosures
- Findings:
  - Some CRR Part Eight disclosures duplicate accounting disclosure requirements.
  - Exposures and transactions with related parties (IAS 24) and accounting policies are generally required in financial statements but not necessarily in Pillar 3; exception examples: Article 442a (accounting policies for past-due and impaired) and Article 449j (securitization transactions).
  - SIs generally are not required to disclose related party exposures or transactions with related parties in Pillar 3 disclosures.
  - Materiality guides scope and aggregation; Article 432(1) and associated Guidelines set the materiality framework.
  - Title II and III of Part 8 of the CRR require disclosure of risk management objectives and policies, governance arrangements, risk exposures, and remuneration policy.
  - EBA December 2016 Guidelines further specify Pillar 3 disclosure requirements and mandate standardized templates and tables based on Basel Committee standards; Guidelines apply fully to G-SIIs and O-SIIs, and partially to less systemically important institutions under proportionality.

### Essential Criterion 3 (EC3): Group structure disclosures
- Findings:
  - For Pillar 3, the scope of consolidation is the CRD IV regulatory scope of consolidation (Articles 18 and 19), not IAS/IFRS consolidation.
  - Article 436b CRR requires disclosure of differences between accounting and prudential consolidation bases and brief descriptions of entities with their consolidation status (fully consolidated; proportionally consolidated; deducted from own funds; neither consolidated nor deducted).
  - Financial statement disclosures include names, registered offices, proportion of capital and voting rights, rationale for consolidation, and circumstances for derogations (Article 43(2)(h) of the CRR, Directive 86/635; IFRS 12 references).

### Essential Criterion 4 (EC4): Review and enforcement of disclosure compliance
- Findings:
  - JSTs verify disclosure compliance as part of the annual supervisory cycle; MEL activities include assessments of Pillar 3 compliance and result in recommendations.
  - EBA assessed disclosures on crisis-related exposures (2008–2010) and compliance with CRR disclosure requirements (from 2010 onwards), identifying best practices.
  - Article 18(1) SSMR: the ECB may directly impose pecuniary penalties on SIs for breaches of disclosure requirements.
  - Article 18(5) SSMR: the ECB may request NCAs to impose non-pecuniary penalties and/or sanction natural persons where national law requires sanctions to remedy deficiencies; assessors were shown samples of referral reports, administrative proceedings, and imposition of pecuniary penalties related to breaches such as improper reporting of own funds requirements and large exposure limits.

### Essential Criterion 5 (EC5): Aggregated public information on the banking system
- Findings and published data:
  - Commission Implementing Regulation No 650/2014 sets format, structure, contents list and annual publication date for aggregate information.
  - Aggregate statistical information includes:
    - texts of laws, regulations, administrative rules and guidance in the Member State field of prudential regulation;
    - information on exercise of options and discretions available in EU law;
    - information on general criteria and methodologies used for SREP;
    - aggregate statistical data on key aspects: number of banks and investment firms; total banking assets and share of GDP; total Tier I, total Tier 2 capital; total capital requirements; total capital adequacy ratio; own funds requirements by type of risks (in percent of own funds requirements); credit exposure by exposure class (in percent of own funds requirements); own fund requirements for operational risk by type of approach (in percent of total own fund requirements); own fund requirements for market risk by type of approach (in percent of total own fund requirements).
  - EBA publishes aggregate statistical data on implementation of the prudential framework and national statistical data on banking sector, credit risk, operational risk, market risk, and supervisory actions.
  - ECB’s “Consolidated banking data” provides country-by-country aggregated balance sheet, profit and loss, and supervisory ratios.
  - For SIs, ECB Supervisory Banking Statistics provide consolidated data including profit and loss, balance sheet items, NPLs, provisions, capital adequacy and supervisory indicators; expanded in November 2016 to include general statistics, balance sheet composition and profitability, capital adequacy and asset quality, funding, and data quality.
  - Expansion led to increased volume and higher frequency (quarterly) of published data, including NPLs, forbearance and coverage ratios, country breakdowns, bank classifications (size/degree of international activity), and published solvency and leverage ratios per Part 8 of the CRR.
  - Scope: SIs in SSM-participating Member States at highest level of consolidation; list of SIs per reference period includes banks reporting FINREP with COREP at that time; changes are normally limited, with exception of 2015Q4 when some banks switched reporting frameworks.
  - Definitions align with ID-Cards for the Supervisory Board; statistics updated yearly (ECB Regulation on reporting of supervisory financial information).
  - Consolidated Banking Data (CBD) also applies ITS data.

### Additional Criterion (AC1) under Principle 28: Disclosure of average or over-the-period measures
- AC1 statement: Disclosure requirements should promote information that helps understanding of a bank’s risk exposures during a reporting period (e.g., average exposures or turnover).
- Findings:
  - Disclosures are more often provided using end-of-period values.
  - CRR refers to some average values or over-the-period values, but evidence is lacking that these inputs are used in risk assessment to date.
  - European banks calculate the leverage and LCR ratios as of quarter end, contributing to quarter-end spikes in money markets as banks “sanitize” balance sheets for reporting; end of quarter reporting for these ratios is identified as a distortion and not best practice.
  - Specific CRR provisions referencing period measures:
    - Article 442(c): disclosure of total amount of exposures after offsets and the average amount of exposures over the period broken down by exposure class.
    - Article 449(n)(iv): disclosure of summary of securitization activity of the current period, including amount of exposures securitized and recognized gain or loss on sale.
    - Article 443: disclosures on asset encumbrance made using median values.
  - IFRS references:
    - IFRS 7.42 G(c): where transfer activity is unevenly distributed, disclose when greatest transfer activity took place in the reporting period, related gains/losses, and total proceeds in that part of the reporting period.
    - IFRS 12.27: for sponsored entities without sponsor interest, disclose income from those structured entities during the reporting period and carrying amount (at time of transfer) of assets transferred during the reporting period.
- Assessment commentary:
  - Disclosure standards are generally sound and reflect the substance of Basel II Pillar 3 standards.
  - Supervisors perform sample testing and thematic reviews to confirm compliance.
  - Euro area banks do not mandatorily disclose related party exposures or transactions with related parties as part of Pillar 3; they should be required to do so.
  - Supervisors have attempted to adjust disclosure frequency in some cases; however, non-end-of-period data has not been used in the supervisory process with impact on analysis (AC1).
  - Recommendation: Euro area banks should be required to disclose/report average ratios instead of only end-of-period for certain ratios, such as the leverage ratio and LCR.

*Source: cr18233 - Section III of CRD IV establishes duties of auditors similar to the ones referred to above.*

### 1. Responsibilities, objectives, and powers LC The allocation of supervisory responsibilities

### 1. Responsibilities, objectives, and powers LC The allocation of supervisory responsibilities

### Overview
- The allocation of supervisory responsibilities under the SSM is clear and the ECB has a broad set of powers. However, the SSM legislative framework—reflecting in particular the uneven coverage of national laws—leaves the ECB facing gaps or legal uncertainty with regard to its direct supervisory powers in some areas.
- Core Principle grading across topics includes LC, C, MNC, and MNC ratings reflecting strengths and legal or practical gaps.

### Independence, accountability, resourcing, and legal protection for supervisors (Grade: LC)
- ECB banking supervision is independent in law and operation.
- Decision-making processes are complex and time-consuming.
- The ECB does not have full control over the level and availability of NCA staff committed to SI supervision.

### Cooperation and collaboration (Grade: C)
- Framework for cooperation and collaboration is extensive and effective.
- Progress in finalizing MoUs with third country authorities, within and outside the EEA, has been slower than expected.
- Substantial differences between legal systems and national legal requirements have affected finalization of WCCAs for crisis management coordination in supervisory colleges where the ECB is consolidating supervisor.
- Absence of formal arrangements has not precluded effective working relationships with key authorities.

### Permissible activities and licensing (Grades: LC for permissible activities; LC for licensing criteria)
- Definition of permissible activities for banks and powers regarding use of the word “bank” are conferred to the NCAs.
- Third-country groups operate through entities that escape ECB supervision; investment firms undertaking “bank like” activities may be supervised only at national level.
- ECB is the licensing authority and makes decisions based on applicable national laws with full NCA involvement.
- The ECB does not have authority to authorize and supervise Euro Area branches of non-EU or EEA banks; these branches are regulated by national laws and supervised by local NCAs.
- These arrangements create regulatory and supervisory arbitrage opportunities for non-EU banks, including establishing presence via branches.

### Transfer of significant ownership and major acquisitions (Grades: LC for transfer; MNC for major acquisitions)
- SSM framework provides clear basis for approving acquisitions/disposals of qualifying holdings, but gaps exist in notification and reporting requirements.
- No specific EU requirement for credit institutions to notify supervisors as soon as they become aware of material information negatively affecting suitability of a major shareholder; national notification requirements are inconsistent.
- No consistent requirement for periodic reporting of ultimate beneficial owners of qualifying holdings; no specific penalties for unauthorized modification or reversal of a change of control.
- Major acquisitions: SSM framework does not provide an adequate or consistent basis for ECB to approve/reject or impose prudential conditions on major acquisitions/investments by a credit institution, including:
  - No prior notification or approval requirements for acquisitions in an undertaking outside the financial sector.
  - Rules for acquiring qualifying holdings in another EU credit institution focus on safeguarding target management, not the acquiring institution.
  - No explicit requirements on acquisition of holdings in credit institutions outside the EU.
  - No harmonized procedures or criteria at EU level for assessment of major acquisitions, including assessment of undue risks or hindrance to effective supervision.

### Supervisory approach, techniques, and reporting (Grades: LC for supervisory approach; C for techniques and tools; LC for supervisory reporting)
- ECB supervisory methodology fundamentals are sound: SREP, RAS, and SEP are firmly in place and forward-looking, risk-based, and proportionate to systemic importance.
- Greater emphasis on quantitative analysis aligns with EBA’s SREP Guidelines.
- Coordination between ECB and SRB on resolution could be more timely and better coordinated; crisis management could use recovery plan assessments better and develop operational guidance and enhanced management reporting.
- Techniques and tools: mix of offsite analysis and onsite inspections, horizontal thematic reviews, in-depth reviews, ad hoc reviews; SSM Supervisory Manual and Appendices evidence appropriate design and calibration.
- ECB General Information Systems maintains and develops appropriate information and communications systems for supervision.
- Harmonized supervisory reporting is not sufficiently granular to support offsite supervision; ECB complements through additional data collections and surveys that could migrate into harmonized reporting only via a lengthy and cumbersome process.

### Corrective and sanctioning powers (Grade: MNC)
- Ongoing supervision effectively identifies issues and recommends corrective actions using informal “operational acts” and formal, enforceable ECB Supervisory Board Decisions.
- Noncompliance with a Decision constitutes a breach subject to sanctions.
- Sanction and enforcement powers contain gaps and are fragmented; they do not act as a deterrent and do not ensure a level playing field because of gaps in Union law and national law implementing EU directives.

### Consolidated supervision and home-host relationships (Grades: LC for consolidated supervision; LC for home-host)
- ECB is the consolidated supervisor for all SIs and applies prudential standards to group activities worldwide to the extent permitted by law; supervisory framework is effective.
- Legal gaps exist regarding activities of certain affiliates and parent companies, including Mixed Financial Holding Companies; lack of authority to review such activities in national law may hinder ECB’s ability to assess material impact and take action.
- No framework for resolution of a conglomerate.
- ECB-led supervisory colleges provide effective oversight for subsidiaries within and outside the SSM.
- ECB has not finalized agreements with all international supervisors of G-SIBs with systemic importance.
- EU framework for cross-border crisis cooperation improved due to SSM, SRM, and BRRD.
- ECB lacks authority to expressly prohibit shell banks or continued operation of shell banks and no clear mandate to supervise booking offices in line with international standards.

### Corporate governance, risk management, and internal controls (Grades: C for corporate governance; LC for risk management; C for internal control and audit)
- ECB established clear corporate governance expectations; SREP assesses qualifications, effectiveness and remuneration of management bodies and key function holders.
- Fit-and-proper authorization process effects necessary changes in SIs’ management bodies and key function holders.
- EU law addresses main risk categories at a high level, leaving room for non-harmonized national standards.
- ECB published documents indicating expectations for risk management, but these do not cover full spectrum of CP risks nor ensure enforceability where national binding provisions override.
- Missing elements at EU level and in some national legal frameworks include:
  - Need for Board and senior management awareness of uncertainties in risk measurement.
  - Requirement for removal of CROs to be discussed with supervisor and disclosed publicly.
  - Certain requirements on stress testing: active involvement of Board and senior management, appropriate documentation, regular maintenance and updating.
  - Requirement for banks to appropriately account for risks (including liquidity impacts) in new product approval processes.
- Internal control framework is supported by European law, EBA guidelines, and SSM supervisory statement (2016), reinforced through SREP.

### Capital adequacy, credit risk, provisioning, and exposures (Grades: MNC for capital adequacy; LC for credit risk; LC for problem assets; LC for concentration risk)
- Capital adequacy:
  - EU’s capital adequacy requirements in CRR and CRD IV do not conform to the Basel standards; some deviations, such as non-deduction of insurance holdings, are material and continue to be authorized by the ECB OND Guide.
  - The ECB requires banks to hold capital in excess of minima via Pillar 2 under SREP.
  - The ECB does not regularly monitor effects on banks’ capital ratios of deviations from Basel.
  - Internal model requirements are not consistently applied, including enforcement of permanent partial use of standardized approach by IRB banks in line with Basel (i.e., only for asset classes that are immaterial in terms of size and perceived risk profile).
- Credit risk:
  - EU law sets general requirements on credit risk management but lacks detailed requirements or supervisory expectations.
  - SSM Supervisory Manual provides suggestions for onsite inspections across lending lifecycle but these are examiner guidance not shared with supervised entities and thus not binding regulatory requirements or supervisory expectations.
  - No explicit EU requirement for arm’s-length credit decisions or for Board/senior management approval of credit exposures exceeding certain amounts/percentages of capital; some national jurisdictions have such elements.
- Problem assets and provisioning:
  - ECB’s NPL guidance has advanced supervisory activity on problem assets and provisioning and helped tackle high NPL ratios; the guidance is non-binding.
  - ECB powers to require specific adjustments to own funds calculations have been clarified but should be explicitly enshrined in law.
  - ECB cannot impose reclassification as NPL where exposures do not fully meet all default conditions.
- Concentration risk and large exposures:
  - EU large exposures regime not fully aligned with Basel standard (which will only take effect from January 2019), notably regarding off-balance sheet contingent facilities, treatment of covered bonds, and definition of eligible capital.
  - EU framework does not cover concentration risk beyond credit risk; no requirement that all material concentrations be regularly reviewed and reported to a bank’s supervisory board.

### Transactions with related parties, country/transfer risks, and market/interest-rate risks (Grades: MNC for related parties; MNC for country and transfer risks; C for market risk; C for IRRBB)
- Related parties:
  - No EU-wide framework for transactions with related parties.
  - Some SSM Member States have laws/regulations defining related parties and prescribing limits, but no common SSM approach to related party supervision for SIs.
- Country and transfer risks:
  - No EU-wide framework or SSM-specific expectations with explicit requirements for identification, measurement, evaluation, monitoring, reporting, control or mitigation of country and transfer risk.
  - Incorporation of country risk into stress tests is not explicitly required; no provisioning scheme for country/transfer risk.
- Market risk:
  - Market risk management standards are generally sound; supervisors take an active approach.
  - Opaqueness in valuation of Level 3 products and uncertainties in classification of Level 2 assets require intense supervisory scrutiny.
  - SSM has stepped up efforts on valuation of Level 3 assets/liabilities and specific Level 2 products; scrutiny should continue and be extended to all Level 2 instruments.
- Interest rate risk in the banking book (IRRBB):
  - 2017 stress-test exercise provided granular information on banks’ IRRBB exposure and qualitative information on risk management practices.
  - ECB verified offsite and onsite supervisory activity focused on IRRBB.

### Liquidity risk and operational risk (Grades: MNC for liquidity risk; LC for operational risk)
- Liquidity risk:
  - LCR requirement not fully aligned with Basel standard: no explicit requirement for Boards to regularly review and adjust liquidity strategy in light of changing risk profile and external developments.
  - No explicit requirement for supervisors to conduct separate liquidity risk strategy analysis and monitoring for each significant currency and to evaluate cross-currency liquidity transferability across jurisdictions and legal entities.
  - Data to support such analysis were not generally available at time of assessment, though regular reporting of a maturity ladder with breakdown by significant currency started in March 2018.
  - Information on unencumbered assets currently available to SSM might not be sufficient to gauge residual capacity to obtain emergency liquidity in a quickly deteriorating environment.
- Operational risk:
  - ECB strengthened operational risk program, IT risk specialist caliber, data reporting, collection/use of loss data, and verification.
  - IT, cybersecurity, and outsourcing require continued attention.
  - Supervisory practices to assess effective implementation of operational risk management need greater emphasis.
  - A system-wide analysis of common operational risk exposures or vulnerabilities is needed; opportunity to emphasize collection and analysis of material outsource providers.

### Financial reporting and external audit (Grade: LC)
- Responsibilities under EU directives for financial reporting and external audit lie with other competent authorities; the ECB is increasing its involvement in external audit processes.
- Overall EU framework appears robust, but power to access external auditors' working papers is absent in EU law.

*Source: cr18233 - 1. Responsibilities, objectives, and powers LC The allocation of supervisory responsibilities*

### 28. Disclosure and transparency LC Disclosure standards are generally sound and

### 28. Disclosure and transparency LC Disclosure standards are generally sound and

### Summary of findings
- Disclosure standards are generally sound and promote transparency, reflecting the substance of the Basel II Pillar 3 standards.
- Supervisors routinely confirm compliance with the standards through both sample testing and thematic reviews.

### Disclosure gaps
- Euro area banks do not mandatorily disclose related party exposures or transactions with related parties as part of the Pillar 3 disclosures.

### Reporting practices
- Euro area banks disclose/report some average ratios instead of only end-of period for certain ratios, such as the leverage ratio and LCR.

*cr18233 - 28. Disclosure and transparency LC Disclosure standards are generally sound and*

### 29. Abuse of financial services  Not assessed.

### 29. Abuse of financial services  Not assessed.

### Recommended Actions to Improve Compliance with the Basel Core Principles and the Effectiveness of Regulatory and Supervisory Frameworks
- Principle 1,4,5
  - The EU should give the ECB supervisory powers over all significant forms of credit intermediation in the Euro Area.
- Principle 2
  - The ECB should further streamline its decision-making processes.
  - The ECB should formalize staffing arrangements with NCAs if collaborative efforts cannot ensure the level, suitability and availability of NCA staff on JSTs and OSIs.
- Principle 3
  - The ECB should finalize MoUs with third-country authorities within and outside the EEA.
  - The ECB should finalize WCCAs for crisis management coordination in supervisory colleges for which it is consolidating supervisor.
- Principle 4
  - The CRR/CRD should be amended to ensure that large cross-border investment firms undertaking “bank-like” activities establishing in the Euro Area are authorized and supervised by the ECB as credit institutions.
- Principle 5
  - Euro area branches of a third country banking group exceeding a certain threshold should be authorized and supervised by the ECB.
- Principle 6
  - The ECB should confirm its supervisory expectation that credit institutions notify their JST as soon as they become aware of any material information that may negatively affect the suitability of a major shareholder or a party that has a controlling interest.
- Principle 7
  - The EU should give the ECB supervisory powers to require a credit institution undertaking a material acquisition or investment within or outside the EU to notify the ECB in advance of the proposed transaction, and to approve or reject the proposed transaction.
- Principle 8
  - The ECB should continue to streamline and simplify its supervisory processes to ensure effective resource use and timely responses to emerging supervisory issues.
  - The ECB’s supervisory processes should also be reviewed for effectiveness in light of recent resolution experience. The ECB’s crisis management function should make better use of recovery plan assessments and develop operational guidance for crisis management activities.
  - The ECB and SRB should forge closer working relationships in recovery and resolution planning.
  - The ECB should finalize revisions to the existing MoU with the SRB. In doing so, priority should be given to maximizing information sharing early in the process, well before formal “failure or likely to fail” notifications are required, to facilitate seamless recovery and resolution planning.
- Principle 9
  - The ECB should streamline Internal reporting lines to ensure the timely communication of supervisory and other information within the ECB and timely feedback to SIs.
  - The ECB should seek a mandatory notification requirement that SIs report all substantive changes in their activities, structure and overall condition, or as soon as they become aware of any material adverse developments.
  - The ECB should increase its transparency about its supervisory policies, expectations, and approaches through the publication of further guides on supervisory topics.
- Principle 10
  - Processes for amending and augmenting harmonized supervisory reporting should be streamlined and expedited.
  - The development and widespread adoption of BIRD and IReF as the single source for supervisors’ multiple information needs should be further promoted.
- Principle 11
  - The legal framework for enforcement and sanctions is asymmetrical and should be harmonized, including for direct enforcement measures and sanctions on individuals and entities regarding all breaches of the CRR.
  - The EU should give the ECB express authority to impose non-pecuniary sanctions, such as enforceable “cease and desist” orders with affirmative covenants, as an additional supervisory tool.
- Principle 12
  - Gaps in national law that impact the ECB’s ability to supervise the activities of companies affiliated with parent companies should be closed.
  - Potential gaps in the ECB’s fit-and-proper supervisory authority where there is corporate ownership of the group and there is no governing national law should be closed.
  - Potential gaps in the supervision of financial conglomerates under FICOD, which do not require MFHCs to obtain authorization from regulators should be addressed.
  - Thresholds for the conglomerate definition under FICOD should be changed to include off-balance-sheet assets, with supervisory discretion to include other assets or to deem a group a conglomerate based on risk.
  - A framework for resolution of a conglomerate should be established.
- Principle 13
  - The ECB should finalize MoUs with all supervisors of G-SIBs as quickly as possible.
  - The EU should give the ECB express authority to prohibit shell banks or to limit the use of foreign branches as mere booking offices.
- Principle 14
  - The fit-and-proper framework should be harmonized in line with international best practice principles.
  - The ECB should have greater discretion to object to persons whose prior work experience and relationships may make them not fully independent from management.
  - Internal governance standards for financial conglomerates should be enhanced.
- Principle 15
  - Responsibility for defining the prudential standards for different categories of risk should be assigned to competent authorities (e.g., by moving Articles 79 to 87 of CRD IV to the CRR).
  - The ECB should issue a comprehensive document on risk management that collects, structures, and reorganizes all existing guidelines, letters and other documents issued so far and completes them, with indications on areas not covered yet.
  - A requirement or explicit supervisory expectations about Board and senior management awareness of the uncertainties attached to risk measurement should be introduced.
  - EU law should introduce a requirement that the removal of a CRO should be discussed with the supervisor and should be disclosed publicly.
  - A requirement or explicit supervisory expectations should be introduced that stress testing programs should actively involve the Board and senior management, be appropriately documented and regularly maintained and updated.
  - A requirement or explicit supervisory expectations should be introduced for banks to appropriately account for risks (including liquidity impacts) in their new product approval process.
- Principle 16
  - The EU should conform the capital adequacy requirements of the CRR and CRD IV to the Basel standards.
  - The requirement for banks to hold capital in excess of the minima should remain a supervisory power exercised by the ECB under Pillar 2 through the SREP process.
  - The ECB should regularly monitor the effects on banks’ capital ratios of deviations from the Basel standard.
  - The ECB should continue to require the consistent application of internal model requirements, including by enforcing the permanent partial use of the standardized approach by IRB banks in line with Basel standards (i.e., only for asset classes that are immaterial in terms of size and perceived risk profile).
- Principle 17
  - EU law should introduce a requirement for banks to make credit decisions on an arm’s-length basis.
  - EU law should introduce a requirement for banks’ credit policies to prescribe Board or senior management approval of credit risk exposures that exceed a certain amount or percentage of a bank’s capital, or are especially risky, or are otherwise not in line with the mainstream of the bank’s activities.
- Principle 18
  - Further convergence between the definitions of defaulted and NPEs and between these and the accounting definition of ‘impaired’ should be promoted.
  - The EU legislation should confirm the ECB powers to require capital deductions in case of mis-classification or under-provisioning of assets from a prudential perspective.
  - Criteria and approaches for adequate write-off should be introduced.
- Principle 19
  - The EU should amend the rules on large exposures to ensure closer alignment with the international standard.
  - Supervisors should address the potential consequences of deviations of the large exposure regime from the international standard in their risk assessments, closely monitoring the risk concentrations that these deviations could incentivize.
  - SIs should obtain LEIs for all supervised entities in their group and regularly use LEIs in reporting and in identifying their corporate clients.
  - A requirement or explicit supervisory expectations should be introduced that all material concentrations be regularly reviewed and reported to a bank’s Board.
  - A more comprehensive framework for the analysis of concentration risk should be adopted, encompassing all forms of risk concentration, beyond those linked to credit risk.
- Principle 20
  - The EU should introduce a harmonized framework for exposures to related parties, compliant with this Core Principle.
- Principle 21
  - The EU should introduce a harmonized framework for country risk, compliant with this Core Principle.
- Principle 22
  - Verification of the adequacy of classification and valuation should be extended to all L2 assets and liabilities.
- Principle 23
  - EU legislation should incorporate the principles of the Basel standard on IRRBB (April 2016).
- Principle 24
  - The EU should conform the rules on LCR to the Basel standard.
  - Assumptions on the outflows of different categories of deposits within given time horizons should be revised, both for the bank’s own and supervisory stress testing, in the light of the circumstances that led to the recent resolution of certain banks.
  - Adequate circulation of relevant information—within the ECB and at national level—between the units in charge of Emergency Liquidity Assistance (ELA) and the JSTs should be ensured for banks experiencing (or likely to experience) liquidity stress.
  - A requirement or explicit supervisory expectations should be introduced for the Board to conduct (at least annually) a regular review and appropriate adjustment of the bank’s strategy, policies and processes for liquidity risk management.
  - Supervisors should conduct separate analyses of liquidity risk strategy and monitoring of liquidity needs for each significant currency and evaluate the bank’s ability to transfer liquidity from one currency to another across jurisdictions and legal entities; supervisory reporting should be integrated accordingly.
- Principle 25
  - IT and cybersecurity risks require more intense supervisory attention.
  - Intra-industry IT/cybersecurity threat incident information sharing mechanisms should be strongly encouraged.
  - Inter-governmental IT/cybersecurity threat information sharing and crisis management mechanisms among ECB banking supervision and Euro Area, EU and global financial regulators should be strengthened and formalized.
  - The ECB, either alone or in conjunction with the EBA, should periodically publish IT/cybersecurity threat best practice guidance gleaned from its supervisory activities and IT industry standard setters.
  - The ECB’s IT/cybersecurity threat recovery planning and crisis management policies and practices should be strengthened and formalized.
  - The ECB should encourage the industry development of data vaults that would permit the storage and recovery of preserved data should a bank suffer an IT/cybersecurity incident.
  - The ECB should strengthen its review of third party vendors and SI due diligence practices in the IT/cybersecurity context.
  - The EU should give the ECB prior approval and notification powers over outsourcing activities, including the power to restrict such outsourcing, to require information from the outsourcing provider and to undertake inspections.
  - The ECB should have sufficient and timely information to consider AML risk in its risk assessments and supervision of banks. Legal barriers to the mandatory exchange of AML information among the ECB and Euro Area AML supervisory authorities should be removed. The ECB should take supervisory measures based on AML-related risk management and operational risk deficiencies (instead of only increasing capital and liquidity requirements).
- Principle 27
  - EU law should include a clear reference to additional supervisory powers for the competent authorities regarding the replacement of an external auditor.
- Principle 28
  - Euro area banks should be required to disclose related party exposures or transactions with related parties as part of their Pillar 3 disclosures.
  - Euro area banks should be required to disclose/report average ratios instead of only end-of period for certain ratios, such as the leverage ratio and LCR.

### Authorities’ Response to the Assessment

- European Central Bank (ECB) — key points
  - The ECB welcomes the IMF assessment and "generally, except on liquidity risk supervision, the ECB concurs with its findings and values the recommendations" as opportunities to improve banking supervision in the Banking Union.
  - The Euro Area FSAP occurred "five years after the IMF performed a financial stability assessment of the European Union, and almost three years after the SSM (SSM) was formally established." The ECB notes the SSM and SRB have reached "full consolidation" and a "truly Euro Area dimension" for supervision and resolution of significant institutions.
  - The ECB appreciates recognition of increased supervisory intensity, intrusive forward-looking risk-based homogeneous supervision, and harmonisation across the SSM; it welcomes the IMF acknowledgment of ECB efforts to streamline decision-making by delegation.
  - Disagreement with BCP24 assessment: the ECB "disagrees with the assessment of BCP24 on Liquidity Risk as Materially Non-Compliant" and considers that assessment "severely misrepresents the intrusiveness, intensiveness, timeliness and efficaciousness" of current supervisory practices.
  - The ECB asserts its supervisory approach monitors liquidity of all significant institutions in a timely and forward-looking manner and increases intrusiveness and engagement when early signs of liquidity deterioration arise; such actions have permitted orderly resolution in some crises without affecting financial stability or requiring public funding.
  - ECB highlights three scope/power issues it deems important:
    - Concurrence that lack of ECB supervisory powers over large branches of non-EU banks ("3rd country branches") entails risks and EU legislative harmonisation is needed.
    - Support for extending ECB supervisory powers to relevant cross-border investment firms carrying out bank-like activities in the Euro Area.
    - Support for retaining the ECB’s agile Pillar 2 power to require banks to hold capital in excess of minima via the SREP; the ECB emphasizes this power includes setting the appropriate level and composition of additional capital.
  - The ECB agrees further harmonization is needed across EU law (e.g., fit-and-proper, authorisation, sanctioning) to ensure a level playing field and effective enforcement; it has called to expand the list of infringements subject to sanctions.
  - On crisis management, the ECB agrees operational guidance should be updated, has an action plan including revisions to crisis procedures/manuals, more explicit recovery planning in crisis identification/management, and further work on early intervention guidance. The ECB and SRB have revised their bilateral MoU to enhance cooperation and information exchange.
  - On supervisory reporting, the ECB agrees the maximum harmonization principle can limit supervisory agility and supports streamlining and expediting the process for amending harmonized supervisory reporting; it stresses Article 10 of the SSMR provides flexibility to address data needs.
  - The ECB supports regular Euro Area FSAPs and close continued engagement with the IMF.

- European Commission — key points
  - The European Commission "welcomes the IMF's comprehensive assessment" and "largely agrees with its findings, with notable exceptions."
  - Disagrees with IMF’s BCP assessment of liquidity risk as "materially non-compliant." Notes the Basel Committee RCAP found the EU implementation of the LCR to be "largely compliant."
  - Argues the IMF assessment may misunderstand EU liquidity regulatory requirements; cites Article 86(1) of CRDIV which "contains all-encompassing requirements" on supervision of liquidity risk, including tailoring to different currencies.
  - Notes the assessment sometimes focuses on ECB tasks without fully accounting for NCAs’ roles under the SSM; the SSM is a system with task allocation and the ECB responsible for overall functioning while NCAs retain some powers (e.g., certain sanctioning powers).
  - Observes the assessment references proposed amendments to CRDIV; the Commission states assessments should be based on adopted rules, not proposals, and that the proposed amendments aim to clarify and harmonize Pillar 2 without limiting existing SSM tools.
  - Indicates powers to impose capital deductions for insufficient provisioning of NPLs are already present in Article 104(1)(d) of CRDIV and notes policy developments such as the "Action Plan To Tackle Non-Performing Loans in Europe" and related proposals and guidance.
  - On supervisory reporting, the Commission defends harmonisation and the explicit legislative flexibility for supplementary data collections as part of Pillar 2 powers.
  - On disclosure practices (e.g., leverage ratio averages vs end-of-period), the Commission states EU rules are "fully in line with the international standards agreed by the Basel Committee."
  - Flags factual inaccuracies in the assessment (e.g., assertion that mixed financial holding companies are not included in the definition of conglomerates), contending such statements are incorrect given FICO Directive and provisions in CRD IV and CRR.

*Source: cr18233 - 29. Abuse of financial services  Not assessed.*

---


_Source: https://www.imf.org/-/media/files/publications/cr/2018/cr18233.pdf_