## 1sweea2023008 ## Source details **Canonical URL:** [1sweea2023008](https://www.imf.org/-/media/files/publications/cr/2023/english/1sweea2023008.pdf) ## Other formats - [Markdown version](/-/media/files/publications/cr/2023/english/1sweea2023008.pdf.md) - [Structured JSON version](/-/media/files/publications/cr/2023/english/1sweea2023008.pdf.json) --- ### Executive summary — recent reforms and supervisory posture - Key legal and regulatory changes since 2016: - Revision to the Capital Requirement Regulation (CRR). - Transposition of European Directives. - Implementation of IFRS 9. - Revised Payment Services Directive (PSD2). - Banking Recovery and Resolution Directive (BRRD). - Finansinspektionen (FI) intends to comply with numerous EBA guidelines and EBA technical standards (including ICT and security management, outsourcing arrangements, and internal governance). EBA technical standards and guidelines are directly applicable in Sweden. - FI issued regulations and general guidelines on: - Management of credit risks; governance, risk management and control; reporting of significant events; measures against ML/TF; activities of payment service providers. - Supervisory assessment outcome highlights: - Supervisory framework broadly aligns with many BCP essential criteria but several important gaps remain. - Principal supervisory shortfalls stem from: gaps in legal/regulatory frameworks; significant resource constraints at FI; weaknesses in supervisory processes and tools (onsite inspection frequency/depth, IRB model approval/monitoring, stress-testing assessment, supervisory reporting quality, and automation). ### Resourcing, governance, independence - Staffing and funding: - Banking section staffing decreased from 165 in 2019 to 136 in 2021. - Staff turnover about 19 percent in 2021. - In 2021, about 84 percent of FI’s total funding was the appropriation from the state budget. - Remaining funding derived from fees charged for voluntary services. - Operational impacts of resource constraints: - Difficulty attracting/retaining senior experts (credit risk model, cybersecurity, governance, stress testing). - Reduced frequency and intrusiveness of onsite inspections; onsite time rarely exceeding 3–4 days. - Delays meeting timelines for approvals of IRB models; approvals and model reviews backlogged. - Limited engagement with high-risk smaller institutions (categories 3 and 4). - Excessive reliance on banks’ internal controls and internal audit for data quality. - Independence and legal protection: - FI is an independent government authority; Director General appointed by government for fixed term. - No explicit legal protection currently provided to FI staff for actions in good faith beyond general tort/state liability framework. - Government appropriation letters create year-to-year budget uncertainty. ### Structure and intensity of FI supervision (categorization, SREP, scope) - Supervisory categorization and SREP frequency: - Category 1 (three largest): quarterly risk review meetings and annual SREP. - Category 2 (next eight largest): semi-annual meetings and biennial SREPs. - Categories 1 and 2 account for approximately 95 percent of total assets for the Swedish banking system (excluding systemic branches of Nordea and Danske Bank). - Category 3: target SREP at least once every three years (historical practice variable). - Category 4: less frequent and more risk based; 2021 simplified SREP aims for ~every three years. - EBA SREP guidelines: SREP should be performed every three years for all category 3 and 4 institutions; FI has deviated due to resource constraints. - Supervisory techniques and tools — key gaps: - No dedicated distinction between onsite and offsite teams; onsite inspections are limited in depth and duration. - Supervisory manuals and procedural documentation insufficiently granular. - Offsite monitoring partially automated (liquidity risk dashboard), but automation limited for other risk types. - FI does not routinely require senior management certification of supervisory returns. ### Model supervision, capital framework and IRB issues - IRB and RWA composition: - Credit risk is the most significant component of RWA. - Credit RWA of the three largest banking groups represent 81.2 percent of their total RWA. - Market risk represents 2.6 percent of total RWA; operational risk represents 8.6 percent of total RWA. - About 80 percent of the credit RWA is calculated using an IRB model (advanced or foundation). - Capital buffers and requirements (as at Q4 2021 for three largest banks): - Minimum capital requirement of 8.0 precent. - Systemic risk buffer (SRB) of 3.0 percent. - Other Systemically Important Institutions (O-SII) buffer of 1.0 percent. - Capital conservation buffer (CCoB) of 2.5 percent. - Pillar 2 requirements between 1.7 percent and 1.9 percent. - Pillar 2 Guidance (P2G) of 1.5 percent. - FI lowered CCyB from 2.5 percent to zero in March 2020; decided CCyB of 1.0 percent in September 2021 to apply from September 2022; FI intends a positive neutral CCyB rate of 2 percent going forward. - IRB model supervision and capacity constraints: - Number of credit risk model experts decreased by 50 percent between 2020 and 2021 (from 12 to 6). - Backlog of almost a hundred IRB-related applications (post-2019 EBA IRB review). - Material instances where IRB model issues led to material underestimation of RWA; EBA benchmarking correction led to a 65% increase in credit risk RWA in one example. - Supervisor assessment of capital (findings): - Sweden applies a conservative stance relative to EU discretions (no insurance consolidation waiver, no extended transitional phase-in, mortgage risk weight floor applied). - Remaining findings from EU RCAP considered not material but supervisory capacity on internal models deemed inadequate. ### Risk management, stress testing and supervisory stress testing - FI assessment practices and gaps: - FI’s risk assessment “handbook” is high level and lacks granular supervisory guidance and direct references to EBA guidance. - Assessment of banks’ internal stress testing does not fully reflect BCBS stress testing principles (2018); FI’s supervisory assessment of internal stress testing is high level with limited detailed testing. - Staffing for internal stress testing assessment very limited; same staff perform P2G calculation. - FI has developed top-down supervisory stress tests that inform P2G. - Key recommendations on stress testing: - Perform thematic deep-dive on banks’ internal stress testing and incorporate EBA guidelines into handbook. - Increase specialist staff for stress-testing oversight. ### Credit risk, provisioning, classification and related supervisory gaps - Regulation and supervisory coverage: - FI issued credit risk management regulation in 2018 (FFFS 2018:16) covering governance, identification, measurement, credit risk assessments, credit decisions, credits with increased risk and credits to related parties. - IFRS 9 is the basis for provisioning; FI has not performed widespread file reviews since IFRS 9 introduction—last credit file reviews for categories 1 and 2 banks were in 2017/2019 for some activities. - Observed weaknesses: - Lack of routine credit file reviews and limited onsite testing reduces ability to challenge asset classification, provisioning adequacy, evergreening, forbearance, collateral valuation and independent review processes. - No specific legal requirement that big, complex or especially risky exposures must be decided by board or senior management. - Country and transfer risk incorporated into credit risk regulation but no structured supervisory SREP/inspection/thematic process for country risk; EU rules treat EU countries differently for country/transfer risk purposes. ### Liquidity, funding, currency and dashboarding - System-level metrics and funding: - Banking sector assets about 300 percent of GDP at end-2021. - Share of covered bonds as a proportion of total liabilities was 15.5 percent at end of Q4 2021. - Deposits share of aggregate funding for deposit-taking institutions above 50 percent (was 42 percent in 2015). - Liquidity requirements and FI Pillar 2 (examples): - LCR implementation differences: Sweden/EU use month-end averages over 12 months vs BCBS daily observations. - FI restricted Swedish covered bonds to maximum 50 percent of total liquidity reserve and 70 percent for other issuers (EU). - FI introduced LCR limits: 100 percent for EUR and USD, 75 percent for other significant currencies including SEK as a P2R. - FI created an automated Liquidity Risk Dashboard (November 2021); liquidity performance measures fully automated in SAS; dashboard approach to be extended to other risk types is recommended. - Supervisory coverage: - LCR and NSFR are binding in Sweden; FI conducts inspections and thematic reviews; FI performed eight liquidity inspections in last five years and has automated tools for liquidity metrics. ### Operational risk, cyber resilience, outsourcing and third-party risk - Focus areas and inspections: - FI prioritized cyber risks, outsourcing, third-party risk and business continuity; 12 operational risk deep-dive inspections in three years; published reports: FI Supervision report 18 (continuity) and report 9 (information and cyber security). - Gaps and recommended initiatives: - No central database to collect information on outsourcing providers — limits FI’s ability to detect common points of exposure. - Recommendation to create a provider database and require notification of significant outsourcing changes/terminations; align approach with forthcoming DORA (implementation timelines noted but not invented). ### Disclosures, external audit and market discipline - Accounting and disclosure standards: - IFRS applied in consolidated financial statements; IFRS 9 fully implemented in 2018. - Pillar 3 disclosure framework implemented via CRR; disclosure standards generally sound but FI has not consistently assessed Pillar 3 data quality. - FI publishes quarterly capital requirements for category 1 and 2 banks and semi-annual market reports and Financial Stability Reports. - External auditor oversight: - FI has no explicit statutory power to reject or rescind an external auditor appointment; FI can (i) report to the Swedish Inspectorate of Auditors, or (ii) file for removal through district court per Companies Act (Chapter 9, Section 22a). - Chapter 13, section 9 BFBA: FI may appoint auditors to participate in audits when needed. - Assessors note value in considering legislative powers to remove auditors and in exploring external auditor involvement in supervisory reporting assurance. ### AML/CFT supervisory findings (Principle 29) - Legal framework and FI responsibilities: - Sweden transposed the fourth and fifth EU AML Directives via the Act on Measures against Money Laundering and Terrorism Financing (2017:630); FI issued detailed regulations (FFFS 2017:11). - FI increased AML/TF supervisory resources; performed 21 AML inspections in last 5 years (11 since 2018). - Gaps and operational observations: - Existing AML periodic supervisory tool lacked granular geographic/transaction volume/customer data — updated questionnaire expected to improve targeting. - Gaps remain in supervision of correspondent banking relationships and employee screening processes; last dedicated correspondent banking onsite inspection concluded in 2015 with follow-ups in 2016/17. - FI imposed major AML fines: examples include a warning and SEK 4 billion fine in one case and a remark with SEK 1 billion fine in another. - Recommendations: - Enhance granularity of AML data collection, target supervision more effectively, reassess correspondent banking risk focus and employee screening supervision. ### Legal, corrective powers, appeals and resolution interface - FI powers and interventions: - Range of corrective measures: orders to limit/reduce risks, injunctions, adverse remarks, warnings, fines, removal/barring of board members/managing director (for 3–10 years), and license revocation. - FI may require specific own funds or liquidity requirements where warranted (Special Supervision Act). - Appeals and legal effects: - FI decisions may be appealed to Administrative Court, then Administrative Court of Appeal and Supreme Administrative Court (leave to appeal required for higher courts). - FI can make orders to take effect immediately (e.g., withdraw license) irrespective of appeal; courts rarely stay execution. - Legal uncertainty from appeals may impede timely supervisory action. - Resolution cooperation: - SNDO is designated resolution authority (Resolution Act 2015); FI reviews recovery plans and consults with SNDO; FI determines FOLF (failing or likely to fail) and consults SNDO and Riksbank; SNDO decides on resolution in public interest. - SNDO’s resolution reserve target: "3 percent of covered deposits." Use of reserve requires European Commission approval for State Aid. ### Quantitative sector metrics (selected exact figures) - Banking sector assets: 1,738 (in billions of USD) — Banks total assets in table. - Total financial sector assets: 3,274.6 (in billions of USD); Assets (in percent of GDP) 550.3. - Banks: Number of Institutions 152; Assets (in percent of GDP) 292.1. - Domestic legal entities: Assets 952; Number of Institutions 97; Assets (in percent of GDP) 160.0. - Foreign banks: Assets 104; Number of Institutions 6; Assets (in percent of GDP) 17.5. - Subsidiaries: Assets 348; Number of Institutions 12; Assets (in percent of GDP) 58.5. - Branches: Assets 220; Number of Institutions 34; Assets (in percent of GDP) 37.0. - State-owned: Assets 114; Number of Institutions 3; Assets (in percent of GDP) 19.2. - Insurance Companies: Assets 494; Number of Institutions 142; Assets (in percent of GDP) 83.0. - Life insurance companies: Assets 412; Number of Institutions 29; Assets (in percent of GDP) 69.2. - Pension Fund Administrators: Assets 513.6; Number of Institutions 42; Assets (in percent of GDP) 86.3. - Total: Assets 3,274.6; Number of Institutions 407; Assets (in percent of GDP) 550.3. - Key banking ratios (period ending Q4 2021): - Capital adequacy ratio (CAR): 23.0 percent. - Return on Asset (ROA): 1.1 percent. - Return on Equity (ROE): 10.7 percent. - Nonperforming loans (NPL) ratio: 0.4 percent. - Mortgage exposure shares: - 28.3 percent of gross loans to residential real estate. - 12.5 percent to Commercial Real Estate (CRE). - Three largest banks’ capital/ buffer example (Q4 2021): - Minimum capital requirement 8.0 precent; SRB 3.0 percent; O-SII 1.0 percent; CCoB 2.5 percent; Pillar 2 between 1.7 percent and 1.9 percent; P2G 1.5 percent. ### Priority recommendations (selected, exact phrasing preserved where numeric) - Financing and resourcing: - MoF should consider further increase in funding to FI to ensure that it is adequately resourced. - Explore medium-term plan to increase FI’s resources with government commitment. - FI should develop strategy for attracting and retaining staff; consider salary surveys and benchmarking. - Explore use of independent external experts for specific supervisory tasks. - Supervisory intrusiveness and tools: - Enhance onsite inspections: more comprehensive onsite exercises, detailed testing of data quality and internal controls, prioritize systemically important banks. - Further automation of offsite monitoring processes and dashboards across risk types. - Develop detailed supervisory manuals and procedural documentation. - Ensure lead supervisors are supported by risk experts (IRB, cyber, stress testing). - IRB/models, stress testing and data quality: - Enhance IRB model review in line with EBA guidelines; implement ongoing monitoring and onsite evaluation of model deployment, PD and LGD testing, and collection of granular model-level data. - Incorporate EBA/BCBS stress testing guidance into FI handbook; perform thematic deep-dive on internal stress testing. - Undertake regular risk-based onsite inspections to assess data validation and banks’ data quality assurance processes. - Consider requiring senior management certification of supervisory returns and explore requiring external auditor opinion on supervisory reporting accuracy. - Governance, licensing and legal powers: - Consider granting FI legal powers to assess fitness and propriety of all members of senior management (not limited to board and managing director). - Consider explicit legal protection for FI staff in line with BCP expectations. - Consider legal changes to enable FI to remove all senior management where necessary and to have clearer powers over external auditors (reject/rescind appointment, access to working papers) and over related-party exposure treatment. - AML/CFT: - Enhance granularity of AML periodic reporting; perform targeted supervision of correspondent banking relationships and staff screening; deepen understanding of ML/TF risks in supervised entities. - Country and transfer risk: - Develop a structured supervisory process for country and transfer risk (SREP, inspections, thematic reviews), given Sweden’s cross-border banking hub role. *Source: IMF staff assessment in the provided chapter content.* ### EXECUTIVE SUMMARY ...................................................................................................... ### EXECUTIVE SUMMARY ### Overview of recent reforms and regulatory changes - Key changes to the legal framework since the 2016 FSAP: - Revision to the Capital Requirement Regulation (CRR). - Transposition of European Directives. - Implementation of International Financial Reporting Standard on Financial Instruments (IFRS 9). - Revised Payment Services Directive (PSD2). - Banking Recovery and Resolution Directive (BRRD). - Finansinspektionen (FI) intends to comply with numerous EBA guidelines and EBA technical standards (including ICT and security management, outsourcing arrangements, and internal governance). EBA technical standards and guidelines are directly applicable in Sweden. ### FI regulations issued since 2016 (summary) - FI issued regulations and general guidelines on: - Management of credit risks. - Governance, risk management and control. - Reporting of significant events. - Measures against money laundering (ML) and terrorist financing (TF). - Activities of payment service providers. - Noted regulatory gaps remain in areas such as country and transfer risk, and related parties. ### Assessment of supervisory framework against Basel Core Principles - The supervisory framework and implementation in Sweden are broadly in line with a number of BCP essential criteria, but several gaps remain. - Primary sources of shortcomings: - Gaps in legal or regulatory frameworks. - Significant resource constraints within the banking supervision function at FI. - Gaps in supervisory processes and tools, notably: - Frequency and depth of onsite inspections of domestic and foreign operations. - Assessment of banks’ stress testing processes. - Approval and ongoing monitoring of banks’ IRB models. - Assessment of the quality of supervisory reporting by banks. - Need for greater automation in monitoring and screening. ### Structure and intensity of FI’s supervision - FI applies a risk-based approach with most resources focused on largest institutions and significant branches. - Supervisory categories and processes: - Category 1 banks (three largest): structured supervisory process with quarterly risk review meetings and annual SREP. - Category 2 banks (next eight largest): semi-annual meetings and biannual SREPs; FI has progressed in structuring supervision for these banks since 2016. - Categories 1 and 2 account for approximately 95 percent of total assets for the Swedish banking system (excluding systemic branches of Nordea and Danske Bank). - Categories 3 and 4 (about 100 institutions): less frequent supervisory reviews. FI’s target historically: SREP for category 3 at least once every three years; category 4 less frequently and more risk based. In 2021 a simplified SREP approach was launched aiming for SREP reviews for categories 3 and 4 about every three years. - EBA SREP guidelines: SREP should be performed every three years for all category 3 and 4 institutions; FI has deviated in the past due to resource constraints. ### Resource constraints at FI - Resource limitation is a major challenge affecting supervision effectiveness. - Key facts: - High turnover: about 19 percent in 2021. - Staffing reduction in banking section: from 165 in 2019 to 136 at end-2021. - In 2021, about 84 percent of FI’s total funding was the appropriation from the state budget. - Remaining funding derived from fees charged for voluntary services; FI disposes income to cover costs of those specific services. - Impact areas: - Difficulty attracting and retaining experienced risk experts, particularly senior credit risk model and cybersecurity experts. - Affected supervisory activities include more intrusive supervision, IRB model approvals, and enhanced cyber-risk supervision. - Supervisory approach and tools impacted: limited engagement with high-risk smaller institutions, excessive reliance on banks’ internal controls and internal audit, lack of intrusiveness in supervision of domestic and foreign operations of systemic firms. - Offsite monitoring, screening tools, and supervisory manuals/procedures need enhancement. ### Recommended initiatives to address resource and supervisory shortcomings - Government consideration: - Increase FI’s financing to align available and required resources. - Explore a range of solutions including a medium-term plan to increase FI’s resources and capacity, supported by government commitment to fund the plan. - FI internal initiatives: - Optimize processes and tools by enhancing offsite monitoring and screening tools. - Further automate processes such as collection and analysis of qualitative data. - Improve internal manuals and procedures to enhance consistency and effectiveness. - Priority supervisory actions contingent on additional resources and legal changes: - Achieve a minimum level of engagement with all supervised entities and set SREP cycles. - Meet minimum baseline requirements for sound supervisory practices per the BCPs. - Reduce the risk of missing significant risks within supervised banks and reduce reactive responses to problems. - Specific priorities: - Further automation of offsite monitoring processes to target supervisory activities and better utilize limited resources. - Phased recruitment and retention of specialized staff in IRB models, cyber risks, and governance. - Enhanced onsite inspections with detailed testing of data quality and internal controls, prioritizing systemically important banks. - Note: Some findings may require new laws to be passed. ### Responsibilities, objectives, powers, independence (summary) - Legal mandate: - FI’s mandate and responsibilities provided by the Financial Supervisory Authority Ordinance Instruction (2009:93). - FI is an integrated authority responsible for supervision, regulation, and licensing of financial markets and institutions and for measures to prevent financial imbalances. - Ordinance requires FI to ensure financial system stability, well-functioning markets meeting households’ and companies’ financial services needs, high level of consumer protection, and contribution to sustainable development. - Potential mandate conflicts: - FI’s multiple objectives (prudential supervision, consumer protection, sustainable development) could potentially conflict (not observed historically). - Example risk: consumer protection measures (e.g., restrictions on foreclosures) could create incentives adversely impacting financial stability. - Recommendation: FI should clarify how it would resolve conflicts between objectives and ensure prudential objectives take priority or are well complemented by other objectives. - Financing framework and operational implications: - In 2021, about 84 percent of FI’s funding was appropriation from the state budget; appropriations are financed by yearly fees paid in retrospect by supervised undertakings. - Budget being part of the government’s annual budget process introduces year-to-year uncertainty that can impact FI’s ability to develop a longer-term supervisory strategy. - State budget allocations have not kept pace with FI’s resource requirements given the size and regional importance of the Swedish financial system, emerging risks and vulnerabilities, new mandates (macroprudential policy and sustainable development), and evolving financial and regulatory landscape. _Executive Summary (selected extracts) — 1sweea2023008 - EXECUTIVE SUMMARY_ ### 12. Resourcing continues to be a major challenge for FI, particularly in the face of high ### 1sweea2023008 - 12. Resourcing continues to be a major challenge for FI, particularly in the face of high ### Resourcing and staffing constraints - Current staffing at FI is described as inadequate to achieve an acceptable minimum level of supervision of domestic and cross-border operations of Swedish banks. - Staffing level in the Banking section decreased from 165 in 2019 to 136 in 2021. - Turnover has generally been high at about 19 percent, with most staff leaving FI for employment in the regulated credit institutions where salaries are often much higher. - Decrease in staff concentrated mostly within the categories of risk experts and lawyers. - FI faces challenges in attracting and retaining senior technical experts, particularly those with expertise in: - supervision of credit risk models, - cyber security-related risk, - governance, - stress testing. - Operational allocation of resources may differ between years depending on risks identified during the year. ### Impacts on supervisory activities and intrusiveness - Resource constraints have led to: - reduced frequency and intrusiveness of onsite inspections; - challenges meeting timelines related to approval of IRB models; - difficulty achieving target minimum engagement with smaller institutions in categories 3 and 4; - investigations taking longer due to inability to allocate more resources. - Time spent onsite by supervisors is noted as varying but rarely exceeding 3–4 days, which is inadequate for detailed evaluations such as: - effectiveness of banks’ internal controls, - reliability of supervisory reporting data, - quality of Pillar 1 credit risk model deployment, - effectiveness of stress testing processes and methodologies, - consistency in classification of exposures, - adequacy of loan loss provisioning. - The SREP process is, in a number of instances, high level; assessment of internal stress testing does not involve detailed testing. - IRB onsite inspections in the last five years (five in total) involved review of internal governance, validation function, banks’ change policies, and banks’ modeling approaches. ### Model supervision and data quality - Current monitoring of internal credit risk models is done through the SREP, risk review meetings, and EBA exercises. - Recommendations to enhance IRB model supervision: - introduce a more comprehensive offsite monitoring and onsite testing process; - undertake detailed testing of specific risk parameters such as Probability of Default (PD) and Loss Given Default (LGD); - collect and analyze granular model-level data from banks; - onsite evaluation of quality of deployment of approved IRB models, including assignment of exposures to specific regulatory approved IRB models, calculation of Risk Weighted Assets (RWAs), and review of banks’ data management and model governance arrangements. - Significant reliance on banks’ internal controls and internal audit for data quality and information; FI does not typically carry out regular onsite examination to assess how the data reported by banks is validated. - Where FI has reason to believe there may be data-quality issues, more in-depth supervision may be considered in line with a risk-based approach. - Authorities could explore requiring independent external auditors to provide an opinion on the accuracy of credit institutions’ supervisory returns. ### Supervisory approach, consistency, and offsite tools - Banking operational section comprises five departments: Banking Supervision, Bank Analysis and Policy, Financial Risks, Operational Risk, and Bank Law. - Minimum level and type of engagement driven predominantly by firm category based on systemic importance; risk ranking of individual institutions is not usually a factor in determining the SREP cycle except for a recently introduced list of institutions selected for intensified frequent assessments. - Limited consideration of risk profiles in determining supervisory cycle could adversely impact timeliness of supervisory action for high-risk institutions. - Inconsistencies in assessment and formulation of supervisory actions attributed to limited number of risk experts; staff changes have in one instance led to a change in regulatory approach and intrusiveness. - Suggested actions: - introduce a list of objective criteria to identify institutions subject to higher frequency of SREP or formalize the role of the intensified-assessment list in informing the SREP cycle. - Offsite monitoring could be enhanced by implementing more efficient analytical tools and dashboards: - FI has fully automated generation of performance measures for liquidity risk, producing a risk dashboard and trend/peer comparison reports; - extend this more developed dashboard approach to other risk types to facilitate supervisory monitoring and benchmarking; - fully automate analysis of information collected for supervisory exercises (e.g., Quarterly Risk Reviews) to enable more efficient screening and targeted reviews. - Consider extending use of self-assessment questionnaires to other risk areas to aid prioritization and deepen risk-based supervision. ### Legal protection, appropriation letters, and corrective powers - No explicit legal protection currently provided to FI or its staff against liability for actions and omissions in discharging their duties in good faith. - Swedish tort law provides protection to employees; the state is generally liable for damages caused by errors or omission of their employees in the exercise of public authority. - Assessors note the potential future need to explore explicit legal protection for FI and its staff given emergence of nontraditional financial institutions more willing to challenge regulatory decisions and seek damages. - Annual appropriation letters from the government contain specific tasks and objectives for FI and could potentially impact FI’s ability to set priorities, allocate resources, and establish a long-term supervisory strategy if tasks become burdensome or resource-intensive; letters reviewed required minimal resource commitment by FI but can be amended during the year, introducing uncertainty. - Limitations in FI’s corrective and remedial powers: - Swedish Company Law does not recognize “senior management” as a legal body; FI can remove or bar an individual from the board or position of managing director but does not have the power to remove all members of senior management. - More direct intervention powers, including ability to remove senior management, could be more efficient and lead to timelier outcomes. - Formulation of corrective actions should be enhanced to ensure clarity and targeting of root causes, which may require detailed onsite testing or in-depth review of governance, data management processes, and infrastructure. - FI has two internal procedural documents to guide intervention and sanction processes: - intervention process for handling cases that may lead to supervisory measures or intervention against a legal or natural person; - sanction procedures to be applied in cases that may lead to sanctions such as a remark, warnings, penalties, or withdrawal of authorizations. *Source: IMF staff assessment in the provided chapter content.* ### 26. The regulatory decisions by FI can be appealed to the administrative courts. The right ### 26. The regulatory decisions by FI can be appealed to the administrative courts. The right ### Appeals and legal effects on supervision - FI’s regulatory decisions, including sanctions and other forms of intervention (e.g., an order to rectify), can be appealed to the Administrative Court. - Further appeal can be made to the Administrative Court of Appeal and the Supreme Administrative Court. - If appealed, FI’s decisions are subjected to a comprehensive review by the court; the court can disagree in matters of fact and in matters of law. - FI can decide that an order to rectify a situation and a decision to withdraw a license come into effect immediately, irrespective of appeal. - If such a decision is appealed, the court must decide to stay the execution for the decision by FI not to come into effect until the court has made its determination; the possibility to have execution stayed is set at a high threshold and is rarely obtained. - For other decisions, such as warnings and remarks, there is legal uncertainty until the court has finally determined the appealed decision. - A decision on leave to appeal is required for a review in substance by the Administrative Court of Appeal and the Supreme Administrative Court. - The legal uncertainty created by appeal rights could impede effective supervision, allow claimants to delay FI interventions, and may reduce FI’s incentives to exercise some intervention powers. ### Corporate governance and internal audit (CP 14, 26) - FI regulation added a definition of senior management since the last FSAP in 2011, but: - FI regulation does not entail management functions responsibilities for others than the board of directors and the managing director. - “Senior management” is not a legal body under Swedish Company Law. - FI’s regulation defines senior management as “the managing director, the deputy managing director and other members of the management group or a similar body that report directly to the board of directors or the managing director,” and outlines the board of directors’ oversight function and managing director’s executive function. - The definition affects remuneration practices and composition of the risk committee but does not clearly implement responsibilities for day-to-day management beyond board and managing director. - Impacts: - The absence of a Company Law concept of “senior management” affected supervisory processes including suitability assessment in licensing, corrective actions, ability to sanction all members of a bank’s senior management, and assessment of corporate governance, risk management practices, specific-risks provisions. ### Capital (CP 16) — structure and requirements - Credit risk is the most significant component of RWA; most credit RWA is calculated based on an IRB model. - The credit RWA of the three largest banking groups in Sweden represent 81.2 percent of their total RWA. - Market risk represents 2.6 percent of total RWA; operational risk represents 8.6 percent of total RWA. - About 80 percent of the credit RWA is calculated using an IRB model (advanced or foundation). - As at fourth quarter 2021, the three largest banks were required to maintain: - minimum capital requirement of 8.0 precent, - systemic risk buffer (SRB) of 3.0 percent, - Other Systemically Important Institutions (O-SII) buffer of 1.0 percent, - capital conservation buffer (CCoB) of 2.5 percent and - Pillar 2 requirements between 1.7 percent and 1.9 percent. - FI lowered the countercyclical buffer (CCyB) from 2.5 percent to zero percent in March 2020 in response to the COVID pandemic. - A CCyB rate of 1.0 percent was decided in September 2021, and will be applied from September 2022. - As at fourth quarter 2021, the three largest banks were also subject to a Pillar 2 Guidance (P2G) of 1.5 percent. ### Supervision of IRB models and staffing - Shortcomings exist in supervision of IRB models used to calculate RWAs. - FI has faced challenges retaining internal model experts; staffing has been affected by substantial turnover driven by competition from the private sector since the EBA review of the IRB approach started in 2019. - Example: the number of credit risk model experts decreased by 50 percent between 2020 and 2021 (from 12 to only 6). - Consequences: - FI’s capacity to continuously review banks’ IRB models, and to approve new models or material changes in an effective and timely manner has been significantly impaired. - There have been cases where issues in IRB models not detected and addressed by FI in a timely manner led to material underestimation of RWA. ### Alignment with international standards - The capital framework in Sweden is more in line with BCBS standards compared to the EU because Sweden does not use all discretions available in the CRR. - Examples: - Sweden has not exercised the waiver applicable to the consolidation of insurance companies. - Sweden has not used the extended transitional phase-in, and applies a risk weight floor to mortgage exposures. - Remaining findings from EU RCAP still hold but are considered not to be material. ### Risk management (CPs 15, 17–25) - Sweden improved supervision of risk management practices since last FSAP, but material issues remain. - FI’s capacity to assess quality of credit institutions’ risk management processes, internal controls, and alignment with regulatory requirements is limited. - Risk assessment methodology (“handbook”) should be more granular and comprehensive: - Current assessment methods lack adequate detail and do not clearly specify how supervisors should assess particular risks or control functions. - Handbook does not make direct reference to provisions of EBA guidelines. - Shortcomings could lead to inconsistencies between supervisors, less intrusive supervision, and longer assessments. - Suggested two-step approach: first increase precision to achieve consistency; second enhance comprehensiveness and depth to increase intrusiveness. ### Internal stress testing and supervisory stress testing - Notable gaps in supervisory assessment of banks’ internal stress testing processes and methodologies. - FI’s assessment does not fully reflect BCBS stress testing principles (2018); does not properly assess if stress testing is used as a risk management tool to inform business decisions. - Handbook does not fully capture stress test analysis or supervisory assessment of end-to-end stress testing. - Staffing for internal stress testing and assessment is very limited; same staff also perform calculation of P2G. - FI has developed top-down supervisory stress tests that inform the P2G, reducing perceived need for intrusive examination of banks’ internal stress tests. - Risks of current approach: - In-house stress test expertise within banks may weaken. - Banks may under-invest in internal tools if supervisors rely primarily on their own techniques. ### Credit risk supervision, provisioning, and regulation gaps - Supervisory activity on credit risk, problem assets, and provisioning impacted by lack of intrusive supervision. - Credit risk expert team has broad responsibilities with limited staff. - Supervisory process relies on supervisory expertise and internal control reports; does not regularly review credit files due to resource constraints. - Lack of detailed file review impedes challenge of classification of exposures and provisioning practices (e.g., evergreening, forborne exposures, collateral valuation, independent reviews). - FI issued regulation on credit risk management in 2018 covering governance, identification, measurement, credit risk assessments, credit decisions, credits with increased risk, and credits to related parties; and general guidelines on consumer credit. - Remaining gaps: - No specific requirement that big, complex, or especially risky exposures be decided by board or senior management. - No specific FI power to impose limits for exposures to related parties, deduct such exposures from capital when assessing capital adequacy, or require collateralization. - Assessors did not find evidence that FI fully assesses compliance with EBA Guidelines on renewing/refinancing existing exposures, approval of new exposures, or requirement for an independent review function on the credit risk rating process. ### Country and transfer risk, market risk, IRRBB, and liquidity - Country and transfer risk were incorporated into credit risk regulation since last FSAP, but no structured supervisory process (SREP, inspections, thematic reviews) targets country risk as BCPs require. - EU regulations do not consider EU countries as third countries for country- and transfer-risk perspectives. - FI has not issued specific regulation on market risk and IRRBB other than current EU regulation; uses general national banking laws to address market risk at a high level. - FI published methodology for assessing P2R for IRRBB to identify, measure, and capitalize risk exposure in SREP. - Lack of detailed regulation has caused issues (e.g., trading vs. banking book boundary), expected to be addressed in 2025 when EU implements FRTB. - LCR in Sweden is less stringent than Basel Standards but introduces single currency requirements: - HQLA definition in Sweden and the EU includes covered bonds to a larger extent than BCBS HQLA requirements. - FI restricted covered bonds from Swedish issuers to a maximum of 50 percent of the total liquidity reserve and 70 percent from other issuers, as in the EU regulation. - BCBS disclosure standards are based on daily observations for LCR; Sweden and the EU use month-end observations over the 12 months preceding the end of each quarter. - To minimize LCR currency mismatch, FI introduced an LCR limit of 100 percent for EUR and USD and 75 percent for other significant currencies, including SEK, as a P2R. ### Operational risk, cyber, outsourcing, and supervisory tools - FI focused on cyber risks, outsourcing, third-party risk, and business continuity plans during the last five years, but more is needed. - Some supervisory reports illustrate FI’s deep-dive analysis of banks’ operational risk management practices. - Creation of a database to collect information on outsourcing providers would improve supervision of outsourcing. ### Disclosures and transparency (CPs 27–28) - Law does not explicitly grant FI the power to reject or rescind appointment of an external auditor; FI is not the competent authority for auditor supervision. - FI has two formal possibilities to initiate removal of an external auditor: - Report issue to the Swedish Inspectorate of Auditors, which will assess the issue. - File for removal of the external auditor through the district court in accordance with Companies Act (Chapter 9, Section 22a). - FI can also often achieve removal by pressuring a credit institution’s board; explicit power grounded in legislation would help speed up removal when needed. - Pillar 3 disclosures: - FI has not properly assessed Pillar 3 disclosures, despite using them in some supervisory activities. - Disclosure standards in Sweden are generally sound, but Pillar 3 may need assessment to ensure reported data quality and to enhance consistency in disclosures. ### Abuse of financial services, AML/CFT (CP 29) - Sweden transposed the fourth and fifth EU AML Directives into local legislation through the Act on Measures against Money Laundering (ML) and Terrorism Financing (TF); FI issued more detailed regulations on ML and TF. - FI increased supervisory resources for ML/TF risks in banks, but gaps remain in AML/CFT supervision, particularly in targeting supervision of ML/TF risks. - One supervisory tool focused mainly on inherent risks did not collect sufficiently granular information on geographic exposure, volume or value of transactions or customers, or banks’ control environment to assess residual risk and MF/TF risks. - This tool is one of several parts of FI’s risk-identification process; deficiencies are mitigated by other measures and information at FI’s disposal. - The AML periodic reporting questionnaire has been updated to address identified gaps; once fully implemented it should lead to more targeted and effective AML supervision by FI. - Gaps also exist in supervision of correspondent banking relationships and in banks’ employee screening processes, which have not been a focus of recent AML/CFT inspections in the banking sector. *Source: 1sweea2023008 (provided content).* ### 43. This assessment of the implementation of the BCPs by FI is part of the FSAP ### 1sweea2023008 - 43. This assessment of the implementation of the BCPs by FI is part of the FSAP ### Scope and timing of the assessment - The assessment is part of the Financial Sector Assessment Program (FSAP) undertaken by the International Monetary Fund (IMF) in 2022. - The BCP assessment mission took place between March 14 and April 5, 2022. - The assessment reflects the regulatory and supervisory framework in place as of the date of completion of the assessment. - It is not intended to represent an analysis of the state of the banking sector or crisis management framework, which are addressed in the broader FSAP exercise. ### Assessment methodology and standards applied - The assessment is based on the 2012 version of the Basel Core Principles (BCPs) issued by the Basel Committee on Banking Supervision (BCBS). - Sweden opted to be assessed and graded against both the essential and additional criteria (highest standards of supervision and regulation). - The BCP Methodology uses essential criteria (EC) and additional criteria (AC): - Essential criteria set out the minimum baseline requirements and are universally applicable. - Additional criteria are recommended best practices for more complex financial systems and are optional to be assessed. - Compliance with each Core Principle (CP) is judged qualitatively using a five-part rating system: - compliant - largely compliant - materially noncompliant - noncompliant - non-applicable - Ratings definitions (verbatim from the assessment): - "Compliant" — all the essential and additional criteria are met without any significant deficiencies, including instances where the principle has been achieved by other means. - "Largely compliant" — only minor shortcomings observed that do not raise concerns about the authority’s ability and clear intent to achieve full compliance within a prescribed period; system does not meet all EC and AC but overall effectiveness is sufficiently good and no material risks are left unaddressed. - "Materially noncompliant" — severe shortcomings despite existence of formal rules and procedures; evidence that supervision has clearly been ineffective or shortcomings raise doubts about ability to achieve compliance. - "Noncompliant" — not substantially implemented; several essential criteria are not complied with, or supervision is manifestly ineffective. - "Non-applicable" — criteria do not relate to the country’s circumstances. - The assessment adopts a proportionate approach: supervisory expectations and standards are to be commensurate with the complexity, interconnectedness, size, risk profile, and cross-border operations of the banks being supervised. - The assessment is qualitative and judgment-based; the number of criteria complied with is not always an indication of the overall compliance grade. Emphasis is placed on the commentary accompanying each grade. ### Materials reviewed and cooperation - Assessors reviewed the framework of laws, regulations, procedures, guidelines, and other materials mainly provided by Finansinspektionen (FI). - Assessors held extensive meetings with FI officials and additional meetings with select banks, external audit firms, and the Swedish National Debt Office (SNDO). - Authorities provided a BCP self-assessment, responses to additional questionnaires, and access to supervisory documents, files, staff, and supervisory systems. - Assessors noted and appreciated the "excellent cooperation" received from the authorities. ### Institutional framework for regulation and supervision (Sweden) - FI is a full-scope supervisory authority under the government (in practice, Ministry of Finance (MoF)) responsible for supervision of the whole financial system in Sweden, including consumer protection and AML supervision. - In December 2017 legislative changes widened FI’s macroprudential toolkit; these entered into force in February 2018 and strengthened FI’s legal mandate to take measures to counteract financial imbalances on the credit market (e.g., household indebtedness). - The law requires FI to obtain the government’s consent before any new regulations are adopted when measures may have macroeconomic impacts or affect private individuals’ finances. - FI supervises more than 2,000 entities, including: banks, credit companies, limited insurance companies (life and non-life), occupational retirement provision undertakings, mutual benefit societies, pension foundations, insurance intermediaries, stock exchanges, trading venues, central securities depositories (CSD), and clearing firms (some CCPs). - Self-regulation plays a minor role in Swedish financial markets; there are no active formal self-regulatory organizations for banks in Sweden. - FI’s Banking Department supervises banks and bank-like institutions, specialized nonbank lenders, and payment and e-money institutions. - As at end-2021: - Banks: 100 domestic banks (3 are state owned), 6 foreign banks, 12 subsidiaries, and 34 branches of foreign banks. - Active payment institutions: about 50. - Active e-money institutions: about 5. - Exemptions and lighter requirements: - Some marginal activities are subject to lighter requirements where registration with FI is sufficient and no effective supervision is carried out (examples provided verbatim): (i) professional trading of bank notes, coins, and traveler’s cheques issued in a foreign currency (foreign currency exchange); and (ii) "other financial operations" as set out in the Banking and Financing Business Act, which includes but is not limited to: granting and brokering loans (e.g., consumer credit and loans secured by charges over real property or claims); participating in financing (e.g., by acquiring claims and leasing personal property). Offering for sale cryptocurrencies and digital currencies that are used as a means of payment is considered to be other financial operations. ### Overview of the banking sector: structure, concentration, and funding - The Swedish financial system is large and highly concentrated. - Banking sector assets were about 300 percent of GDP at end-2021. - The five largest banks accounted for over 75 percent of deposits and lending. - Large banks account for about 75 percent of total mortgage lending; mortgages constitute about 50 percent of these banks’ lending portfolios in general. - Share of covered bonds as a proportion of total liabilities was 15.5 percent at the end of Q4 2021. - Table 1 (selected figures as provided): - Banks: Assets 1,738 (in billions of USD); Number of Institutions 152; Assets (in percent of GDP) 292.1 - Domestic legal entities: Assets 952; Number of Institutions 97; Assets (in percent of GDP) 160.0 - Foreign banks: Assets 104; Number of Institutions 6; Assets (in percent of GDP) 17.5 - Subsidiaries: Assets 348; Number of Institutions 12; Assets (in percent of GDP) 58.5 - Branches: Assets 220; Number of Institutions 34; Assets (in percent of GDP) 37.0 - State-owned: Assets 114; Number of Institutions 3; Assets (in percent of GDP) 19.2 - Insurance Companies: Assets 494; Number of Institutions 142; Assets (in percent of GDP) 83.0 - Life insurance companies: Assets 412; Number of Institutions 29; Assets (in percent of GDP) 69.2 - Non-life insurance companies: Assets 83; Number of Institutions 113; Assets (in percent of GDP) 13.9 - Pension Fund Administrators: Assets 513.6; Number of Institutions 42; Assets (in percent of GDP) 86.3 - Other Fund Administrators: Assets 529; Number of Institutions 71; Assets (in percent of GDP) 88.9 - Total: Assets 3,274.6; Number of Institutions 407; Assets (in percent of GDP) 550.3 - Data sources: FI. - Concentration specifics: - Three large domestic banks with extensive reach across the Nordic-Baltic region: SEB, Handelsbanken (SHB), and Swedbank. - Two systemically important branches of large Nordic banks: Nordea and Danske Bank. - Collectively the five banks account for about 75 percent of lending to Swedish households and corporates (or 55 percent counting only the three Swedish banks). - Nordea changed its domicile from Sweden to Finland in 2018. - Total banking sector composition: about 100 domestic banks and 34 branches of foreign banks. - About 110 payment service providers are supervised by FI (not formally banks). - Interconnectedness and systemic risk: - Major banks are highly interconnected, with significant ownership of one another’s covered bonds and similar exposures to certain industries. - Strong links exist to other financial market agents in Sweden and abroad (investors in bank-issued securities). - System structure implies problems in one bank can quickly spread to others and to markets, affecting confidence and arising from issues in earnings, funding capacity, money laundering incidents, or cyber-attacks. ### Funding, investors, and market shares - Large Swedish banks rely substantially on market funding, primarily through covered bonds. - Deposits as a share of aggregate funding for all deposit-taking institutions has been growing and is now above 50 percent (was 42 percent in 2015). - Swedish households allocate significant savings to pensions, insurance, and mutual funds rather than large deposit balances. - Insurance companies and state pension funds hold 22 percent and 8 percent, respectively, of outstanding Swedish bonds. - Foreign investors hold about one-fifth of outstanding Swedish SEK-denominated bonds, equivalent to more than 17 percent of GDP. - Swedish covered bonds are issued in SEK and foreign currencies (primarily dollars and euros, typically hedged through FX swaps); underlying mortgages are SEK-denominated. ### Profitability, capitalization, and asset quality - Swedish banks are generally profitable and well capitalized compared to European peers. - For the period ending Q4 2021 (verbatim metrics): - Capital adequacy ratio (CAR): 23.0 percent. - Return on Asset (ROA): 1.1 percent. - Return on Equity (ROE): 10.7 percent. - Nonperforming loans (NPL) ratio: 0.4 percent. - The banking sector is highly concentrated in the real estate sector: - 28.3 percent of gross loans being to the residential real estate. - 12.5 percent to the Commercial Real Estate (CRE). ### Prudential requirements and macroprudential policy by FI - FI has introduced Pillar 2 requirements considering: - flow-back risk associated with securitization; - pension risk; - interest rate risk and additional market risk; - risks related to Commercial Real Estate (CRE) lending; - credit-related concentration risk and risk weights for exposures to corporates. - Buffers and timing (verbatim measures and dates): - Systemic risk buffer: 3 percent. - O-SIIs buffer: 1 percent. - Countercyclical capital buffer (CCyB) of 1 percent from September 29, 2022. - FI aims to raise the CCyB to 2 percent in 2022, conditional on economic recovery, low credit losses, and banks’ capacity to meet nonfinancial firms’ demand for credit. - FI introduced a Pillar 2 guidance communicated to banks based on stress tests and quantitative and qualitative analysis. - Historical CCyB actions (verbatim): - FI applied a CCyB of 2.5 percent from September 2019. - FI lowered the CCyB to zero in March 2020 in response to the COVID-19 pandemic. - In September 2021, FI decided to raise the CCyB rate to 1 percent to be applied from September 29, 2022. - FI has manifested that it will apply a CCyB positive neutral rate of 2 percent going forward, to ensure the possibility of freeing up capital for Swedish banks during a crisis. ### Risk concentrations and supervisory responses - The Swedish banking sector remains highly exposed to the residential real estate market. - Concern regarding IRB model adequacy: - Given a long period of low loss levels, IRB-approved banks’ models may not generate sufficient capital to fully capture unexpected credit losses if those were to crystallize. - Regulatory response for mortgages: - FI decided in 2013 to apply a risk weight floor for Swedish mortgages in Pillar 2. - The floor was first set at 15 percent, then raised to 25 percent. - In August 2018 the decision was made to implement the floor in Pillar 1 rather than Pillar 2; this came into force on December 31, 2018 for a period of two years. - In 2020, FI assessed that the underlying risks necessitating the risk weight floor remained and that the measure continued to be necessary. - FI will reassess the floor in December 2023. - The limited data on credit losses affects the estimation of Expected Credit Losses (ECL) under IFRS 9. *Source: IMF FSAP BCP assessment (assessment mission March 14–April 5, 2022; assessment based on the 2012 Basel Core Principles).* ### 63. Prior to the onset of the COVID pandemic, Sweden had been on a positive growth in ### 1sweea2023008 - 63. Prior to the onset of the COVID pandemic, Sweden had been on a positive growth in ### Economic performance and innovation capacity - Sweden recorded positive GDP growth "between 1.2 percent and 4.5 percent since 2013." - Growth drivers: - Highly competitive, trade-dependent economy. - Robust institutional and regulatory framework providing stability and predictability. - Investment in Research and Development (R&D) sustaining a competitive edge in knowledge-intensive sectors. - R&D indicators where Sweden ranks highly: public and private spending per capita, number of researchers, number of patent applications, and intellectual ownership licenses. ### Fiscal position and macro-financial resilience - Prudent fiscal policy has kept public debt on a downward trend: "35 percent of GDP." - Earlier tightening of macroprudential policies and a well-capitalized financial sector positioned the economy to better withstand the COVID-19 shock. - Remaining financial vulnerabilities: relatively high household debt and exposure to CRE (commercial real estate). - Structural features that mitigated COVID fallout: - High share of jobs that can be performed from home. - Small hospitality sector. - Buoyant pharmaceutical and machinery exports. - Policy note: these factors contributed to the pandemic fallout being relatively smaller compared to peers. ### Framework for financial stability policy formulation - Shared responsibilities among the Ministry of Finance (MoF), the Financial Supervisory Authority (FI), the Riksbank, and the Swedish National Debt Office (SNDO). - MoF: overall responsibility for designing the framework and primary legislation. - FI: authority responsible for macroprudential policy; publishes Financial Stability Report half yearly. - SNDO: resolution authority, designated deposit insurer, responsible for precautionary government support; can wind up or restructure failing credit institutions while maintaining critical functions. - Riksbank: prevents crises via analysis and communication, maintains crisis management tools, and ensures a central payment system; publishes Financial Stability Report half yearly. ### Macroprudential and borrower-based regulation - 2017 regulation amendment (effective February 2018) strengthened FI’s legal mandate to reduce household indebtedness risks. - New requirement: credit and mortgage institutions must operate in ways that do not create financial instability in the credit market. - Clarified that Loan-to-Value (LTV) and Loan-to-Income (LTI) amortization requirements apply to mortgage institutions. - Dual decision-making governance for measures expected to directly affect households: - FI must obtain government consent before introducing measures with macroeconomic or household financial impact. - FI submits a public proposal; government can accept or reject but not amend; decision is public. - Dual decision-making does not apply to capital-based or risk-weight measures. ### Institutional coordination and Financial Stability Council (FSC) - Agencies cooperate via the FSC chaired by the Minister for Financial Markets; members include the Governor of the Riksbank, Director General of FI, and Director General of SNDO. - FSC meets normally twice a year; can meet more frequently during crises. - FSC is not a decision-making body; each authority acts within its mandate and decides independently. ### Legal, business, and financial infrastructure - Judiciary: civil law system; independence of courts established in the constitution; general courts and general administrative courts handle criminal/civil and public administration cases respectively. - Business laws: robust corporate, bankruptcy, contract, consumer protection, and private property laws; domestic financial sector legislation largely derived from EU regulations and directives. - Accounting and audit: Sweden has implemented International Financial Reporting Standards (IFRS); FI issues standards for financial companies and requires IFRS in consolidated financial statements for all credit institutions and financial holding companies. - Payments and clearing: - Well-developed financial infrastructure. - Securities settlement functioning well but needs better harmonization with the EU. - Well-functioning local CCPs. - Riksbank provides payments infrastructure (RTGS) and oversees financial market infrastructure. ### Crisis management, recovery, and resolution - Four key authorities: government (MoF) overall crisis management; FI supervises and counters imbalances; SNDO handles resolution, deposit guarantee, and precautionary support; Riksbank ensures payment system and provides liquidity if stability is threatened. - SNDO designated resolution authority under the Resolution Act of 2015; BRRD transposed into Swedish law via the Resolution Act, Resolution Ordinance, and Banking and Financing Business Act. - SNDO powers: assume control of failing institutions, use resolution tools, resolution planning, ensure resolvability, decide on MREL, monitor compliance, address MREL shortfalls. - Recovery and resolution planning: - FI responsible for peacetime recovery planning; SNDO responsible for resolution plans. - Assessment of recovery plans for systemically important institutions carried out by FI in consultation with SNDO and, for the largest banks, the Riksbank. - Frequency: systemically important institutions—yearly or after extraordinary events; simplified-obligation institutions—bi-annually. - Implementation gaps: - Detailed policies and procedures for effective implementation of the Resolution Act are still being developed (contingency plans for prompt control, funding in resolution, FSC coordination). - SNDO has not fully specified all details of resolvability assessment. - March 2022: SNDO issued a guidance document based on EBA guidelines to assist banks in interpreting and applying parts of those guidelines. ### Public safety net and liquidity support - Deposit guarantee: - Administered by SNDO as designated deposit insurer under the Deposit Guarantee Act. - Covers all accounts except pension accounts. - Compensation: up to "SEK 1,050,000 per person per institution." - Swedish Act transposes Directive 2014/49/EU. - Riksbank as lender of last resort: - Statutory function to supply liquidity to the banking system in normal times and crises. - Tools include liquidity to support specific banks or more general measures (loans at longer maturities or in currencies other than Swedish kronor). - SNDO liquidity and resolution funding: - SNDO can provide liquidity support in resolution to institutions, subsidiaries, bridge institutions, or asset management vehicles. - Support can be guarantees and loans, flexible in currency and duration, and without collateral. - Funding via the Resolution Reserve (a notional account with SNDO). - All use of the reserve requires European Commission approval per Competition Policy for State Aid. - Resolution reserve target level: "3 percent of covered deposits." Once target reached, resolution fees cease; fees resume if reserve falls below target. - SNDO can provide temporary liquidity assistance to viable credit institutions to counteract serious disturbances; such precautionary support requires government and European Commission approval. ### Market discipline, transparency, and public disclosure - Principle of disclosure and transparency is well established. - Banking transparency supported by "Pillar 3" disclosure framework implemented via CRR. - FI policy: disclose as much information as possible without harming firms’ competitive positions. - FI publishes quarterly capital requirements of banks in supervisory categories 1 and 2 (including pillar 2 guidance). - FI publishes semi-annual reports on the Swedish banking market with statistics by business model category. - Since 2021, FI publicly announces when an inspection is opened or concluded, naming the company and topic. - FI and the Riksbank publish semi-annual Financial Stability Reports. - Public governance transparency governed by the Public Access to Information and Secrecy Act; as a rule, information from authorities is publicly disclosable upon request. - FSC minutes are made public. ### Detailed assessment — supervisory powers, responsibilities, and functions (Principle 1) - Legal and institutional framework: - FI is an integrated authority responsible for prudential supervision, AML/CFT, and consumer protection. - Specific responsibilities set out in the Financial Supervisory Authority Instruction Ordinance (2009:93) and publicly disclosed on FI website. - Section 1 of the Ordinance lists FI responsibilities: 1. "The supervision, regulation and licensing of financial markets and financial institutions, and" 2. "measures to prevent financial imbalances with the aim of stabilizing the credit market, while considering the impact of these measures on economic development." - Section 2 requires FI to ensure the financial system: - "is stable and characterized by well-functioning markets that meet households and companies' needs for financial services;" - "provides a high level of consumer protection;" and - "contributes to a sustainable development." - Statutory powers and designations: - Banking and Financing Business Act (SFS 2004:297) Section 2 of Chapter 13 grants FI power to supervise credit institutions and foreign branches in Sweden. - Credit Institutions and Securities Companies (Special Supervision) Act (SFS 2014:968) designates FI as competent authority pursuant to the Prudential Requirements Regulation [Capital Requirements Regulation (EU/575/2013)] and grants supervisory powers. - FI is a designated responsible authority pursuant to Articles 124, 164 and 458 of the Capital Requirements Regulation. - Operational and governance notes: - FI expected to ensure regulations and procedures are cost-effective and understandable. - Government issues annual appropriation letters to FI setting responsibilities and objectives; appropriation letters are publicly disclosed. - 2022 appropriation letter included an objective for FI to strengthen consumer standing through popular financial education. - Primary objective and mandate interactions: - FI primary objective: promote safety and soundness of banks and the financial system (Sections 1 and 2 of the Ordinance). - Additional mandates (consumer protection, sustainable development) are subordinate and should not conflict with primary objective. - Assessors note potential for future conflicts between financial stability and sustainability objectives; recommend considering segregation of responsibilities and safeguards to manage potential conflicts. - Prudential powers: - CRR (EU/575/2013) sets minimum prudential standards on capital and liquidity. - Under the Special Supervision Act, FI is empowered to supervise compliance with CRR and to require credit institutions to hold additional own funds to cover excessive leverage and other risks. - Powers to impose specific own funds requirements apply where justified by risk profile and systemic importance. *1sweea2023008 - 63.* ### 1. A bank has not satisfied the supervisory requirements in relation to risk management, ### 1. A bank has not satisfied the supervisory requirements in relation to risk management, capital, liquidity, reporting, transparency, sound business practices and responsibility of the board of directors, and where in the view of the supervisor other measures are not sufficient to address the identified deficiency within a reasonable time ### Conditions triggering specific own funds or liquidity requirements - Circumstances under which FI may require specific own funds or liquidity requirements: 1. A bank has not satisfied the supervisory requirements in relation to risk management, capital, liquidity, reporting, transparency, sound business practices and responsibility of the board of directors, and where in the view of the supervisor other measures are not sufficient to address the identified deficiency within a reasonable time 2. A bank is or may be exposed to additional risks and a separate own funds requirement is necessary to cover these risks; 3. It is likely that a bank will not be able to meet its specific own fund requirements within the next twelve months; and 4. A bank has on repeated occasions failed to conform with a guidance on additional own funds (Pillar 2 guidance) from FI or where circumstances have come to light which may cause misgivings from a supervisory perspective. - 42 ### Capital buffers and supervisory instruments - The Capital Buffer Act (2014:966) contains provisions on different types of capital buffers, and on interventions and restrictions when a bank fails to meet requirements in relation to capital buffers. - Buffer types and application: - capital conservation buffers, - the system risk buffer, - countercyclical capital buffer and - other systemically important institutions (O-SII) buffer. - FI imposes these buffers on the Swedish banks and the requirements are published on a quarterly basis. - Example: In February 2022, FI published the Q4 2021 report on capital requirements of Swedish Banks. The report included requirements in relation to: minimum capital, Pillar 2, capital buffers (capital conservation, systemic risks, countercyclical). - The systemic risk and O-SII buffers apply to the three largest banks. - The Pillar 2 capital charge: - is applicable to all banks, - is differentiated across institutions based on their risk profile, and - covers, amongst others, credit concentration risk, interest rate risk and additional market risk, pension risk and other Pillar 2 requirements. - FI’s ability to issue Pillar 2 guidance is provided for in Chapter 2 section 1c in the Special Supervision Act. - FI may decide on a specific liquidity requirement for an institution where necessary (according to Chapter 2 section 2 of the Special Supervision Act). - The Special Supervision Act (Chapter 3 and 4) provides that the specific own funds and liquidity requirements are applicable on group and/or solo level. - Under the Capital Requirements Regulation (Article 124 and 164), FI can introduce higher risk weights for exposures within the jurisdiction secured against real estate. - FI required Swedish mortgage issuers using the IRB approach to apply a risk-weight floor of 25 percent Swedish mortgages. ### EC4 — Updating laws, regulations and prudential standards - Banking laws and regulations are updated as necessary to remain effective and relevant to changing industry and regulatory practices; these updates are subject to public consultation, as appropriate. - EU level: - Majority of new banking laws and regulations are developed by the EU. - The MoF prepares new level one regulation; FI often supports the MoF with expert knowledge and participates extensively in EBA regulatory work. - National legislation: - The MoF is responsible for preparing Swedish financial legislation at the national level; FI provides necessary support. - Section 3 (point 4 and 5) of the Financial Supervisory Authority Instruction Ordinance (2009:93) requires FI to bring up regulatory needs in a yearly consumer protection report and half yearly Stability Report. - FI may make a direct request to the government for amendments or new legislation. - FI has a formal process for regulatory projects including public consultation; FI regulations are decided and approved by FI’s Board of Directors. - Drafting/amendment generally done by FI’s legal departments with input from reference groups (financial institutions, industry associations, governmental agencies). - Constraint: FI does not have broad powers to issue binding regulations beyond specific laws or ordinances; this can cause delays in issuing specific regulations to address identified risks or vulnerabilities, especially where gaps in EU Directives exist. - Speed of innovation in the Swedish financial sector increases the importance of powers to issue binding regulation quickly. ### EC5 — Access, group-wide review, and supervision of foreign banks - FI powers to obtain information and access: - Section 3 (first paragraph) of Chapter 13 of the Banking and Financing Business Act (BFBA) requires credit institutions and foreign credit institutions with branches in Sweden to provide FI with any and all information regarding their operations and related circumstances when requested. - FI may request such information from persons employed by the bank. - Entities required to provide information under Chapter 6, Section 1 of the Credit Institutions and Securities (Special Supervision) Act include all entities within a banking group and specifically: 1. a) Companies under supervision based on their consolidated situation under Special Supervision Act or a foreign legal Act based on the Capital Requirements Directive (CRD), b) Companies under supervision according to Article 7 Regulation (EU) 2019/2033 c) Companies part of a consolidate situation through a decision in accordance with Article 8 Regulation (EU) 2019/2033 2. Subsidiaries of a credit institution, a financial holding company, a mixed financial holding company, or an investment holding company, 3. Mixed activity holding companies and subsidiaries of mixed activity holding companies, 4. Mixed financial holding companies, and 5. Entities engaged by a credit institution, a financial holding company, mixed activity holding company, mixed financial holding company, or investment holding company to perform certain work or certain functions. - Investigation powers: - Section 4 of Chapter 13 of the BFBA provides FI the power to carry out an investigation at the premises of a credit institution and branches in Sweden; FI must consult the competent authority in the EEA country that authorized the foreign credit institution before investigating a branch. - Section 5 of Chapter 13 provides power to collect information from individual entities in a banking group for supervision. - Supervisory meetings and attendance: - FI may convene a meeting of the board of directors of a credit institution and can issue a notice if the board fails to convene an extraordinary general meeting. - Representatives of FI can attend general meetings and board meetings which it has convened and can participate in deliberations (Chapter 13 section 12 of BFBA). - Consolidated supervision: - Chapter 4 (Section 1-3) of the Credit Institutions and Securities Companies (Special Supervision) Act specifies FI’s responsibility as consolidating supervisor over compliance with consolidated requirements. - Intervention against foreign credit institutions: - Chapter 15, Section 15: Where a foreign credit institution conducting operations in Sweden fails to conduct operations in accordance with applicable legal provisions or there is a material risk of non-compliance, FI is required to notify the competent authority in the institution’s home country and may, in urgent cases, take measures pending actions by the home authority to maintain financial stability in Sweden. - Chapter 15, Section 15 (a): Where a foreign credit institution conducting operations in Sweden does not comply with the Money Laundering and Terrorist Financing (Prevention) Act (SFS 2017:630), FI may order rectification and, if not complied with, notify the home competent authority and may enjoin the institution from commencing additional transactions in Sweden. ### EC6 — Corrective actions, sanctions, license revocation, and resolution cooperation - Legal bases for intervention and corrective measures: - Chapter 15, Section 1 of the BFBA provides FI powers to intervene where a credit institution has violated obligations under BFBA, other statutory instruments, articles of association, by-laws, regulations, or internal instructions based on statutory instruments. - Range of measures FI can take against a credit institution (examples): - issue an order to limit or reduce the risks of the operations in some respect, to limit or refrain from payment of dividends or interest, or to take another measure in order to rectify the situation within a specific time; - issue an injunction against executing resolutions; or - issue an adverse remark. - Where infringement is serious, FI can revoke the license or issue a warning. - License revocation additional conditions (Chapter 15, Section 3): - revocation may occur where the institution: (i) has been placed in insolvent liquidation or an order has been issued to place the institution in compulsory liquidation; (ii) has obtained the license by providing false information or otherwise in improper manner; and (iii) has transferred its entire business. - Punitive fines: - The BFBA (Sections 7–9 of Chapter 15) sets out punitive fines that may be levied in conjunction with an adverse remark or a warning. - Powers to intervene against board members or management: - Chapter 15, Section 1a provides FI power to intervene, under certain circumstances, against a member of a credit institution’s board of directors or its managing director, or a replacement for any such person. - General conduct requirement: - Chapter 6, Section 4 requires credit institutions to conduct their business in a sound manner, providing FI wide scope for intervention based on safety and soundness concerns. - Specific own funds and liquidity requirements in Special Supervision Act (Credit Institutions and Securities Companies (Special Supervision) Act (SFS 2014:968)): - Chapter 8 (section 1 and 2) contains provisions regarding FI’s possibility to intervene through decisions regarding specific own funds requirements and specific liquidity requirements. - Section 1: power to order the company to limit its operations in any respect within a certain time, to reduce the risks therein, or take any other measures necessary to rectify the situation if it fails to fulfil the requirements of the Prudential Requirements Regulation, the Special Supervision Act, or regulations promulgated on the basis of the Special Supervision Act. - Section 2: power to require an institution to take remedial measures where the holding company fails to meet requirements imposed pursuant to the Prudential Requirements Regulation, the Special Supervision Act or regulations promulgated on the basis of the Special Supervision Act. - Section 2a: power to intervene against a financial holding company or mixed financial holding company which fails to fulfil obligations pursuant to special provisions regarding the requirement for approval of financial holding companies and mixed financial holding companies. - Remedies available against financial or mixed holding companies (Chapter 8, section 2a): - order it to limit, within a certain time, the risks in some respect; - divest or reduce its holding in institutions or other subsidiaries in the group; - transfer to its shareholders the ownership interests in subsidiaries which are institutions; - appoint an undertaking to ensure on a temporary basis, that the requirements in relation to capital and risk management are satisfied; - to limit or refrain completely from paying dividends or interest; or - submit a plan showing how the company shall satisfy the requirement without delay. - Capital Buffers Act (Chapter 8) intervention and restrictions: - contains provisions regarding FI’s intervention and restrictions against a credit institution when certain capital buffers are not met. - The reduction or suspension of dividends is regulated by Chapter 8 of the Capital Buffers Act (SFS 2014:966). - Automatic restrictions on value transfers are triggered when the bank is in breach of the combined buffer requirement. *Source: 1sweea2023008 - 1. A bank has not satisfied the supervisory requirements in relation to risk management, capital, liquidity, reporting, transparency, sound business practices and responsibility of the board of directors, and where in the view of the supervisor other measures are not sufficient to address the identified deficiency within a reasonable time* ### Section 15 of Chapter 15 of the BFBA sets out specific rules regarding intervention against ### 1sweea2023008 - Section 15 of Chapter 15 of the BFBA sets out specific rules regarding intervention against ### Intervention powers under Chapter 15 of the BFBA and related legislation - FI must notify the competent authority in the institution’s home country when a foreign credit institution domiciled within the EEA that conducts operations in Sweden has: - failed to conduct its operations in accordance with the provisions of the BFBA, or - there is a material risk of non-compliance with the provisions. - FI may, in urgent cases and pending measures by the home country competent authorities, take measures against the institution to maintain financial stability in Sweden. - Chapter 15, Section 1a, BFBA empowers FI to intervene against a member of a credit institution’s board of directors or its managing director by: - ordering that the person may not serve as a member of the board of directors or managing director of a credit institution, or a replacement for any such person, for a period of not less than three years and not more than ten years; or - imposing a punitive fine. - Section 8 (Chapter 15) of BFBA sets punitive fine limits for a credit institution at an amount not to exceed: - 10 percent of the credit institution’s turnover or, where applicable, comparable turnover on a group level during the immediately preceding financial year; - two times the profit which the institution realized as a result of the regulatory infringement, where the amount can be ascertained; or - an amount corresponding to five million euro. - FI is empowered by the Money Laundering and Terrorist Financing Act (SFS 2017:630) to intervene where a foreign credit institution breaches the Money Laundering Act or regulations. Section 9 Money Laundering and Terrorist Financing Act (SFS 2017:630) empowers FI to, in the event of non-compliance with ML and TF requirements, order the legal entity to: - take corrective action; or - if corrective action is not undertaken, to cease the operations if the business operator is a legal entity. ### Use of intervention powers and enforcement outcomes (sampled cases) - The assessor reviewed a sample of cases where FI intervened and noted use of: - adverse remark, - punitive fines, - revocation of a license. - Examples and observations: - A remark and administrative fine in one case resulted from deficiencies in governance and controls regarding AML measures. - Decisions and amounts of fines are published on FI’s website and described as adequately punitive. - One institution was fined SEK 4 billion for non-compliance with Swedish legislation. - An entity’s authorization to undertake business was withdrawn due to major deficiencies in governance and controls, and credit risk management. ### Supervisory reach over parent and affiliated companies (EC7) - FI’s power to review parent companies and other companies in a banking group stems from provisions transposing the Capital Requirements Directive (2013/36/EU) and provisions in the Capital Requirements Regulation (EU) 575/2013. - Section 1 of Chapter 6 of the Special Supervision Act: all companies subject to consolidated supervision must provide FI with any information required for its supervision. This extends to: - financial holding companies, - mixed financial holding companies, - mixed activity holding companies, - subsidiaries to these companies irrespective of whether they are part of the consolidated group or not. - Section 8 of Chapter 1 of the BFBA: FI’s power to supervise and intervene applies to all companies under consolidated supervision; where a credit institution is under supervision on a consolidated basis, relevant provisions apply to all other companies in the group and restrictions apply jointly. - Areas explicitly covered in pertinent parts for group companies include: - legal provisions regarding the business of a credit institution, recovery plans, intra-group support agreements, operations and holding of property, handling of loans and other commitment, amounts of own funds, or legal incompetence (Chapter 6-9 of the BFBA); - provisions on supervision (Chapter 13 of the BFBA) and provisions on intervention (Chapter 15 of the BFBA); - provisions regarding an institution’s business and supervision as per Credit Institutions and Securities Companies (Special Supervision) Act. ### Assessment of FI’s mandate, powers and practice (Principle 1) - Assessment: Largely Compliant. - Key findings on FI’s mandate and powers: - FI has a wide legal mandate covering supervision, regulation, licensing, consumer protection, macroprudential policy, and ensuring financial stability. - FI is not expected to raise or lower capital requirements for certain exposures solely to promote sustainable development but must ensure credit institutions manage sustainability-related risks. - FI can: - impose additional capital and liquidity requirements on a credit institution; - intervene against or restrict operations of a credit institution; - take corrective action against a credit institution, its board member or its managing director; - revoke a credit institution’s license; - supervise all companies under consolidated supervision; - collect necessary information from entities in a supervised banking group and from employees of credit institutions operating in Sweden; - carry out investigations at the premises of a credit institution. - Assessors found evidence of use of all these powers except for specific instances where FI took corrective action against a member of the board or managing director. - As consolidating supervisor, FI can exercise supervision over compliance with specified consolidated requirements and intervene against foreign credit institutions and undertakings with operations in Sweden. - FI can intervene against a financial holding company or mixed financial holding company for failure to fulfil legal and regulatory obligations. - Observations on regulatory process and limitations: - Majority of new banking laws and regulations in Sweden are developed by the EU; the Ministry of Finance (MoF) prepares national level one regulation and financial legislation. - FI supports MoF with expertise and must raise needs for new regulation in the half-yearly Stability Report; FI can request government amendments or new legislation. - FI does not have broad powers to issue binding regulations aimed at ensuring a safe and sound financial system without delegation from specific laws or ordinances. - Suggested considerations by assessors: - consider further the interaction between FI’s different objectives and mandates and develop a policy for addressing conflicts, potentially including: - safeguards so consumer protection or sustainable development measures do not distort incentives or adversely affect financial stability; - measures to ensure prudential objectives always take priority or are well complemented by consumer protection and sustainable development objectives; - assignment of responsibility to staff including segregation of duties to avoid conflicts across mandates. - consider greater delegation to FI or alternative measures to ensure gaps in the prudential framework (especially topics not covered by EU directives) receive priority attention by the MoF and government. ### Governance, independence, accountability and resourcing of FI (Principle 2 and EC1–EC5) - EC1 — Independence and discretion: - FI is an independent government authority; independence protected by The Instrument of Government (SFS 1974:152). - Article 2 of Chapter 12 of The Instrument of Government: no public authority can determine how an administrative authority is to decide in a particular case involving exercise of public authority vis-à-vis a private subject or local authority. - FI’s mission, goals and governance are defined by an official ordinance with instructions for FI (Ordinance SFS 2009:93). - Government issues an annual publicly disclosed Letter of Appropriation specifying objectives, assignments, reporting requirements and funds; FI is consulted in preparation. - Appropriation letter for 2022 required FI to report on, among others: - how the financial appropriation has been used to strengthen supervision of AML and CFT; - how supervision of financial institutions’ management of information and cyber risks has been strengthened; - impact of supervision of new capital adequacy rules (amendments to the EU Prudential Regulation and the EU Capital Requirement Directive); - supervision of credit assessment in accordance with Consumer Credit Act. - FI processes and practices are subject to review by the Swedish National Audit Office (SNAO) and Parliamentary Ombudsmen. - EC2 — Appointment and removal of leadership: - Director General is appointed by the Swedish government following an open application process; announcement published in newspapers and on government website. - Section 5 of Chapter 12 of the 1974 Instrument of Government: government must consider only objective factors such as merit and competence for appointment. - Identities of applicants are protected by secrecy per The Public Access to Information and Secrecy Act (SFS 2009:400) chapter 39 section 5 b; secrecy does not apply to the person appointed. - Director General normally appointed for a term of six years, which can be prolonged for a period of three years (one or two times). - Section 32 of the Public Employment Act (SFS 1994:26): it is not possible to terminate a Director General appointed for a fixed term. Section 33 allows transfer to other public employment appointed in the same manner where necessary for organizational reasons or best interests of the authority. - Government has never removed a Director General of FI during his/her term; reasons for removal would have to be publicly disclosed. - FI board is appointed by the government; chairman and vice chairman also appointed by government. FI board members have a minimum appointment of three years. - EC3 — Publication of objectives and accountability: - FI governed by Ordinance (SFS 2009:93) with instructions detailing objectives, assignments and responsibilities. - Government issues a publicly disclosed Letter of Appropriation annually. - Section 3 of the Ordinance prescribes specific yearly reports FI must provide to government. - Ordinance on annual report and budget basis (SFS 2000:605) requires FI to present an annual report no later than February 22 each year (Chapter 2, Section 1). All reports are publicly available. - FI subject to: - annual financial audit by the SNAO assessing credibility and correctness of financial statements and compliance with ordinances, rules and regulations; - regular inspection by the Parliamentary Ombudsmen (PO), with inspection outcomes reported to FI management and follow-up where issues persist. - EC4 — Internal governance and emergency decision-making: - FI’s rules of procedure and internal decision ordinance regulate decision-making, including urgent situations, allocation of responsibilities between board and Director General, and delegation within the organization. - FI subject to Internal audit ordinance (2006:1228) and Ordinance on internal management and control (2007:603) requiring an internal audit function for independent review of internal management and control. - FI has established ethical standards covering confidentiality, loans from supervised entities, additional occupations, and dealings in financial instruments; policies exist for staff moving to supervised institutions, including removal from sensitive responsibilities when taking up such roles. - EC5 — Staff professionalism, integrity and conflict rules: - Rules on avoidance of conflicts of interest set out in Section 16–18 of the Administrative Procedure Act (2017:900). - Rules on secondary occupation referenced (text cut off in source at this point). *Source: 1sweea2023008 - Section 15 of Chapter 15 of the BFBA sets out specific rules regarding intervention against (PDF chapter/section).* ### Section 7 to 7d of the Public Employment Act (SFS (1994:260). Section 14 of the ### Section 7 to 7d of the Public Employment Act (SFS (1994:260). Section 14 of the ### Ethical rules, internal governance and disciplinary framework - Ordinance with instructions for the Financial Supervisory Authority (2009:93) restricts secondary occupation for board members or employees of FI: - Board members or employees of FI may not engage in trade on their own or third party's behalf, or be associated with entities that are obliged to report, register or hold a license from the Authority (FI). - Board members or employees of FI may also not be employed by or accept tasks from such companies. - Board members or employees commissioned by the board need prior permission to hold debt issued by supervised entities. - FI has adopted three internal guidelines on ethical issues: - (i) Guidelines on secondary occupation, - (ii) Guidelines on conflicts of interest, - (iii) Rules and guidelines on bribery. - FI operates an internal Ethical Council led by the Chief Legal Counsel with representatives from all Operational sections and Offices; the council meets approximately four times every year and minutes are published on the intranet. - In accordance with Section 15 of the Ordinance with instructions for the Financial Supervisory Authority, FI has established a Disciplinary Committee (Personnel Liability Committee) and has adopted Guidelines for the handling of disciplinary matters. - Section 14 of the Public Employment Act: an employee who intentionally or negligently breaches the obligations of employment may be subject to disciplinary sanctions for dereliction of duty; sanctions may include a warning, wage deduction, suspension from employment or dismissal from employment. - Section 22 of the Public Employment Act: a person reasonably suspected of having committed an offence in his employment shall be reported to the public prosecutor where the suspicion relates to certain criminal offences, such as taking a bribe, misuse of office and breach of duty of confidentiality (or other offences, where it may be assumed to result in a sanction other than fines). ### EC6 — Financing and resourcing for effective supervision (description and findings) - Financing structure: - FI is mainly financed through appropriation from the state budget; FI levies fees on supervised entities and passes these funds to the state budget. - In 2021, about 84 percent of FI’s activities were funded in this manner. - Remaining financing is from fees charged by FI for specific services (e.g., approval of licenses or waivers). - Fee levels shall provide for full cost coverage; FI proposes changes to government if level of fees need to be increased or decrease, or if new fees need to be added. - Appropriation process and discretion: - After the state budget adoption, the government issues an annual appropriation instruction (“Appropriation Letter”) to each administrative authority, including FI. - FI requests funds annually for coming years but rarely receives the full amount requested; FI emphasized in latest budget documentation that it was underfunded. - Except for resources explicitly granted by government for specific projects, FI has discretion over its allocation resources. - Budget trends and comparative sizing: - FI’s budget has increased substantially since 2008 but demand for resources has outpaced budget increases due to expanded mandate (sustainability-related matters and macroprudential policy), more regulation, more institutions, and new risks. - FI remains relatively small relative to the Swedish financial sector and compared to similar European authorities. - FI analysis for 2022-2024 noted the Dutch supervisory authority has about 100 more employees despite a narrower mandate. - Impact of resource constraints: - FI has had to reprioritize supervisory activities; this has adversely impacted ability to carry out frequent and intrusive onsite examinations and overall supervisory engagement. - Re-allocation of experienced staff to urgent issues reduced proactive supervision. - FI requested a substantial increase in resources for 2022-2024 but will receive about half of the requested additional funds for the upcoming three-year period. - Consequence: likely adverse impact on FI’s ability to effectively supervise institutions. ### EC6 — Specific resource elements (findings) - Salary scales and staff retention: - Swedish public sector practice constrains public servant salaries relative to private sector; FI compares salary levels with other public authorities and aims for a top-level public authority scale. - FI faces tough competition from private sector; recruitment and retention challenges for Internal Rating Based (IRB) model experts and senior cyber security experts. - Staff turnover was about 19% in 2021. - Banks noted FI had limited experienced staff in assessment of credit risk models, cybersecurity and new business models. - Ability to commission external experts: - The Swedish Banking and Financing Business Act (Chapter 13, article 9) enables FI to hire and appoint auditors to participate in audits and to hire external experts for specific assignments. - Limitations: FI can hire external experts only as long as it uses its funds within the stipulated framework per the Financial Supervisory Authority Instruction Ordinance (2009); some activities may preclude external experts for security reasons. - Training budget: - FI has a specific budget for training and offers on-boarding, supervisor training, leadership programs and topical seminars. - Technology budget: - General budget constraints have reduced internal development of supervisory tools and created a backlog in IT development. - Travel budget: - FI has a travel budget but aims to reduce travel following COVID-19 experience and government instruction to reduce carbon dioxide emissions linked to business travel; reduced travel not expected to adversely impact participation in supervisory colleges and international working groups. ### EC6 — Assessment conclusion - The assessors conclude FI currently does not have adequate resources to effectively deliver on its mandate due to limited staff numbers, high turnover and inability to attract experienced technical experts (notably cybersecurity and Pillar 1 credit risk model assessment). - Industry stakeholders expressed major concern about lack of resources and adverse impact of high turnover on supervisory engagement. ### EC7 — Annual resource planning and skills assessment (description and findings) - FI management assesses existing skills and resources with a long-term perspective as part of annual planning; outcomes inform short- and long-term priorities on skills, training and structural changes. - Planned staffing changes: - Planned increase in number of staff for the banking section to the same level it was in 2019 (165), expected to be achieved before the end of the year. - Increase responds to open vacancies and the new mandate under the Swedish Security Act and IT/cyber-related supervision. - FI recently hired new IRB experts in response to a high number of new Pillar 1 IRB models submitted for approval and the need to monitor ongoing performance. - Constraints and uncertainties: - High turnover and limited short-term options other than recruitment or internal re-allocation. - Use of independent external experts or short-term secondees from other supervisors is not a common feature in Sweden. ### EC8 — Risk-based supervisory programs and resource allocation (description and findings) - Risk-based approach: - FI categorizes supervised credit institutions into four buckets (categories 1 to 4) based on systemic importance using the O-SII model from EBA Guidelines complemented with qualitative assessment. - Category 1 contains most systemically important institutions; category 4 contains least systemically important. - SREP frequency by category: - Category 1 institutions (D-SIBs): annual Supervisory Review and Evaluation Process (SREP). - Category 2 institutions: biennial SREP. - Category 3 credit institutions: SREP at least every 3years. - Category 4 institutions: until recently subjected to SREP less frequently and on a more risk-based basis; in 2021 FI launched a simplified SREP enabling more frequent SREP for category 4. - Resource allocation by category: - Category 1 and 2: supervisory teams with risk experts led by Lead Supervisor support SREP, continuous risk assessment and day-to-day supervision. - Category 3 and 4: significantly smaller supervisory teams (lead and backup supervisors) with ad hoc engagement by risk experts; Lead Supervisor performs most planned assessments and analysis but can seek support. - Most supervisory resources for SREP are spent on category 1 and 2, which corresponds to approximately 95 percent of the total assets of the Swedish banking market. - More experienced and senior supervisors are normally assigned to larger and more complex institutions. - Intensified supervision list: - FI identified a list of institutions selected for intensified frequent risk assessment triggered by the COVID-19 pandemic; these institutions file additional supervisory reports (capital adequacy and credit risk) and are subjected to closer monitoring based on risk profile. - Identified gap: - FI has not adopted a system for formally ranking institutions using more frequent information (e.g., quarterly COREP and FINREP) which could facilitate timely identification of high-risk institutions in category 3 and 4 for closer monitoring and potential intervention. - Risk profiles could change significantly between SREP cycles, increasing the importance of such a system. ### EC9 — Legal protection for supervisors and staff (description and findings) - BFBA (SFS 2004:297) contains no specific provisions on legal protection for the supervisor or supervisory staff concerning actions taken in good faith. - Applicable general framework: - Tort Liability Act (SFS 1972:207) applies to state agencies including FI; under Chapter 3, Section 2 the state is liable for damages resulting from negligence by state agencies. - Liability may also arise from misleading information or advice, or violation of fundamental rights (Chapter 3, Sections 3 and 4). - The Office of the Chancellor of Justice often represents the state in legal disputes; FI generally does not bear the costs of that representation. - Employee liability is possible under exceptional reasons (Chapter 4, Section 1 of the Tort Liability Act). - FI’s view: - FI considers the Tort Liability Act to imply a strong presumption against personal liability and protection for employees who acted in good faith, including protection against costs of defending actions taken while discharging duties in good faith. - Assessors’ observation: - Lack of explicit legal protection may not be a major concern currently given the high threshold for successful legal action and Sweden’s less litigious culture, but the emergence of non-traditional institutions and influence from other jurisdictions may over time create need for explicit legal protection. ### Assessment of Principle 2 — Material conclusions and key impacts - Overall assessment: Materially Non-Compliant. - Rationale and key impacts: - FI is an independent government authority with decision-making capacity provided in The Instrument of Government; objectives and governance specified in Financial Supervisory Authority Ordinance; Director General appointed by government for fixed duration of six years with possible extension for a period of three year (one or two times). - FI is accountable to government and subject to annual audit by the Swedish National Audit Office (SNAO) and regular inspection by the parliamentary Ombudsmen (PO); must submit annual report to the Swedish Financial Management Authority. - FI has internal rules and ethical standards, an Ethical Council and a Disciplinary Committee; statutory provisions exist for conflict of interest and secondary occupations. - Major deficiency: FI is significantly under-resourced — limited staff numbers, high turnover and inability to attract experienced technical experts — which materially affects supervisory capacity. - Specific operational impacts of resource constraints: - Supervision of credit risk models, governance, cybersecurity and stress testing. - Intrusiveness of onsite inspections; days spent onsite by supervisors limited to only between 3 and 4 days. - Ability to meet timelines for approval of credit risk models (should be done within 6 months of submission of complete application) but timelines currently not being met. - Ability to have a SREP every 3 years for banks in categories 3 and 4 is not being met for some institutions. - Duration of investigations can be prolonged, delaying corrective action. - Consistency in risk assessment and formulation of corrective action can be impaired due to insufficient granularity. - Assessment of quality of data reported by banks has resulted in over-reliance on banks’ internal control functions. - Drivers of resource shortfall: - Relatively lower salaries at FI compared to private sector leading to staff departures; main destinations are private sector. - Specific disadvantage in attracting experienced credit risk model and cybersecurity experts. - Consequence: - Shortage of experienced staff, if not addressed urgently, would continue to severely impact FI’s ability to undertake critical supervisory activities and timely identification of risks. ### Principle 3 — Cooperation and collaboration (EC1 description and findings, excerpt) - Financial Supervisory Authority Instruction Ordinance (2009:93) requires FI to cooperate with Riksbank and the Swedish Civil Contingencies Agency in crisis preparedness matters, and to consult with Riksbank on payment system stability and with SNDO on deposit guarantee scheme matters. - FI and Riksbank are required by Chapter 28 (section 4) of the Resolution Act to provide SNDO with information needed for its activities as per the Resolution Act. *Source: 1sweea2023008 - Section 7 to 7d of the Public Employment Act (SFS (1994:260). Section 14 of the* ### Section 5) to cooperate and exchange information with one another. ### Section 5) to cooperate and exchange information with one another. ### Financial Stability Council (FSC) and domestic coordination - Sweden has established a Financial Stability Council (FSC) through an MOU between the relevant parties. - FSC composition: representatives of the government MoF, FI, the SNDO, and the Riksbank. - Meeting frequency and remit: - The FSC meets twice a year to discuss risks to financial stability and policy measures to prevent the build-up of financial imbalances. - In the event of a financial crisis, the FSC will meet to discuss the need for measures to manage such a situation (as it happened during the COVID pandemic). - The preparatory group meets more frequently, contributes to regular exchange of information between the authorities, prepares the agenda for FSC meetings, and discusses analyses produced by the different authorities. - Purpose and outputs: - The aim of the discussion at the FSC is not to form a joint view of the financial stability risks. - Minutes from FSC meetings summarize the authorities’ views on the risks for financial stability and indicate where the authorities agree on the risk assessment and, if relevant, in what respect the authorities’ views may differ. - Impact and examples of collaborative work: - The discussion of risks in the FSC and the preparatory group has led to further analytical and policy work, either by one authority or jointly, with outcomes reported back to FSC. - Examples: analysis of vulnerabilities in the CRE sector and cooperation on cyber security in the financial sector. - The discussions at the FSC normally benefit from the risk analysis undertaken by each of the authorities, which include the financial stability reports prepared by FI and the Riksbank based on their independent analysis. - Crisis experience: - Authorities noted that regular cooperation within FSC in normal times proved very useful in times of crisis, evident in crisis management work during the Covid-19 pandemic. - During the onset of the Covid-19 crisis, FSC met more frequently to discuss developments, effects on the macro economy and financial stability, each authority’s implemented measures, and the need for possible further measures. - The preparatory group had regular meetings and continuous exchange of information to coordinate crisis management work. ### Other domestic cooperation arrangements and AML information sharing - FI has a formal cooperation arrangement with the Police Authority on AML issues involving: - FI supporting the Police with financial competence and supervisory information on business models, ownership structure, and clients of individual companies, as well as analyses of sectors and transaction flows. - The Police sharing intelligence with FI on current schemes for money laundering and TF, and information on particularly exposed companies and sectors. - FI participation in forums: - FI is part of the “Private-public Collaboration of the Financial Sector” forum where financial institutions, FI, SNDO, the Riksbank, Social Insurance Agency, and Civil Contingencies Agency collaborate and share knowledge on analysis and scenario exercises aimed at strengthening financial sector resilience to threats and crises. - Memoranda and practical effectiveness: - The MoU between the Government Offices (MoF), Riksbank, FI, and the SNDO regarding cooperation on financial stability and crisis management, though not legally binding, provides a good basis for cooperation and information sharing. - MOUs with the Swedish Police have been valuable in facilitating sharing of information related to AML and entities operating in the Swedish financial system without an appropriate license. - Assessors’ observations: - The mechanism of information exchange through FSC and bilaterally between FI and SNDO was noted to be working well in practice. ### Cooperation with foreign supervisors (EC2) - Legal framework for disclosure: - Public Access to Information and Secrecy Act (Chapter 8, Section 23) allows FI to disclose nonpublic information to foreign supervisory authorities if: (i) the disclosure takes place in accordance with a special provision in an Act (including Swedish laws and EU regulations, or ordinance), or (ii) the information would in a corresponding case have been disclosed to a Swedish authority and it appears clear, based on an examination by the disclosing authority, that it is compatible with Swedish interests to disclose the information to the foreign authority or international organizations. - Statutory cooperation requirements: - Section 3 of Chapter 6 of the Credit Institutions and Securities Companies (Special Supervision) Act requires FI to cooperate and exchange information with other foreign supervisors of banks (“competent authorities”) as required under Sweden’s membership in the EU. - FI is required to cooperate and share information with: (i) other competent authorities, (ii) the European Banking Authority (EBA), (iii) the European Systemic Risk Board (ESRB), (iv) European Securities and Markets Authority (ESMA), (v) authorities within the EEA which supervise insurance undertakings, (vi) public bodies within the EEA, and (vii) other competent authorities involved, in the event a critical situation arises in Sweden which may jeopardize the liquidity of financial markets or the stability of the financial system of another country within the EEA. - Supervisory colleges and multilateral MOUs: - FI can share information with other foreign supervisors in line with EU legal provisions where there is a Written Coordination and Cooperation Arrangement (WCCA) within a supervisory college as prescribed in CRD. - This is the case for the three large Swedish banks where FI leads the supervisory college in its capacity as the home supervisor. - FI participates in other supervisory colleges as host supervisor, and in a number of resolution and AML colleges for cross-border banks it supervises. - Supplementary arrangements: a multilateral MOU on the supervision of significant branches between supervisory authorities in the Nordic and Baltic countries and ECB, and a multilateral MOU on cooperation and coordination of cross-border financial stability between relevant ministries, supervisory authorities, central banks, and resolution authorities of Nordic and Baltic countries. - Ongoing work: agreement on an MOU between the ECB, Single Resolution Board (SRB) and the authorities of the nonparticipating Member States as well as an MOU between ECB and EU non-SM National Competent Authorities (NCA) as per Article 3 (6) of the Single Supervisory Mechanism Regulation (SSMR). - Footnotes in the source note: “Memorandum of Understanding on prudential supervision of significant branches in Sweden, Norway, Denmark and Finland” and “To be signed in May/June 2022.” - Bilateral MOUs with third countries: - Bilateral agreements or MOUs are needed to enable effective information exchange with authorities in third countries (i.e., those not members of EEA). - FI has MOUs with supervisors in several third countries including China, Russia, United States of America and Ukraine. - After the United Kingdom left the EU, FI signed an MOU on supervisory coordination with the Prudential Regulation Authority and the Financial Conduct Authority to facilitate cooperation and exchange of information. - It is noted that, in the case of Sweden, a bilateral cooperation agreement is not a prerequisite for exchanging information with a foreign authority as FI may, on request, share information with another competent authority if the Public Access to Information and Secrecy Act does not prevent disclosure of such information. - Regional and informal engagement: - FI and corresponding authorities in other Nordic countries hold regular informal multilateral meetings at Director General level and at Executive Director Banking level. - The Nordic-Baltic Directors General meet twice a year within the Nordic-Baltic Macroprudential Forum, together with the Nordic Baltic Central Bank Governors to discuss risks in financial markets and the macroprudential policy response in the region. - Assessors’ findings on practical information sharing: - Assessors reviewed samples of information shared between FI and the college of supervisors and bilaterally with other supervisors, minutes of college meetings, and the WCCA; they noted effective information sharing arrangements. - Limited involvement of FI in joint onsite inspections with other foreign supervisors, especially the ECB, was noted; FI has been involved in 3 onsite-inspections and deep dives of Nordea since 2018, which were led by the ECB/SSM. - FI does not have the resources to participate in all inspections led by ECB/SSM. - Types of information shared with other supervisors: - Group recovery plans, risk assessment documents, supervisory/SREP assessments, supervisory examination plans, information obtained from the bank as part of the quarterly risk review (QRR), and general information. ### Confidentiality, permitted uses, and protections (EC3 and EC4) - Domestic authority information sharing (EC3): - FI is an integrated supervisory authority and can share confidential information with Riksbank and SNDO, who have mandates over financial stability and resolution/deposit guarantee respectively. - Information sharing with Riksbank and SNDO is guided by the Public Access to Information and Secrecy Act, which has specific provisions related to disclosure and confidentiality. - Pursuant to the Financial Supervisory Authority Instruction Ordinance, FI may share necessary information with the Riksbank on matters related to financial stability, and the SNDO on matters related to the Deposit Guarantee Scheme. - As provided for by the Resolution Act (Chapter 28 Sections 4 and 5), FI may also provide information to SNDO on matters related to resolution of banks. - The information shared with Riksbank and SNDO is governed by confidentiality provisions of the Public Access to Information and Secrecy Act. - Foreign authority information sharing and legal limits (EC3 & EC4): - Chapter 13 (Section 6a) of the Banking and Financing Business Act allows FI to cooperate and exchange information with other foreign supervisory authorities in line with EU-legislation, which is binding in Sweden. - Chapter 28 (section 5) of the Resolution Act allows FI to cooperate and exchange information with corresponding authorities within the EEA and with the EBA in accordance with CRR, CRD and BRRD. - Chapter 8 (section 3) of the Public Access to Information and Secrecy Act: confidential information may only be provided to a foreign authority if this is regulated in law or regulation (including EU regulation) or if the information under corresponding circumstances could be provided to a Swedish authority. - The information exchanged between FI and other supervisory authorities is regulated by EU legislation, which requires that confidentiality of information is protected and that information provided must be used only for supervisory reasons. - Determination and scope of confidentiality (EC4): - The Public Access to Information and Secrecy Act determines whether information received by FI is confidential. - The Act sets out that a large proportion of information held by FI is confidential; e.g., according to chapter 30 (section 4), information on banks and their customers is confidential. - Confidentiality regarding information about a bank applies if it could be assumed that a disclosure could cause damage to the bank. - Confidentiality provisions of the Public Access to Information and Secrecy Act also apply to information FI has received from other foreign supervisors in accordance with binding EU legislation or an agreement with a foreign state entered into by the EU or approved by Swedish Parliament. - Information received from other supervisors is therefore considered confidential to the extent that its disclosure could harm Sweden’s participation in international cooperation under the EU legislation or agreement. *Source: 1sweea2023008 - Section 5) to cooperate and exchange information with one another.* ### Chapter 15 Section 1a of the Public Access to Information and Secrecy Act. The Public ### Chapter 15 Section 1a of the Public Access to Information and Secrecy Act ### Confidentiality and information sharing under Public Access to Information and Secrecy Act - Where an information sharing agreement or EU legislation provides for absolute confidentiality of information, the same confidentiality applies to FI. - Where an agreement or EU legislation gives the originator the power to veto against disclosure, FI should classify such information as confidential. - Where secrecy applies to certain information, FI may not use that information outside of the operations for which the secrecy provision applies. - If EU legislation or an MOU/agreement under which confidential information has been exchanged stipulates that the originator should be informed of a request for the information, FI is obliged to inform the originator in accordance with that EU legislation or applicable MOU/agreement. - The provisions ensure that information provided to FI via information gateways created under EU legislation is protected by Swedish confidentiality provisions, and that confidential information regarding banks and their customers may only be used by FI for supervisory purposes. ### EC5 — Processes to support resolution authorities (recovery and resolution planning and actions) Description and findings: - Legal basis: - The Banking and Financing Business Act and the Resolution Act require FI (bank supervisor) and SNDO (resolution authority) to cooperate in recovery and resolution planning. - Preparation and planning: - FI is responsible for assessment of banks’ recovery plans and consults with SNDO as required; SNDO is expected to identify and assess measures affecting resolvability. - FI supports resolution authorities by: - undertaking ongoing supervision of MREL and intervening (after consultation with SNDO) where an institution fails to comply with MREL requirements; - exercising oversight over recovery and other key indicators; - facilitating access to information required to update resolution plans. - Use of intervention powers: - If an institution fails to provide SNDO with requested information, FI can use its intervention powers to force the institution to provide the required information. - Determination that an institution is failing or likely to fail (FOLF): - FI determines if an institution is FOLF and must consult with SNDO and Riksbank before making a FOLF determination. - If FI determines FOLF, SNDO (after consultation with FI and the Riksbank) determines whether alternative measures can prevent failure and whether resolution is necessary in the public interest. - Conduct of resolution actions — FI’s supportive roles include: - approving decisions connected to resolution planning that impact the maturity profile of capital instruments; - contributing to SNDO decisions on MREL; - supervising implemented MREL requirements; - approving portfolio transfers; - revoking an institution’s license where compulsory liquidation is decided; - deciding on write-down or conversion of relevant capital instruments where necessary and sufficient to prevent failure and absent alternative remedies; - granting required approvals where the sale of business tool is used to transfer shares and the acquisition requires a permit; - granting a license when a transfer requires a banking or other license; - granting an operating license to a bridge institution in a timely manner. - supporting SNDO in decisions on potential use of bail-in, restructuring, or government stabilization, and providing information needed for any resolution measures. - Other information-sharing arrangements: - FI shall share information from foreign authorities with SNDO in accordance with EU legislation, Public Access to Information and Secrecy Act and Written Coordination and Cooperation Arrangement (WCCA). - Based on MOU and as required by the Resolution Act and Banking and Financing Business Act, FI is expected to share with SNDO information on: negative developments in group entities that may have serious consequences for institutions; significant sanctions; activation of the deposit guarantee; extraordinary measures; and imposition of Pillar 2 capital requirements. - Observations: - Cooperation and coordination between FI and SNDO is still developing and yet to be fully tested due to absence of noteworthy bank failures or resolutions among larger or medium-sized banks. - Cooperation has been strengthened with respect to review of recovery and resolution plans. ### Assessment of Principle 3 — Cooperation and information sharing - Assessment: Largely Compliant - Findings: - FI has cooperation agreements and MOUs with domestic and foreign regulators, providing platforms for interaction, discussion, and information sharing relevant to FI’s mandate. - Domestic cooperation: - Active cooperation and information sharing with Riksbank and SNDO via the Financial Stability Council (FSC). - FI has information-sharing arrangements with Swedish Consumer Agency, Swedish Police and Swedish Pension Agency. - The FSC meets regularly; minutes are public; a preparatory group meets more frequently to facilitate information exchange. - FSC discussions have led to analytical and policy work (e.g., analysis of vulnerabilities in the CRE sector and cooperation on cyber security in the financial sector). - International cooperation: - FI has international MoUs with foreign regulatory agencies, including supervisors of subsidiaries of large Swedish banks. - FI has established and leads supervisory colleges for the three largest Swedish banks as home supervisor and participates in other supervisory, resolution and AML colleges. - Limited joint onsite inspections with other supervisory authorities, especially the ECB; since 2018 FI has been involved in 3 onsite-inspections and deep dives of Nordea led by ECB/SSM. - FI does not have resources to participate in all inspections led by ECB/SSM. - Shared materials in supervisory colleges include: group recovery plans, group risk assessment documents, ICAAP documents, supervisory examination plans and ad hoc information including responses to banks’ quarterly risk reviews information requests. - Confidentiality framework: - FI has a good framework for exchanging and preserving confidentiality of information with domestic and foreign supervisory authorities. - Confidentiality is governed by the Public Access to Information and Secrecy Act, EU legislation and MOUs; information provided via EU information gateways is adequately protected and used only for supervisory purposes. - FI has a secure platform to facilitate exchange of information with supervisory colleges. ### Principle 4 — Permissible activities (summary of essential criteria EC1–EC5) - Assessment: Largely Compliant - EC1 — Definition of “bank”: - Chapter 1, Section 5 of the Banking and Financing Business Act (BFBA) defines “bank” as comprising banking companies, savings banks and members’ banks. - “Banking company” is defined as “a limited liability company licensed to conduct banking business.” - The term “bank” is distinct from “credit institution” (broader), defined by BFBA (Chapter 1, Section 5) as a bank or a credit market undertaking. - “Banking business” (BFBA Chapter 1, Section 3) includes: (i) payment services via general payment systems; and (ii) receipt of funds which, following notice of termination, are available to the creditors within not more than 30 days. - Both banks and credit market undertakings may carry out “financing business” (BFBA Chapter 1, Section 4) including: (i) accepting repayable funds from the public; and (ii) granting loans, providing guarantees for loans or financing purposes, acquiring claims or granting rights of use in personal property. - Both banks and credit market undertakings are credit institutions for the EU legal framework and are subject to prudential requirements of BFBA; credit market undertakings meet the EU directive terms but are not banks under Swedish law. - EC2 — Permissible activities: - Chapter 7 (section 1) of BFBA lists permissible activities for a credit institution; credit institutions may, in operations: 1. borrow funds, for example by accepting deposits from the general public or issuing bonds or other comparable debt instruments; 2. grant and broker loans, for example in the form of consumer credit and loans secured by charges over real property or claims; 3. participate in financing, for example by acquiring claims and leasing personal property; 4. provide payment services pursuant to the Payment Services Act; 5. provide means of payment; 6. issue guarantees and assume similar obligations; 7. participate in the issuance of securities; 8. provide financial advice; 9. hold securities in safekeeping; 10. conduct letters of credit operations; 11. provide bank safety deposit services; 12. engage in currency trading; 13. conduct securities operations subject to the conditions prescribed in the Securities Market Act; 14. provide credit information subject to the conditions prescribed in the Credit Information Act; and 15. issue electronic funds pursuant to the provisions of the Electronic Funds Act. - EC3 — Use of the word “bank”: - Chapter 1, section 9 of BFBA provides that only banks, the Central Bank of Sweden (Swedish Riksbank) and foreign credit institutions may use the word “bank” in their business name or otherwise in conjunction with a designation of their business operations. - A foreign credit institution may conduct operations in Sweden under the business name it uses in the state of its head office. - An association or other legal person closely linked to banks, Riksbank or foreign credit institutions may use the word “bank” subject to consent by FI (second paragraph, Chapter 1, section 9 BFBA). - Chapter 1, section 3 BFBA defines “banking business” to include: (i) payment services via general payment systems; and (ii) receipt of funds (deposits) which, following notice of termination, are available to the creditor within not more than 30 days. - The law does not explicitly restrict derivatives of the word “bank” (such as “banking,” “banker”) in a name; authorities noted legislation should be used so that derivatives are included in the restriction. - EC4 — Reservation of deposit-taking: - BFBA (Chapter 1, Section 7) provides that, apart from investment firms allowed to accept deposits to facilitate investment business (subject to specific consent), only credit institutions are allowed to accept deposits from the public. - Both credit institutions and investment firms are under full supervision of FI and require authorization from FI. - Deposits with these institutions are covered by the Swedish Deposit Guarantee Scheme. - Previously, “deposit companies” could accept deposits up to SEK 50,000 per consumer (not protected by the deposit guarantee). The Deposits Business Act under which they operated is no longer in force. Since January 1, 2021, it is no longer possible to start such business. Existing deposit companies were allowed to continue until December 31, 2021, and have now all ceased to operate in Sweden. - EC5 — Publication of licensed banks list: - FI publishes and maintains a current list of licensed banks in Sweden, including branches, on its website. - The list includes banking companies, savings banks, members banks, foreign banks, branches of credit institutions in the EU/EEA, credit market companies, foreign credit companies and other institutions supervised by FI. ### Assessment of Principle 4 — Comments - The BFBA (SFS 2004:297) clearly defines “banking business” and restricts deposit-taking to institutions licensed and supervised by FI, which include credit institutions (banks and credit market undertakings) and, subject to specific consent from FI, investment firms for the sole purpose of facilitating their investment business. - The BFBA identifies permissible activities for credit institutions and restricts the use of the word “bank” to banks, the Central Bank of Sweden and foreign credit institutions. - FI publishes and maintains a current list of licensed banks and credit market undertakings in Sweden on its website; the list includes banking companies, savings banks, members banks, foreign banks, branches of credit institutions in the EU/EEA, credit market companies, foreign credit companies and other licensed institutions supervised by FI. - The law does not explicitly restrict derivatives of the word “bank” such as “banking,” “banker,” etc., in a name, but preparatory work of the BFBA states derivatives are restricted; preparatory work is a source of law and is regarded as a reliable explanation of the legal text. ### Principle 5 — Licensing criteria (introductory note) - Principle summary: - The licensing authority has the power to set criteria and reject applications that do not meet criteria. - Licensing process at minimum consists of assessment of ownership structure and governance (including fitness and propriety of Board members and senior management), strategic and operating plan, internal controls, risk management and projected financial condition (including capital base). - Where proposed owner or parent is a foreign bank, prior consent of its home supervisor is obtained. - EC1 (beginning of description): - The law identifies the authority responsible for granting and withdrawing a banking license. If the licensing authority and the supervisor are not the same, the supervisor has the right to have its views on each application considered and its concerns addressed. The licensing authority provides the supervisor with any information material to supervision of the licensed bank. The supervisor imposes prudential conditions or limitations on newly licensed banks where appropriate. *Source: 1sweea2023008 - Chapter 15 Section 1a of the Public Access to Information and Secrecy Act.* ### Section 1 of the Financial Supervisory Authority Instruction Ordinance grants FI with the ### 1sweea2023008 - Section 1 of the Financial Supervisory Authority Instruction Ordinance grants FI with the ### Licensing authority and legal mandate - FI (Financial Supervisory Authority) is identified as the authority responsible for licensing of financial institutions including banks in Sweden (Section 1 of the Financial Supervisory Authority Instruction Ordinance). - Chapter 3 (section 8) of the Banking and Financing Business Act provides that an application for a license to conduct banking or financing business is to be assessed by FI and that FI will only grant a banking license if the set conditions for conducting banking business (see Chapter 3, section 2 of the Banking and Financing Business Act) are fully met. - Chapter 15, section 3 of the Banking and Financing Business Act provides that FI shall revoke the credit institutions license if, amongst others, the institution fails to commence business to which it has been granted the license within a period of one year from the time the license was granted. - FI has the power to set criteria for licensing banks, reject an application if criteria are not fulfilled or information is inadequate, and to revoke a banking license if it was obtained based on false information (Chapter 15, section 3 point 7 of the BFBA). ### Licensing criteria and regulation (EC2, EC3) - Licensing criteria are set out in Chapter 3, section 2 of the Banking and Financing Business Act (BFBA). - FI has power to set more detailed criteria via regulations, including: - Regulations regarding measures against money laundering and terrorist financing (FFFS 2017:11) - Regulations and guidelines regarding managements of credit risks in credit institutions and securities companies (FFFS 2018:16) - regulations and general guidelines regarding governance, risk management and control at credit institutions (FFFS 2014:1) - FI can reject applications where criteria are not fulfilled or information is inadequate; license revocation possible if license was based on false information. - Out of the 18 applications for commercial banking licenses that were received by FI in the last 5 years, 4 were declined. - Criteria required for licensing (and consistent with ongoing supervision) include: - Conduct of business or planned business in accordance with the provisions of BFBA and other statutes that govern the operation of banks in Sweden; - Suitability of the significant shareholders, individual board members and management of the undertaking; - Suitability of the board as a whole in terms of expertise and experience; - Whether the holder or significant holder of a significant holding has a connection with or can increase the risk of money laundering or terrorist crimes. - Chapter 13 (Section 2) of the BFBA requires supervision to ensure: (i) business is conducted in accordance with BFBA and other statutes; (ii) owners and management satisfy suitability requirements; (iii) significant owners do not have connection with or are not associated with increased risk of money laundering or terrorist financing. ### Assessment scope at licensing (EC4, EC5, EC6, EC7, EC8, EC9) - FI assesses whether proposed legal, managerial, operational and ownership structures (solo and consolidated) will not hinder effective supervision; Chapter 3, section 2 provides license may be granted only where close links do not hinder effective supervision. - FI requires clarity and transparency of ownership; unclear or non-transparent ownership structures lead to application not accepted. - FI requires information on outsourcing plans and evaluates whether outsourcing arrangements hinder supervision or corrective measures. - Fit and proper assessments: - Fit and proper test for major shareholders and significant holders guided by Chapter 3, section 2 and FFFS 2009:3 (regulation on ownership and management assessment). - Assessment includes shareholders’ financial strength, reputation, connection to money laundering/terrorist financing risks, and ability to exercise significant influence. - FI reviews suitability of qualifying owners including capital strength and ownership structure; in one observed case FI identified an additional qualifying owner through supplementary information. - Minimum initial capital requirements (EC6): - A bank shall on commencement of the business have an initial capital of not less than five million euros (Chapter 3, section 5 BFBA). - Minimum initial capital for a savings bank is one million euros (Chapter 3, section 6 BFBA). - A member’s bank and a credit market undertaking can be allowed to have a lower initial capital of one million euros if the total balance sheet will be less than SEK 100 million (Chapter 3, section 7 BFBA); formal consent required and FI has not given such consent for many years. - Board and senior management suitability (EC7): - FI’s licensing procedure includes fit and proper test of Board members and the CEO, assessing relevant and sufficient training and experience, conflicts of interest, and criminal or adverse regulatory records. - FI collects information from the Tax Authority, Police and the Companies Registration Office to facilitate assessments. - Swedish Company Law does not recognize the concept of “senior management”; therefore, members of senior management (except the CEO and his or her deputy) are not legally subject to formal fit and proper assessments by FI. - Strategic, operational, governance and control review (EC8): - Application expected to include business strategy, business plan including financial forecast, operating plan, organization chart, description of outsourcing arrangements, information on proposed Board and CEO. - FI reviews strategic and operating plans, organizational structure, control functions, risk management, outsourcing arrangements, ethical guidelines and anti–money laundering measures. - Assessment memoranda include a three-year financial forecast, business model, capital and liquidity position, risk management, organizational requirements including control functions, internal frameworks, outsourcing agreements, ownership and management. - Financial projections and capital adequacy (EC9): - Applications must include pro forma financial statements and a three-year forecast, including forecast of own funds and capital requirement over a three-year horizon. - Banks must disclose if forecasted capital shortfalls over the coming three years are expected and explain reasons. - FI’s assessment considers Pillar 1 risks (credit, market and operational), Pillar 2 risks (interest rate risk in the banking book and concentration risks) and capital buffer requirements. - Financial strength of significant holders is assessed as part of suitability. ### Cross-border establishments and interaction with home supervisors (EC10) - Foreign banks from within the EU do not require a formal license to establish a branch in Sweden; a notification procedure between home and host supervisors applies. - FI requires a notification from the home supervisor stating it has no objection to opening the branch in Sweden (Chapter 4, section 1 BFBA). - Foreign banks from outside the EU planning to open a branch in Sweden: FI requires the home supervisor to give a formal consent before a formal license is granted (Chapter 4, section 4 BFBA). - For foreign banks planning a subsidiary in Sweden, FI contacts the foreign (home) supervisor before deciding on the license; assessment informed by home supervisor contact and includes fitness and propriety. ### Monitoring new entrants and supervisory follow-up (EC11) - Authorities noted new entrants are followed up more closely than other banks with the same risks; normal practice is an in-depth follow-up one year after commencement of operations. - The practice is not formalized; assessors recommend formalization to ensure: - Besides firm category based on systemic importance (i.e., category 1-4), the frequency of SREP is also informed by time since license was granted; - New entrants are subjected to a detailed onsite examination to assess effectiveness of procedures, controls and governance in real practice. - Current observation: closer follow-up was noted by authorities but assessors could not find documented evidence in supervisory processes. ### Assessment outcome, findings and recommendations - Assessment of Principle 5: Largely Compliant. - Key findings: - Legal framework clearly assigns licensing responsibility to FI and empowers FI to set criteria, reject applications, and revoke licenses obtained on false information. - FI’s licensing criteria are broadly consistent with ongoing supervision and include comprehensive assessments of owners, ownership structure, control functions, outsourcing, pro forma financials and three-year forecasts. - Gap: Swedish law does not recognize “senior management,” limiting FI’s formal fit and proper assessments to the CEO and deputy; other senior managers are not legally subject to formal FI fit and proper assessments. - Process gap: Monitoring of new entrants is practiced but not formalized or documented sufficiently to evidence consistent supervisory follow-up. - Recommendations implied by assessors: - Formalize supervisory processes for monitoring new entrants (e.g., internal policy to require more frequent SREP and detailed onsite examinations for new entrants relative to similarly sized entities). - Address the legal gap regarding formal recognition of “senior management” to enable comprehensive fit and proper assessments of senior management beyond the CEO and deputy. *Source: Excerpt from the IMF assessment document provided.* ### Chapter 1, section 5 (15) of the Banking and Financing Business Act defines “qualifying ### 1sweea2023008 - Chapter 1, section 5 (15) of the Banking and Financing Business Act defines “qualifying ### Definition of “qualifying holding” - Chapter 1, section 5 (15) of the Banking and Financing Business Act defines “qualifying holding” as a direct or indirect ownership in an undertaking, where the holding represents ten percent or more of the equity capital or of the voting capital or where the holding otherwise renders it possible to exercise a significant influence over the management of the undertaking. ### Principle 6 — Ownership, control, and transfer of significant ownership (EC2–EC6): legal powers and supervisory requirements - EC2 — Requirements to obtain supervisory approval or provide immediate notification of proposed changes: - Chapter 14, section 1 of the Banking and Financing Business Act: consent from FI is required prior to a direct or indirect acquisition of shares in a credit institution which would result in an acquirer becoming a qualifying (significant) holding. - Prior consent requirement also applies to acquisitions resulting in an increase in a qualifying holding such that it amounts to or exceeds 20, 30 or 50 percent of equity capital or voting capital for all shares or participating interests or which would cause the undertaking to become a subsidiary. - Acquisitions occurring by division of joint marital property, testamentary disposition, corporate distribution, or similar measures: the acquirer must apply for consent within six months of the acquisition to retain the shares or participating interests. - EC3 — Power to reject or reverse a change in significant ownership: - FI only gives consent if set criteria for approval of a change in significant ownership in an existing bank are met, which are the same as the criteria used to assess suitability of shareholders when licensing a bank. - Section 37 of The Administrative Procedure Act gives FI powers to change or reverse a decision if based on incorrect or misleading information; FI therefore has the power to reverse a decision should it be based on false information. - EC4 — Reporting and identification of significant shareholders and beneficial owners: - Chapter 14, Section 4 requires credit institutions other than savings banks to submit an annual statement to FI containing names of persons who hold a qualifying holding and the extent of such holdings. - FFFS 2011:14 (FI regulations and general guidelines) require credit institutions to report qualifying holdings on an annual basis and whenever there are changes; applies to all credit institutions including savings banks. - Required information for each owner with a qualifying holding: - Personal identification number or company registration number, alternatively foreign identification number; - Each owner’s holdings expressed as a percentage of capital and votes, respectively, for both direct and indirect participations; and - The date the owner’s qualifying holding in the institution enters into effect. - Additional required information where the owner is not a Swedish institution: - Name or business name; - The firm’s registered office, city and postal code; - Business code as per the table below; and - Operational description, brief summary of main business. - FI provided assessors a sample report on qualified owners drawn from its reporting tool. - EC5 — Powers to address unapproved changes of control: - Chapter 14, section 6: FI can prohibit a holder who failed to submit an application for consent from representing the shares or participating interest to the extent subject to a consent requirement. - Chapter 14, section 7: FI may order an owner to divest a portion of its shares or ownership rights so the holding no longer constitutes a qualifying (controlling) holding, and can order divestment to ensure compliance with FI decisions. - Example: FI identified unqualified owners exercising significant influence at a licensed entity, leading to supervision difficulties and resulting in sanctions and about four months for the entity to wind up operations while under FI supervision with operational restrictions. - EC6 — Notification obligations by banks regarding material changes in suitability: - Swedish laws or regulations do not explicitly require banks to notify FI as soon as they become aware of any material information which may negatively affect the suitability of a major shareholder. - Chapter 14, section 4 requires institutions to report to FI when they become aware of changes in significant ownership. ### Assessment of Principle 6 - Overall assessment: Largely Compliant - Key conclusions: - Law recognizes significant ownership (“qualifying holding”) at ten percent or more of equity or voting capital or where significant influence is possible. - Prior consent from FI is required for acquisitions creating or increasing significant ownership; FI has powers to reject, modify, or reverse approvals if based on false information. - Consent criteria for changes in significant ownership are the same as those used for licensing banks. - Annual reporting obligations exist for all banks to inform FI of significant shareholders and their holding sizes. - FI can prohibit representation of shares at general meetings, and can order divestment to remove controlling interests. - Gap: no explicit statutory or regulatory requirement for credit institutions to notify FI immediately upon becoming aware of material information affecting a major shareholder’s suitability. ### Principle 7 — Major acquisitions (EC1–EC5, AC1): authorization thresholds, criteria, and supervisory approach - EC1 — Definitions of acquisitions/investments requiring prior approval vs. notification: - Chapter 7, section 12 of the Banking and Financing Business Act: credit institutions must obtain prior authorization from FI before acquiring property where the consideration to be paid is more than 25 percent of its own funds. - FFFS 2016:1: credit institutions must notify FI if they intend to acquire property for which the consideration is more than SEK 10 million or 10 percent of own funds and less than 25 percent of own funds; notification must be made before acquisition. - EC2 — Criteria to judge proposals: - Swedish law/regulation does not provide specific criteria by statute; more specific criteria exist in the law’s preparatory work and FI’s internal work procedures and templates. - Assessors noted a gap due to lack of specific provisions in law or binding regulation on criteria to be applied in assessment of individual proposals, potentially limiting FI’s discretion and consistency. - EC3 — Objective criteria consistent with licensing requirements and supervisory assessment: - FI’s nonbinding work processes and templates guide authorization assessments; documented considerations include: - Analysis of terms and conditions of the acquisition to evaluate effects on capital position, i.e., goodwill, minority interests, etc. - Assessment of impact on the acquiring company’s consolidated position, financial strength, risk exposure, organization, governance and internal control. - Assessment of capital and liquidity adequacy of the acquiring company after the acquisition. - Business model analysis to assess the impact of the acquisition and to challenge forecasts provided by the acquirer. - Fit and proper assessment of owners if ownership structure or significant shareholding changes. - Assessment if acquisition may hinder effective supervision or affect supervisory needs. - Authorization decision: supervisor and administrating legal counsel determine, according to licensing criteria, whether reasons exist not to grant authorization. - EC4 — Assessment of acquiring bank’s resources to execute acquisition: - FI work process requires submission of information including: - the capital base of the company (consolidated situation) and the capital requirements before and after acquisition; - how the company intends to finance the acquisition; - indication of the impact of the acquisition on existing operations, business orientation and business model; - new risks arising from the acquisition and how these will be managed; and - details of the company’s liquidity before and after the acquisition. - Acquirer must submit ownership review and/or notification of management suitability where acquisition is expected to change ownership structure or management positions. - EC5 — Supervision of risks from nonbanking activities: - FI is an integrated financial sector supervisor practicing consolidated supervision; risks within a banking group and at entity level are assessed as part of the SREP exercise. - Chapter 6 Section 2 (BFBA) requires credit institutions to identify, measure, control, internally report and verify risks associated with operations; Chapter 15 provides FI with intervention powers (e.g., orders to limit or reduce risks, rectification measures, injunctions, adverse remarks). - Chapter 7, Section 2 (BFBA): a credit institution may only possess property needed for its own business operations. - Authorizations may include terms or time limits; FI may impose conditions or time limits on acquisition authorizations. - AC1 — Review of major acquisitions/investments by other group entities: - FI’s prior authorization is required where consideration for an acquisition exceeds 25 percent of a credit institution’s capital base (Chapter 7, Section 12, BFBA). - No explicit statutory or regulatory detailed criteria for judging individual proposals, but FI has internal procedures setting assessment criteria. - SREP implementation provides a route to address risks arising from nonfinancial activities, group structures and unconsolidated entities; FI may impose higher capital requirements or order risk reduction if statutory requirements on risk management, transparency and soundness are not met. *Source: Chapter excerpts from the Banking and Financing Business Act and related FI regulations and work procedures as presented in the assessed material.* ### Chapter 15 (section 1) of the Banking and Financing Business Act. ### Chapter 15 (section 1) of the Banking and Financing Business Act ### Notification requirement for acquisitions (FFFS 2016:1) - The regulation on notification of certain acquisition (FFFS 2016:1) requires institutions to notify FI prior to the acquisition of property when: - the purchase price corresponds to at least SEK 10 million, and - the purchase price is the equivalent of at least 10 percent and at most 25 percent of own funds of the acquiring firm. - Notification shall be given prior to the acquisition. - Purpose: to help ensure that FI has visibility over acquisitions by firms, which can be an input into its risk assessment of the institution as part of the SREP or other investigation. ### Relevant provisions of the BFBA - Chapter 7, section 12: - Provides that authorization to acquire property shall be granted unless it can be assumed that the acquisition will result in the violation of the Act or other statutes. - FI noted that this can be inferred as a reference, amongst others, to Chapter 6 of BFBA. - Chapter 6 — “General provisions regarding the business of a credit institution.”: - Chapter 6, Section 1: - Requires that a credit institution’s operations shall be conducted in such a manner that the institution’s ability to perform its obligations is not jeopardized. - Chapter 6, Section 2: - Provides that a credit institution shall identify, measure, manage, internally report and have control over the risks associated with its operations. - Requires that the institution shall ensure that it has in place effective internal controls. *Source: Chapter 15 (section 1) of the Banking and Financing Business Act (1sweea2023008).* ### Chapter 7, section 2 of the BFBA provides that a credit institution may only possess ### 1sweea2023008 - Chapter 7, section 2 of the BFBA provides that a credit institution may only possess ### Acquisition, possession and disposal rules (BFBA) - Credit institutions may only possess property that it needs for its own business operations. - Chapter 7, section 6-8 of the BFBA requires that any property acquired to secure a claim must be: - reported to FI, and - disposed of as soon as deemed appropriate in light of market conditions and, in any event, within three years, unless FI approves otherwise. - A list of such properties is to be provided annually to FI. ### Supervisory thresholds, notification and approval procedures - Prior supervisory approval is required where consideration is more than 25 percent of own funds of the acquirer. - Notification in advance is required where the consideration is more than SEK 10 million or 10 percent of own funds but less than 25 percent of own funds. - While there is no current Swedish law or regulation specifying criteria for judging proposals requiring prior approval, preparatory work (referred to as a reliable source of law in Sweden) contains more specific criteria. - FI has developed nonbinding work procedures and templates to facilitate assessment of acquisition proposals; the authorization process includes assessment of whether the acquisition may violate the Banking and Financing Business Act or other statutes, focusing on: - capital, liquidity, risk management and transparency requirements; - new risks arising from the acquisition and how they will be managed; - impact of the acquisition on the company’s operations and business model; - how the company intends to finance the acquisition. - Acquirers must submit an ownership review and/or notification of management suitability where the acquisition is expected to result in a change in ownership structure or management positions. ### FI powers and remedial actions under the Banking and Financing Business Act - Credit institutions must identify, measure, control, internally report and verify risks associated with operations. - Where an institution has violated legal obligations, FI can intervene by, among other measures: - issuing an order to limit or reduce the risks associated with the operations; - taking measures to rectify the situation within a specific time; - issuing an injunction; - issuing an adverse remark. - Under SREP, FI may impose a higher capital requirement or an order to the institution to reduce risks where statutory requirements regarding risk management, transparency and soundness are not met (Chapter 15, section 1). ### Assessment of Principle 7 — Conclusion - Assessment: Largely Compliant ### Supervisory approach — Overview of Principle 8 and FI methodologies - Principle 8 summary: supervisor must develop and maintain a forward-looking assessment of banks’ risk profiles, identify and address system-wide risks, have early intervention framework, and resolution plans in partnership with relevant authorities. ### EC1 — Methodology for determining and assessing risks - FI categorizes Swedish credit institutions and Swedish branches of foreign credit institutions into four categories (category 1 - 4) based on systemic importance; categorization is done yearly with possibility for ongoing changes. - Starting point for categorization is the EBA methodology for O-SII, complemented with qualitative assessment; qualitative adjustments have moved some institutions across categories. - Categorization informs: - frequency and scope of SREP; - design of ongoing supervision; - application of supervisory methods (some methods only applied to most systemically important institutions). - SREP frequency by category: - full SREP every year for institutions in category 1; - every second year for institutions in category 2; - every three years for institutions in category 3; - less frequently and more risk-based for institutions in category 4. - 2021: a simplified SREP introduced allowing more frequent SREP for category 4 institutions. - Full SREP is performed annually for significant plus and significant branches. - FI uses SREP based on EBA SREP Guidelines issued in 2014 and revised in 2017 and 2022. - SREP scoring: - overall SREP score between 1 (low level of risk) and 4 (high level of risk); - four viability scores: (i) business model analysis (BMA); (ii) internal governance and institution-wide control; (iii) capital adequacy; (iv) liquidity adequacy. - viability scores for capital and liquidity are supported by underlying risk scores; risk scores range between 1 (low level of risk) and 4 (high level of risk). - Risk coverage in SREP includes credit, operational, market, insurance, pension, liquidity and funding risks; IRB model risks captured under credit risk; IT risks captured under operational risk. - Peer review/benchmarking, risk seminars and supervisory committees are used to challenge and validate scores. - Observations and deficiencies: - Need for more comprehensive onsite inspections and greater use of risk experts (especially for IT risk and IRB model assessment). - Lack of clarity on factors determining scope and frequency of SREP for high-risk institutions in category 3 and 4. - Concern that absence of regular onsite inspection and detailed testing may hinder effective supervisory judgement. ### EC2 — Forward-looking view and use of SREP - FI uses SREP as main tool for risk profile assessment; includes Business Model Analysis (BMA) and stress testing with forward-looking elements. - BMA assesses ability to generate acceptable return: - over the next 12 months (sustainability of business model); - over three years (sustainability of strategy). - Inherent risk assessment includes review of banks’ stress testing processes, macroeconomic and financial market developments, expected growth and effects of economic cycle via stress testing. - Supervisory cycle primarily driven by institution categorization rather than individual risk ranking; FI maintains a list of institutions selected for intensified frequent risk assessment based on individual risk situation. - Lead supervisors analyze key risk indicators quarterly and flag changes that may warrant intensified supervision. - Assessors noted lack of clarity how SREP score influences supervisory cycle; reliance on category may affect timeliness of supervisory action for category 3 and 4 institutions. - Recommendation implied: consider a risk ranking system based on more frequent COREP and FINREP to better target supervisory resources. ### EC3 — Assessing compliance with prudential regulations and legal requirements - FI processes for assessing compliance include continuous risk assessment, thematic reviews, deep-dive analyses and investigations. - Monitoring frequency: - KRIs and legal requirements for solvency (leverage ratio and CAR) monitored quarterly; - LCR and NSFR monitored monthly. - SREP frequency: - annual for category 1; - at least every second year for category 2; - less frequent for category 3 and 4 (every three to five years), which may reduce effectiveness for smaller institutions. - FI has dashboards using traffic light system and trend analysis reports. - Thematic reviews (e.g., yearly mortgage lending review) and well-structured thematic reviews recommended as effective tools given resource constraints. - Deep-dive analyses documented and may lead to investigations performed on risk-based basis. - Onsite supervision: - No distinction between onsite and offsite supervision; degree of onsite work very limited with time onsite rarely exceeding 3-4 days. - Lack of dedicated onsite inspection team; inspections often targeted at specific issues and include offsite components. - Limited onsite time undermines ability to test effectiveness of internal controls, compliance, reliability of supervisory reporting, IRB model deployment, asset classification and provisioning. - IRB model review currently focuses on high-level monitoring of model governance; no detailed testing due to ongoing IRB repair, resource limitations and high turnover of credit model experts. - FI conducts quarterly risk review meetings: - for the 3 largest banks: quarterly with CFO, CRO, Head of Compliance and Head of Internal Audit; - for category 2 banks: twice a year. - Documents submitted for risk meetings include CRO report, compliance report, CFO report, internal audit report, group recovery plan, ICAAP documents, credit information, top 25 exposures. - KRIs are monitored quarterly for institutions in categories 2-4 and form an early-warning system. - Recommendation implied: FI should increase focus on assessing quality of end-to-end supervisory reporting processes and provide supervisors with more analytical tools for processing bank-provided information. ### EC4 — Macroeconomic environment in risk assessment - FI has microprudential and macroprudential mandate and monitors the financial system to prevent imbalances. - FI integrates cross-sectoral developments into its Risk Identification Process and publishes “Stability in the Financial System” twice a year. - Business Model Analysis considers current information and forecasts on macroeconomic indicators including GDP, unemployment, interest rates, house price developments and consumer confidence. - Example: SREP assessment reports considered macroeconomic environment and COVID-19 related uncertainty. ### EC5 — System-wide risk monitoring, concentrations and communication - FI prepares “Stability in the Financial System” semi-annually and a “Bank barometer” with same frequency describing industry trends; both are public. - Stability report includes banks’ vulnerability in relation to concentration and interconnectivity, solvency and profitability, asset quality and credit risk, and financing and liquidity. - Bank barometer contains distribution of bank lending, lending by banks to the public, bank financing, profitability, and supports benchmarking by business model categories. - FI is a member of the Financial Stability Council (FSC) alongside the government (MoF), the Riksbank, and the SNDO; FSC meets regularly and minutes are public; FSC has no decision-making mandate. - FI imposed a risk weight floor: - risk weight floor of 25 percent for Swedish mortgage in pillar 1; - pillar 2: risk weight floor of 25 percent for commercial residential property and risk weight floor of 35 percent for commercial property. - FI noted concentration risk in CRE sector and emphasized ensuring systemically important actors and markets are sufficiently resilient. ### EC6 — Resolvability assessments and cooperation with resolution authority - BRRD transposed into Swedish law through the Resolution Act and Resolution Ordinance; SNDO is designated resolution authority; FI provides comments on resolution plans. - FI assesses banks’ recovery plans and consults SNDO; SNDO assesses resolvability annually in connection with resolution plans but has not yet formulated all assessment details. - EBA guidelines on resolvability published January 13, 2022 and enter into force on January 1, 2024; SNDO intends to base its resolvability framework on these guidelines. - SNDO has set minimum requirements for own funds and eligible liabilities (MREL) and continuously monitors compliance. - FI supports SNDO by supervising MREL and intervening after consultation when institutions fail to comply. - Recommendation implied: FI and SNDO should continue refining cooperation processes and SNDO should develop detailed resolvability assessment content. ### EC7 — Framework for handling banks in stress - FI is responsible for determining whether an institute is failing or likely to fail (FOLF) but must consult SNDO and the Riksbank prior to determination. *Source: 1sweea2023008 - Chapter 7, section 2 of the BFBA provides that a credit institution may only possess* ### Chapter 8, section 1 of the Resolution Act. Initiation of FOLF assessment is made either by ### Chapter 8, section 1 of the Resolution Act. Initiation of FOLF assessment is made either by ### Initiation and purpose of FOLF assessment - Initiation of FOLF assessment is made either by FI or by SNDO. - The dual initiation power aims to ensure that FOLF assessments are made in a timely manner. ### Relationship with SREP - The FOLF is an outcome of the supervisory review and evaluation process (SREP). - Where a FOLF decision is needed then SREP will be updated. ### Resolution decision process and criteria - Subsequent to a FOLF assessment, SNDO determines whether the institution should be placed into resolution. - In addition to the bank being FOLF, two criteria need to be met as per Chapter 8, Article 5-10 of the Resolution Act: - (i) absence of alternative measures to prevent a failure, and - (ii) resolution being in the public interest. ### Actions upon resolution decision - Once resolution has been decided, SNDO assumes control of the bank (Chapter 10, Article 1). - SNDO is required to as soon as possible publicly announce the resolution decision (Chapter 8, Article 13). *Source: https://www.imf.org/-/media/files/publications/cr/2023/english/1sweea2023008.pdf* ### Chapter 6a (section 1) of the Banking and Financing Business Act also requires banks to ### 1sweea2023008 - Chapter 6a (section 1) of the Banking and Financing Business Act also requires banks to ### Recovery plans and legal requirements - Chapter 6a (section 1) of the Banking and Financing Business Act requires banks to draw up recovery plans. - Section 3 requires that a recovery plan and a group recovery plan should set out: - (i) the measures which are identified as reasonably being expected to lead to the credit institution or group being able to preserve or restore its financial position and viability, and - (ii) the plan and the measures which are identified as reasonably being expected to be carried out quickly and efficiently in the event of financial stress and without leading to a serious disruption in the financial system. ### EC8 — Supervisory perimeter, bank-like activities and regulatory arbitrage - Where the supervisor becomes aware of bank-like activities being performed fully or partially outside the regulatory perimeter, the supervisor takes appropriate steps to draw the matter to the attention of the responsible authority. - Where the supervisor becomes aware of banks restructuring their activities to avoid the regulatory perimeter, the supervisor takes appropriate steps to address this. - Use of the word ‘bank’ is restricted by law and its use requires approval. - FI is responsible for supervision of the whole of the financial sector in Sweden and has legal powers to take action against companies performing services without authorization. - Chapter 15, section 18 of the Banking and Financing Business Act (BFBA) provides that where any person conducts such business as covered by this BFBA without a license to do so, FI shall order such person to cease the business. - Historical enforcement: FI has forced a few companies to close down operations for conducting business without authorization. - Case evidence: FI addressed regulatory arbitrage where new mortgage providers transfer loans to special funds, avoiding capital charges associated with on-balance sheet lending. FI analyzed risks and issued a memorandum setting out preconditions to ensure new actors in the mortgage market do not increase risks for consumers or the financial system; these preconditions inform authorization assessment and supervision of mortgage market players. ### Assessment of Principle 8 - Assessment: Largely Compliant - FI practices and tools: - FI has a methodology for categorizing Swedish credit institutions and Swedish branches of foreign credit institutions based on systemic importance, using EBA methodology for O-SII as a starting point complemented by qualitative factors. - Categorization informs: - (i) frequency and scope of FI's SREP of individual credit institutions and branches; - (ii) design of FI's ongoing supervision; and - (iii) usage and application of FI's supervisory methods. - SREP produces: business model, internal governance and institution-wide control, capital adequacy and liquidity adequacy assessments to obtain a risk score; outputs include Pillar 2 capital requirement, Pillar 2 liquidity buffer requirements, and Pillar 2 capital guidance. - FI collaborates with the Financial Stability Council and publishes semi-annual financial stability reports used for macro-level risk identification. Key banking vulnerabilities identified included: concentration and connectivity, solvency and profitability, and asset quality. - FI uses tools including: (i) KRIs covering solvency, liquidity and balance sheet ratios, (ii) SREP process, (iii) thematic reviews, (iv) deep dives, (v) quarterly or semiannual risk review meetings with banks’ senior management. - Noted issues: - Minimum level and type of engagement in regular SREP process is predominantly driven by firm category rather than risk profile, which may delay supervisory action for smaller institutions given long SREP cycles. - Inconsistency in risk assessment and supervisory outcomes attributed to lack of depth of risk experts in areas such as new business models, cyber-security, risk methodologies, stress testing, and governance. - Lack of clarity regarding factors determining scope and frequency of SREP for institutions in category 3 and 4. ### Principle 9 — Supervisory techniques and tools: overall assessment - Assessment: Materially Non-Compliant ### EC1 — mix of onsite and offsite supervision - FI has a risk-based approach focused on large institutions (categories 1 and 2). - FI does not distinguish between onsite and offsite supervision; same experts conduct both. - Onsite intensity: - Onsite visits vary but rarely exceed 3-4 days. - For three major banking groups and two largest branches: multiple visits per year as part of SREP including quarterly risk assessment updates. - Ongoing supervision onsite engagement with major banking groups includes: - (i) quarterly meetings with CFO, CRO, Head of Compliance and internal audit; - (ii) annual meetings with executive management and the Board; - (iii) annual meeting with external auditor. - SREP frequency: - Category 1: annual SREP conducted jointly with supervisory college. - Category 2: SREP at least every second year. - Smaller credit institutions: SREP every third year. - Supervisory investigations (ad-hoc) can be quick offsite or full on- and offsite; onsite time rarely exceeds 3–4 days. - Assessors’ view: - Current level of onsite inspections is inadequate, especially given 3–4 day onsite duration and limited use of inspection techniques. - Continued lack of intrusive onsite inspections could result in significant risks being missed. ### EC2 — process for planning and executing onsite and offsite activities - FI has documented supervisory strategy/processes for risk identification, categorization, SREP, KRIs, recovery plan review, supervisory analysis and inspections. - Standardized templates and checklists exist for scoping, meeting agendas and communication. - FI does not distinguish between onsite and offsite functions; risk departments conduct supervisory investigations and analyses. - Supervisory committee chaired by Executive Director of Operational Section Banking ensures consistency of supervisory decisions; FI staff hold risk seminars to challenge risk ratings and findings. - Assessors noted absence of detailed supervisory manual for onsite inspections; such manuals would enhance consistency and training given high staff turnover. ### EC3 — information sources and verification - FI implements EU directives/regulations and EBA guidelines; uses COREP/FINREP regulatory reporting framework and national reporting requirements. - Reporting frequency varies: monthly, quarterly, annually or when changes occur. - Examples of national reports: Money Laundering Report, holdings by qualifying owners and property acquired to protect a claim, standard reporting template, ICAAP and interest rate risk in non-trading activities. - EU/EBA reports: COREP (Own Funds requirement, Leverage Ratio, Liquidity Coverage Ratio, Net Stable Funding Ratio and Large Exposures), FINREP, Funding Plans, etc. - Banks submit ICAAP/ILAAP, recovery plans and stress testing results. - FI collects information to calculate Pillar 2 capital add-on for IRRBB, credit concentration risk and pension risk. - FI introduced COVID-19 reporting requirements to track pandemic impact on credit portfolios. - FI largely relies on firms’ internal quality assurance controls and internal audit for data quality and board approval for ICAAP/ILAAP/recovery plans. - Assessors noted onsite work is unlikely to be sufficient to determine reliability of all information; additional information was requested in SREP processes including: strategy and business plan, financial forecasts, internal controls and governance, granular credit risk information, performance indicators for credit risk models, credit concentrations, ICAAP adverse scenarios. ### EC4 — tools for regular review and assessment - FI tools/methodologies include analysis of risk exposures, capital and liquidity adequacy, business model viability, internal governance and controls, supervisory stress tests and sensitivity tests. - Gaps: - FI’s review of banks’ own stress testing is limited and does not comprehensively assess methodologies and assumptions, especially for larger banks due to resource constraints. - Review of IRB models focused on high-level monitoring of model performance and governance; no detailed testing carried out. - FI conducts thematic reviews such as: - (i) annual survey of new consumer credit, - (ii) review and analysis of funding structure for three Swedish banks, - (iii) thematic review of accounting of defined pension plans under IAS 19 focusing on actuarial assumptions. - FI communicates SREP findings in formal decisions in line with EBA SREP Guidelines and publishes capital requirements and Pillar 2 guidance for large institutions quarterly. - Assessors identified need for greater consistency and clarity in communication of findings, including granularity and root-cause identification. ### EC5 — systemic risk identification and supervisory stress testing - FI runs supervisory stress tests for financial stability analysis and for determining Pillar 2 guidance (based on a sensitivity stress test). - FI participates in EBA EU-wide stress testing program; 2020 stress test covered five Swedish banks while large branches were covered indirectly via parents. - FI and the Riksbank publish financial stability reports twice a year identifying key banking vulnerabilities. - FI performs an annual bottom-up risk identification process to set top supervisory priorities; top supervisory priorities are published. ### EC6 — evaluation and reliance on internal audit function (IAF) - FI meets IAF of the three largest banks on a quarterly or semi-annual basis to assess quality, management and competence of internal audit, examining reports, work programs and risk analyses. - For banks in category 2, supervisors examine all auditor reports and audit plans as part of ongoing supervision. - Evidence provided: minutes of meetings, presentations, SREP reports show assessment of internal audit including reporting lines, audit findings, resourcing, backlogs and report granularity. - FI has no regular meetings with IAF in other banks. ### EC7 — contacts with Board, management and challenge of strategy - Director General of FI meets Boards and CEOs of three large banks at least annually. - Executive Director of Banking Supervision and Group Supervisor meet CEO and executive management annually to discuss business model viability. - Director of Banking Supervision meets CFO, CRO and Head of Treasury quarterly to discuss financial results and risk development. - Group supervisors meet Head of Compliance and Internal Audit to discuss key issues. - FI does not typically meet separately with independent board members; limited contact with boards and senior management of smaller banks (event-driven). - Banks indicated desire for increased engagement. ### EC8 — communication of supervisory findings - FI procedural documents specify communication protocols; all investigations are publicly announced on FI’s website and outcomes, including mitigating actions, are published. - SREP results communicated in formal decision; capital requirements and Pillar 2 guidance published quarterly for large credit institutions. - Closing letters of investigations are sent to CEO with copy to Chair of the board. - Annual meetings between FI’s Director General and boards of largest banks discuss key findings; such regular meetings are not typical for smaller banks. ### EC9 — follow-up and escalation - FI monitors and follows up on mitigating actions via SREP; frequent meetings with large firms facilitate timely communication and follow-up. - Supervisory engagement for smaller institutions is less frequent, but supervisors can seek more frequent follow-ups where needed. - Assessors found instances where expectations, specific actions, expected outcomes and timelines were not clearly or explicitly defined. - Distinction in FI communications: formal assessment of non-compliance within examinations versus less strict expressions of weaknesses within SREP. ### EC10 — notification requirements - Firms subject to EU regulations requiring notification of substantive changes, breaches of minimum requirements, breaches of Pillar 2 guidance, or triggers in recovery plans. - Regulation on notification of certain acquisition (FFFS 2016:1) requires notification to FI of planned acquisition or investment exceeding 10 percent of own funds or SEK 10 million prior to acquisition. - FI’s general guidelines on reporting of events of material significance (FFFS 2018:5) require immediate reporting to FI of events that could lead to significant financial loss for a large number of customers or considerable reputational loss. - Branches subject to notification requirements typically communicated via home supervisor using “change in branch particulars” template. ### EC11 — use of independent third parties - FI has power to commission experts; Swedish Banking and Financing Business Act (Chapter 13, article 9) enables FI to hire and appoint auditors to participate in institution audits where needed. - FI uses external auditors for annual assessment of firms’ compliance with covered bond regulations and can hire external experts for specific inspections (exceptions rather than rule). - Results from external audits are reviewed and findings incorporated into ongoing supervision and SREP. ### EC12 — supervisory information systems and data processing - FI developed in-house reports and risk dashboards and recently implemented a new data platform (FIDA) for finding, extracting and working with regulatory data. - SREP and supervisory findings registered in MS Access (FI-loggen) for monitoring and follow-up. - FI uses Abacus regulator 3 and in-house solutions to process regulatory data which feed into SAS for aggregation and KRIs calculation; end users use Excel, SAS and FIDA. - Liquidity risk performance measures fully automated in SAS; other risk areas predominantly use SAS_VA. - System for capturing regulatory data has no restrictions regarding previous reported version; FI has SAS processes to identify changes between returns. - Supervisors have a system for monitoring KRIs with automatically calculated indicators including: LCR, NSFR, cost-to-income ratio, return on equity and credit losses. - Risk experts have more detailed KRI systems; other risk performance measures require further development for monitoring and benchmarking. ### AC1 — independent review of supervisory tools - FI’s independent internal audit function reviews and evaluates effectiveness of FI’s processes, decisions and internal governance and controls including adequacy and effectiveness of supervisory tools. - Annual audit plan is risk-based and signed off by the board. ### Principal 9 — Key comments and supervisory gaps (Materially Non-Compliant) - FI focuses supervisory resources on large banks; tools include continuous assessment, SREP, investigations, deep-dives and thematic surveys. - Major gaps: - No distinction between onsite and offsite supervision; onsite inspections are generally inadequate (3–4 days) and do not involve extensive testing of compliance, internal controls, data reliability, IRB model deployment or exposure classification. - Supervision of banks’ stress testing practices and IRB models lacks detailed challenge of processes, assumptions and methodologies; reviews do not include deep-dive assessments or detailed testing. - Excessive reliance on banks’ internal quality assurance and internal audit for data and reports (ICAAP, ILAAP, recovery plans) due to insufficient onsite capacity. - Lack of detailed supervisory manuals and procedural documentation to ensure consistency and retain institutional knowledge amid high staff turnover. - Communication of supervisory findings lacks consistency, clarity and granularity needed to address root causes. - Limited engagement with smaller but potentially high-risk institutions (categories 3 and 4) and long SREP cycle of 3 years for smaller institutions (which sometimes is not met) risks delayed identification and escalation of issues. - Uneven automation of performance measures across risk types; liquidity fully automated while other risk indicators need further development. - Recommended supervisory enhancements implied by assessors (based on identified gaps): - Increase onsite inspection intensity and use inspection techniques to test internal controls and data reliability. - Strengthen resources and senior-level expertise, particularly for IRB model assessment/validation, stress testing and specialist risk areas (cybersecurity, risk measurement methodologies). - Develop detailed supervisory manuals and granular procedural documentation to improve consistency and staff training. - Reduce excessive reliance on banks’ internal assurances; perform targeted independent verification of data quality using risk-based approach. - Enhance supervisory engagement with smaller high-risk institutions, potentially through targeted thematic reviews and more frequent interactions. - Further develop automated performance measures and KRIs for non-liquidity risk areas to enable better monitoring and benchmarking. - Improve clarity and granularity of communication to banks, including explicit timelines and expected outcomes for remedial actions. ### Principle 10 — Supervisory reporting (introductory EC1 quoted) - Principle 10 statement: The supervisor collects, reviews and analyzes prudential reports and statistical returns from banks on both a solo and a consolidated basis, and independently verifies these reports through either onsite examinations or use of external experts. - EC1 (beginning): The supervisor has the power to require banks to submit information, on both a solo and a consolidated basis, on their financial condition, performance, and risks, on demand and at regular intervals. These reports provide information such as on- and off-balance sheet assets and liabilities, profit and loss, capital adequacy, liquidity, large exposures, risk concentrations (including by economic sector, geography and currency), asset quality, loan loss provisioning, related-party transactions, interest rate risk, and market risk. *Source: 1sweea2023008 - Chapter 6a (section 1) of the Banking and Financing Business Act also requires banks to (excerpts).* ### Chapter 13 of the Banking and Financing Business Act give FI the power to request any ### 1sweea2023008 - Chapter 13 of the Banking and Financing Business Act give FI the power to request any ### Supervisory reporting framework and harmonized reporting - FI has a reporting framework based on both Swedish and EU-regulations. The current periodical supervisory reporting is submitted according to Swedish national regulations, EU regulation and EBA guidelines. - The harmonized reporting includes information on: - 1. Solvency/COREP (capital adequacy); - 2. Financial information/FINREP (on- and off-balance sheet assets and liabilities, profit and loss, asset quality (NPLs, forbearance), loan loss provisioning, related-party transactions, geographical, sectoral concentration); - 3. Large exposures (concentration per counterparty sector and region) • Losses from immovable property; - 4. Leverage ratio; - 5. Liquidity (LCR and NSFR (with detail of significant currencies) and additional monitoring metrics); - 6. Asset encumbrance; - 7. Supervisory benchmarking; - 8. Funding plans; and - 9. Remuneration policies. ### New reporting introduced since last FSAP - The new reports that have been introduced as a result of changes in EU and Swedish regulated reporting since the last FSAP include: - 1. Reporting on additional liquidity monitoring metrics; - 2. Reporting on liquidity requirements; - 3. Guidelines on COVID-19 measures reporting and disclosure; - 4. Guidelines on fraud reporting under PSD2; - 5. Reporting for the purposes of identifying G-SIIs and assigning G-SII buffer rates; - 6. Specific reporting requirements for market risk (FRTB); and - 7. Money laundering. ### EC2 — Accounting standards for supervisory reports - Legal and regulatory requirements: - Chapter 7, section 2 of FI’s regulations and general guideline regarding annual accounts for credit institutions and securities companies (FFFS 2008:25) stipulates that all credit institutions and securities companies and financial holding companies regardless of size or if they are listed or not applies IFRS (approved by the EU) in their consolidated financial statements. - Regulation (EC) No 1606/2002 of the European Parliament and of the Council of July 19, 2002 on the application of international accounting standards (IAS-regulation) requires all European listed entities to apply IFRS in their consolidated financial statements. - Chapter 2, section 1 of FFFS 2008:25 also stipulates that institutions should apply international financial reporting standards approved by the EU in their annual financial statement if nothing else is required by law (e.g., the Annual Accounts Act for Credit Institutions and Securities Companies,1995:1559) or by FI’s regulations according to FFFS 2008:25. - Practice: - Financial statements on an entity level are prepared based on Swedish local accounting standards. - Current financial supervisory reports submitted to FI are expected to comply with annual accounts and the standards stipulated by FI’s regulations and general guideline regarding annual accounts for credit institutions and securities companies are the relevant EBA guidelines. ### EC3 — Valuation governance and prudent valuation - Requirements and standards: - All Swedish credit institutions are required to use the IFRS in the preparation of their consolidated financial statements; fair valuation should be determined based on IFRS principles and particularly IFRS 13 (fair value measurement). - EU prudential regulation (the CRR article 34 in combination with article 105, together with the delegated regulation (EU) 2016/101) covers provisions on valuation, including valuation governance, for institutions’ fair valued assets and liabilities. - Article 105(2), 105(7), 105(11), 105(12), 105(13) of the CRR and the delegated regulation (EU) 2016/101 set out detailed requirements for systems and controls, less liquid positions, exotic and hard-to-value instruments, and methods for calculation of category-level and aggregate AVA. - Article 105(8) of the CRR specifies standards for Independent Price Verification (IPV) and requires IPV in addition to daily marking to market or marking to model. - Banks are required by Regulation (EU) No 575/2013 (CRR) to consider valuation uncertainty related to all fair valued assets and liabilities in the determination of capital adequacy; aggregated valuation adjustments (total AVA) as calculated in accordance with delegated regulation (EU) 2016/101 is deducted from CET1 capital. - Supervisory actions and findings: - FI uses the draft technical standard on IMA as best practice guidance (benchmark). - In 2017-2018, FI conducted a thematic inspection exercise on prudent valuation covering four large Swedish banks and one large nonbank credit institution; the inspection focused on advanced approach to AVA calculations. - Common findings from the thematic review included: - (i) deficiencies and shortcomings in the documentation of internal approaches to valuation and prudential valuation; - (ii) deficiencies and shortcomings in informing FI on the use of expert based approaches; - (iii) deficiencies in the internal reporting and internal awareness of vulnerabilities related to valuation uncertainty, in particular subject to stressed market environments; - (iv) the use of overly simplified assumptions and omitted risk factors in the calculation of category AVAs for UCS, including inappropriate use of parameters, omissions of the potential directional way risk for CVA. ### EC4 — Frequency and granularity of supervisory reporting - Frequency and flexibility: - In accordance with FI’s and EU regulations, most supervisory reports are submitted on a quarterly basis. - FI can require credit institutions to provide supervisory reports on a more frequent basis; evidenced during early stages of the COVID-19 pandemic when FI introduced additional reporting requirements that were continuously amended as the pandemic evolved. - Simplified reporting for smaller institutions: - Commission Implementing Regulation (EU) 2021/451 (ITS (EU) 2021/451) applies to Sweden; institutions deemed small and non-complex (SNCI) have simplified reporting requirements. Criteria for SNCI designation are in Article 4 of ITS (EU) 2021/451. - The simplified reporting requirements are applicable to leverage ratio, Simplified NSFR, additional liquidity monitoring metrics and asset encumbrance. - Current practice: - FI collects information on liquidity on a monthly basis while most other information is collected on a quarterly, semiannual or annual basis. - Some information is collected only at the consolidated level while others are collected at both the entity and consolidated level. Information collected only at the consolidated level include information on: high earners and remuneration. ### EC5 — Comparability of data across entities and consolidation levels - Findings: - National and EU-regulated financial information is prepared by the same reference date and for the same period. - The layout for national reporting is different from that for EU-regulated financial report (FINREP-package) and hence not comparable. - There is a recent EU-initiative by the EBA to introduce the FINREP-package also for financial reporting on an entity level, which if implemented would make comparison between entity and consolidated reporting possible. - According to FI’s regulations governing the reporting of interim and annual report data (FFFS 2014:14) banks are required to submit financial information on an entity level (solo) prepared according to FFFS 2008:25 with a different layout compared to the FINREP-package applicable to consolidated information. ### EC6 — Legal powers to request information (scope and group-wide reach) - Legal basis: - Section 3 (first paragraph) of Chapter 13 of the Banking and Financing Business Act (2004:297) requires credit institutions to provide FI with any and all information regarding their operations and related circumstances as the Supervisory Authority may requests. - Section 5 of Chapter 13 provides FI with the power to collect information from individual entities which are part of a banking group. - Chapter 28 Section 1 and Section 2 of the Resolution Act (2015:1016) provide SNDO with powers to request information from institutions and group undertakings for resolution purposes. - Practice and evidence: - Assessors found evidence of supervisor requesting additional information, particularly before quarterly risk reviews, including information on: capital, quarterly reporting of audit, credit risk/asset quality, CRO report, liquidity risk, interest rate risk in the banking book (IRBB). - Additional requested information included business model forecast, credit risk deficiencies identified by risk control and information on IRB models (accuracy ratios, probabilities od default, loss given default, credit conversion factors, ICAAP adverse scenarios), etc. ### EC7 — Access to records, Board, management and staff - Legal powers and practices: - Section 3 (first paragraph) of Chapter 13 of the Banking and Financing Business Act (2004:297) requires credit institutions to provide FI with any and all information regarding their operations and related circumstances as FI may requests; FI may also request such information from persons who are employed by the institutions (Chapter 13 section 3 paragraph 2). - Section 4 of Chapter 13 provides for FI to, where it deems it necessary, carry out an investigation at the premises of a credit institution. - FI may convene a meeting of the board of directors of a credit institution and a representative of FI may be present at general meetings and board meetings which the FI has convened and also participate in the deliberations (Chapter 13 section 12). ### EC8 — Enforcement powers for timely and accurate reporting - Legal enforcement powers: - Chapter 15 of the Banking and Financing Business Act (2004:297) gives FI the power to impose a fine for incomplete, inaccurate or late reporting by credit institutions. The size of the fine depends on severity of the inaccuracy, the frequency of late/wrong reporting and the size of the firm. - In serious cases and together with other aggravating circumstances, withdrawal of the credit institution’s license is possible. - Chapter 15, section 1a holds members of the board, the managing director or a person replacing them, responsible for misreporting if the inaccuracy is serious and has been caused intentionally or through gross negligence. - In deciding on intervention and penalty, FI may prohibit the responsible person from being a board member or CEO for a credit institution for a certain time or impose a fine; penalty types and sizes are provided in Chapter 15, section 1a-1d and section 8a-9. - Typical supervisory approach: - First step in event of misreporting is for FI to contact the institution; may be followed by a formal letter to the CEO or chairman, and in some cases onsite inspection and then intervention process or sanction. - There is a late charge of up to SEK 100,000 depending on the number of late reports and size of the institutions. ### EC9 — Data validity, integrity and verification procedures - Current practices: - FI does not carry out regular onsite examinations either directly or through other experts to assess how data reported by banks as part of their supervisory returns are validated. Such examinations are performed selectively when supervisors have received indications of severe issues. - Supervisors carry out assessments to confirm consistency between the information in the annual financial statement filed with The Swedish Companies Registration Office and the data submitted to the FI (on a sample basis). Where there are differences, banks are asked to explain and/or correct identified differences. - The Reporting unit undertakes a number of data quality checks on reported data, which for the EU-regulated reporting, are beyond the validation rules forming part of the EU-reporting framework. - Trends and metrics: - FI noted a reduction in follow-ups due to misreporting: the number of misreporting has reduced from about 100 per quarter in 2011 to about 30 per quarter in 2021 out of about 1,700 reports that are received per quarter (follow up are of 1.76 percent). ### EC10 — Use of external experts (note in source: description not provided) - The source concludes with the heading EC10 but does not include the Description and findings re EC10 within the provided text. *Source: 1sweea2023008 - Chapter 13 of the Banking and Financing Business Act give FI the power to request any* ### Chapter 13, section 9 of the Banking and Financing Business Act (2004:297) give FI the ### 1sweea2023008 - Chapter 13, section 9 of the Banking and Financing Business Act (2004:297) give FI the ### Appointment and role of auditors and external experts - Chapter 13, section 9 of the Banking and Financing Business Act (2004:297) gives FI the power to appoint one or more auditors to participate in the audit of a credit institution when needed. - An auditor appointed by FI participates alongside auditors appointed by the company during the general meeting. - An auditor appointed by FI may, according to the general guidelines for auditors appointed by FI (FFFS 2004:10), be given specific instructions from FI on what to assess or investigate within the institution. - FI can hire external experts for specific assignments, for instance to contribute with expert skills in certain areas or to participate in an inspection. - External experts may conduct reviews used by the supervisor, yet it is ultimately the supervisor that must be satisfied with the results of the reviews conducted by such external experts. - Hiring of auditors and other external experts is done in accordance with the provisions of the Public Procurement Act (2016:1145), where the basic principles of objectivity and transparency apply. - FI has a central procurement function that supports supervisors in the tendering process; tender documents outline required expertise and Terms and Conditions are specified in the contract. - Use of auditors or external experts by FI is rare outside the area of supervision of Covered Bonds issuers. ### Procurement and qualification requirements for independent inspectors (covered bonds) - For supervision of covered bond issues, FI places strict requirements on independent inspectors’ expertise and qualifications, e.g., in financial auditing, IT and systems, law, property valuation and the financial market. - Applicants for appointment as independent inspector must provide to FI: - A description of the independent inspectors’ skills and experience in relevant areas. - A list of all assignments that the internal inspector and the company the inspector represents has with the companies that are licensed to issue covered bonds, or with other companies within the same group. - References that can prove the independent inspector’s competence in relevant areas. - A brief description of how independent inspector intend to carry out the assignment. - FI reviews applicant information to assess whether the applicant meets requirements; the applicant is expected to report any potential conflict of interest given the independence required under Swedish law. ### EC11 — External experts and prompt reporting of material shortcomings - EC11 requirement: The supervisor requires that external experts bring to its attention promptly any material shortcomings identified during the course of work undertaken for supervisory purposes. - Chapter 13, Section 10 of The Banking and Financing Business Act (SFS 2004:297) requires an auditor or a special examiner to immediately report to FI if, during performance of duty in a credit institution, they learn of circumstances which may: - (i) constitute a material violation of the statutes governing the institution’s operations; - (ii) negatively affect the institution’s continued operations; or - (iii) result in the auditor recommending that the balance sheet or profit and loss statement should not be adopted or in qualification. - The use of external auditors and experts has been rarely used, except in the area of supervision of Covered Bonds issuers. ### EC12 and Principle 10 — FI’s information collection, reporting changes and enforcement - FI is empowered to collect any information it may require for supervisory purposes and can introduce new reporting requirements. - Since the last FSAP FI has introduced seven (7) new report out of these six (6) were based on EU regulations and one (1) was based on Swedish regulation. The new reports are: - Report on additional liquidity monitoring metrics; - Report on liquidity coverage requirements; - Guidelines on COVID-19 measures reporting and disclosure; - Guidelines on fraud reporting under PSD2; - Reporting for the purposes of identifying G-SIIs and assigning G-SII buffer rates; - Specific reporting requirements for market risk (FRTB); and - Money Laundering Report. - Assessment re Principle 10: Largely Compliant. - FI can request and receive any information required from banks on a solo and consolidated basis and from entities in the wider group irrespective of their activities; it can access information on bank operation and related circumstances and collect information from persons employed by the credit institution, including the bank’s board, management and staff. - Most supervisory reports are submitted on a quarterly basis; FI can require more frequent submissions and did so during the early stages of the COVID-19 pandemic. - All credit institutions in Sweden are required to apply IFRS in their consolidated financial statements and Swedish local accounting standards at the entity level; the EU initiative by the EBA to introduce FINREP-package for financial reporting on an entity level, if implemented, would improve comparability between entity and consolidated reporting. - FI can impose fines for incomplete, inaccurate or late reporting; the size depends on severity, frequency and institution size. In serious cases, FI can withdraw a credit institution’s license. Example provided: a fine of SEK 12 million was imposed on a bank for deficiencies in its reporting. - FI does not carry out regular onsite examination to assess how banks validate data reported in supervisory returns; supervisors carry out sample assessments to confirm consistency between annual financial statements filed with The Swedish Companies Registration Office and data submitted to FI. - FI does not have an explicit requirement for senior management to certify accuracy of supervisory returns. ### Principle 11 — Corrective and sanctioning powers; findings on EC1, EC2, EC3 - Principle summary: The supervisor acts at an early stage to address unsafe and unsound practices; has an adequate range of supervisory tools including ability to revoke banking license or recommend its revocation. EC1 — Early engagement, remediation and follow-through - FI communicates SREP, inspection, deep dive and thematic review findings to the relevant bank; the bank must respond with plans to rectify deficiencies. - In inspections, deviations are written in a preliminary assessment letter shared with the institution and sent to the CEO with a copy to the Chairman of the Board; the letter seeks additional information and ensures findings are based on complete and accurate information. - If measures proposed by the institution are assessed as likely to remediate shortcomings within an acceptable period, FI can close the issue and monitor implementation through ongoing supervision. - If an institution does not remediate or if violations are severe or repeated, the case may be escalated according to sanctions or intervention process. - Potential vulnerabilities are discussed with bank management as part of ongoing supervision and can give rise to a Pillar 2 capital add-on. - FI has two internal procedural documents guiding intervention and sanctions; intervention decisions are normally made by the Executive Director. - The Board of FI decides on sanctions such as remarks, warnings, penalties and withdrawal of authorizations; sanctions decisions may be appealed to the Court. - Observations: some FI investigations take relatively long, impacting timeliness of communication; gap exists in monitoring corrective action, particularly requiring banks to provide regular progress reports and checks to ensure satisfactory resolution. - Recommendation noted: FI should consider requiring banks’ internal audit to provide attestation that required corrective action has been implemented and, where applicable, to test effectiveness of new controls or changes to internal models. EC2 — Range of supervisory tools available - FI has a wide range of intervention tools (Chapter 15, section 1 of the Banking and Financing Business Act), including: - Order to limit or reduce risk of operations or to take appropriate measure to rectify the situation within a specific time; - Restriction on dividend payments; - Issuing of an injunction against executing resolutions; - Issuing an adverse remark or warning to a bank (combined with a fine); and - Withdrawal of the license (where infringement is serious). - FI can remove a member of the board of directors or managing director of a credit institution (Chapter 15, section 1a of the Banking and Financing Business Act). - The authorities provided details of 11 sanctions imposed on banks and bank management over the last 5 years; the most commonly used sanction was adverse remark or warning combined with a fine which ranged between SEK 1.6 million and SEK 4.0 billion. - Grounds for sanctions/fines included: deficiencies in credit risk management processes, deficiencies in the reporting of transactions, major deficiencies in AML work, non-compliance with regulations on minimum requirements for the liquidity coverage ratio (LCR). EC3 — Power to act when banks fall below regulatory thresholds - Under Chapter 2, section 3 of the Credit Institutions and Securities Companies (Special Supervision) Act, FI can utilize measures specified in the Banking and Financing Business Act if an institution fails to meet minimum capital and liquidity requirements. - Under Chapter 8 (section 1) Credit Institutions and Securities Companies (Special Supervision) Act, same applies where an institution does not meet prudential requirements: FI is required to order the bank to limit operations, reduce risks, or take other measures necessary to rectify the situation. - Institutions that fail to meet the combined buffer requirement or the requirement for a leverage ratio buffer are required under the Capital Buffers Act (Chapter 8, section 1) to, within five (5) working days from the date on which it was established that the buffer requirement has not been met, submit a capital conservation plan showing how it will achieve the requirement again within a reasonable time. - Section 2 of the Capital Buffer Act grants FI power to intervene where it is not satisfied that measures in the capital conservation plan will restore: (i) Common Equity Tier 1 capital in the combined buffer requirement, and (ii) Tier 1 capital in respect of the leverage ratio buffer requirement; FI may compel enhancement of capital base or impose stricter restrictions. - The Banking and Financing Business Act (Chapter 15 section 1) empowers FI to issue an order to the institution to “take measures in order to rectify the situation” in the event of violation of legal or statutory obligations or internal instructions based on statutory instruments. *Source: Excerpt from the IMF FSAP country report chapter on Sweden (1sweea2023008) contained in the supplied PDF content.* ### section 1 paragraph 4) grants FI with the power to intervene where it is likely that within ### 1sweea2023008 - section 1 paragraph 4) grants FI with the power to intervene where it is likely that within ### EC4 — Early intervention powers and available measures - FI may intervene where it is likely that within 12 months a credit institution will no longer be able to fulfil its legal or any statutory obligations which govern its operations. - To utilise intervention measures, FI must demonstrate that the institution has violated its obligations or is likely to violate its obligations within 12 months. - Guiding principles for choice of measure: materiality and risk. - Range of supervisory measures described and applied according to gravity of the situation: - require a bank to take timely corrective action; - impose sanctions expeditiously; - restrict current activities of the bank; - impose more stringent prudential limits and requirements; - withhold approval of new activities or acquisitions; - restrict or suspend payments to shareholders or share repurchases; - restrict asset transfers; - bar individuals from the banking sector; - replace or restrict the powers of managers, Board members or controlling owners; - facilitate takeover by or merger with a healthier institution; - provide for interim management of the bank; - revoke or recommend revocation of the banking license. - Examples under Chapter 15 of the Banking and Financing Business Act: - require an institution to limit or reduce its risks; - place restrictions on payment of dividends or interest; - restrict transfer of assets; - require a bank to take other measures to rectify the situation; - depending on gravity, impose sanctions or revoke the institution’s license. - FI can intervene against board members or managing director for failures to submit information or for submitting incomplete/inaccurate information: - prohibit the person from serving as board member or CEO for a period of not less than 3 years and not more than 10 years; - impose a punitive fine on members of the board or the CEO. - Chapter 14 section 7 BFBA: FI may order a significant shareholder to divest a portion of its shares or ownership rights to reduce its holding. ### EC5 — Sanctions against institutions and individuals - Supervisor applies sanctions to the bank and, when necessary, to management and/or the Board, or individuals therein. - FI powers under Chapter 15, section 1a of the Banking and Financing Business Act: - impose a punitive fine on a board member or CEO; or - order removal of a board member or CEO for not less than three years and not more than ten years. - Limitation noted: - Swedish Company Law does not recognize the concept of “senior management”; FI does not have explicit power to replace or restrict powers of any manager other than the managing director of a credit institution. - Assessors did not find specific evidence of FI using these powers in practice (no identified cases of sanctions applied on a member of management or board). ### EC6 — Corrective actions and ring-fencing powers - FI has power to take corrective actions, including ring-fencing the bank from actions of parent companies, subsidiaries, parallel-owned banking structures and other related entities that could impair safety and soundness. - Chapter 15 section 1, paragraph 4 BFBA: FI shall intervene by issuing an order where it has assessed that the bank is likely to be in violation of its obligations within 12 months. - Intervention could include prohibiting the bank from making certain transactions or issuing an injunction against executing resolutions to ensure the bank does not violate its obligations. - Chapter 14, section 6 BFBA: FI may order that a party with a significant (qualifying) holding may not represent more shares or participating interests at the general meeting than correspond to a non-qualified holding where the holder impedes or can be anticipated to impede the operations of a credit institution compatible with BFBA or other statutory instruments. - Chapter 14, section 7 BFBA: FI may order a significant owner to divest such a portion of its shares or ownership rights so that the holding thereafter will no longer constitute a qualifying (significant) holding. ### EC7 — Cooperation with resolution authority (SNDO) and information exchange - FI and SNDO cooperate and exchange information in line with Chapter 28 section 4 of the Resolution Act (SFS 2015:1016), which requires FI to provide SNDO with required information for its activities under the Resolution Act. - Resolution Act requires SNDO and FI to cooperate and exchange information with each other and with corresponding authorities within the EEA (Chapter 28, section 5). - Cooperation on recovery plans: - SNDO is expected to identify measures in recovery plans that could have a negative impact on orderly resolution and provide recommendations to FI (Chapter 6a, Section 4 BFBA). - Examples of information shared between FI and SNDO: - intra-group financial support agreements approved by FI (Chapter 6b, section 5 BFBA); - notifications by institutions to FI where the institution is failing or is likely to fail (Chapter 13, section 4a BFBA). - FI obligations when intervening: - notify SNDO where violations are of such nature or scope that the credit institution may be subject to resolution; - submit information needed to prepare for resolution measures (Chapter 15 section 2b BFBA). - SNDO consultations with FI: - when resolution plans are being established; - before SNDO decides on measures to remove or reduce impediments to implementation of a resolution plan; - regarding the use of bail-in, restructuring or use of government stabilization tools. - FI responsibilities in the resolution context: - Approve decisions connected to resolution planning affecting the maturity profile of Common Equity Tier 1, tier 1 and tier 2 instruments; - Use its intervention powers to force the institution to deliver information where an institution does not provide SNDO with the requested information (Chapter 28, [text truncated in source]). *Source: 1sweea2023008 - section 1 paragraph 4) grants FI with the power to intervene where it is likely that within* ### Section 1 Resolution Act (2015:2016); and ### Section 1 Resolution Act (2015:2016); and ### Additional criteria — AC1: Timeliness of corrective actions - Finding: There are no formal time limits for taking appropriate corrective actions. - FI has an internal sanctioning procedure applicable to preparation and processing of cases where FI may intervene (covers withdrawal of authorization, warnings, objections or remarks, and administrative fines). - Past criticism: Swedish Ombudsman criticized FI for shortcomings in documentation of decisions to initiate and close cases and of decisions to continue processing, creating ambiguities on when a case is considered closed. - Follow-up: FI internal audit noted the Ombudsman’s criticism has mainly been addressed; improvements include training efforts, updated registration process, and an updated investigation process. ### Additional criteria — AC2: Coordination with supervisors of nonbank entities - Institutional setup: FI is the single integrated financial sector supervisor for all financial markets and financial institutions, including nonbank financial institutions (e.g., securities and insurance companies). - Finding: There are no other domestic supervisory agencies FI must coordinate with for supervision of the financial sector. - Practice: When decisions are taken, FI informs relevant parties and publishes decisions on FI’s website. ### Assessment of Principle 11 — Intervention, corrective measures and sanctions - Overall assessment: Largely Compliant - Communication and tracking: - FI communicates supervisory findings to banks normally by letter to the CEO with a copy to the Chairman of the Board. - FI has a system for tracking implementation of corrective measures by banks. - Internal procedures: - Two internal procedural documents: an intervention process (cases possibly leading to measures/intervention) and a sanction procedure (cases possibly leading to remark, warnings, penalties, or withdrawal of authorizations). - Intervention decisions: made by the Executive Director. - Sanctions decisions: made by FI’s board of directors. - Range of intervention powers: - Order to limit or reduce risk or to take corrective measures. - Restriction of dividend payments. - Injunction against executing resolutions. - Issuing an adverse remark. - Withdrawal of the license. - Removal of a member of the board or CEO; prohibition from serving as board member or CEO for a period of not less than 3 years and not more than 10 years. - Imposition of punitive fine on individuals. - Timing: When ordering corrective measures FI states in the decision when the correction should be made at the latest. - Sanctions imposed (examples reviewed by assessors): - Warning or remark combined with administrative fine. - Withdrawal of authorization. - Injunction to take remedial action. - Grounds for sanctions included: deficiencies in credit risk management and processes; deficiencies in reporting of transactions; major deficiencies in work to combat money laundering. - Notable AML cases reviewed: - One bank: warning combined with a fine of SEK 4 billion. - Another bank: remark combined with a SEK 1 billion fine. - Additional intervention authorities: - FI can intervene where it is likely that within 12 months a credit institution will not be able to meet legal or statutory obligations. - FI can order a significant shareholder to divest a portion of its shares to reduce its holding. - FI–SNDO cooperation (resolution preparedness): - FI and SNDO share information and collaborate (e.g., review of recovery and resolution plans; share information on institutions that could be subject to resolution). - FI is expected to facilitate use of resolution tools by SNDO by issuing necessary licenses, approving decisions affecting maturity profile of capital instruments, using intervention powers to facilitate access to information by SNDO, and determining non-viability (failure or likely to fail, FOLF). - Appeal process: - FI’s decisions on sanctions or intervention may be appealed to the Administrative Court; further appeal to the Administrative Court of Appeal and the Supreme Administrative Court is possible (leave to appeal required for higher courts). - Identified gaps / recommendations: - No explicit requirement for banks to submit periodical progress reports on implementation of remedial actions; such reports could facilitate FI monitoring. - Resource limitations and challenges in supervisors undertaking detailed confirmation work suggest value in requiring banks’ internal audit to attest or verify implementation of important recommendations periodically (e.g., remedial actions taken; required changes to internal models introduced). ### Principle 12 — Consolidated supervision: Overview and practices - Principle statement: Supervisor supervises banking group on a consolidated basis, monitoring and applying prudential standards to all aspects of the business conducted by the banking group worldwide. EC1 — Understanding group structure and material activities - FI supervises on a consolidated basis in accordance with applicable EU laws and EBA guidelines. - FI prepares and updates annually a mapping of each banking group’s entities and business areas (cooperating with supervisory college members). - Mapping includes overview of legal entities, subsidiaries, branches, size and importance, jurisdiction, and any capital or liquidity waivers. - Practice: FI has not applied capital waivers in CRR article 7 or 10 to banking subsidiaries in Sweden; subsidiaries of domestic banks are required to meet minimum prudential requirements at the solo level. - SREP: FI prepares individual SREP assessments for subsidiaries of large banks in a proportional and risk-based manner; capital and liquidity decisions for subsidiaries form part of the SREP joint decision of the banking group. - SREP scope allows coverage of material subsidiaries (including those not subject to consolidation) and material risks, normally including reputation risk. EC2 — Consolidated prudential standards, reporting and analysis - FI imposes prudential standards on banking groups per EU laws and regulations; expectation set out in Chapter 2 of FI’s regulations on prudential requirements and capital buffers (FFFS 2014:12). - FI has power to require any relevant information for supervisory purposes (capital, liquidity adequacy, material risks) and has not experienced difficulties obtaining information from subsidiaries or branches, including requests beyond consolidated information. - FI cooperates with host authorities in supervisory colleges and decides jointly on capital and liquidity requirements based on CRD/CRR and EBA guidelines. - Large exposure requirements and reporting standards apply per EU regulation and EBA Guidelines; exposures to related parties disclosed semi-annually in FINREP. - Evidence reviewed by assessors: - FI collects and analyzes consolidated information including capital, liquidity, large exposures, and FINREP. - Capital requirements set at consolidated and entity level, including joint college decisions. - Extensive information collected as part of SREP (business forecast, credit risk models, pension risk, etc.). - Example: joint decision letters on capital and on liquidity for a category 1 bank. EC3 — Oversight of foreign operations and host supervision - Assessment of oversight of foreign activities undertaken as part of quarterly risk meetings. - Governance and internal controls for the group assessed in SREP (annual for category 1 banks). - Banks required to submit information in advance of quarterly risk meetings to facilitate assessments (suitability of management, quality of control functions). - For groups with supervisory colleges, quality of local management and compliance with group policies frequently discussed with host supervisors. - FI regularly reviews group policies, procedures, and business plans for foreign operations. - Offsite supervision of foreign subsidiaries carried out by collecting information via Swedish parent or contacting host supervisor; onsite supervision of subsidiaries only jointly with host supervisors. - FI has had no experience of host countries impeding access to information; FI does not and would not hinder access to information from Swedish branches/subsidiaries. - No Swedish bank currently has material operations outside of Europe. - Cooperation in supervisory colleges governed by written coordination and cooperation arrangements (WCCA) and confidentiality specifications. - FI has experience of joint inspections with Nordic and Baltic supervisors; example: investigation into AML governance and controls in subsidiaries in Estonia, Latvia, and Lithuania led to a remark and a SEK 1 billion fine. - Limitation: FI does not formally evaluate effectiveness of supervision conducted in host countries (such assessments are done by the EBA annually). - EU joint decision processes and SREP assess host supervisor effectiveness in practice; deviations from EU standards are signaled through sources such as the comply-or-explain procedure. EC4 — Onsite examinations of foreign operations - Primary channel for supervision of foreign offices is supervisory colleges. - FI has the power to conduct onsite examinations of foreign operations and to require additional reporting. - FI does not have a separate policy specifically for evaluating the need for onsite examinations of foreign operations; uses same processes as for domestic entities. - Coordination tool: college supervisory examination program governed by WCCA and updated annually per Article 16 of Commission Delegated Regulation (EU) No 2016/98 and Article 11 of Commission Implementing Regulation (EU) No. 2016/99. - WCCAs and Nordic MoU govern principles for sharing information and confidentiality arrangements. - Practice pre-COVID: FI regularly visited foreign operations (e.g., early 2020 visit to material foreign operations of one of the three largest banks); host supervisors informed and usually invited. - For subsidiaries, FI can only visit together with host competent authority. - Evidence: joint inspections on AML identified deficiencies in Baltic operations. - Limitation: onsite examination of foreign operations is limited (e.g., full participation in joint inspections with ECB not common), attributed to resource constraints. EC5 — Review of parent company activities and affiliates - FI’s remit as supervisor of all financial institutions in Sweden allows identification of activities and affiliated companies of parent companies that could materially impact safety and soundness of the bank and group (includes credit institutions, insurance undertakings, securities entities). - FI can obtain information from entities in the same group to review activities and related risks. - Legal basis: Chapter 13, section 5 of the Banking and Financing Business Act (SFS 2004:297) — other undertakings in the group must provide FI with any information FI requires for supervision. - Legal basis: Chapter 6 section 8 of Special Supervision Act (SSA) authorizes FI to order investigations when necessary for supervision. *Source: 1sweea2023008 - Section 1 Resolution Act (2015:2016); and* ### 1. companies which are obligated to provide information and of financial holding ### 1. companies which are obligated to provide information and of financial holding ### Entities obligated to provide information and subject to FI corrective measures - Companies required to submit consolidated accounts or aggregated information: - companies, mixed activity holding companies, and mixed financial holding companies. - Companies engaged by an institution or a holding company to perform specific work or specific function. - Companies included in the group over which the FI carries out supervision. - FI may take corrective measures (intervene) against a parent company (financial holding companies and mixed financial holding companies) per Chapter 8 sections 2-2c of SSA, including but not limited to: - restricting the company from representing the share in subsidiaries which are institutions; - ordering the company to limit the risks within a certain time; - ordering the company to divest or reduce its holding in institutions or other subsidiaries; - ordering the company to transfer ownership in subsidiaries which are institutions; - ordering the company to limit or restrain from paying dividends; - ordering the company to submit a remediation plan. ### EC6 — Limits on group activities and locations (legal criteria) - The supervisor limits the range of activities the consolidated group may conduct and the locations in which activities can be conducted (including the closing of foreign offices) if it determines that: - (a) the safety and soundness of the bank and banking group is compromised because the activities expose the bank or banking group to excessive risk and/or are not properly managed; - (b) the supervision by other supervisors is not adequate relative to the risks the activities present; and/or - (c) the exercise of effective supervision on a consolidated basis is hindered. ### Description and supervisory practice regarding EC6 - FI has the power to limit or suspend activities by the banking group if these would compromise the safety and soundness of the bank or banking group. - FI adopts a progressive remedial escalation ladder to address unsafe and unsound practices. - Through SREP and the ongoing supervision of the large firms, FI is able to identify unsafe or unsound practices at an early stage, including in foreign entities of the banking group, through the close cooperation in supervisory colleges. - Breaches or deficiencies identified by FI are first addressed through SREP and monitored through ongoing supervision. - If a bank does not remediate or rectify the issue to the satisfaction of the FI or the supervisory college, a formal investigation can be initiated. For foreign entities, this is coordinated with the host competent authority. - Depending on the outcome of the investigation, this can lead to an intervention process, including sanctions and legally binding orders. ### Third-country coordination and equivalence - With regard to third-country authorities (outside the EU), the EU Commission normally conducts assessments of whether the third-country’s regulatory/supervisory regime for a particular area is equivalent to that provided within the EU law. *SWEDEN — 1sweea2023008 (EC6 excerpt)* ### Chapter 3, section 2 of the Banking and Financing Business Act provides that, where an ### 1sweea2023008 - Chapter 3, section 2 of the Banking and Financing Business Act provides that, where an ### Supervision on a consolidated and individual-bank basis (EC7; Assessment of Principle 12) - Legal framework and practice - Chapter 3, section 2 of the Banking and Financing Business Act: a licence may be granted only where close links do not impede effective supervision of the undertaking. - FI supervises banks on a consolidated basis and on the individual bank level in line with applicable EU laws and EBA Guidelines. - FI conducts SREP assessments of respective entities based on a risk-based approach proportional to the size and relevance of the entity to the group's risk profile. - Outcome of SREP is used to set capital and liquidity requirements for individual banks within the banking group and at the consolidated level. - For the three large Swedish banks, FI together with supervisory college members uses the outcome of SREP to set capital and liquidity requirements at the group level and for relevant entities within the group. - Powers and information - FI has the power to require credit institutions to provide any information necessary for supervisory purposes and reports no difficulties obtaining information related to subsidiaries or branches of Swedish banks. - FI prepares and updates annually the mapping of each banking group's entities and business areas in cooperation with supervisory college members. - Assessment of adequacy of oversight of foreign activities is undertaken as part of quarterly risk meetings and discussed with host supervisors where supervisory colleges exist. - Limitations and observations - Limited actual testing of effectiveness of banks’ procedures and internal controls (see CP 8 and 9). - FI can conduct onsite examinations of foreign operations but not routinely; there is no separate FI policy for evaluating need for onsite examinations of foreign operations—handled same as domestic operations. - Limited participation by FI in joint onsite inspections with other supervisory authorities, particularly the ECB, attributed to resource constraints. - FI does not formally evaluate effectiveness of supervision conducted in host countries; these assessments are done by the EBA annually. - Assessment - Assessment of Principle 12: Largely Compliant. ### Ownership, fit-and-proper standards (Additional Criterion AC1) - Corporate ownership and approval thresholds - Sweden permits corporate ownership of credit institutions. - For holdings exceeding 10, 20, 30, or 50 percent of share capital or votes in a credit institution, the owner needs FI’s approval before acquisition. - FI powers on owners and parent companies - Where FI assesses a financial conglomerate exists, it can review parent company activities and enforce fit-and-proper standards for future owners at time of ownership change. - On an ongoing basis, FI can enforce fit-and-proper standards only if the owner is a financial holding company or mixed financial holding company and management is not fit and proper. - If the owner is not a financial or mixed financial holding company, FI can enforce standards only if at acquisition the owner is assessed to impede sound management of the credit institution, has committed serious crimes or increases likelihood for money laundering or terrorist financing (Chapter 14, section 2 of Banking and Financing Business Act). - Senior management of parent company - Swedish Company Law does not recognize the concept of senior management, so there is no legal basis for FI to assess fitness and propriety of senior management of parent company on an ongoing basis. ### Home-host relationships and cross-border cooperation (Principle 13; EC1–EC10) - Supervisory colleges and scope - FI is involved in 18 supervisory colleges, chairing eight of them (excluding AML colleges). - FI chairs supervisory colleges for the three D-SIBs and participates as member in colleges of banks operating in Sweden. - All colleges are governed by written coordination and cooperation agreements (WCCAs) drafted in accordance with Commission Delegated Regulation (EU) No 2016/98, Article 5. - FI is a member of more than 50 AML colleges and is lead supervisor in three AML colleges. - Information sharing (EC2) - Information exchanged via supervisory colleges includes: key risk indicators; supervisory risk assessments and findings; risk reports covering credit, market and liquidity risks; results of stress tests; capital and liquidity position and plan; statement of financial position and prospects; organizational structure; ICAAP and ILAAP; group recovery plan; strategic plans. - Bilateral MoUs include the Nordic MoU on the supervision of significant branches and MoUs with supervisory authorities from the UK, US, and China. - Coordination and joint work (EC3, EC4) - FI uses supervisory college examination programs governed by WCCA and updated annually per Article 16 of Commission Delegated Regulation (EU) No 2016/98 and Article 11 of Commission Implementing Regulation (EU) No 2016/99. - Examination program typically based on Group risk assessment, group recovery plan assessment, and capital and liquidity joint decisions. - WCCA specifies roles, responsibilities and communication policy; consolidating supervisor (FI) communicates with parent company, other members communicate with entities/branches in their remit. - Crisis cooperation and resolution (EC5, EC6) - Swedish cross-border crisis cooperation is based on BRRD and relevant EBA guidelines, including recovery planning, resolution planning and resolution colleges. - SNDO is responsible for developing group resolution plans and chairs resolution colleges for Swedish D-SIBs; FI participates as non-signing member. - FI shares detailed prudential capital requirements necessary for MREL calculation with SNDO and provides prudential data to support resolution college assessments. - WCCAs specify interaction between supervisory and resolution colleges and treatment of confidential information. - Prudential treatment of cross-border operations (EC7–EC9) - Transposition of EU directives and application of EU regulations and EBA guidelines ensure cross-border operations of foreign banks are subject to similar prudential, inspection and regulatory reporting requirements as domestic banks. - Reciprocation of local macroprudential requirements is laid down in the Nordic MoU for significant branches. - Shell banks are not permitted under Swedish law; Article 24 of EU Directive 2015/849 prohibits correspondent relationships with shell banks. - Article 15, Section 3 of the Banking and Financing Business Act empowers FI to revoke a credit institution’s licence where it fails to commence business within one year or does not conduct business for a consecutive period of six months. - Onsite access and inspections (EC8, EC10) - Under Article 52 of the CRD, home supervisor has right to carry out local onsite inspections of foreign branches; Nordic MoU expects home supervisors to invite host supervisors to participate. - Inspections are to be agreed within supervisory college as part of the examination program. - FI closely cooperates with foreign supervisors and the Nordic MoU states participants agree to inform each other of significant supervisory actions without delay. - Assessment - Assessment of Principle 13: Compliant. ### Corporate governance (Principle 14; EC1–EC2) - Legal and regulatory instruments - FI’s Regulation regarding governance, risk management and control at credit institutions: FFFS 2014:1 (Chapters 2, 3, 4, 5, 6, 7). - FI’s regulation on remuneration: FFFS 2011:1. - Companies Act reference: Section 4 of Chapter 8 of the Companies Act (SFS 2005:551). - EBA guidelines: EBA/GL/2017/11 (repealed) and revised guideline EBA/GL/2021/05. - Roles and responsibilities - FFFS 2014:1: Board or managing director shall decide on risk appetite and risk strategy, internal rules for governance, compliance, risk management, conflict of interest, control, accounting, risk reporting, outsourcing agreements and recovery plan; Board/managing director should have sound knowledge of organizational structure, processes, operations and risks. - Chapter 6: Board or managing director should take appropriate measures from control function reports as soon as possible. - FI’s regulation defines “senior management” as “the managing director, the deputy managing director and other members of the management group or a similar body that report directly to the board of directors or the managing director.” - Gaps and observations - Swedish Company Law does not recognize the concept of “senior management,” and no law, regulation or supervisor establishes responsibilities for senior management related to day-to-day management, implementation of business strategies, risk management systems and reports, risk culture, processes and controls, or oversight by the Board as contemplated in BCBS Corporate Governance Principles for Banks (2015). - FI’s definition of senior management in regulation may not encompass management function responsibilities as intended by BCBS Guidance. - Supervisory assessment and tools (EC2) - FI assesses governance policies and practices annually through SREP, with a rating from 1 (best) to 4 (worst) for banks in category 1 and 2. - FI conducts broad surveys and thematic reviews and may publish reports conveying findings. - FI’s method for assessing internal governance and control is based on EBA guidelines; the revised guideline EBA/GL/2021/05 adds elements to foster sound risk culture and strengthen oversight and risk management, including AML/TF risk factors. - The method evaluates sufficiency of internal governance and control relative to risk profile, business model, size and complexity, and assesses the risk of actual and potential deficiencies affecting stability and survivability. *Source: 1sweea2023008 - Chapter 3, section 2 of the Banking and Financing Business Act provides that, where an* ### 1. Overall system for internal control; ### 1. Overall system for internal control ### Scope and component areas - Internal control assessment covers eight areas: - 1. Overall system for internal control; - 2. The Board, the Board's committees and the CEO; - 3. Corporate and risk culture; - 4. Remuneration policy; - 5. Framework for risk management; - 6. Framework for internal control, including independent control functions; - 7. Information systems and continuity management; and - 8. Recovery plan. ### Final grading, survival rating, and supervisory response - The final grade for internal management and control must be reconciled with one survival rating that describes the risk of the identified deficiencies in internal governance and control to the institution's stability and viability. - If the total rating for internal management and control is 3 or 4, a dialogue should be initiated between risk expert, responsible manager and supervisor. - Purpose: produce a proposal for suitable supervisory measure and / or a pillar 2 surcharge proportional to the materiality of the deficiency. - The proposal should be submitted to the Banking Area's Supervisory Committee. - Possible actions include: - warnings, - administrative fees, - other requirements, such as deficiencies correction, - recommendations and capital add-ons. - Historical precedent: During the period 2016-2021, four banks in category 1 and 2 received capital add-ons for governance related issues as a result of the SREP. ### Method application and resource constraints - Method primarily used for credit institutions categorized by FI as categories 1 and 2. - For credit institutions in categories 3 and 4, the responsible department head decides whether the method must be used; the method should be adapted to the credit institution in question size and complexity. - Supervisory documents show appropriate attention to governance matters, but resource constraints have reduced intrusiveness of supervision. - Governance specific investigations have been deprioritized and governance experts reallocated to AML/CFT areas. - Consequence: difficulty for FI to continue adequately supervising banks and performing thematic governance reviews (examples: independence of the CRO and the risk control function; remuneration regulation). ### EC3 — Nomination and appointment processes; Board structures - Supervisor determines governance structures and processes for nominating and appointing Board members are appropriate for the bank and group; Board membership includes experienced non-executive members where appropriate; Board structures include audit, risk oversight and remuneration committees with experienced non-executive members. - Legal and regulatory framework and FI practices: - BFBA (SFS 2004:297, Chapter 10, Section 8) requires the chairman to provide information to the general meeting on positions in other undertakings held by persons to be elected; restrictions are subject to company size. - FI can partially reduce restrictions but cannot determine that governance structures and processes for nominating and appointing Board members are appropriate. - FI assesses Board members' experience, skills, knowledge, conflicts of interest, reputation and honesty under BFBA (SFS 2004:297, Chapters 3, Section 2) and FFFS 2009:3. - As part of SREP, FI assesses chosen board structure, including audit, risk oversight and remuneration committees. - FFFS 2014:1 requires significant banks to ensure the board has a risk committee; members must have appropriate knowledge and skills (Chapter 5, Section 13). - FFFS 2011:1 requires a remuneration committee for significant firms; members must have sufficient knowledge and experience in risk management and remuneration. - Companies Act (SFS 2005:551) requires an audit committee or equivalent; committee members may not be employees, and at least one member must be independent with accounting or auditing proficiency. ### EC4 — Board members' qualifications, duties of care and loyalty - Supervisor determines board members are suitably qualified, effective and exercise their “duty of care” and “duty of loyalty.” - FI assessment details: - Suitability assessment performed in accordance with BFBA (2004:297) and FFFS 2009:3. - Appendix 2 of FFFS 2009:3 lists background check information required for appointments (chairman, board member, alternate, managing director, deputy managing director). - FI’s regulation on credit risk management (FFFS 2018:16) describes handling of credit decisions concerning Board members. - Conclusion: FI performs assessments following established criteria and handles conflicts of interest per regulation. ### EC5 — Board oversight of strategy, risk appetite, culture and conflicts - Supervisor determines Board approves and oversees implementation of strategic direction, risk appetite and strategy, establishes and communicates corporate culture and values, and establishes conflicts of interest policies and a strong control environment. - FI framework and practices: - FFFS 2014:1 establishes high-level Board requirements covering approval, control and oversight of strategy, risk appetite and strategy, risk and ethical culture and conflicts of interest rules. - SREP includes assessment that the Board approves and oversees implementation of strategic direction, risk appetite and strategy. - Regular one-to-one meetings and investigations assess practical application; Board meeting minutes are reviewed as part of SREP. ### EC6 — Fit and proper standards, succession and oversight of senior management - Supervisor determines Board has established fit and proper standards in selecting senior management, maintains succession plans, and oversees senior management’s execution of Board strategies. - Findings and constraints: - Swedish Company Law has no definition of senior management; responsibilities related to management activities are held by the board or managing director. - Provisions and supervisory processes apply to the board regarding fit and proper standards (FFFS 2014:1, Chapters 2–5), but no provisions specific to senior management. - Joint ESMA and EBA Guidelines on suitability include selection, monitoring and succession planning principles; Sweden informed it does not intend to comply with certain paragraphs: - Paragraph 172: Swedish law does not provide for suitability assessment of key function holders; related guideline parts will not be implemented in Sweden. - Paragraph 165 (on removal of key function holder) will not be implemented for the same reason. - Sections 15 (paragraphs 123-127): selection and appointment processes and nomination committee tasks are not applicable in Sweden. - Assessors found no evidence FI performs assessment of member selection processes or succession plans. ### EC7 — Compensation system oversight and alignment with prudent risk-taking - Supervisor determines Board oversees design and operation of compensation system, ensuring appropriate incentives aligned with prudent risk-taking and long-term objectives. - FI regulation and assessments: - FFFS 2011:1 incorporates FSB Principles for Sound Compensation Practices. - Chapter 4 Section 2: variable remuneration components shall primarily be based on risk-adjusted profit measures that consider current and future risks. - Amendments FFFS 2020:30 clarify remuneration policies shall be gender neutral and specify employee categories that can influence risk profile. - FFFS 2014:22 contains criteria for fixed and variable remuneration and introduces prolongation for disbursement of variable remuneration. - Remuneration policies are assessed in SREP. - In 2021, FI performed a broad survey of 18 credit institutions on interpretation of FFFS 2011:11; results published in December 2021. - FI identified areas for improvement, mainly regarding categorization and definition of fixed and variable remuneration; overall, remuneration policies could benefit from improvement. - Legal limitations: Sweden cannot comply with certain EBA guidelines on sound remuneration policies (EBA/GL/2015/22, revised EBA/GL/2021/04): - Paragraph 83 – rules on branches; - Part 15.7 – claw-back provisions; - Paragraph 128 – prescriptive ways of intervention. ### EC8 — Understanding and oversight of operational structure and related risks - Supervisor determines Board and senior management understand operational structure and risks, including risks from non-transparent structures, and that risks are effectively managed and mitigated. - FI requirements and practices: - FFFS 2014:1, Chapter 3 Section 2: board members must have sound knowledge and understanding of organizational structure and processes. - FFFS 2014:1, Chapter 2 Section 1: undertakings must have an appropriate, transparent organizational structure with clear allocation of functions to ensure sound governance and enable FI to conduct efficient supervision. - EBA Guidelines on Internal Governance (Chapter 6.3) advise institutions to avoid complex, non-transparent structures without clear economic rationale; management body should understand such structures and ensure internal controls. - SREP assesses whether Board and senior management know and understand operational structure and risks; regular meetings, minutes review and investigations are used to verify practical application. ### EC9 — Supervisory powers to require Board composition changes - Supervisor has power to require changes in Board composition if individuals are not fulfilling duties. - Legal framework and practice: - BFBA (2004:297), Chapter 13 Section 2: FI shall ensure owners and management fulfil suitability requirements. - Chapter 15 Section 2: if a board member fails to fulfil requirements in Chapter 3 Section 2 subsection 4, FI shall revoke the institution’s license; prior adverse remark and a period up to three months must elapse before revocation. - Alternatively, FI may order that a board member or managing director may no longer serve and may appoint a replacement until a new appointment is made. - Intervention may only take place where infringement is serious and caused intentionally or through gross negligence. - Practical effects: - The need to prove intentional or gross negligence and to issue an adverse remark first could hinder removal of a board member. - FI has removed a board member once (in the context of initial suitability assessment after appointment); the case was questioned in court (ruled in favor of FI). - FI has directed criticism to Boards that led supervised entities to undertake changes; FI has questioned suitability on conflicts of interest in a few cases, with institutions addressing conflicts or withdrawing nominations. ### Additional Criteria AC1 — Reporting duties by banks - Laws, regulations or the supervisor require banks to notify the supervisor as soon as they become aware of material information that may negatively affect fitness and propriety of Board members or senior management. - Relevant guidance: - Joint ESMA and EBA Guidelines (Articles 162 and 170) require institutions to inform competent authority without delay if management body is not suitable individually or collectively. - FI’s general guidelines regarding reporting of significant events (FFFS 2021:2) require institutions to immediately report events to the competent authority, such as events that may lead to significant reputational risk. ### Assessment of Principle 14 - Overall assessment: Largely Compliant. - Key reasons and constraints: - Swedish Company Law does not recognize the concept of “senior management”; board of directors or managing director bear senior management responsibilities. - FI’s regulation on remuneration (FFFS 2011:1) defines senior management for remuneration purposes but the legal framework does not clearly implement day-to-day management responsibilities beyond the board and managing director. - The lack of legislation defining senior management responsibilities limits clarity and implementation for entities other than the board and managing director. *Source: 1sweea2023008 - 1. Overall system for internal control;* ### references the roles and responsibilities to be assigned to senior management affects a ### references the roles and responsibilities to be assigned to senior management affects a ### Corporate governance: roles, responsibilities, and legal constraints - Swedish law: the management body does not have a role to play in the process of selection and appointment of any of its members. - Assessors found no evidence that FI performs an assessment of selection of members’ process or succession plans. - Removal of a board member may be hindered because the need to prove an intentional or gross negligence action for the removal or to issue an adverse remark first (depending on the root causes for the removal). - FI has been able to change board composition to date, but legal/removal constraints could hinder future removals. - Governance-specific investigations have been incorporated into targeted risk-specific investigations; governance experts have been recently reallocated to AML/CFT areas. - Consequence: difficulty for FI to continue fulfilling its mandate to adequately supervise banks and to perform thematic governance reviews (e.g., independence of the CRO and the risk control function; remuneration regulation). - Recommendation implied by findings: FI’s governance supervisory method should be reviewed to align with the new internal governance EBA guidelines (which incorporate provisions related to gender diversity, money laundering, financing terrorist risk, and management of conflicts of interest, including in the context of loans and other transactions with members of the management body and their related parties). ### Resource constraints and supervisory intrusiveness - Observations indicate lack of intrusiveness of supervision because of resource constraints also applies to corporate governance assessment. - Lack of onsite interaction with bank staff other than senior managers hinders FI’s ability to assess risk culture in a bank. - FI identifies most material issues but is not always able to go deep into details and sometimes findings are not timely. - Deep-dive investigations provide better root-cause understanding but are infrequent due to lack of resources. - Evidence of lack of consistency of supervisory practices that might reflect high-level manuals or lack of expertise of supervisors. ### Alignment with EBA guidance and supervisory methods - FI’s risk assessment methods (also referred as “handbook”) are: - Too high level; - Do not clarify how supervisors should assess particular items; - Do not make direct reference to EBA guidelines’ provisions other than the SREP. - Risk assessment methods' shortcomings may lead to: - Lack of consistency between different supervisors; - Less intrusiveness; - More time-consuming assessments because of lack of further guidance. - Assessors verified that the assessment methods broadly follow the provisions in the EBA GL SREP, but practical guidance and references to other EBA guidance (e.g., for credit risk) are limited. ### Principle 15 — Risk management process (overview) - Principle statement: The supervisor determines that banks have a comprehensive risk management process (including effective Board and senior management oversight) to identify, measure, evaluate, monitor, report and control or mitigate all material risks on a timely basis and to assess the adequacy of their capital and liquidity in relation to their risk profile and market and macroeconomic conditions. This extends to development and review of contingency arrangements (including robust and credible recovery plans where warranted) that take into account the specific circumstances of the bank. The risk management process is commensurate with the risk profile and systemic importance of the bank. - Footnote context: For the purposes of assessing risk management by banks in the context of Principles 15 to 25, a bank’s risk management framework should take an integrated “bank-wide” perspective and, where applicable, cover risk exposure across the banking group. ### Essential Criteria — summary findings (EC1 to EC8) - EC1 — Board-approved risk management strategy and oversight - Legal/regulatory basis: - BFBA (SFS 2004:297, Chapter 6, Section 2): credit institutions shall identify, measure, control, internally report and verify risks; ensure credit, market, operational and other risks do not on aggregate jeopardize ability to fulfil obligations; maintain capital sufficient to cover risks. - FFFS 2014:1 Chapter 5: comprehensive risk management framework required; framework must be integrated into decision-making; business units responsible for daily risk management; internal rules decided by the board; procedures for monitoring and control; board to inform and train staff. - Supervisory practice: - Assessment performed as part of SREP via targeted investigations and ongoing supervision. - FI holds quarterly risk review meetings with the three major banks and semi-annually with eight medium sized credit institutions. - SREP assessments use risk assessment methods built on information from firm reporting, internal risk/capital/liquidity/audit/compliance reports, meetings, closed investigations. - Limitations: - Handbooks are high level and lack detail and direct EBA references. - Lack of consistency among supervisors; limited ability to go deep due to resource constraints. - EC2 — Comprehensive bank-wide risk management policies and processes - Regulatory basis: BFBA (SFS 2004:297), Chapter 6 Sections 2 and 5. - Findings: Assessors shown conclusions where FI identified deficiencies in risk management (often governance and credit risk) and measures were taken. - EC3 — Documentation, review, communication, and escalation of exceptions - Regulatory basis: BFBA Chapter 6, Section 5; FFFS 2014:1 Chapter 5 and Sections 6, 8, 9. - Findings: - Regulations require written internal guidelines and regular evaluation. - Undertakings must report risks to the board timely; perform forward- and backward-looking analyses; inform and train staff. - Regulation lacks a clear requirement that breaches should be taken to the appropriate level of senior management and the board where necessary. - FI relies on the second line of defense to monitor internal trading limits; limited onsite assessment of communication across levels. - Evidence that FI identified limit-related deficiencies and measures were taken. - EC4 — Board and senior management understanding of risks and information limitations - Regulatory basis: FFFS 2014:1 Chapter 3, Section 2; Chapter 5, Section 5; Chapter 6, Section 7. - Findings: - Board members required to be familiar with operations and risks. - Banks must report actual and possible risks to the board; control functions should report risks and follow-up. - FI reviews Board material and meeting minutes as part of SREP to assess whether boards obtain sufficient information and act. - EC5 — Internal capital and liquidity adequacy processes (ICAAP/ILAAP) - Regulatory basis: FFFS 2014:12 Chapter 10, Section 1 requires annual ICAAP/ILAAP documentation. - Practice: - FI adopted EBA guidelines on ICAAP and ILAAP information collected for SREP (EBA/GL/2016/30) and recommended supervised entities to report accordingly. - FI assesses ICAAP/ILAAP in SREP and evaluates internal capital and liquidity adequacy assessments and strategies. - EC6 — Use and governance of models - Findings: - In SREP, FI collects documentation of models and validations; models assessed as part of each risk type evaluation (e.g., IRRBB by market risk experts; IFRS 9 models in credit risk assessment). - Assessors found evidence FI performed inspections addressing EC6, though remarks in EC5 of CP16 are applicable. - EC7 — Risk data aggregation and reporting (IT and information systems) - Regulatory basis: FFFS 2014:1 Chapter 2 requires current and appropriate IT systems and reporting procedures; capability to gather and automatically compile data on significant risks; flexibility for analysis and stress tests; risk data compilable by operation area, legal entity, asset class, counterparty type, region, etc. - Findings: - FI determines banks have appropriate risk management systems but does not require specific information systems nor performs detailed assessments unless a specific inspection is needed. - During SREP, FI assesses compliance with BCBS 239 principles; evidence from Covid pandemic shows banks could quickly provide requested information without significant delay. - EC8 — Policies for new products, material changes, and major initiatives - Regulatory basis: FFFS 2014:1 requires undertakings to manage risks when introducing new or materially altered products, services, markets, processes, IT systems or major operational changes; risk control function must evaluate risks prior to introduction. - Findings: FI’s regulation and supervisory practice require evaluation of risks for new or materially altered activities; control functions expected to evaluate and report. ### Key supervisory process observations - FI performs SREP assessments using decided risk assessment methods and a range of information sources (firm reporting; internal risk, capital, liquidity, auditing, compliance reports; meetings; closed investigations). - FI assesses risk frameworks both by risk type and for internal control under the SREP. - FI assesses consistency between ICAAP/ILAAP thresholds, recovery plans, and risk appetite/limits; assessors found evidence FI adequately performs such assessments. - Onsite assessments and thematic governance reviews have been reduced or constrained by resource reallocations (e.g., governance expertise moved to AML/CFT). *Source: IMF staff assessment text provided in the supplied PDF content.* ### Chapter 5, Section 10-14) a bank should have a process for the approval of new products. ### 1sweea2023008 - Chapter 5, Section 10-14) a bank should have a process for the approval of new products. ### New product approval process (FFFS 2014:4, Chapter 5, Section 10-14) - New products include those developed by the bank or by a third party and purchased or distributed by the bank. - Banks should consider, for example: compliance with rules and regulations, the risks connected with the product, the impact of the bank ́s capital, necessary resources and competence, appropriate processes and procedures to monitor the risks. - The approval process should be described in internal rules, which are approved by the board. - The approval process for new products is assessed under the SREP. ### EC9 — Risk management function: requirements and supervisory findings - FI’s Regulations and General Guidelines regarding governance, risk management and control at credit institutions (FFFS 2014:1) Chapter 6, Sections 1 and 3 require an undertaking to have a risk control function with: - resources required, staff with the required knowledge and powers and access to the information needed to discharge its tasks. - Independence criteria for a control function (Chapter 6, Section 6) require: 1. staff of the control function shall not perform any tasks that are included in the operations they are to monitor and control, 2. it shall, in organizational terms, be separate from the functions and areas it is to monitor and control, 3. the person responsible for the control function shall regularly report directly to the board of directors and attend board meetings at which the area of responsibility or reports of the function in question are addressed, and 4. the method for establishing remuneration for the staff of the control function shall not be devised such that it jeopardizes or could perceivably jeopardize the objectivity of the staff. - Chapter 9, section 5, items 4 and 5 require internal audit to review internal controls and risk management regularly. - Supervisory practice: - FI holds regular meetings with banks’ risk control functions (quarterly for category 1 banks and semi-annually for category 2). - Prior to these meetings, reports from the risk control function are evaluated. - In SREP, adequacy of the bank’s risk control function is evaluated against the criteria above. - FI meets with internal audit twice a year and has access to its reports to assess evaluation of the first two lines of defense. - Internal audit and supervision findings generally concur; supervisory findings are presented at a higher level and may not address all specific issues and root causes. ### EC10 — Chief Risk Officer (CRO) and governance - FFFS 2014:1 Chapter 7, Sections 4-6 require undertakings of a certain nature, scope and complexity to appoint a chief risk officer (CRO) who shall: - be in charge of the risk control function and assess whether the risk management framework is efficient and appropriate, - be directly subordinate to the managing director and report directly thereto and to the Board and, when appropriate, to the risk committee of the Board of directors. - Board responsibilities: - An undertaking shall have internal rules for appointing and replacing a CRO. - The board shall approve and decide on the appointment and replacement of the CRO. - The undertaking shall inform FI when it appoints or replaces the CRO. - Risk committee (Chapter 5, Sections 13-16) required for significant undertakings. - Removal and replacement practice: - For category 1 banks, FI has a dialogue at senior management level immediately when receiving information on CRO removal to assess impact. - For categories 2–4 and as follow-up for category 1, FI raises questions regarding replacement in ensuing quarterly/semi-annual meeting; if no meeting is scheduled, written communication takes place, if appropriate. ### EC11 — Risk-specific binding regulations issued by FI - List of FI regulations (as stated): - FFFS 2010:7 FI’s Regulations regarding management of liquidity risks in credit institutions and investment firms. - FFFS 2014:4 FI’s Regulations and General Guidelines regarding the management of operational risks. - FFFS 2014:5 FI’s Regulations and General Guidelines regarding information security, IT operations and deposit systems. - FFFS 2018:16 FI’s Regulations and General Guidelines regarding management of credit risks in credit institutions and securities companies. - FFFS 2007:4 FI’s regulations on reporting interest rate risk in the banking book (IRRBB). - Additional points: - FI has issued guidance regarding the calculation of IRRBB (included in the Pillar 2 requirements) and declared its intention to comply with EBA guidelines on IRRBB. - No national regulation specifically related to market risk nor to IRRBB yet, as Sweden is following the EU plan for regulation in this area. - FFFS 2000:10 was repealed on January 1, 2021; replaced by regulatory frameworks that are (1) legally binding, (2) based on Basel 2.5 standards, and (3) in general better adapted to contemporary trading books. - Replacement frameworks include provisions for: - General trading book provisions and hence management of market risk; - Market risk capital requirement (SA); - Market risk capital requirement (IMA); and - Prudential CVA, both internal and standard approach. - Other applicable regulations: FFFS 2014:1, comprehensive CRR standards for prudent valuation, SFS (2014:968) on special supervision, and EBA GL on the treatment of structural FX positions. - Introduction of CRD6/CRR3 in EU (FRTB implementation) will increase compliance with the Basel standard further. ### EC12 — Contingency arrangements and recovery planning - FFFS 2014:4, Chapter 5, Section 15 require institutions to have internal rules, methods and procedures for contingency, continuity and recovery plans. - FI assesses whether the recovery plan is an integrated part of the risk management framework; contingency arrangements are considered in the SREP process. - BFBA (SFS 2004:297, Chapter 6a) establishes requirements and procedures for drawing up a recovery plan and supervision of recovery plans. - Review and coordination: - FI shall review the recovery plan and SNDO shall be given the opportunity to review the plan to identify measures that could negatively impact the credit institution’s possibility for resolution and to provide recommendations to FI. - The review shall be carried out following consultation with competent authorities in EEA member states where a significant branch is located. - The procedure for review of a group recovery plan for a cross-border group is set forth in sections 8–11 of the act. - Remedial actions where FI finds material deficiencies or impediments: 1. Order the credit institution to submit a revised plan within two months to rectify deficiencies or impediments. 2. If changes cannot adequately rectify deficiencies, FI may order the institution to identify changes in its business activities to eliminate deficiencies. If material deficiencies remain, FI may order the institution to: - reduce the risk profile of the institution, including the liquidity risk; - enable timely recapitalization measure; - review the institution’s strategy and structure; - make changes to the financing strategy so as to improve the resilience of the core business lines and the critical functions; or - make changes to the governance structure of the institution. - Supervisory evidence: - FI assesses adequacy of banks’ contingency arrangements and requires changes to recovery plans both at regular SREPs and deep-dive investigations. - In 2020, FI published a report on the continuity management at banks. ### EC13 — Stress testing requirements and supervisory assessment - CRR provisions referenced: - Article 177 sets requirements for stress tests used by IRB banks in assessment of capital adequacy. - Article 221 requires rigorous stress testing for Internal Models Approach for master netting agreements. - Article 290 sets stress testing requirements for internal model method for counterparty credit risk. - Article 302 requires scenario analysis and stress testing for exposures to a CCP. - Article 368 sets stress-testing requirements for internal models for market risk. - Article 407 sets stress-testing requirements for banks investing in securitization positions. - EBA guidelines: EBA/GL/2018/04 requires stress testing program to be integral to risk management (ICAAP and ILAAP), documented and updated, based on severe but plausible scenarios. - Supervisory findings: - Stress testing is evaluated and graded under the SREP assessment of ICAAP and market risk, but assessment methodology is "not as detailed as in many other chapters." - The stress testing assessment methodology is described in other chapters from a high-level perspective. - Limited resources: number of staff dedicated to assessing stress testing is "very limited (2-3 FTE)" and they are also responsible for performing the P2G calculation. - Because FI uses its internal stress testing to require capital add-ons from institutions (P2G), greater focus may be on the P2G calculation. - Assessors found that banks’ internal stress testing are assessed from a high-level perspective in some aspects and do not fully cover the recommendations in the BCBS stress testing principles (2018). - To date, FI has not required changes to banks’ internal stress testing nor performed any deep-dive investigations on stress testing; FI has had no onsite engagement with banks on stress testing so far. ### EC14 — Internal pricing, performance measurement and new product approval - FFFS 2010:7, Chapter 3, Section 2 requires institutions to calculate costs for liquidity and take these costs into account in internal pricing and performance measures; costs for liquidity shall reflect the firm’s current cost of refinancing upcoming maturities and the cost the firm incurs to maintain a liquidity reserve. - FFFS 2014:4, Chapter 5, Section 10-14 requires a bank to have a process for the approval of new products (see New product approval process above). - SREP practice: - For categories 1 and 2, FI assesses if there is a method for internal pricing, and if it is reflected in the cost of financing and liquidity reserve; this assessment is mainly performed by the market risk expert team. - Approval process for new products is assessed in the SREP with contribution from the operational risk expert team. ### Additional criteria — AC1 (other material risks) - FI’s mandate and requirements: - According to the credit institutions and securities companies Act (SFS 2014:968, Chapter 2, Section 1), FI shall order that a credit institution, in addition to the own funds required pursuant to the Prudential Requirements Regulation, shall satisfy: 1. a specific own funds requirement for risks associated with excessive leverage; and *Source: 1sweea2023008 - Chapter 5, Section 10-14) a bank should have a process for the approval of new products.* ### 2. a specific own funds requirement for other risks. ### 2. a specific own funds requirement for other risks. ### Legal basis and scope for Pillar 2 requirements - Item 2 provides the legal basis for FI to require any additional capital under a Pillar 2 requirement. - The BFBA (SFS 2004:297, Chapter 9) stipulates that requirements for own funds, capital requirements and large exposure requirements are prescribed in the EU’s Capital Requirement Regulation No 575/2013 (CRR). - The CRR establishes the requirements for calculating prescribed capital requirements (Part Three, Articles 92–386), including thresholds by reference to which a bank might be subject to supervisory action and which banks are required to satisfy at all times (Article 92(1)). - The CRR establishes the following minimum capital requirements thresholds: Common Equity Tier 1 (CET1) capital 4.5 percent, Tier 1 capital (including additional Tier 1) 6 percent, and total capital (including Tier 2 capital) 8 percent. - Part Two of the CRR defines the components of capital following the Basel-based capital tier structure. - EU’s Capital Requirement Directive 2013/36/EU (CRD) contains the regulation for Pillar 2 capital requirements (P2R), capital buffers and the Pillar 2 guidance (P2G). - Sweden has implemented the CRD mainly in the Swedish Credit Institutions and Securities Companies Special Supervision Act (SFS 2014:968) and Capital Buffers Act (SFS 2014:966). - Based on the Special Supervision Act (SFS 2014: 968), FI may require institutions to hold additional capital in relation to both the risk-weighted capital requirement and the leverage ratio requirement (Pillar 2 requirements). - The Special Supervisions Act provides a standard capital composition for P2R but FI has the mandate to, in some situation, require the institution to meet the P2R with a higher portion of CET1 capital or Tier 1 capital. - FI makes formal decision regarding P2R, according to disclosed methodologies, for the following risks: - Flow back risk associated with securitization; - Pension risk; - Interest rate risk and additional market risk; - Risks related to CRE lending; - Credit-related concentration risk; and - Risk weights for exposures to corporates. - FI also has the power to decide on a P2R for other risks that a bank is or may be exposed to, which has been the case for several banks. - In addition to the minimum capital requirements, the Capital Buffers Act (SFS 2014:966) includes all components within the combined buffer requirement that FI may decide on. FI has the power to impose and decide on the level for systemic risk buffers (SRB), a buffer for other systemically important institutions (O-SII buffer) and a countercyclical capital buffer (CCyB). The Capital Buffers Act also prescribes a capital conservation buffer. ### FI supervisory practices and identified limitations - FI has established different methods for requiring additional Pillar 2 requirements for the risks listed above and assessors were able to identify additional pillar 2 requirements related to those risks for different institutions. - Strategic risk is assessed by FI under the business model’s risk. - Supervisor does not require nor assess if banks take into account reputational risks. - The supervisory process is based on the risk assessment methods (also referred as “handbook”). - The assessment methods are described as too high level, do not clarify how supervisors should assess particular items and do not make direct reference to EBA guidelines’ provisions (other than the SREP one) that are particularly useful for some specific risks, such as credit. - Evidence of inconsistency in supervisory practices was found: changes in the supervisory team have led to changes in the regulatory approach and intrusiveness in some examples. - FI relies on the second line of defense to monitor trading limits; in the absence of close monitoring this could lead to material breaches other than prudential VaR breaches not being reported as fast as it should. - FI has been able to identify material issues but is not able to go deep into the details and sometimes it is not timely. - When performing deep-dive investigations, FI is better able to understand root causes; however, these deep-dive investigations are not frequent due to lack of resources. - The lack of onsite inspections and the small amount of time spent in loco is insufficient to properly assess the provisions in this CP. - FI uses EU standards, EBA Guidelines, and the general Swedish regulatory code (FFFS 2014:1) to regulate market risk, ahead of the introduction of the FRTB in the EU. ### Assessment of stress testing and P2G practices - The assessors saw evidence that stress testing is evaluated under the SREP when assessing banks’ ICAAP and market risk. - The assessment of stress testing is not as detailed as in many other chapters. - The number of staff dedicated to assessing stress testing is very limited; those staff are also responsible for performing the P2G calculation. - Since FI uses its internal stress testing to require capital add-ons from institutions (P2G), it might be putting a greater focus on the P2G calculation. - Banks’ internal stress testing are assessed from a high-level perspective and do not fully cover the recommendations in the BCBS stress testing principles (2018). - FI has not required any changes to banks’ internal stress testing nor have performed any deep-dive investigations on stress testing. - So far, FI has had no onsite engagement with banks on stress testing. ### Assessment outcome — Principle 15 (Materially Non-Compliant) - Overall, while most elements of this CP are addressed in FI’s processes, supervision puts too great a focus on procedures and documentation rather than meaningful corroboration of quality of implementation. - The likely reason is resource constraints and that more intrusive assessment would be time consuming. - Ensuring that policies are adhered to in practice, for example through a rigorous process of spot checks and file reviews, is fundamental, at least for the systemic firms. - The high-level assessment methods risk: - Lack of consistency between different supervisors; - Less intrusiveness and more time-consuming assessments because of lack of further guidance; - Changes in supervisory approach when supervisory teams change, possibly reflecting high-level internal guidelines or lack of expertise. - The de-prioritization of supervision of stress testing materially affects the evaluation of this CP. ### Assessment of Principle 16 — Capital adequacy (EC1 findings) - Laws, regulations or the supervisor require banks to calculate and consistently observe prescribed capital requirements, including thresholds by reference to which a bank might be subject to supervisory action. - Laws, regulations or the supervisor define the qualifying components of capital, ensuring emphasis is given to elements of capital permanently available to absorb losses on a going concern basis. - CRR and domestic legislation establish capital definitions and minimum thresholds (CET1 4.5 percent; Tier 1 6 percent; total capital 8 percent). - FI has formal powers under the Special Supervision Act (SFS 2014: 968) to require additional capital (P2R) and to prescribe composition of P2R with a potential higher portion of CET1 or Tier 1 where warranted. - FI has applied P2R decisions for the six listed risk categories and for other risks on a case-by-case basis. *Source: 1sweea2023008 - 2. a specific own funds requirement for other risks.* ### 2.5 percent of RWA where the level is given directly by the law. According to the act, all ### 1sweea2023008 - 2.5 percent of RWA where the level is given directly by the law. According to the act, all ### Capital buffers and prescribed requirements - All capital buffers within the combined buffer requirement should be met by CET1 capital. - Current buffer levels and decisions: - CCyB is currently zero percent on exposures in Sweden. FI has decided to increase the buffer value to one percent, which applies from September 29, 2022. - FI will apply a positive neutral rate of 2 percent going forward for the CCyB. - FI has set an O-SII buffer of 1 percent of the RWA for the major banks. - One of Nordea’s Swedish subsidiaries classified as an O-SII will receive an O-SII buffer amounting to 1 percent of the RWA. - FI has set an SRB of 3 percent of the RWA for the major banks. - Combined illustrative capital calculation (example used in assessment): - Total capital required (including buffers), excluding P2G, could amount to 18.5 percent, composed as: 8% + 2.5% + 2% + 3% + 1% + 2% (minimum requirement + CCoB + CCyB + SRB + O-SII + P2R). - Note: a P2R of 2 percent was used illustratively (P2R values vary significantly across institutions). ### P2G, P2R, and supervisory use of measures - Special Supervision Act (SFS 2006:531 / SFS 2014:968) allows FI to communicate a P2G and to impose P2R. - P2G characteristics and methodology: - P2G can be communicated for both the risk-weighted and the leverage ratio requirement. - Methodology is a two-step approach: - Step 1: FI conducts a sensitivity-based stress test that estimates potential fall in capital levels at the bank given assumptions and methodology choices; outcome rounded into intervals. - Step 2: FI considers other quantitative and qualitative grounds; final P2G determined from overall assessment of both steps. - FI has discretion to decide capital composition for P2G and has decided that the P2G shall be met with CET1 capital. - P2R characteristics: - FI makes formal decisions regarding P2R for each bank. - P2R shall be covered with at least 75 percent Tier 1 capital, of which at least 75 percent shall be CET1 capital, although FI can require higher proportions. - FI has published methodology documentation concerning P2R. - Consequences of breaches: - Falling below certain parts of the capital requirements results in automatic restrictions on certain value transfers, possible limitations on dividends and on coupon payments on Tier 1 capital instruments, and obligation to submit a capital conservation plan. - Breaches of minimum requirement or P2R require action by FI; breaches of P2G have no automatic consequences but FI can intervene (e.g., intensified follow-up or decide on a P2R). - FI can, in practice, replace P2G with a P2R where justified. ### Supervisor powers and use of capital measures - FI powers and practices: - FI may impose additional capital requirements (P2R) and communicate P2G. - FI can impose a specific capital charge and/or limits on all material risk exposures, including risks not adequately transferred or mitigated through transactions. - FI has the power under the Special Supervision Act (SFS 2014:968, Chapter 8) to limit operations, reduce risks, or take necessary corrective measures where a company fails to fulfil prudential requirements. - Observed supervisory practice: - FI has been active in requiring additional P2R and P2G for institutions; methodologies for calculating P2R and P2G are public. - Examples of measures other than additional capital are scarcer in practice; the assessors note that additional capital is not always the appropriate countermeasure (e.g., risk management deficiencies may require governance or operational remedies). ### Internal models, IRB issues, and supervisory capacity - Regulatory framework for internal models: - Use of internal assessments (IRB, AMA, IMA) adheres to CRR Part 3 (IRB), Title 3 (Operational risk), Title 4 (Market risk) and applicable EBA guidelines. - Any material modification or cessation of internal model use requires prior permission (Article 143(3), Article 312, Article 363(3), Article 149, Article 283(5), Article 313 as applicable). - FI processes: - FI has one process for assessment of applications/permissions to use IRB and for material changes, and another for ongoing monitoring (SREP, risk review meetings, EBA exercises). - FI uses assessment templates based on CRR, technical standards and guidelines. - Capacity constraints and backlog: - There are currently 11 banks IRB approved (approximately 75% of banking assets). - Because of EBA IRB review since 2019, almost a hundred applications are waiting to be approved. - FI has not shown capacity to evaluate a bank’s internal assessment process or to approve models/material changes in due time. - FI has faced considerable challenges retaining IRB model experts; staffing affected by substantial turnover and competition from private sector. - FI currently has 4 FTE for market risk and 2 FTE for operational risk. - Material model deficiencies observed: - Evidence from EBA benchmarking exercise showed material issues in IRB models; when corrected, this led to a 65% increase in RWA for credit risk. - FI applies P2R add-ons to mitigate some underestimation risks: risk-weight floor for CRE corporate exposures set as 35 percent of the average risk weight for corporates exposures secured by CRE and 25 percent for corporates exposures secured by commercial residential property. ### Risk weights, transitional arrangements, and conservatism - Mortgage risk weight floors: - Risk weight floor for Swedish retail mortgages: introduced at 15% in 2013 and raised to 25% percent in 2014. - As of December 2018, the mortgage risk weight floor was replaced by an equivalent requirement in Pillar 1 in line with article 458 in the CRR. - FI decided on December 16, 2021 to prolong the credit institution-specific minimum level of 25% for the average risk weight on Swedish housing loans, applicable to credit institutions that have adopted the IRB Approach, with effect from December 31, 2021, for a period of two years, under Article 458 of the CRR. - Transitional arrangements: - CRR permits more generous transitional phase-in for certain deductions (e.g., deferred tax assets under Article 478(2), equity holdings in insurance undertakings under Article 47); FI currently uses none of these transitional arrangements. - Sweden’s general stance: - Swedish application of the CRR is conservative and does not make use of all discretions; Sweden has not exercised certain waivers (e.g., consolidation of insurance subsidiaries) and has applied more conservative measures (risk weight floors, non-use of generous phase-in). ### Assessment outcomes and supervisory shortcomings - Principle 16 assessment: Materially Non-Compliant. - Key assessment findings: - The CRR and national rules are broadly based on Basel standards, and Sweden applies more conservative measures in several respects. - FI is active in imposing P2R/P2G and has public methodologies. - Critical supervisory capacity issues persist, especially regarding evaluation and approval of internal models: - Backlog of almost a hundred IRB-related applications. - Lack of capacity leads to high-level monitoring rather than detailed testing and onsite assessments. - The integrity of models is critical given IRB banks account for roughly 75% of banking assets. - FI’s examples of using powers other than raising capital are limited; reliance on capital add-ons may not address root causes (e.g., risk management weaknesses). - The supervisory approach could be enhanced by more comprehensive offsite monitoring, collection of granular model-level data, and onsite evaluation of model deployment, data and governance. - Specific supervisory actions taken: - 2018 thematic inspection on counterparty risk management led to increase in alpha factor from 1.4 to 1.5 under article 284(4) of the CRR. - FI required reversion to standardized approach for one branch in a specific case following legal status change. *Source: https://www.imf.org/-/media/files/publications/cr/2023/english/1sweea2023008.pdf* ### 1. quantitative risk measurement, valuation and value adjustment, ### 1. quantitative risk measurement, valuation and value adjustment, ### Key areas covered - 1. quantitative risk measurement, valuation and value adjustment, - 2. risk mitigation with regards to the risk associated with non-cleared derivatives, - 3. credit institutions’ internal instructions for taking on new products and markets, - 4. stress tests, and - 5. internal risk management and governance. ### Supervisory resourcing and approach - The team responsible for supervision of credit risk (CCR excluded, but consumer protection, ESG, related parties, country and transfer risk, among others are included) has overall nine people. - Guiding principle: follow perceived or identified risks within credit risk rather than perform a full-scope assessment; priorities vary over time and are set jointly with input from different departments at FI, including the Economic Analysis Office and the Bank Analysis & Policy Department. - Inspections and deep-dive investigations are primary tools; deep-dives are useful but scarce, resource-consuming, and slow to finalize. - SREP process considered by assessors to be too high-level to capture material findings; deep-dive investigations have proven more useful but are not efficient to cover regular supervisory gaps. ### EC2 — Board and senior management responsibilities (findings and regulatory basis) - Supervisor determines that a bank’s Board approves and regularly reviews the credit risk management strategy and significant policies and processes for assuming, identifying, measuring, evaluating, monitoring, reporting and controlling or mitigating credit risk (including counterparty credit risk and associated potential future exposure) and that these are consistent with risk appetite set by the Board. Senior management implements the Board-approved credit risk strategy and develops the policies and processes. - Regulatory framework cited: - FI’s Regulation regarding governance, risk management and control at credit institutions (FFFS 2014:1), Chapters 2, 3, 4, 5, and 7. - Regulations stipulate the board shall ascertain that an undertaking has a risk strategy and evaluate it regularly and update if necessary. ### EC3 — Requirements for an appropriate credit risk environment (a–g) and FI findings - Supervisor requires policies/processes to establish an appropriate and properly controlled credit risk environment including items (a)–(g) below. - (a) Well-documented and effectively implemented strategy and sound policies and processes for assuming credit risk, without undue reliance on external credit assessments. - BFBA (Chapter 8, Sections 1–3) requires credit assessment based on applicant’s repayment capacity, documentation of credit decisions. - FFFS 2018:16 (Chapter 2) requires appropriate internal rules aligned with documented credit risk appetite, including conditions for credits with increased risk and documentation requirements. - FFFS 2014:1 (Chapter 5, Section 11) requires critical review of own risk assessments, not solely relying on external assessments, and forward-looking and backward-looking analyses. - FI has not performed credit file reviews for categories 1 and 2 banks since 2017. - (b) Well defined criteria and policies/processes for approving new exposures (including prudent underwriting standards) and for renewing/refinancing existing exposures; appropriate approval authority for size and complexity. - FFFS 2014:1 (Chapter 2, Section 1 paragraph 2) requires current and documented decision-making procedures specifying reporting lines. - FFFS 2018:16 Chapter 3, Section 2 requires procedures/methods to identify, measure, internally report and control credit risks including probability of default and loss given default; underlying data shall be reliable and complete. - Chapter 6 requires review of all credits at least once a year; credits with increased risk reviewed more frequently. - FI unable to show a supervisory process to verify circumvention of classification and rating requirements, including rescheduling, refinancing or reclassification. - (c) Effective credit administration policies/processes including continued analysis of borrower’s ability/willingness to repay, monitoring of documentation, covenants, collateral and appropriate asset grading/classification system. - FFFS 2018:16 Chapter 6 establishes requirements for review of credit exposures. - EBA/GL/2017/06 provides guidance on evaluating credit risk management practices and accounting for expected credit losses; Paragraph 43 requires independent review function for credit rating process. - No requirement related to review of performance of underlying assets in securitization exposures (market very small in Sweden). - Quarterly risk meetings include information on 25 largest exposures; in-depth credit file reviews may follow initial findings. - (d) Effective information systems for accurate and timely identification, aggregation and reporting of credit risk exposures to Board and senior management. - FFFS 2014:1 (Chapter 2) requires current and appropriate IT systems. - FI assesses IT systems during SREP but does not require specific information systems nor perform detailed assessments unless a specific inspection is identified. - (e) Prudent and appropriate credit limits, consistent with risk appetite, risk profile and capital strength, understood by and regularly communicated to relevant staff. - FFFS 2018:16 (Chapter 5) contains general guidelines on sound risk culture; FFFS 2014:1 (Chapter 5, Section 2) requires risk management framework to be well integrated into organizational and decision-making structure. - Assessors found evidence FI assesses relationship between credit limits, risk appetite, risk profile and capital strength in banks’ policies. - FI advised to perform more in loco activities to determine actual communication of risk culture to relevant staff. - (f) Exception tracking and reporting processes ensuring prompt action at appropriate level of senior management or Board. - EBA SREP guidelines paragraph 192.c recommend supervisors verify timely reporting of breaches/exceptions. - FI assesses breaches and reporting during SREP and supervisors found evidence limit breaches are analyzed in SREP assessments. - (g) Effective controls regarding use of models to identify and measure credit risk and set limits (including quality/relevancy of data and validation procedures). - EBA SREP guidelines paragraph 217 recommend supervisors assess internal validation for IRB banks. - FI is behind schedule in majority of applications associated with ongoing IRB repair; completeness checks finalized for all applications received. ### EC4 — Monitoring total indebtedness and unhedged FX risk (findings) - FFFS 2018:16 Chapter 4 requires credit assessment based on well-defined criteria providing accurate overview of borrower repayment capacity and pledged collateral; assessments to be forward-looking based on available historical data. - Background document provides examples of factors to consider: purpose of credit, credit conditions, sources of repayment, historic repayment capacity, forward-looking repayment capacity analysis, cash flow and sensitivity analysis, forward-looking prospects for sector/market/country, political and sustainability-related risks. - For consumer credits, current and future consumer debt situation should be taken into account per FFFS 2021:29. - Recommendation: create a centralized credit registry to enable monitoring of total indebtedness of consumers; more information should be available to FI and institutions. ### EC5 — Conflicts of interest and arm’s length credit decisions (findings) - Securities Companies Act (SFS 2005:551) specifies areas where certain positions represent conflict of interest and prohibits specified persons from accepting certain positions, managing specified tasks, entering certain agreements (affected positions include shareholders (chapter 7, section 46), board members (chapter 8, section 23), CEO (chapter 8, section 34), auditor (chapter 9, section 17), nonprofessional auditors (chapter 10, section 10)). - BFBA (SFS 2004:297, Chapter 8, Section 5) lists persons potentially having a conflict of interest and permits FI discretion in determination. - EBA GL on internal governance requires conflicts of interest framework to ensure loan decisions with management body members and related parties are taken objectively and at arm’s length. - FFFS 2014:1 requires procedures for managing/distinguishing duties and preventing conflicts of interest and ensures no person single-handedly processes a transaction through the entire processing chain. ### EC6 — Board/senior management decision thresholds for major/exotic exposures (findings) - FFFS 2014:1 (Chapter 2, Section 1) requires current and documented decision-making procedures specifying reporting lines and staff expertise. - Credit policy is not required to prescribe exposures exceeding a certain amount or percentage of the bank’s capital that must be decided by Board or senior management, nor explicitly require Board decision for exposures especially risky or outside mainstream activities. - Companies Act and FFFS 2014:1 section 3, chapter 3 require the board to review and update internal documents, and big/complex/especially risky exposures are normally decided by CEO or board in line with board-decided instructions. - Further guidance available in EBA guideline on loan origination and monitoring. *Source: 1sweea2023008 - 1. quantitative risk measurement, valuation and value adjustment,* ### section 4.4 and FFFS 2018:16, chapter 5. ### 1sweea2023008 - section 4.4 and FFFS 2018:16, chapter 5 ### EC7 — Supervisor access to credit and investment portfolio information - Legal and regulatory basis: - BFBA (Chapter 13, Sections 3–4) requires an undertaking to provide any and all information regarding their operations and related circumstances that FI may require. - FI regulation on governance, risk management and control (FFFS 2014:1, Chapter 2, Section and 7) establishes that risk data shall be compilable at least in the event of crisis situations, stress tests and at the request of FI. - FI regulations on reporting of interim and annual report data (FFFS 2014:14) contain requirements on undertakings’ quarterly reporting of balance sheets and income statements with specifications. - Reporting and data availability: - All banks must provide a detailed report of their asset quality in the quarterly reporting (COREP and FINREP). - Uniform reporting requirements in all Member States in Europe ensure data availability and comparability. - Undertakings are regularly required to report to FI in line with CRR and the standard report; specific reports are required within the regular review process and ahead of quarterly and bi-annual meetings or when FI requests them. - FI requests specific data during inspections, deep dives, and specific occasions such as the pandemic. - Operational findings: - FI’s experience indicates no problem obtaining necessary information, on site or off site. - Evidence from the Covid pandemic crisis shows banks were able to quickly react and provide requested information without significant delay. - Cross-reference: - See also CP 10 on supervisory reporting. ### EC8 — Inclusion of credit risk exposures in bank stress testing - Regulatory context: - The EBA SREP guidelines require supervisors to assess whether the institution has undertaken stress testing to understand the impact of adverse events on its credit risk exposures and on the adequacy of its credit risk provisioning (paragraph 211). - The EBA Guidelines on Stress Testing (EBA/GL/2018/04) provide a starting point for the design of stress tests for banks and supervisors. - Findings: - Assessors found evidence that banks’ internal stress testing are assessed from a high-level perspective and do not fully cover the recommendations in the BCBS stress testing principles (2018). ### Assessment of Principle 17 — Overall compliance and supervisory capacity - Assessment result: - Largely Compliant - Regulatory developments: - In 2018, FI issued a regulation regarding management of credit risks in credit institutions and securities companies (FFFS 2018:16), specifying expectations on governance and responsibilities with focus on credit risk (governance, identification, measurement, credit risk assessments, credit decisions, credits with increased risk and credits to related parties). - FI issued general guidelines on credits regarding consumer credit reflecting in large part the EBA Guidelines on loan origination and monitoring; it does not fully cover all aspects related to housing credits. - Governance and decision-making gaps: - No requirement that big, complex, especially risky exposures or major credit risk exposures exceeding a certain amount or percentage of the bank’s capital be decided by the bank’s Board or senior management. - Authorities view self-regulation as preferable if it works well; FI has not identified a need for detailed instructions given no issues observed. - Supervisory process and resource constraints: - FI has been unable to show a supervisory process to verify circumvention of classification and rating requirements, including rescheduling, refinancing or reclassification of lending exposures. - Financial institutions and FI cannot monitor total indebtedness of consumers because of lack of information. - SREP review process for credit risk is based on the credit risk assessment method (part of the “handbook”); internal manuals are high-level and could be strengthened by more specific provisions in EBA Guidelines on loan origination and monitoring. - The team managing credit risk within banking supervision has a broad range of responsibilities with a rather limited number of staff, leading to reliance on supervisory expertise and internal control reports rather than fuller assessments. - FI has not performed credit file reviews for categories 1 and 2 banks since 2017. - In loco activities and onsite inspections are limited; time spent in loco on categories 1 and 2 is insufficient to properly assess credit risk provisions. - Deep-dive investigations are useful but scarce, resource-consuming, and slow to finalize, making them inefficient to cover regular supervisory process gaps. - Implication: - FI lacks resources to perform more intrusive supervision; this materially affects the ability to fully assess and enforce provisions under this Core Principle. ### Principle 18 — Problem assets, provisions and reserves (EC1) - EC1 requirement: - Laws, regulations or the supervisor require banks to formulate policies and processes for identifying and managing problem assets, and require regular review by banks of their problem assets (individual level or portfolio level for homogenous assets) and asset classification, provisioning and write-offs. - Regulatory and supervisory framework: - FFFS 2018:16 stipulates that an undertaking shall have special rules for credits with increased risk, including: - who may take decisions on credits with increased risks, - criteria for which credits entail an increased risk, and - methods for identifying credits with increased risk. - Chapter 7 of FFFS 2018:16 is dedicated to the management of credits with increased risk and mandates: - effective credit risk management at an early stage, - regular reviews (in less than a year), - investigation whether a repayment plan should be initiated, and - assessment of need for mitigation. - The review shall be performed at the individual level when required in accordance with the undertaking’s internal rules and taking into consideration the size and assessed risk level of the credit. - Sweden’s regulation of classifying/provisioning of exposure for regulatory purposes is based on the CRR. Article 47a and 178 of the CRR stipulate when an exposure is nonperforming or when a default shall be considered to have occurred. - FI’s regulations and general guidelines regarding annual accounts (FFFS 2008:25) are also referenced in the supervisory framework. *Source: 1sweea2023008 - section 4.4 and FFFS 2018:16, chapter 5* ### Chapter 7, Section 2), the basis for calculating provisioning is according to IFRS 9. ### 1sweea2023008 - Chapter 7, Section 2), the basis for calculating provisioning is according to IFRS 9. ### Basis for provisioning and regulatory adjustments - The basis for calculating provisioning is according to IFRS 9. - For regulatory requirements, adjustments are made for prudential purposes. - Reserves for the purposes of the Principle are “below the line” non-distributable appropriations of profit required by a supervisor in addition to provisions (“above the line” charges to profit). - Accounting standards shall present a “true and fair view of the provisions” according to CRR (see Principle 10 EC 2). ### Applicable guidelines and reporting standards - Two EBA guidelines applicable in Sweden: - Guidelines on management of nonperforming and forborne exposures (EBA NPL GL) — sound risk management practices for credit institutions for managing, including the review, nonperforming exposures (NPEs), forborne exposures (FBEs) and foreclosed assets. - Guidelines on disclosure of nonperforming and forborne exposures (EBA NPE disclosure GL) — content and uniform disclosure formats for disclosures related to NPEs, FBEs and foreclosed assets. - EBA GL on credit institutions’ credit risk management and accounting for expected credit losses — credit institutions should have in place sound governance, systems, and controls to manage exposures with increased risk and identify them before they are past due. - EBA Final Draft Technical Standards on supervisory reporting on forbearance and nonperforming exposures under article 99 (4) of Regulation (EU) No 575/2013 (EBA ITS on NPE and FBE) are mandatory for Swedish banks. - EBA SREP guidelines require competent authorities to consider whether data, information systems and analytical techniques are appropriate to detect, measure, and monitor credit risk inherent in all on- and off-balance-sheet activities (paragraph 206). ### EC2 — Supervisor reviews of grading, classification and provisioning processes - The supervisor determines adequacy of a bank’s policies and processes for grading and classifying assets and establishing robust provisioning levels. - Reviews supporting the supervisor’s opinion may be conducted by external experts, with the supervisor reviewing their work. - Findings: - Policies and processes are reviewed in the regular SREP process. - Due to resource constraints, regular supervision does not routinely review credit files; specific investigations are needed for credit file reviews. - For the most significant banks, the last credit file review was in 2019. - For less significant banks with higher assessed risk appetite, inspections with credit file reviews are more common but not comprehensive nor frequent. - FI considers remarks in statements by internal or external auditors to prioritize work. - Since IFRS9 introduction, FI has not performed an investigation; attention increased during the Covid pandemic and the credit expert team recently started a deep-dive analysis covering overlays and forbearance supported by accounting experts. ### EC3 — Off-balance sheet exposures in classification and provisioning - The supervisor determines that bank systems account for off-balance sheet exposures. - Legal/technical basis: - Article 5 p. 1 in the CRR: an “exposure” means an asset or off-balance sheet item. - Article 24: valuation of assets and off-balance sheet items effected in accordance with the applicable accounting framework. - EBA ITS on supervisory reporting includes off-balance sheet items, particularly loan commitments and financial guarantees. - Findings: - Off-balance sheet items must be taken into account in an undertaking’s classification and provisioning system. - The same constraints on supervisory review of classification and provisioning (as in EC2) apply to off-balance sheet items. - Note: two types of off-balance sheet exposures recognized — those cancelable unilaterally by the bank and those that cannot be unilaterally cancelled. ### EC4 — Timeliness and realism of provisions and write-offs - The supervisor determines banks have policies/processes to ensure provisions and write-offs are timely and reflect realistic repayment and recovery expectations considering market and macroeconomic conditions. - EBA SREP guidelines require systems and methodologies enable determination of the level of provision and credit valuation adjustments required to cover expected and incurred losses (p. 208). - Findings: - Regular SREP reviews cover strategies for credit risk management and analyze the level of provisions and allowances. - FI’s risk assessment method for credit risk is based on EBA guidelines and requires supervisors to analyze evolution of provisions, allowances and related ratios. ### EC5 — Early identification and oversight of deteriorating assets - The supervisor determines that banks have policies/processes and resources for early identification of deteriorating assets, ongoing oversight of problem assets, and collection on past due obligations. - For homogeneous portfolios, classification occurs when payments are contractually in arrears for a minimum number of days (e.g., 30, 60, 90 days). - Supervisor tests banks’ treatment of assets to identify material circumvention of classification and provisioning standards. - Findings: - FI regulation (FFFS 2018:16, Chapter 7) requires effective credit risk management at an early stage, regular reviews (in less than a year), investigation into repayment plans and mitigation when credits show increased risk. Reviews performed at individual level when required by internal rules considering size and assessed risk level. - EBA SREP Guidelines (p. 212) mandate continuous and effective monitoring of credit risk exposure based on specific indicators and triggers for early warning alerts. - Classification of arrears regulated by EBA ITS; FINREP template F18 buckets exposures by days in arrears: less than 30; between 30 and 60; between 60 and 90; and more than 90 (considered nonperforming). - EBA SREP Guidelines (p. 187) require attention to adequacy of classification and assessment of potential misclassification impacts; competent authorities may use peer analysis, benchmark portfolios, and sampling. - FI uses sampling of loans when assessing portfolio credit quality. - Information requested for regular meetings includes reporting of exposures with increased risk: the 25 largest exposures on watch list, the 25 largest nonperforming exposures and 25 largest exposures with forbearance measures. - If same exposure occurs in more than one undertaking, supervisor can compare classifications; FI can assess exposures’ evolution but not the classification itself. - To reduce misrepresentation risks, FI could extend analysis to different modalities (including small and medium enterprises, retail). - Supervision suffers constraints on intrusiveness (as explained in CP 9), limiting ability to properly test banks’ treatment of assets to identify material circumvention. ### EC6 — Access to detailed information and documentation - The supervisor obtains regular and detailed information on classification of assets and provisioning and requires banks to have adequate documentation to support levels. - EBA ITS on Supervisory Reporting includes specific templates for NPEs (F18) and forborne exposures (F19) to be reported quarterly. - FI regulation (FFFS 2014:14) requires submission of a quarterly standard report from each undertaking based on IFRS. - Since COREP and FINREP introduction: - COREP first reporting period Q3 2014. - FINREP first reporting period Q4 2014. - Loan losses, restructured loans and nonperforming loans by bank and exposure class are collected quarterly by FI through reporting. - For quarterly and bi-annual meetings, banks prepare information packages including updates on watch lists and impaired credits. ### EC7 — Prudential adequacy of classifications and provisioning and supervisory powers - The supervisor assesses adequacy of classification and provisioning for prudential purposes and can require adjustments if inadequate. - Findings: - If FI deems an undertaking’s level of provisions and/or overall financial strength insufficient, FI has power to intervene and demand rectification through setting higher capital requirements (BFBA Chapter 15, Section 1). - FI cannot overrule a bank’s decision on classifications of individual assets and increase its levels of provisioning without a legal basis to act. - If risk classifications are potentially incorrect, an inspection can be initiated to inspect asset classification and provisioning procedures; if deficiencies are identified FI can order rectification. - Until rectification is made, FI can decide on a Pillar II add-on. ### EC8 — Valuation and monitoring of risk mitigants and collateral - The supervisor requires mechanisms for regularly assessing value of risk mitigants, including guarantees, credit derivatives and collateral; valuations reflect net realizable value under prevailing market conditions. - Findings and legal basis: - Real estate collateral generally recognized at market value in line with section 9.3 of the EBA Guidelines on management of nonperforming and forborne exposures and Section 7 of EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06). - Article 208(3) of the CRR: institutions shall monitor property values at minimum every year for CRE and at minimum every three years for residential real estate; more frequent monitoring where market conditions change; valuation reviewed when information indicates material decline relative to general market prices. - Valuations further regulated in CRR article 229. - For NPEs, EBA ITS on NPE and FBE stipulates exposures shall be categorized for their entire amount without taking into account existence of collateral. - EBA guidelines (EBA/GL/2018/06) include further specifications on valuation of immovable property. - FI assesses rules regarding assets eligible as collateral, their valuation and leverage principles, including consideration of climate-related risks in valuation principles. - Given majority of operations in Sweden are collateralized by real estate, FI focuses assessment on real estate collaterals. ### EC9 — Criteria for identifying problem assets and reclassification - Laws, regulations or the supervisor establish criteria for: - (a) identification as a problem asset; and - (b) reclassification as performing. - Findings and legal basis: - CRR article 47 a establishes when an exposure shall be classified as nonperforming and when nonperforming and forborne exposures cease to be classified as nonperforming. - Article 178 (used by IRB banks) states when an exposure shall be classified as defaulted. - CRR is unspecific regarding discontinuation of default status (Article 178.5). - Criteria for discontinuation of nonperforming and forborne exposures are to be applied by institutions for supervisory reporting on top of criteria they already apply for discontinuation of defaulted exposure quality per Article 178 of the CRR. - Further instructions found in EBA guideline on management of nonperforming and forborne exposures (EBA/GL/2018/06). - EBA ITS on Supervisory Reporting introduces definition of nonperforming exposure used for supervisory reporting (instructions for template F18 in Annex V). ### EC10 — Board reporting on asset portfolio condition - The supervisor determines that the bank’s Board obtains timely and appropriate information on asset portfolio condition, including classification, provisions and reserves, and major problem assets. - Required information includes summary results of latest asset review, comparative trends in problem asset quality, and measurements of existing or anticipated deterioration and expected losses. - Description and findings: - FI’s regulation governing the reporting of interim and annual report data (FFFS 2014:1, ...) requires submission of relevant reporting; banks prepare information packages for supervisory meetings including watch lists and impaired credits. *Source: 1sweea2023008 - Chapter 7, Section 2), the basis for calculating provisioning is according to IFRS 9.* ### Chapter 3, Section 2) stipulates that board members shall be thoroughly familiar with and ### Chapter 3, Section 2) stipulates that board members shall be thoroughly familiar with and ### Board responsibilities and risk reporting - Chapter 3, Section 2: board members shall be thoroughly familiar with and knowledgeable about the undertaking’s operations and the nature and scope of its risks. - Chapter 5, Section 5: an undertaking shall have a procedure for regularly reporting the risks that exist or which could perceivably arise in the operations to the board of directors and the risk committee, if such has been appointed, the managing director and other functions that require such information, so that they receive reliable, current and complete reports in a timely manner. - The board of directors and the risk committee, if such has been appointed, shall establish the nature, volume, format and frequency of the risk information they are to receive. - FI’s determination as to whether the Board receives timely and relevant information on the condition of an undertaking’s asset portfolio is also made in the course of SREP, where Board minutes and Directors’ packages often are collected for review. - In the assessment of reports, aspects such as the reports timeliness, their content and coverage can be evaluated by the supervisor. *Source: Chapter 3 and Chapter 5 provisions as described in the content unit.* ### EC11 — Valuation, classification and provisioning for significant exposures - Supervisory requirement: valuation, classification and provisioning, at least for significant exposures, are conducted on an individual item basis; banks must set an appropriate threshold for identifying significant exposures and regularly review that threshold. - FFFS 2018:16, Chapter 7: credits with increased risk shall be regularly reviewed (in less than one year) and the review shall be performed on an individual level when required in accordance with the undertaking’s internal rules and taking into consideration the size and assessed risk level of the credit. - EBA ITS on Supervisory Reporting (instructions for table F18 in Annex V): classification of exposures as nonperforming shall be done on an individual basis or for the overall exposure to a given debtor. - Since January 1, 2018, IFRS 9 replaces IAS 39; assessments of impairment and loan allowance estimation can be made both on individual and collective basis under IFRS 9. - CRR article 47b, p. 4: difficulties experienced by an obligor in meeting its financial commitments shall be assessed at obligor level, taking into account all the legal entities in the obligor’s group which are included in the accounting consolidation of the group, and natural persons who control that group. ### EC12 — Supervisory assessment of trends, concentrations and provisions - Supervisor regularly assesses trends and concentrations in risk and risk build-up across the banking sector in relation to banks’ problem assets and considers any observed concentration in risk mitigation strategies and the potential effect on mitigant efficacy. - FI practice: - Trends and risks in different portfolios are regularly discussed within the credit expert team. - Regular SREP review is combined with benchmarking discussions with special focus on credit risk; portfolios, quality of obligors and underlying securities are compared and risks discussed. - FI has a large degree of independence in setting priorities and undertakes deep-dives or investigations in areas seen as problematic (credit risk, stability, consumer protection). - Sectors given special attention over the last five years: oil- and gas, CRE. - Publications and monitoring: - Mortgage lending market and consumer lending market are closely monitored and reports are published annually. - “Bank Barometern” is published twice a year and captures industry-level trends; the bi-annual report follows an indicator related to credit losses (amount of problem loans) over the years. - Limitations: - FI may not systematically take into account any observed concentration in banks’ risk mitigation strategies and their effect on mitigant efficacy unless they are significant and become FI focus areas. - When FI focuses on an area, it has shown ability to perform deep-dive investigations and challenge provisioning levels. ### Assessment of Principle 18 — Findings and supervisory capacity - Overall assessment: Largely Compliant. - Strengths: - FFFS 2018:16 stipulates special rules for credits with increased risk covering most provisions in the CP. - SREP process reviews undertaking policies and processes for grading and classifying assets. - FI uses sampling of loans to monitor evolution of credit risks. - Requested information ahead of regular quarterly or bi-annual meetings includes the 25 largest exposures on watch list, the 25 largest nonperforming exposures and 25 largest exposures with forbearance measures. - Weaknesses and constraints: - FI lacks some powers: cannot overrule a bank’s decisions on classification of individual assets and increase provisioning levels without legal basis to act. - FI can initiate an inspection and, if deficiencies are identified, order rectification and decide on a Pillar II add on until rectification is made. - Due to resource constraints, supervision does not regularly go through credit files; FI has not performed credit file review for categories 1 and 2 banks since 2017. - Reliance on sampling and focus on large exposures risks misrepresentation; suggested extension to a more representative and wider sample including large corporates, SMEs, retail. - SREP process considered too high-level to properly capture material findings; deep-dive investigations useful but scarce, resource consuming and slow. - Specific supervisory practices: - FI assesses major changes in classification and auditors’ remarks to prioritize inspections. - Information requested for meetings covers specific top-25 exposure lists (watch list, nonperforming, forbearance). ### Principle 19 — Concentration risk and large exposure limits; EC1–EC5 findings - Principle summary: Supervisor determines banks have adequate policies/processes to identify, measure, evaluate, monitor, report and control or mitigate concentrations of risk on a timely basis; supervisors set prudential limits to restrict bank exposures to single counterparties or groups of connected counterparties. EC1 — Bank-wide view of concentration risk - CRR, Part Four, Articles 387–403 regulate the large exposure regime. - Article 393: institutions must have sound administrative and accounting procedures and adequate internal control mechanisms for identifying, managing, monitoring, reporting and recording all large exposures (exposures equal or in excess of 10 percent of Tier 1 capital). - Article 389: “exposure” means any asset or off-balance sheet item. - Article 394: institutions report to competent authorities their large exposures and additional information on their 10 largest exposures (20 largest for IRB banks). - Article 395: imposes limits to large exposures. - FFFS 2018:16, Chapter 2, Section 1: documented risk appetite for credit risk shall specify scope and focus of total credit risk, composition of the credit portfolio, diversification and concentration; within the framework, the undertaking shall also have limits for its credit risks and written analysis is required before changing risk appetite. EC2 — Information systems to identify and aggregate concentrations and large exposures - FFFS 2014:1, Chapter 2, Section 7: contains guidelines related to compilation of risk data, requires capability to gather and automatically compile data regarding significant and measurable risks as soon as possible; IT systems shall be flexible and able to meet various analysis needs and compilable in crisis situations, stress tests and at FI request. - EBA SREP guidelines (EBA/GL/2014/13) require assessment of whether institutions have appropriate skills, systems and methodologies to identify and measure credit concentration risks. - FI concentration risk assessment within SREP covers sectors, industries, climate-related physical and transition risks, individual counterparties, groups of connected counterparties, geographical areas and collateral — but does not clearly encompass all aspects in the referenced footnote. - In SREP, FI collects and assesses policies, processes and regulations on how undertakings compile concentrations and collects specific information for FI’s Pillar II method for credit related concentration risk. EC3 — Thresholds, limits and reporting to Board - FFFS 2018:16, Chapter 2, Section 1: documented risk appetite must specify scope, composition, diversification and concentration and include limits for credit risks; decisions to change risk appetite require written analysis on effects and must be monitored and evaluated. - FFFS 2014:1, Chapter 5, Section 1–3: risk management framework requirements; board of directors shall decide on internal rules; Section 5 requires procedure for regularly reporting risks to board, risk committee, managing director and other functions so they receive reliable, current and complete reports in a timely manner. - EBA SREP guidelines (EBA/GL/2014/13, paragraph 202): competent authorities should assess whether institution has a sound, clearly formulated and documented credit risk strategy approved by the management body, reflecting exposure type, sector, geography, currency, maturity, including concentration tolerances. - FI practice: - FI assesses concentration limits with banks usually within SREP. - Breaches reported to the board and reviewed by supervisors via board and internal control minutes. - Severe breaches normally reported within 24 hours; less severe breaches can be reported in the next quarterly dialogue with FI. - Differentiated supervisory action for regulatory and internal limit breaches. - Communication to relevant staff assessed through report analysis and onsite supervision, which face resource constraints. EC4 — Supervisor obtains information to review portfolio concentrations - Article 394 of CRR requires reporting of large exposures and additional information on 10 largest exposures (20 largest for IRB banks) including client/group identification, exposure value before CRM, types of credit protection, and expected run-off. - FI specific SREP reporting: name, sector and geographical concentrations; breakdown of aggregate credit portfolio by individual industries, portfolios and geographies showing both nominal exposure and RWA per sector, segment and country. - FI calculates Pillar 2 capital requirements for name concentration, industry concentration and geographic concentration: - For Standardised Method: Herfindahl index-based approach. - For IRB banks: method combining Herfindahl index and Gordy-Lütkebohmerts approach. - EBA reporting framework 3.0: - COREP (quarterly): contains information on large exposures and groups of connected clients; templates 26-29 report name concentrations (including connected clients and concentration to shadow banks) and exposures to different geographical markets. - FINREP (quarterly): banks report exposures to different sectors of economic activity by using NACE codes (Regulation (EC) No 1893/2006). EC5 — Definition and treatment of groups of connected counterparties - FFFS 2018:16 references article 4(1)(39) of the CRR for definition of a group of connected clients. - Regulation requires credit assessment to investigate, identify and document need for co-limitation for a group of connected clients; co-limitation shall be applied if needed. - EBA Guidelines on the treatment of connected clients (EBA/GL/2017/15) give guidance on identifying a group of connected clients based on control relationships and economic dependencies. *Source: Extracted content from the provided PDF chapter/section.* ### Section 4) establish that an undertaking should analyze, as a minimum, whether a specific ### Section 4) establish that an undertaking should analyze, as a minimum, whether a specific ### EC6 — Large exposure regulatory framework and supervisory practice - Legal and regulatory framework: - Article 389 of the CRR defines what an exposure is within the large exposure regime, which includes any asset or off-balance sheet item. - Article 390 of the CRR specifies how the exposure value shall be calculated; the calculation shall cover the total exposures of a group of connected clients and shall cover exposures in the trading book and in the non-trading book. Specific requirements relate to derivative contracts. Some listed exposures are excluded (e.g., settlement limits). - CRR Article 392: an institution's exposure to a client or a group of connected clients is a large exposure where the value of the exposure is equal to or exceeds 10 percent of its Tier 1 capital. - CRR Article 395: an institution shall not incur an exposure to a client or group of connected clients the value of which exceeds 25% of its Tier 1 capital, after taking into account credit risk mitigation effects in accordance with Articles 399 to 403. - CRR Article 11: the large exposure regime also applies at the consolidated group level. - Article 395(5): limits may be exceeded for a limited period for trading book exposures provided conditions are met; the institution shall report without delay the amount of the excess and the name of the client and, where applicable, the group of connected clients. - Article 393 of the CRR: institutions shall have sound administrative and accounting procedures and adequate internal control mechanisms for identifying, managing, monitoring, reporting, and recording all large exposures and subsequent changes. - Regulation regarding prudential requirements and capital buffers (FFFS:2014:12, Chapter 5, Section 4) requires an undertaking to conduct a thorough analysis of all exposures exceeding 2 percent of the undertakings or the group’s eligible capital when determining large exposures to a group of connected clients. - Supervisory practice and findings: - FI assesses concentration limits in discussions with banks usually within the SREP process. Breaches are reviewed via board and internal control minutes; contingent on materiality, supervisory measures applied. - Assessors found evidence (discussion on evolution and breaches of large single exposure, 20 largest net exposures, among others) that FI assesses that senior management monitors these limits and that they are not exceeded on a solo or consolidated basis during SREP. - FI does not exercise discretion in applying the definition of a group of connected counterparties on a case-by-case basis. - Due to resource constraints, regular supervision does not go through credit files and therefore does not verify the definition of a group of connected counterparties adopted by a bank unless for ad hoc manual sanitize checks. - Noted exceptions and monitoring gaps: - Some exemptions in FFFS 2014:12 weaken limits (see AC1). The potential consequences of deviations are not clearly monitored by FI. ### EC7 — Stress testing for concentration risk - Regulatory guidance: - EBA guidelines on stress testing (EBA/GL/2018/04, Section 4.7.8) mandate institutions to assess concentration risk considering on- and off-balance-sheet exposures, as well as banking, trading and hedging positions in their stress testing. Paragraphs 171 to 178 provide details for banks. - Supervisory implementation and findings: - Elements related to stress testing are present in undertakings’ ICAAP and recovery plans; these elements are evaluated when reviewed by FI. ICAAP review is performed in line with EBA guidelines on ICAAP and ILAAP information collected for SREP purposes (EBA/GL/2016/10) and is always performed in combination with the SREP. - As mentioned in EC13 of CP 15, assessors found evidence that banks’ internal stress testing are assessed from a high-level perspective and therefore do not clearly take into account significant risk concentrations. ### AC1 — Additional criteria on large exposures - Prescribed thresholds: - (a) 10 percent or more of a bank’s capital is defined as a large exposure. - (b) 25 percent of a bank’s capital is the limit for an individual large exposure to a private sector nonbank counterparty or a group of connected counterparties. - Minor deviations may be acceptable if explicitly temporary or related to very small or specialized banks. - Findings regarding exemptions: - FFFS 2014:12, Chapter 5 establishes exemptions that weaken the limits, including exposures: - incurred by an institution to its parent undertaking or subsidiaries (Section 1); - to institutions within the European Economic Area (EEA), provided those exposures do not constitute such institutions' own funds, do not last longer than the following business day and are not denominated in a major trading currency (Section 1); - related to covered bonds (Section 2). - These exemptions align with Article 400 (2 1, 2c and 2f) of the CRR, which allows competent authorities to fully or partially exempt exposures listed under Article 400 (2). - Supervisory monitoring: - FI’s concentration risk assessment in SREP covers name, industry, geographical concentrations, sectors facing climate-related physical and transition risks, individual counterparties, groups of connected clients, and collateral. - Supervisory reports: besides COREP and FINREP, FI has SREP-specific reporting on concentration risk by name, sector and geography, showing both nominal exposure and risk-weighted assets (RWA) per sector, segment and country. - FI has imposed Pillar 2 capital requirements for concentration risk via the memorandum “Pillar 2-method for calculation of capital add-ons for credit related concentration risk.” The requirement considers name, industry and geographic concentration and uses: - a Herfindahl Index approach for companies using the Standardised Method for credit risk; and - a method combining Herfindahl index and Gordy-Lütkebohmerts approach for IRB banks. - Despite Pillar 2 measures, banks’ own stress testing may not clearly take into account significant risk concentrations. ### Assessment of Principle 19 — Large exposures - Overall assessment: Largely Compliant - Key comments: - The CRR sets the large exposures regime and limits; framework broadly aligns with Basel large exposures. - Exceptions (exposures to parent/subsidiaries, institutions within EEA, covered bonds) weaken limits. - FI does not exercise discretion in applying the definition of a group of connected counterparties on a case-by-case basis. - Due to supervisory resource constraints, FI’s regular supervision does not review credit files to verify banks’ adopted definitions of groups of connected counterparties except via ad hoc checks. - The EBA published a report (EBA/Rep/2022/16) analyzing European banks’ use of exemptions from large exposure limits and quantifying the impact of potential removal of individual exemptions. ### Principle 20 — Transactions with related parties (summary of findings across ECs) - Regulatory and legal framework highlights: - Swedish Companies Act (SFS 2005:551, Chapter 21) forbids companies to lend money to certain related parties (board, shareholders, controllers). - BFBA (SFS 2004:297, Chapter 8, Section 5) forbids credit institutions to enter into service agreements under terms that differ from those normally applied with or for certain related parties, including senior staff. - FI regulation on management of credit risks (FFFS 2018:16) contains special management requirements for related parties whose activities can materially impact a firm’s risk level. - EC1 — Definition and supervisory discretion: - Different laws/regulations provide related-party definitions depending on context; definitions broadly encompass the footnote to the Principle. FI can apply different definitions as relevant. - EC2 — Terms of transactions: - BFBA prohibits entering into services agreements or other agreements with terms not commercially justified with or for the benefit of specified related parties (enumerated list 1–6 in source). - EC3 — Board approval and conflicts of interest: - BFBA (Chapter 8, Section 6) requires the board to handle issues of services agreements (including granting credits) with related parties for all transactions. - Companies Act (SFS 2005:551, Chapter 8, Section 23) and FFFS 2018:16 require board members to be excluded where conflicts arise; credit procedures must avoid persons participating where bias risk exists. - EC4 — Policies and processes to prevent conflicts: - FFFS 2018:16, Chapter 8, Section 4 requires special procedures and methods for identifying, managing, internally reporting and controlling credits to related parties and capability to compile credits to related parties for individual and aggregate borrowers. - In SREP, FI checks that credits to related parties are addressed to the Board and that disqualified board members did not participate; FI assesses whether the code of conduct (internal conflict rules) was evaluated by the board. - EC5 — Limits, capital deduction, collateralization powers: - Under Chapter 6 of BFBA FI may take measures against institutions extending credit to related parties inconsistently with sound business practices. - There is not a clear and specific power for FI to impose limits for exposures to related parties, to deduct such exposures from capital when assessing capital adequacy, or to require collateralization. Exposures to related parties are clearly limited only as in the large exposures’ limits. - EC6 — Identification, monitoring, independent review: - Transactions with related parties are monitored as part of credit assessment within the regular SREP; inspections occur when necessary based on FI’s risk-based approach. - No provisions require monitoring and reporting on related-party exposures to be subject to an independent credit review or audit process. - Assessors were provided two examples where conflict of interest issues were found in credit risk inspections in 2018; general lack of intrusiveness in regular SREP makes identification of issues difficult. - EC7 — Aggregate reporting and records: - BFBA (Chapter 8, Section 6) requires the Board to keep a written record of all agreements with related parties; this record is checked at least annually by external auditors and by FI at credit risk inspections when needed. - Finrep templates 31.01 and 31.02 report transactions and exposures toward related parties, following accounting standards and therefore not meeting the CP’s requirements regarding definition of related parties and relevant transactions. - FI considers credit to related parties not a material risk in Sweden because exposures are small; one reason may be the legal requirement that all exposures to related parties must be approved by the board irrespective of size. - Assessment of Principle 20: Largely Compliant - Key supervisory capacity constraints: - FI’s supervisory capacity limits impact supervision of related-party aspects; limited intrusiveness of regular SREP constrains identification of issues. ### Principle 21 — Country and transfer risks (brief) - EC1 summary: - Country and transfer risks are elements within credit risk under FI’s regulation (FFFS 2018:16 Chapter 1 Section 5 p. 7 and 10). - Definitions provided: - Country risk: credit risks due to transfer risk, regulatory environment and political risks in a specific country. - Transfer risk: risk of not being able to transfer currency to and from a specific country. *Source: 1sweea2023008 - Section 4) establish that an undertaking should analyze, as a minimum, whether a specific* ### Chapter 2, Section 3 and Chapter 3, Section 1 of the same regulation requires ### 1sweea2023008 - Chapter 2, Section 3 and Chapter 3, Section 1 of the same regulation requires ### Country and transfer risk (Principle 21) — regulatory requirements and supervisory findings - Regulatory requirement: - Undertakings must have appropriate internal rules for credit risk management, which shall be in line with their documented credit risk appetite. The rules must cover procedures and methods for identifying, measuring, governing, internally reporting and controlling credit risks and special rules for certain types of risks such as country- and transfer risks, covering, as a minimum the country risk for individual borrowers and the undertaking’s total credit risk per country. Rules regarding the required material upon which the decision shall be based for credit assessments and reviews must also be established as well as documentation requirements of credit decisions. (FFFS 2018:16 referenced.) - Definitions noted by assessors: - Country risk: "the risk of exposure to loss caused by events in a foreign country. The concept is broader than sovereign risk as all forms of lending or investment activity whether to/with individuals, corporates, banks or governments are covered." - Transfer risk: "the risk that a borrower will not be able to convert local currency into foreign exchange and so will be unable to make debt service payments in foreign currency. The risk normally arises from exchange restrictions imposed by the government in the borrower’s country." - EC2 — Board approval and oversight (Description and findings): - Country and transfer risks are elements within credit risk. There are no specific provisions or supervisory processes. ICAAP reports and SREP assessments have been unable to evidence the supervisory approach. - EC3 — Information systems, aggregation and limits (Description and findings): - Exposure concentration to different countries is monitored, however, there are no established country exposure limits. - Country and transfer risks are elements within credit risk. There are no specific provisions or supervisory processes. - EC4 — Supervisory oversight of provisioning (Description and findings): - Accounting framework: IFRS 9 is principle based; macro related risks shall be taken into account by an undertaking. Management overlays can be used to manage risks in certain exposures (e.g., country or region). - There are no provisions established against country risk and transfer risk minimum provisions. - FI conducts targeted investigations or deep dives regarding exposures toward different countries when needed; special focus given to portfolios in countries subject to international sanctions or otherwise risky. - On an ad hoc basis undertakings may be required to inform and elaborate on exposures and portfolios in certain countries. - During meetings, assessors noted that countries in the European Union were not considered in a country and transfer risk perspective. - EC5 — Stress testing (Description and findings): - Country and transfer risks are an element within credit risk. No specific provisions with respect to country and transfer risks have been implemented. - Banks’ internal stress testing are assessed from a high-level perspective and do not fully cover the recommendations in the BCBS stress testing principles (2018). - EC6 — Information access and timeliness (Description and findings): - Finrep templates 20.4 to 20.7 contain information ‘country-by-country’ based on residence of the immediate counterparty; exposures or liabilities with international organizations and multilateral development are assigned to ‘Other countries.’ - This information is not sufficient to assess country risk and transfer risk of banks. - BFBA, chapter 13, section 3 gives FI the right to request information on an undertaking’s business and other conditions; additional information can be required when necessary and has been in past crisis situations. - Assessment outcome and key observations: - Assessment of Principle 21: Non-Compliant. - The assessors found the definition of country and transfer risk is in line with the BCP definition, though it does not clearly list important socio-political changes and largely unpredictable events. - Assessors were not provided with evidence that supervisors follow an ultimate risk approach. - The incorporation of country risk into stress tests and into provision by banks is not explicitly required by FI. - The supervisory processes in FI’s credit risk assessment method for SREP do not cover the requirements set out in this CP. ICAAP reports and SREP assessments have been unable to show the country and transfer risk analysis. - Sweden is a regional banking hub and cross border banking activity and country exposure is a significant feature of the banking system, concentrated in a few institutions. - EU regulations (CRR and CRD) mean countries within the European Union are not considered as third countries from a country and transfer risk perspective; consequently, a proper supervisory process for country and transfer risk is recommended to be introduced. ### Market risk (Principle 22) — regulatory context and supervisory findings - Principle statement: - The supervisor determines that banks have an adequate market risk management process that takes into account their risk appetite, risk profile, and market and macroeconomic conditions and the risk of a significant deterioration in market liquidity. This includes prudent policies and processes to identify, measure, evaluate, monitor, report and control or mitigate market risks on a timely basis. - EC1 — Laws, regulations or supervisor requirements (Description and findings): - Sweden has not implemented any specific national banking law or supporting regulation that specifically addresses the management of market risk. - FI repealed a specific regulation on the management of market and liquidity risks (FFFS 2000:10) arguing it was outdated and that corresponding, binding rules exist in other FI regulations aligned with regulation (EU) 575/2013 (CRR). - FI applies general provisions for the trading book as in Article 102 – 106 of regulation (EU) No. 575/2013 (CRR) and detailed regulatory standards in the CRR for positions subject to the internal model approach (IMA). - EBA Guidelines on the treatment of structural FX positions (EBA/GL/2020/09) are effective in Sweden and used in approval processes of waivers under article 352 (2) of the CRR. - Applicable general national banking laws and supporting regulations cited: BFBA (2004:297) on risk management and responsibilities of the board; Supervision of Credit institutions and Investments Firm Act SFS (2014:968) on supervision of internal models; FI’s regulation regarding governance, risk management and control (FFFS 2014:1) setting provisions on governance, risk appetite framework, limit set-up, IT system support, responsibility of the board and the CEO, including review of risk management and internal control functions. - The assessors verified FI has applied such provisions in recent market risk and counterparty credit risk inspections, though lack of detailed regulation can be problematic for inspections of front office/first line activities (e.g., intra-day monitoring, P&L attribution for non-IMA banks, system support, xVA). - Current Basel standards and CRR assume end-of-day calculations of risk. - FI has used the Final Draft RTS on Assessment Methodology as a best practice tool despite it not being adopted in the EU Official Journal. - FI would benefit from more granular regulations on risk positions and management of positions not covered by IMA. - FI performs market risk management process assessments in the SREP following the EBA GL SREP grading methodology, considering: - Market risk exposure, measures and metrics; and - Market risk governance and management. - Assessors verified FI’s assessment of banks’ ICAAP; market risk assessment in ICAAP looked more detailed than other risks’ assessments. - EC2 — Board approval and oversight (Description and findings): - FI bases supervision on EU and national regulation as mentioned in EC1. - The overall efficiency of market risk management and controls are assessed through the regular Quarterly Risk Review (QRR) sessions, and the SREP, which is based on the EBA SREP GL. - Ongoing supervision of market risk and market risk models includes, but is not limited to: 1. Positions, exposures, and risk measures; 2. Governance and risk management. *Source: Chapter 2, Section 3 and Chapter 3, Section 1 of the referenced regulation (1sweea2023008).* ### 3. Internal models for capital requirements including banks’ practices. ### 3. Internal models for capital requirements including banks’ practices. ### SREP approach and documentation - FI assesses relevant documentation as part of the SREP to evaluate the quality of processes and the documentation (and the alignment between the two), including the use and implementation of models and metrics. - The SREP evaluation follows both a general and a specific path: - General path: internal assessment method developed by FI out of the EBA SREP Guidelines to harmonize assessments across banks, track general market risk trends, and serve as a benchmark tool for market risk experts. - Specific path: dedicated to institution-specific features to track latent risks, exposure to tail risk events and hidden vulnerabilities. - FI supplements SREP with qualitative and quantitative studies of banks’ models, assumptions, P/L attribution, back-testing, P/L explained and P/L unexplained, and follows up on limit breaches and back-testing issues. - Frequency of deep-dive inspections is low: in the last five years, FI performed 6 onsite inspections; some inspections were thematic/targeted covering multiple institutions (example: a CRR inspection covering four institutions, plus one “embedded” inspection dedicated to a bank’s IMM framework). ### Market risk governance, trading/banking book boundary and controls - Supervisor expectations for an appropriate market risk environment include: - (a) effective information systems for identification, aggregation, monitoring and reporting to Board and senior management; - (b) appropriate market risk limits consistent with risk appetite, risk profile and capital strength; - (c) exception tracking and reporting ensuring prompt action at appropriate senior levels; - (d) effective controls about use of models to identify and measure market risk and set limits; - (e) sound policies and processes for allocation of exposures to the trading book. - FI finds trading/banking book boundary policies and procedures as an area where compliance with current regulatory standards (essentially article 102-104 of the CRR) can be questioned. - FRTB implementation in the EU in 2024 is expected to address many trading/banking book boundary issues; FI notes the importance of deep-dive investigations once FRTB is implemented to assess compliance and allocation to trading vs banking book. - FI relies on the second line of defense to monitor banks’ internal trading limits; FI reported a case where it was not informed about an internal material breach as fast as it should. ### Valuation, prudent valuation and market-data controls (EC4) - Regulatory and accounting references: - FFFS 2008:25, Chapter 7 extends IFRS consolidated financial statement requirements to all credit institutions and sets principles for fair valuation including CVA for derivatives. - Articles 34 and 105 of CRR cover valuation governance and prudent valuation; draft technical standard on IMA provides guidance on valuation within IMA. - FI captures valuation aspects through QRR quantitative requests, COREP and FINREP analysis, and thematic inspections (example: 2018 prudent valuation inspection that led to a comprehensive action plan). - FI assesses valuation governance and systems during SREP from risk management and control perspectives. ### Capital requirements and internal models (EC5) - CRR provisions: - CRR Title IV Chapters 1-5: minimum regulatory capital standards for market risk; Article 362 allows use of internal models for computation of capital requirements for market risk subject to supervisory approval; Article 363 sets supervisory assessment of minimum requirements and approval for material model changes (Article 363(3) and Commission Delegated Regulation (EU) No 529/2014). - CRR Title I Chapter 3: defines capital deductions for valuation uncertainties on fair valued positions. - CRR Title VI: minimum regulatory capital standards for CVA risk. - FI evaluates institutions’ capital situation for market risk through ongoing supervision, QRR, SREP and ICAAP analysis using COREP and granular higher-frequency data. - FI participates in the EBA supervisory benchmark exercise regarding IMA (jointly with IRB) to evaluate Swedish IMA banks in an international context. ### Stress testing for market risk (EC6) - Article 368(g) of the CRR requires institutions to frequently conduct a rigorous program of stress testing that encompasses market risk. - EBA SREP Guidelines recommend supervisors assess: - stress test frequency; - identification of relevant risk drivers (e.g., illiquidity/gapping, concentrated positions, one-way markets); - assumptions underlying scenarios; - internal use of stress-testing outcomes for capital planning and market risk strategies. - FI includes market risk stress testing aspects in SREP and quarterly risk reviews; reported outcomes are assessed and challenged. Largest non-IMA banks are required to present stress calibration of the internal (non-prudential) IMA. ### Assessment of Principle 22 — Market risk (summary) - Assessment: Largely Compliant. - Key comments: - No specific national banking law focused solely on market risk management; FI repealed FFFS 2000:10 arguing corresponding rules exist elsewhere. - Lack of detailed regulation has been problematic in front office/first line activities and trading/banking book boundary. - Limited deep-dive supervision: 6 onsite inspections in last five years; some covered multiple institutions. - Over-reliance on the second line of defense to monitor trading limits could delay reporting of material breaches. ### Interest rate risk in the banking book (Principle 23) — key elements - FI mandate to require Pillar 2 Requirement (P2R) for IRRBB is prescribed in sixth chapter of BFBA (SFS 2004:297). - Sweden lacks a specific national banking law addressing IRRBB beyond reporting requirements in FFFS 2007:04; EBA GL on IRRBB (EBA/GL/2018/02) is applicable. - FI’s internal SREP IRRBB assessment method is based on EBA IRRBB guideline and assesses quantitative and qualitative perspectives: strategy and risk appetite, organizational framework, risk management framework and internal control framework. - Reporting and stress-testing inputs: - FI uses a standard report prescribed in FFFS 2007:4 requiring detailed interest repricing data; these are granular enough for standardized EV stress-tests in EBA IRRBB Guidelines. - Since 2014 FI uses a public memorandum describing how SREP will add a pillar-2 requirement proportional to interest rate risk based on an economic value stress test in the style of the Supervisory Outlier Test. - Supervision resource constraints: - No inspection aimed at IRRBB in the last five years; the lack of onsite inspections and limited in-loco time on categories 1 and 2 plus over-reliance on report analysis is assessed as insufficient to comply fully with CP provisions. - EC4 specifics on stress scenarios: - Under FFFS 2007:4 banks must calculate effect on economic value of a sudden and sustained parallel shift of 200 basis points applied to the return curves. - FI pillar-2 calculation model is based on six scenarios from the EBA supervisory outlier test. ### Interest rate risk — additional criteria highlights - AC1: FFFS 2007:4 requires banks to report impact of an interest rate shock corresponding to a sudden and sustained parallel shift with 200 interest points; if economic value falls by more than 20% in relation to capital base, the company must report measures to FI. - AC2: FI assesses adequacy of internal IRRBB capital during SREP using FI’s Pillar 2 methodology for IRRBB. ### Assessment of Principle 23 — Interest rate risk (summary) - Assessment: Largely Compliant. - Comments: - FI applies EBA Guidelines in SREP and uses granular reporting and Pillar 2 methodology. - Resource constraints and lack of recent onsite IRRBB inspections (no IRRBB inspection in last five years except a 2017–2018 CSRBB inspection outside category 1) limit FI’s ability to perform intrusive supervision; recent interest rate changes motivate deeper analysis. ### Liquidity risk (Principle 24) — framework and tools - LCR and NSFR have been implemented as binding liquidity requirements in Sweden. - Liquidity Coverage Ratio (LCR): - FI regulation FFFS 2012:6 effective January 1, 2013; Swedish LCR initially based on 2010 BCBS standard; requirement binding in all currencies combined and in EUR and USD separately. - EU LCR implemented October 2015 (Article 412(1) CRR and Commission Delegated Regulation (EU) 2015/61) with phased increase from 60 percent initially to 100% from January 1, 2018. - RCAP review by BCBS (2017) found one material deviation and four potentially material deviations in EU framework; material deviation relates to expansion of HQLA definition (inclusion of some instruments not listed in Basel standard). BCBS disclosure standard differs (daily observations vs Sweden’s simple average of month-end observations over 12 months). - FI applies a liquidity waiver in some solo entity cases in liquidity subgroups per CRR article 8. - FI restricts covered bonds issued by Swedish issuers: maximum of 50 percent of total liquidity reserve may be Swedish covered bonds when calculating LCR (overall limit of 70 percent for other issuers in EU regulation remains valid). - Net Stable Funding Ratio (NSFR): - EU CRR/CRDV regulation with minimum Pillar 1 requirement of 100 percent in total currencies came into force in June 2021; banks must meet NSFR on an ongoing basis and report quarterly. ### Liquidity risk — management, monitoring and supervisory practices - FI’s regulation FFFS 2010:7 requires firms to: - use several customized risk measures and key ratios, apply forward-looking views, distinguish liquidity risks by currency, and identify vulnerabilities in day-to-day operations and stress; - set limits, test and adjust them, and ensure Board-approved strategies and regular reporting to the Board. - Supervisory tools: - SREP (quarterly and semi-annual risk review meetings) with qualitative assessments graded per EBA SREP GL. - ILAAP assessments for completeness, credibility and forward-looking aspects. - FI defined 20 key risk indicators (including LCR and NSFR), each scored 1-4 per EBA GL SREP. - November 2021: FI created an automated Liquidity Risk Dashboard showing trends, peer comparisons, balance-sheet metrics, traffic-light system for LCR and NSFR, survival horizon, committed credit facilities, etc. - Inspections and thematic work: - Eight liquidity risk inspections in last five years focusing on LCR breaches, LCR calculation, funding structure (2002–2019 and 2019–2021), management and governance, intraday, and stress testing. - 2018 onsite inspection of liquidity risk management and governance covering organizational requirements, measurement and limit management, and contingency planning. - Supervisory stress-testing capability: - FI has developed a stress test tool and uses the ML template (ALMM package) to analyze maturity mismatches and construct survival horizons; maturity ladder enables transparent, comparable and trend analysis. ### Liquidity risk — governance and policies (EC4–EC5) - Governance requirements and FI findings: - FFFS 2010:7 Chapter 2 and Chapter 3 contain Board-approved risk tolerance, intraday liquidity management, stress-testing, limits, and reporting requirements; managing director must regularly report to Board. - FI assesses liquidity strategies, policies and processes in quarterly risk reviews and SREP; inspections on intraday liquidity were performed (e.g., 2015 for largest banks). - EC5 requirements for funding strategies: - FI regulation (FFFS 2010:7) prescribes analysis of funding requirements under alternative scenarios, maintenance of cushion of high-quality unencumbered liquid assets, diversification of funding sources and tenor, efforts to maintain liability-holder relationships, and assessment of capacity to sell assets. (Further details follow in source text beyond excerpt.) *Source: 1sweea2023008 - 3. Internal models for capital requirements including banks’ practices.* ### Chapter 4, Section 2), the firm shall identify the factors that have the largest impact on its ### Chapter 4, Section 2), the firm shall identify the factors that have the largest impact on its ### Liquidity reserve and funding diversification (Chapter 4, Sections 2 and 5) - A firm shall hold a separate reserve of high-quality liquid assets to secure the firm’s short-term capacity to meet payment obligations in the event of lost or impaired access to regularly available funding sources. The assets in the liquidity reserve shall be unencumbered. - The size of the liquidity reserve shall be such to enable the firm to withstand a serious liquidity shortfall without needing to alter its business model. - The liquidity reserve shall consist of assets that enable the rapid creation of liquidity at foreseeable values and shall be composed of assets that are both liquid on private markets and eligible for refinancing by central banks. - Deposits with central banks or any other bank that will be available the following day may be calculated as part of the liquidity reserve. - The firm shall ensure that there are no obstacles to drawing on the reserve's assets for short-term financing. - In a long-term funding strategy, a firm shall strive to have sufficient diversification within its sources of funding in terms of number and type of counterparties, the type of financial instruments, secured and unsecured borrowing, maturities, currencies and geographic markets; and be present in its chosen funding markets to ensure strong relationships with funds providers. ### SREP coverage of liquidity principles - Liquidity strategies as well as policies and processes for management of liquidity risk are discussed in the quarterly risk reviews and SREP. - The SREP assessment is qualitative in nature but is also scored on the same scale as risk exposure where the assessment criteria correspond to a score on the scale provided by the EBA GL SREP. - Assessors verified in the SREP assessment that principles relating to identification of funding factors (a), liquidity reserve (b), and funding diversification (c) are broadly covered. - For assessment of the capacity to sell assets (e), FI verifies if the Bank’s Liquidity Strategy includes: - a description of asset encumbrance to ensure adequate overview and control over assets available for sale; - a description of how the bank ensures that their liquid assets are under the control of a specific liquidity management function and are able to be monetized at any time during the 30 calendar days stress period; - testing of access to the market for those assets and their usability. - Assessors were unable to properly verify in the documents provided that the SREP covers diversification across currencies/geographies (d). See ECs 1 and 3 for more details. ### EC6 — Contingency funding plans: requirements and FI practice - Supervisor expectations: - Banks must have robust liquidity contingency funding plans that are formally articulated, adequately documented and set out the bank’s strategy for addressing liquidity shortfalls in a range of stress environments without placing reliance on lender of last resort support. - Plans must establish clear lines of responsibility, include clear communication plans (including communication with the supervisor) and be regularly tested and updated. - Supervisor assesses feasibility of plans in light of bank’s risk profile and systemic importance and requires remediation of deficiencies. - FI regulations (FFFS 2010:7, Chapter 4, Section 9): - A firm shall have a contingency funding plan for managing liquidity crises that clearly defines distribution of responsibility, contains instructions for addressing liquidity shortfalls, specifies appropriate measures for handling consequences of different crisis types, contains definitions of events that trigger and escalate the contingency plan, and shall be tested and updated regularly based on stress tests. - Article 414 of the CRR: an institution that does not meet, or does not expect to meet, the LCR or NSFR, including during times of stress, shall immediately notify competent authorities and submit without undue delay a plan for timely restoration of compliance with LCR and NSFR. - FI implemented EBA guidelines on funding plans (EBA/GL/2014/04) in September 2015; the funding plan template is reported once a year and includes liquidity forecasts for the next three years. FI uses the funding plan template when discussing reported data at risk reviews and challenging banks’ ILAAP (sent yearly by categories 1 and 2 banks) as part of SREP. - FI performed an inspection reviewing the three Swedish major banks' funding structure including a risk assessment between 2002-2019 and is performing the same inspection for 2019-2021. ### EC7 — Liquidity stress testing: requirements and FI practice - FI regulations (FFFS 2010:7, Chapter 3, Sections 7-9): - Firms shall be well prepared to manage liquidity under abnormal conditions and shall regularly conduct stress tests to identify and measure liquidity risk under different scenarios, ensuring exposures agree with established risk tolerance. - Scenarios shall be based on varying degrees of stress and duration, consider firm-specific and market-related problems, be tested individually and in combination, consider intraday liquidity and time-critical payments, and be based on own and customers' risk exposure and business complexity. - Primary components: assumption of no access to unsecured market financing and assumption of large public deposit withdrawals. Market-wide tests assume rapidly falling market values for some assets and general deterioration in conditions for market funding. - Firms shall regularly review assumptions underlying scenarios and use stress test results to adjust strategies, guidelines and positions consistent with risk tolerance. - FI practice: - FI has regular discussions with institutions about refinancing risk in various foreign currency funding markets and discusses banks’ internal stress tests, assumptions and results at quarterly and semi-annual risk meetings. - FI requests credit institutions' liquidity stress testing framework and methodology with the yearly SREP information request and uses stress test results when reviewing ILAAP. - ILAAP review: FI assesses that the credit institution has included quantitative and qualitative analysis of stress testing outcomes and impact on funding profile, and integration of stress testing into risk management and control framework. - Evidence found that stress tests are used to develop effective contingency funding plans. - FI is compiling an internal analysis report on major Swedish banks' internal liquidity stress tests (methodology, scenarios, assumptions, quantitative outcomes), to be compared with FI's own liquidity stress based on a stress test tool developed using reported COREP data; report expected to be finalized during the second quarter of 2022. These deep-dive analyses supplement annual SREP analysis. ### EC8 — Foreign currency liquidity transformation and Pillar 2 requirements - CRR Article 415(2): institutions must report LCRs separately in significant currencies (where liabilities > five percent of total liability, or if significant branch in a Member State using different currency). EU regulation requires institutions to calculate and monitor LCR in these currencies; foreign currency LCR is calculated and reported but not subject to Pillar 1 requirement. - Basel expectation: while LCR is expected to be met and reported in a single currency, banks should be able to meet liquidity needs in each currency and maintain HQLA consistent with distribution of liquidity needs by currency; no explicit quantitative requirement by currency. - FI Pillar 2 requirements: - Institutions in Supervision Categories 1 and 2 (largest institutions accounting for approximately 75 percent of the system’s total assets) are required to meet an LCR ratio in both EUR and USD of at least 100 percent if the currency is significant to the institution. - FI applies a Pillar 2 requirement to all other individual significant currencies, including SEK. The LCR ratio for each of these other currencies (excluding EUR and USD) needs to be at least 75 percent. - FI has introduced an additional diversification requirement on the liquidity reserve’s composition. - Observation: - A quantitative requirement lower than 100 percent in a single currency implies that inflows in that currency (for example EUR and USD) may be used to cover outflows in other currencies such as SEK, creating dependence on a well-functioning currency swap market and access by individual institutions. - The Riksbank noted in a consultation memorandum that since such market conditions may not be fulfilled during a crisis, the requirement should not be set at a level that is lower in SEK than it is in EUR and USD. - FI activities: - FI continuously monitors compliance with EU minimum liquidity requirements and uses liquidity stress testing in supervision. - An ad-hoc analysis on major banks' funding structure was performed in 2020 focusing on historical trends, financing structure, sources of funding and currency distribution over 2002-2019. ### Additional criteria AC1 — Asset encumbrance - FI regulation (FFFS 2010:7, Chapter 4, Section 4) requires firms to manage collateral and monitor subsidiaries with regard to jurisdiction and currency exposure; firms shall distinguish between encumbered and unencumbered assets. - There is no explicit regulatory recommendation requiring banks to set limits to mitigate risks posed by excessive levels of encumbrance. - Encumbered assets reporting: - Level of encumbered assets is reported quarterly through FINREP and discussed in quarterly and semi-annual risk review meetings. - Level of encumbered assets is evaluated as a key risk indicator in SREP and monitored in the liquidity dashboard. - Asset encumbrance reporting aims to: - compare reliance on secured funding and degree of structural subordination of unsecured creditors and depositors across institutions; - assess ability of institutions to handle funding stress by assessing ability to switch to secured funding; - assess incorporations into crisis management by providing broad assessment of assets available in a resolution situation. ### Assessment of Principle 24 — Summary findings and developments - Assessment: Largely Compliant. - Key points: - Both Liquidity Coverage Ratio (LCR) and the Net Stable Funding Ratio (NSFR) have been implemented as binding liquidity requirements in Sweden. - Sweden implemented LCR in 2011 based on the Basel Committee’s standard from 2010 prior to detailed CRR specification; once LCR and NSFR were in CRR, Sweden followed EU regulation. - The EU’s LCR framework was RCAP-reviewed by the BCBS in 2017 and found overall largely compliant with the Basel LCR standard. - FI restricts covered bonds from Swedish issuer to a maximum of 50 percent of the total liquidity reserve, while the EU-regulation overall limit of 70% remains valid. - BCBS disclosure standards are based on daily observations when calculating average LCR values, while Sweden uses the simple average of month-end observations over the 12 months preceding the end of each quarter. - No explicit recommendation exists for banks to set limits to mitigate risks from excessive asset encumbrance. - FI’s Pillar 2 currency LCR requirements: EUR and USD at least 100 percent for significant currencies for Categories 1 and 2 institutions; other significant currencies (including SEK) at least 75 percent. Assessors support FI’s approach to include Pillar 2 requirements on different currencies. - FI defined 20 key risk indicators in SREP (including LCR and NSFR) scored 1-4 on the EBA guideline scale; SREP monitors LCR and NSFR and includes qualitative assessment covering ten areas for liquidity and funding risk management. - FI implemented EBA funding plan templates in September 2015; funding plan reported once a year includes liquidity forecasts for next three years and is used in SREP and risk reviews. - FI developed an automated Liquidity Risk Dashboard (November 2021) providing dynamic, graphical view of various Liquidity Key Risk Indicators, including traffic light system for regulatory metrics LCR and NSFR, limit monitoring, trends, peer comparisons and balance-sheet related metrics; dashboard is used for all bank categories and business models. - Ongoing work: - FI is compiling an internal analysis report of major Swedish banks' internal liquidity stress tests (methodology, scenarios, assumptions, quantitative outcomes) to compare with FI’s stress test tool based on COREP data; analysis ongoing with planned finalization during the second quarter of 2022. ### Principle 25 — Operational risk (introductory findings) - Principle 25 requires the supervisor to determine that banks have an adequate operational risk management framework covering identification, assessment, evaluation, monitoring, reporting and control or mitigation of operational risk, consistent with risk appetite, risk profile, systemic importance and capital strength. - FI regulation on operational risk management (FFFS 2014:4) requires banks to have appropriate operational risk management strategies, policies and processes; Chapter 2 Sections 1 and 2 mandate internal rules for management of operational risks. *Source: 1sweea2023008 - Chapter 4, Section 2), the firm shall identify the factors that have the largest impact on its (PDF).* ### 1. its main operational risks; ### 1. its main operational risks; ### Definition and supervisory framework - Operational risk defined as "the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events." The definition includes legal risk but excludes strategic and reputational risk. - EBA SREP GL provides the basis for supervisory assessment of operational risk and is reflected in high level provisions in the internal method for assessing operational risk under the SREP. - FI requests specific operational risk information yearly within the SREP framework and receives and analyzes the operational risk report from the banks 2 (category 2) – 4 (category 1) times per year. - FI prepares and performs specific risk focus discussions in regular meetings and includes governance and control of operational risk in onsite inspections. - FI prioritizes onsite inspections for banks considered to have higher operational risks based on trends gathered from the supervision process and from operational risk KRIs. ### Supervisory activities and inspections - In the last 3 years, there have been 12 inspections enabling deep-dive investigations. - Examples of published supervisory reports resulting from inspections: - FI Supervision report 18: Continuity management at banks. - FI Supervision report 9: Information and Cyber Security work in banks. - Areas FI may focus on during meetings and inspections: outsourcing, implementation of new EBA guidelines and AML directives, critical ICT third party providers, business continuity management, crisis management. ### Findings and recommendations — Continuity management (from FI Supervision report 18) - Many banks are actively working with continuity management and have implemented key measures to reduce the risk of serious disruptions. - FI recommendations to improve continuity management: - Strengthen the internal governance and control of continuity management, including the continuity management strategy, risk appetite for operational risk and independent control functions. - Further develop the methods of impact analysis to ensure that all critical functions, including those dependent on one another and on support functions, are identified. - Clarify content and structure of contingency plans, continuity plans and recovery plans. - Ensure that appropriate continuity tests are conducted for all significant processes and the IT systems that support these processes. - Improve reporting of results from completed continuity tests to provide management and boards with relevant and meaningful information. ### Findings and recommendations — Information and cyber security (from FI Supervision report 9) - Several banks are increasing focus on information and cyber security, but many have not yet fully adapted to changes introduced by higher digitalization and increased cyber threats. - FI general recommendations to bank management: - Ensure that the information security management system – organization, security enhancing processes, procedures and controls – that has been adopted, is also implemented in daily operation and throughout all business units of the bank. - Establish an ability to analyze and assess current cyber threat, and which actors are behind these threats, enabling continuous adaptation of risk management. - Improve and expand collaboration and information sharing between banks, and between banks and other stakeholders. - Prioritize training of staff to raise the level of awareness regarding information and cyber security. ### Governance, risk appetite, limits and reporting (EC2–EC7) - EC2: Supervisor requires banks’ strategies, policies and processes for management of operational risk (including risk appetite) to be approved and regularly reviewed by Boards; Board must oversee effective implementation by management. - FI regulation: FFFS 2014:4, Chapter 2, Sections 1 and 2 — board shall decide on and regularly evaluate and update internal rules on management of operational risk and risk appetite; managing director shall decide on and regularly evaluate and update limits for operational risks. - EC3: Supervisor determines that approved strategy and significant policies/processes are implemented effectively and integrated into overall risk management. - FI conducts governance reviews and sample testing of business processes and underlying systems during onsite inspections; staff beyond senior management participate in FI meetings to assess integration. - FI reviews compliance and internal audit reports to confirm implementation and periodic reporting to the board. - EC4: Supervisor reviews quality and comprehensiveness of disaster recovery and business continuity plans to assess feasibility under severe disruption and determine bank's ability to operate as a going concern. - Requirement set out in FFFS 2014:4. - During 2018-2019 FI performed onsite business continuity management inspections on four banks. - In June 2020, FI published FI Supervision 18 Continuity management at banks. - During 2020 FI requested Covid-19 status updates regularly from banks; focus on business contingency plans; institutions updated plans as needed. - EC5: Supervisor determines banks have appropriate IT policies/processes to identify, assess, monitor and manage technology risks and appropriate IT infrastructure to meet requirements under normal and stress conditions. - Relevant regulations: FFFS 2014:4 (Chapter 3, Sections 1 and 4) and FFFS 2014:5 (information security, IT operations and deposit systems). - EBA Guidelines on ICT and security risk provide basis for ICT supervisory assessment and are reflected in SREP internal method; EBA guidelines in ICT are based on two elements of RAS: (a) risk level: operational risk (identification of material operational risk sub-categories, ICT-risk), and (b) risk control: as part of risk management and controls. - During SREP and ICT risk onsite inspections, governance and sample testing of business applications and infrastructure are assessed. - EC6: Supervisor determines banks have appropriate and effective information systems to monitor operational risk, compile and analyze operational risk data, and facilitate reporting to Boards, senior management and business lines. - FFFS 2014:4 Chapter 4 requires reporting operational risks to board and managing director; reports should include indicators for operational risks, breaches of risk appetite and risk limits and serious incidents; results from tests of contingency, continuity and recovery plans must be reported to the board at least once a year. - FI requests specific operational risk information yearly within SREP, analyzes regular operational risk reports, and uses these to follow and challenge management and reporting mechanisms as well as the 1st, 2nd and 3rd lines of defense. - FI determines banks have appropriate management systems to manage operational and ICT risks but does not require specific information systems; FI does not perform detailed assessments on systems unless a specific need is identified. - EC7: Supervisor requires banks have appropriate reporting mechanisms to keep supervisor apprised of developments affecting operational risk. - Based on BFBA (SFS 2004:297, Chapter 13, Section 3) FI asks category 1 banks (quarterly) and category 2 banks (semi-annually) to report status and internal assessments of operational risks, incidents, losses and risk indicators. - Significant incident reporting requirements set out in FFFS 2021:2 and FFFS 2018:4; significant incidents are sent to a dedicated mailbox managed by the operational risk group. - RTS on supervisory reporting (EU Regulation 680/2014) requires regular reporting to the supervisor regarding own funds requirements for operational risk (quarterly) and operational risk losses by business lines and event types (semi-annually). ### Outsourcing and third-party risk (EC8 and AC1) - EC8: Supervisor determines banks have policies/processes to assess, manage and monitor outsourced activities covering due diligence, structuring arrangements, managing and monitoring risks, ensuring effective control environment, and establishing contingency planning; outsourcing policies require comprehensive contracts/SLA with clear allocation of responsibilities. - Requirements set out in FFFS 2014:1 (governance, risk management and control), Chapter 10 Section 5 paragraphs 1-11 (due skill, care and diligence when entering/managing/terminating outsourcing agreements of material significance). - Chapter 10 Section 3 requires sufficient staff knowledge and experience to control outsourced operations. - Chapter 10 Section 5 paragraphs 8 and 11 require continuity and quality of services not be affected by termination of outsourcing agreement. - FFFS 2014:1 Chapter 10 Section 2 requires institutions to notify FI in advance when intending to outsource functions of material significance. - FI conducts supervisory activities on outsourcing and third-party risks and includes review of governing documents and contracts/SLA through SREP updates, compliance and audit reports, and information requests in meetings. - AC1 (additional criteria): Supervisor regularly identifies common points of exposure to operational risk or potential vulnerability (e.g., common service provider concentration). - FI currently lacks a database to collect information on outsourcing providers and is unable to identify common points of exposure or potential vulnerabilities. - The Digital Operational Resilience Act (DORA) from the EU might address this issue; however, the draft is incipient and has been delayed (estimated to enter into force in 2025). ### Assessment and overall comments (Principle 25) - Assessment of Principle 25: Largely Compliant. - Key observations supporting assessment: - FI requests operational risk information yearly within SREP, receives and analyzes operational risk reports semiannually for category 2 banks and quarterly for category 1 banks, prepares specific risk focus discussions, and includes governance and control of operational risk in onsite inspections. - FI uses trends and KRIs to prioritize onsite inspections for higher-risk banks. - FI has published supervisory reports illustrating deep-dive analysis: FI Supervision report 18 and FI Supervision report 9. - FI identified cyber risks, outsourcing and third-party risks, and business continuity plans as focus areas during the last five years. - FI determines banks have appropriate management systems to manage operational and ICT risks but does not mandate specific information systems and generally does not perform detailed system assessments unless a specific need arises. - FI regulations require advance notification for outsourcing functions of material significance, but there is possible lack of clarity in the definition of significant agreements/outsourcing and no requirement to inform FI of changes or terminations to contracts. - Due to lack of a database on outsourcing providers FI cannot identify common exposures or vulnerabilities. ### Principle 26 (intro) and EC1 (internal control and audit) - Principle 26 overview: Supervisor determines banks have adequate internal control frameworks to establish and maintain a properly controlled operating environment, including delegation of authority, separation of functions, reconciliation, safeguarding assets, and appropriate independent internal audit and compliance functions. - EC1: Laws, regulations or the supervisor require banks to have internal control frameworks adequate to establish a properly controlled operating environment taking into account risk profile. Controls address: - (a) organizational structure: definitions of duties and responsibilities, including clear delegation of authority, decision-making policies and processes, separation of critical functions; - (b) accounting policies and processes: reconciliation of accounts, control lists, information for management; - (c) checks and balances: segregation of duties, cross-checking, dual control of assets, double signatures; - (d) safeguarding assets and investments: physical control and computer access. - Description and findings re EC1: - BFBA (SFS 2004:297, Chapter 6, Section 2) establishes that an institution shall ensure it possesses satisfactory internal controls; Section 4b assigns board responsibility to ensure fulfilment. - FI’s regulation regarding governance, risk management and control (FFFS 2014:1) details control functions banks must have in place. *Source: 1sweea2023008 - 1. its main operational risks;* ### Chapter 2, Section 1(5) stipulate that an undertaking shall ensure that it has current and ### 1sweea2023008 - Chapter 2, Section 1(5) stipulate that an undertaking shall ensure that it has current and ### Internal control requirements - Chapter 2, Section 1(5) stipulate that an undertaking shall ensure that it has current and appropriate internal control mechanisms comprising control functions, IT systems and procedures to ensure compliance with decisions and procedures at all levels of the undertaking. - Chapter 7, Section 3 establishes activities related to a properly controlled operating environment that internal control must address. ### Risk control function — duties (Chapter 7, Section 3) - 1. verify that all material current or potential risks are identified and managed and that each business unit monitors all of its material risks in an efficient manner; - 2. monitor and control the risk management and identify its deficiencies; - 3. control and analyze the undertaking’s material risks and how they unfold, and identify new risks that may arise as a result of changed circumstances, and risks deriving from the degree of complexity of the undertaking’s legal structure; - 4. ensure that risk information is regularly submitted to the board and regularly, no less than once a quarter, risk management report its opinion both in writing and verbally to the board; - 5. when the undertaking submits proposals or makes decisions that entail a potential substantial increase in its risks, assess whether they are consistent with the decided risk appetite of the undertaking; - 6. provide all relevant information that may constitute a basis for decisions regarding amendments to risk strategy and risk and assess the proposed risk strategy and provide a recommendation before a decision is made; - 7. verify that relevant internal rules, processes and procedures - 8. are appropriate and efficient, and propose amendments thereto if needed; - 9. identify, verify and report risks of errors in the undertaking’s assumptions and opinions that form the basis of the financial reporting of the undertaking; and - 10. prior to the undertaking deciding on new, or materially altered, products, services, markets, procedures and IT systems, and in substantial changes to the operations and organization of the undertaking, evaluate the risks therein and evaluate how they could perceivably affect the overall risk of the undertaking. ### Duties for segregation of duties and conflict prevention - Chapter 1, Section 10 establishes that an undertaking shall ensure that it has procedures for distinguishing between duties and preventing conflicts of interest. - The undertaking shall also ensure that no person single-handedly processes a transaction throughout the entire processing chain. ### Supervisory assessment of control functions (EC2) - The supervisor determines that there is an appropriate balance in the skills and resources of the back office, control functions and operational management relative to the business origination units, and that staff of the back office and control functions have sufficient expertise and authority within the organization (and, where appropriate, in the case of control functions, sufficient access to the bank’s Board) to be an effective check and balance to the business origination units. - FI’s Regulations and General Guidelines regarding governance, risk management and control at credit institutions (FFFS 2014:1) Chapter 6 Section 3 stipulates that a control function (defined as a function for risk management, compliance or internal audit) shall have the resources required and access to the information needed to discharge its tasks. Such a function shall have staff with the required knowledge and powers for discharging their duties. - Control functions are assessed within the SREP process. In the SREP process, the supervised entity is required to send in an organizational scheme, which FI uses to assess whether reporting lines and staff volumes can be deemed appropriate. - Risk control, compliance and internal audit functions are assessed by supervisors in the context of the “Framework for internal control, including independent control functions” in SREP. Those functions receive a single grade and are part of the final governance assessment. - In FI’s ongoing supervision, regular meetings are held with the control functions of category 1 and 2 banks. The frequency varies between quarterly and semi-annually. In preparation thereto, supervisors study the internal reports from the control functions. - In onsite investigations, FI may perform interviews with staff in different functions to assess whether they have sufficient expertise and authority and whether they have the appropriate tools to perform their duties, but due to the constraints mainly perform the assessment by analyzing banks internal documents. Supervisors do not engage with back-office personnel, nor assess their expertise or authority. - The assessors found evidence that FI analyzed the control function and suggested improvements. ### Supervisory assessment of compliance function (EC3) - The supervisor determines that banks have an adequately staffed, permanent and independent compliance function that assists senior management in effectively managing the compliance risks faced by the bank. - The supervisor determines that staff within the compliance function are suitably trained, have relevant experience and have sufficient authority within the bank to perform their role effectively. - The supervisor determines that the bank’s Board exercises oversight of the management of the compliance function. - FFFS 2014:1 Chapter 8 Section 2 stipulates that the compliance function shall be directly subordinate to the managing director. Chapter 6 Section 1 states that the control functions (defined as risk control, compliance and internal audit) shall, in organizational terms, be separate from each other. Small undertakings with less complex operations, may combine control and compliance. Chapter 8 Section 3 stipulates the responsibilities of the compliance function. Chapter 6 Section 3 stipulates that a control function shall have the resources required and access to the information needed to discharge its tasks. Such a function shall have staff with the required knowledge and powers for discharging their duties. - Compliance function supervisory analysis is taken into account in the final governance assessment within the SREP. The assessors found evidence that FI analyzed the compliance function and suggested improvements, for instance with respect to the reporting to the board, resourcing, and granularity of assessment. ### Supervisory assessment of internal audit function (EC4 and EC5) - EC4: The supervisor determines that banks have an independent, permanent and effective internal audit function charged with: - (a) assessing whether existing policies, processes and internal controls (including risk management, compliance and corporate governance processes) are effective, appropriate and remain sufficient for the bank’s business; and - (b) ensuring that policies and processes are complied with. - FFFS 2014:1 Chapter 9 stipulates the tasks, reporting lines and required competencies of the internal audit function. Section 1 stipulates that the internal audit function shall be directly subordinate to the board of directors of the undertaking. Section 2 stipulates that the staff of the internal audit function may not participate in the work of other functions, in the operating activities or in the work on preparing and selecting risk models or other risk management tools. Section 5, item 2 stipulates that the internal audit function shall review and regularly evaluate whether the undertaking’s organization, governance processes, IT systems, models and procedures are appropriate and efficient. Section 5 detail the tasks of the internal audit function. - EC5: The supervisor determines that the internal audit function: - (a) has sufficient resources, and staff that are suitably trained and have relevant experience to understand and evaluate the business they are auditing; - (b) has appropriate independence with reporting lines to the bank’s Board or to an audit committee of the Board, and has status within the bank to ensure that senior management reacts to and acts upon its recommendations; - (c) is kept informed in a timely manner of any material changes made to the bank’s risk management strategy, policies or processes; - (d) has full access to and communication with any member of staff as well as full access to records, files or data of the bank and its affiliates, whenever relevant to the performance of its duties; - (e) employs a methodology that identifies the material risks run by the bank; - (f) prepares an audit plan, which is reviewed regularly, based on its own risk assessment and allocates its resources accordingly; and - (g) has the authority to assess any outsourced functions. - Internal audit function supervisory analysis is taken into account in the final governance assessment within the SREP. In FI’s ongoing supervision, regular meetings are held with the control functions of category 1 and 2 banks. The frequency varies between quarterly and semi-annually. *Source: https://www.imf.org/-/media/files/publications/cr/2023/english/1sweea2023008.pdf* ### Chapter 6, Section 3 stipulates that a control function, which includes the internal audit ### Chapter 6, Section 3 / Chapter 9 Section 1–3; Chapter 10 Section 5 — Internal Audit, Control Functions, and External Audit (Extract) ### Control function and internal audit requirements (Chapter 6, Section 3; Chapter 9; Chapter 10, Section 5) - Chapter 6, Section 3: a control function, which includes the internal audit function, shall have the resources required and access to the information needed to discharge its tasks. - Control function staff requirements: - staff with the required knowledge and powers for discharging their duties. - Chapter 9, Section 1: the internal audit function shall be directly subordinate to the board of directors. - Chapter 9, Section 2: staff of the internal audit function may not participate in the work of other functions, in the operating activities or in the work on preparing and selecting risk models or other risk management tools. - Chapter 9, Section 3: the internal audit function shall comprise people knowledgeable about, inter alia, the undertaking’s operations, procedures, IT systems, accounting and valuation of assets, and the risks to which the undertaking is exposed, the laws, statutes and other regulations applicable to the operations, and internal audit standards. - Chapter 9, Section 5: internal audit shall work according to a current and risk-based audit plan adopted by the board of directors. - Chapter 10, Section 5 (outsourcing): when entering into an outsourcing agreement, an undertaking shall i.a. ensure that auditors have access to information regarding the outsourced operations and access to the premises of the service provider. ### Supervisory practice regarding internal audit and control functions - Supervisors analyze board meetings and verify if internal audit plans are frequently changed and if the assessments follow the plans. - In quarterly meetings, supervisors criticize internal audit plans for largest banks and may suggest changes to the plans. - Supervisors compare internal audit findings with SREP findings and evaluate if material findings are pointed out. - FI’s ongoing supervision: - regular meetings with the control functions of category 1 and 2 banks; frequency varies between quarterly and semi-annually. - evidence seen of supervisory reviews on internal control frameworks and subsequent supervisory actions to address identified weaknesses. - Supervisory limitations and recommendations: - Supervisors do not engage with back-office personnel, nor assess their expertise or authority. - FI’s engagement with all areas under the control functions is desired because of FI’s reliance on control functions in its own supervisory process. ### Assessment of Principle 26 - Assessment: Compliant - Rationale and findings: - FI’s regulation regarding governance, risk management and control (FFFS 2014:1) provides a comprehensive set of requirements and supervisory expectations for control functions (control, compliance and internal audit). - The regulation details what the control function should focus on and how governance and resources should be established to reinforce independence. - Control functions are assessed within the SREP process via the “Framework for internal control, including independent control functions” in SREP; those functions receive a single grade and are part of the final governance assessment within the SREP. ### Principle 27 — Financial reporting and external audit (overview) - Principle 27: The supervisor determines that banks and banking groups maintain adequate and reliable records, prepare financial statements in accordance with accounting policies and practices that are widely accepted internationally and annually publish information that fairly reflects their financial condition and performance and bears an independent external auditor’s opinion. The supervisor also determines that banks and parent companies of banking groups have adequate governance and oversight of the external audit function. ### Essential Criterion 1 (EC1) — Board and management responsibility for financial statements - Requirement: supervisor holds the bank’s Board and management responsible for ensuring financial statements are prepared in accordance with accounting policies and practices that are widely accepted internationally and supported by recordkeeping systems. - Description and findings: - Listed banking groups are required to apply International Financial Reporting Standards (IFRS) according to Article 3 of Regulation (EC) No 1606/2002. - IFRS 9 was fully implemented in Sweden in 2018. - According to FI’s regulation (FFFS 2008:25, Chapter 7, Section 2), non-listed banking groups are also required to apply the IAS Regulation in their consolidated financial statements. - FFFS 2008:25 Chapter 2, Section 1 stipulates banks shall in their annual financial statement apply IFRS approved by the EU if nothing else is required by law or by FFFS 2008:25. - Differences between IFRS and Swedish local accounting standards exist only in solo legal entity financial statements; consolidated statements apply IFRS. - Main differences noted (not exhaustive): - 1) Intangible assets with indefinite useful lives are not amortized under IFRS (tested for impairment); the Annual Accounts Act for Credit Institutions and Securities Companies (SFS 1995:1559) requires amortization. - 2) IFRS 9 requires changes in own credit risk on financial liabilities designated under the fair value option to be presented in other comprehensive income; the Annual Accounts Act (SFS 1995:1559) requires presentation in the statement of profit or loss (presentation issue; effect on total equity is the same). - 3) Annual Accounts Act (SFS 1995:1559) contains requirements of specific format for presentation of the balance sheet and profit or loss account. - Additional election differences due to tax reasons (examples): - Leases: may elect not to apply IFRS 16 and instead apply RFR 2. - Defined benefit plans: may elect not to apply IAS 19 and instead apply RFR 2. - Development expenditures: may elect not to apply IAS 38; under RFR 2 such expenditures may be recognized in profit or loss. - Assessors found these differences are not significantly material. - Companies Act (SFS 2005:551, Chapter 8, Section 4): board responsible for organization, management, assessing financial position, ensuring accounting and monitoring of finances. ### Essential Criterion 2 (EC2) — External auditor opinion and audit standards - Requirement: supervisor holds the bank’s Board and management responsible for ensuring annual financial statements bear an independent external auditor’s opinion from an audit conducted in accordance with internationally accepted auditing practices and standards. - Description and findings: - A bank must have at least one auditor elected by shareholders (Companies Act SFS 2005:551, Chapter 9, Section1). - Auditor submits an audit report to the shareholders’ meeting; report to be sent to the board no less than three weeks before the annual general meeting. - Pursuant to Auditing Act (SFS 1999:1079 Section 5), the auditor should examine the annual report and accounts and the management’s administration. - International auditing standards (ISA) are applied in audits of Swedish banks. - Annual financial statements for a credit institution must be audited by an external chartered auditor according to Banking and Financing Business Act (SFS 2004:297, Chapter 10, Section 9). - FI has ultimate responsibility for supervision regarding disclosures in listed banks’ financial statements (Securities Market Act SFS 2007:528, Chapter 23, Section 1), with day-to-day supervision delegated to the Council for Swedish Financial Reporting Supervision (Regulation (2007:572) Chapter 6 section 3 and section 1 § paragraph 46). - For non-listed companies, FI supervises disclosures on a best-effort basis. ### Essential Criterion 3 (EC3) — Valuation practices and independent verification - Requirement: supervisor determines banks use valuation practices consistent with internationally accepted accounting standards; framework for fair value estimation subject to independent verification and validation; banks document significant differences between financial reporting and regulatory valuations. - Description and findings: - Valuation practices are the same as in IFRS in financial statements for banks and compliant with IFRS in consolidated accounts (see EC1 exceptions). - CRR Article 105 requires credit institutions to establish and maintain systems and controls sufficient to provide prudent and reliable valuation estimates, including independent verification and validation and procedures for considering valuation adjustments. - CRR Article 436 requires banks to disclose differences between valuations used for financial reporting and for regulatory purposes, including reconciliations and breakdowns identifying main sources of differences. ### Essential Criterion 4 (EC4) — Supervisor powers to set audit scope and standards - Requirement: laws/regulations set, or supervisor can establish, scope of external audits and standards; require risk- and materiality-based approach. - Description and findings: - EU Audit Regulation (537/2014) establishes scope of external audit of public-interest entities according to a risk and materiality-based approach. - Article 10 of Audit Regulation requires audit report to include: - a description of the most significant assessed risks of material misstatement, including assessed risks due to fraud; - a summary of the auditor's response to those risks; and - where relevant, key observations arising with respect to those risks. - FI has no powers under EU or Swedish law to establish the scope of external audits of credit institutions. ### Essential Criterion 5 (EC5) — Audit coverage requirements - Requirement: supervisory guidelines or local auditing standards determine audits cover loan portfolio, loan loss provisions, nonperforming assets, valuations, trading, derivatives, securitizations, consolidation, off-balance sheet vehicles, and internal control over financial reporting. - Description and findings: - RevR100 “Revision av finansiella företag” (“Audit of financial companies”) is a recommendation that regulates a minimum scope of the external audit of banks and other financial institutions. - RevR100 includes recommendations for application of certain paragraphs in ISA 250, ISA 315, IAS 320, ISA 570, audit of internal control, and auditors’ reporting to management and communication with FI. - External auditor is responsible for establishing risk assessment and determining focus areas based on risk and materiality, prepared on the basis of the RevR100 framework. - FI has no powers under EU or Swedish law to establish the scope of external audits of credit institutions. ### Essential Criterion 6 (EC6) — Power to reject or rescind auditor appointment - Requirement: supervisor has power to reject/rescind appointment of external auditor deemed inadequate or non-independent. - Description and findings: - Companies Act (SFS 2005:551) Chapter 9, Section 22a: an auditor appointed by annual meeting in a publicly traded company may be dismissed by a general court if unsuitable. - An application for dismissal can be made by a shareholder minority (≥5%), the board, and the FI. - Possibility for FI to apply for dismissal is limited to companies whose shares are traded on a regulated market. - To date, no such applications have been filed with the court. - Conclusion: the supervisor has no direct power to reject and rescind the appointment of an external auditor. ### Essential Criterion 7 (EC7) — Rotation of external auditors - Requirement: supervisor determines banks rotate their external auditors (firm or individuals) from time to time. - Description and findings: - Audit Regulation (537/2014) Article 17 paragraph 1: neither the initial engagement nor any renewed engagements with a statutory auditor or audit firm shall exceed a maximum duration of 10 years. - FI has mandate to intervene under Act (SFS 2016:429) on supervision of companies of general interest in auditing if the bank does not rotate the auditor according to applicable law. - Assessors found evidence that external auditors rotate according to the provisions in the regulation. ### Essential Criterion 8 (EC8) — Supervisor meetings with external audit firms - Requirement: supervisor meets periodically with external audit firms to discuss issues of common interest relating to bank operations. - Description and findings: - FI complies with the EBA guideline on communication between competent authorities and statutory auditors/audit firms. - Meetings are held at least once a year for category 2 banks and twice a year for category 1 banks. ### Essential Criterion 9 (EC9) — Auditor reporting to supervisor and protection - Requirement: supervisor requires external auditor to report matters of material significance to the supervisor; laws/regulations protect auditors reporting in good faith from breach of confidentiality liability. - Description and findings: - Banking and Financing Business Act (SFS 2004:297, Chapter 13, Section 10): an auditor or a special examiner shall immediately report to the FI if, upon performance of duty in a credit institution, he or she learns of circumstances which: - 1. may constitute a material violation of the statutes governing the institution’s operations; or - 2. may negatively affect the institution’s continued operations. *Source: Excerpt from the referenced chapter and sections of the Swedish assessment document.* ### 3. may result in the auditor recommending that the balance sheet or profit and loss ### 3. may result in the auditor recommending that the balance sheet or profit and loss statement not be adopted or in a notation being filed ### Auditor reporting and access to external auditors’ working papers (AC1) - Finding: No. The Swedish Inspectorate of Auditors (SIA) is the authority that has the power to access external auditors’ working paper Accountants Act (SFS 2001:883, Section 28) and to practice periodic reviews. - FI (Finansinspektionen) does not have the direct power to access external auditors’ working papers. - FI does not have the direct power to reject and rescind the appointment of an external auditor; nor to access external auditors’ working paper. - There is a possibility for FI to apply for the assignment dismissal of an external auditor at the general court if the auditor is unsuitable; however, this possibility is limited to companies whose shares are traded on a regulated market. So far, no such applications have been filed with the court. - FI does not have the power to establish the scope of external audits nor to determine its coverage. They are established in regulations and guidelines. - FI interacts with external auditors on a frequent basis and use their work as an input for the supervisory process. ### Assessment of Principle 27 - Assessment: Largely Compliant - Comments: - IFRS 9 was fully implemented in Sweden in 2018. - Both listed and non-listed banking groups are required to apply IFRS according to IAS regulation. - Differences between IFRS and Swedish local accounting standards exist only in the financial statements of a solo legal entity and are not significantly material. Main differences include: - amortization of intangible assets with indefinite useful lives (e.g., goodwill); - recognition of changes in own credit risk on financial liabilities designated under the fair value option; - particularities with respect to the format for presentation of the balance sheet and profit or loss account. - Examples (not exhaustive) of standards/IFRS rules that a solo legal entity need not apply in the financial statements due to tax purposes: leases, defined benefit plan and development expenditures recognition. - The annual financial statement for a credit institution must be audited by an external chartered auditor according to Banking and Financing Business Act (SFS 2004:297, Chapter 10, Section 9). - FI has the ultimate responsibility for the supervision regarding the disclosures in the listed banks financial statements according to the Securities Market Act (SFS 2007:528, Chapter 23, Section 1) and has the power to intervene against infringements. Day-to-day supervision has been delegated to the Council for Swedish Financial Reporting Supervision according to Chapter 6 section 3 and section 1 § paragraph 46 Regulation (2007:572) on securities markets. - For non-listed companies, FI is responsible for the supervision regarding disclosures and performs it on a best-effort basis. --- ### Principle 28 — Disclosure and transparency (Overview) - Principle: The supervisor determines that banks and banking groups regularly publish information on a consolidated and, where appropriate, solo basis that is easily accessible and fairly reflects their financial condition, performance, risk exposures, risk management strategies and corporate governance policies and processes. #### Essential Criterion EC1 — Periodic public disclosures - Laws, regulations or the supervisor require periodic public disclosures of information by banks on a consolidated and, where appropriate, solo basis that adequately reflect the bank’s true financial condition and performance, and adhere to standards promoting comparability, relevance, reliability and timeliness of the information disclosed. - Description and findings: - Banks and banking groups disclose information required by IAS regulation and FI’s regulations and general guideline concerning the annual reports of banks (FFFS 2008:25). - IFRS requires banks to reflect its true financial condition (IAS 1.15). Requirements promote comparability (IAS 1.38), relevance (IAS 1.17 b) and reliability of the information disclosed (IAS 1.17 b). - Banks are also required to disclose information under Pillar 3. Disclosure requirements are found in part eight of the CRR (article 431-455). Article 433a requires large institutions to implement disclosure requirements under the Basel framework. Article 433b provides simplified regulation for small and non-complex institutions. Article 433c prescribes disclosure for other institutions. - According to the RCAP EU assessment Pillar 3 disclosure was found compliant. #### Essential Criterion EC2 — Scope and content of disclosures - Required disclosures include both qualitative and quantitative information on a bank’s financial performance, financial position, risk management strategies and practices, risk exposures, aggregate exposures to related parties, transactions with related parties, accounting policies, and basic business, management, governance and remuneration. - Description and findings: - Banks and banking groups shall disclose information required under IFRS and FI’s regulations and general guidelines regarding annual accounts for credit institutions and securities companies (FFFS 2008:25). - Additional disclosures are required under the Annual Accounts Act for Credit Institutions and Securities Companies (1995:1559). - Required disclosure under IFRS and this Act include both qualitative and quantitative information on a credit institution’s: - financial performance (IAS 1.10 b and e, 1.13, 1.112-138) - financial positions (IAS 1.10 a and e, 1.13, 1.112-138) - risk management strategies and practices (IFRS 7.31-32A, Annual Accounting Act (1995:1554), Chapter 6, section 1, paragraph 1 - 3) - risk exposures (IFRS 7.33-42, Annual Accounting Act (1995:1554) Chapter 6, section 1, paragraph 3) - exposures to related parties (IAS 24), Annual Accounting Act (1995:1554) Chapter 5, section 16 and 18 - transactions with related parties (IAS 24), Annual Accounting Act (1995:1554) Chapter 5, section 23 and 24 - remuneration (IAS 24) Annual Accounting Act (1995:1554) Chapter 5, section 39 - 44 - accounting policies (IAS 1. 117-124 and IAS 8) - basic business (IAS 1.138 b, IFRS 8) - For the disclosure requirements mentioned, the scope and content provided, and the level of disaggregation and detail are the same for all credit institutions regardless of the size and the complexity of its operations. However, the complexity of the banks business differs, and less complex banks therefore has less burdensome disclosure requirements. - Disclosures about capital adequacy and risk management are also required in the pillar 3 reports according to the Credit Institutions and Securities Companies Special Supervision Act (SFS 2014:968, Chapter 6, Section 2), and Part Eight of the CRR, further specified in the EBA guidelines on disclosure (EBA/GL/2016/11). - Disclosures on exposures and transactions with related parties and accounting policies are only required in the financial statements, with the exception of accounting policies for past-due and impaired (Article 442a of the CRR) and securitization transactions (Article 449j). Therefore, banks are not required to disclose related-party exposures or transactions as part of Pillar 3 disclosures. #### Essential Criterion EC3 — Group structure disclosures - Laws, regulations or the supervisor require banks to disclose all material entities in the group structure. - Description and findings: - Disclosure requirements regarding affiliates and subsidiaries are regulated in IFRS 12 Disclosure of interests in other entities, Annual Accounts Act for Credit Institutions and Securities Companies (SFS 1995:1559). - Article 436b of the CRR requires disclosure of an outline of the differences in the basis of consolidation for accounting and prudential purposes, with a brief description of the entities therein, explaining whether they are: (i) fully consolidated; (ii) proportionally consolidated; (iii) deducted from own funds; or (iv) neither consolidated nor deducted. #### Essential Criterion EC4 — Review and enforcement of disclosure standards - The supervisor or another government agency effectively reviews and enforces compliance with disclosure standards. - Description and findings: - The annual financial statement for a credit institution must be audited by an external chartered auditor according to BFBA (SFS 2004:297, Chapter 10, Section 9). - FI has the ultimate responsibility for the supervision regarding the disclosures in the listed banks financial statements according to the Securities Market Act (SFS 2007:528, Chapter 23, Section 1). Supervision has been delegated to the Council for Swedish Financial Reporting Supervision according to Chapter 6 section 3 and section 1 § paragraph 46 Regulation (2007:572) on securities markets. - External auditors do not assess Pillar 3 disclosures. - FI broadly reviews and enforces disclosures through ongoing supervision, including risk meetings with the banks and meetings with their external auditors. - FI has requested Pillar 3 adjustments following a thematic inspection on CCR, but Pillar 3 disclosure is not an area where FI has focused on. - For non-listed companies, FI is responsible for the supervision regarding both financial statements and Pillar 3 disclosures and performs it on a best-effort basis. #### Essential Criterion EC5 — Aggregate public information on the banking system - The supervisor or other relevant bodies regularly publishes information on the banking system in aggregate to facilitate public understanding and market discipline. - Description and findings: - FI publishes a semi-annual report on the Swedish banking sector, Bankbarometern (the ‘Bank Barometer’), dividing banks by business model and reporting statistics by business model group on i.a. lending, NII margin, financing, ROE, costs, and problem loans. - FI publishes a semi-annual Stability Report containing FI’s assessment of the stability of the Swedish financial system, including the banking sector. The Riksbank also publishes its own Stability Report. - FI publishes an annual Mortgage Market Report, based on the annual Residential Mortgage Inspection where the eight largest mortgage lenders submit data on approximately 20,000 new loans, as well as portfolio data on existing loans. #### Additional Criterion AC1 — Intra-period disclosures - The disclosure requirements imposed promote disclosure of information that will help in understanding a bank’s risk exposures during a financial reporting period, for example on average exposures or turnover during the reporting period. - Description and findings: - Disclosures are more often provided using end-of-period values. - While the CRR refers to some average values or over-the-period values, there was no evidence to show that these inputs are used in the risk assessment. - FI uses intra-period information, in particular for market and liquidity risk, but this information is mostly gathered from financial reporting. ### Assessment of Principle 28 - Assessment: Largely Compliant - Comments: - Banks and banking groups disclose financial information required by IAS regulation and FI’s regulations and general guideline concerning the annual reports of banks (FFFS 2008:25). - Banks are also required to disclose information according to the prudential regulation, under Pillar 3, with proportionality allowances in the CRR. - According to the RCAP EU assessment Pillar 3 disclosure was found compliant. - FI has the ultimate responsibility for supervision regarding disclosures in listed banks but has delegated day-to-day supervision to the Council for Swedish Financial Reporting Supervision. - FI has requested Pillar 3 adjustments following inspections on different themes, but disclosure is not an area where FI’s supervision has focused on. - For non-listed companies, FI performs supervision regarding disclosures on a best-effort basis; it might be worthy to have an external auditor looking at the Pillar 3 disclosure. - Banks are not required to disclose related-party exposures or transactions as part of the Pillar 3 disclosures (only in the financial statements). - Pillar 3 disclosures are more often provided using end-of-period values. FI uses intra-period information, in particular for market and liquidity risk, but this information is mostly gathered from financial reporting. --- ### Principle 29 — Abuse of financial services (Overview) - Principle: The supervisor determines that banks have adequate policies and processes, including strict customer due diligence (CDD) rules to promote high ethical and professional standards in the financial sector and prevent the bank from being used, intentionally or unintentionally, for criminal activities. #### Essential Criterion EC1 — Supervisor duties, responsibilities and powers (AML/CFT) - Laws or regulations establish the duties, responsibilities and powers of the supervisor related to the supervision of banks’ internal controls and enforcement of the relevant laws and regulations regarding criminal activities. - Description and findings: - Chapter 13, Section 2, of the Banking and Financing Business Act (BFBA) grants FI the powers to exercise supervision over credit institutions and branches of foreign credit institution in Sweden with the aim of ensuring that business is conducted in accordance with all statutes governing the operations of the institution as well as the institution’s articles of association, by-laws or regulations and internal instructions based on statutes that govern the operations of the institution. - Specific provisions within the Banking and Financing Business Act (Chapter 15) grant FI the power and responsibilities for the enforcement of the relevant laws and regulations regarding criminal activities in the banking sector. - AML Laws and Regulations: - Sweden has transposed the 4th and 5th EU AML Directives mainly through the Act on Measures against Money Laundering and Terrorism Financing (2017:630) (the Swedish AML/CFT Act). - FI has also issued detailed regulation (regulations regarding measures against money laundering and terrorist financing FFFS 2017:11) in line with the Swedish AML/CFT Act. The regulations cover risk assessment and procedures, measures for verifying identity, monitoring and reporting, and internal control, and are applicable to all financial obliged entities, including banks. - FI is responsible for supervising compliance with directly applicable EU regulations, such as Regulation (EU) 2015/847 on information accompanying transfers of funds (the Wire Transfer Regulation) and any binding Regulatory Technical Standards issued by the European Supervisory Authorities (EBA, ESMA and EIOPA). - The Swedish AML/CFT Act and the regulation grant powers to FI to ensure compliance and establish duties and responsibilities to supervise. - As provided in Chapter 15 of the BFBA, non-compliance with relevant AML/CFT regulation can lead to an intervention by FI, ranging from issuing an order to take corrective measures, issuing of an adverse remark, a warning and ultimately revoking the banking license in its entirety. - Both remarks and warnings can be combined with administrative sanctions fees of up to 10 % of the annual turnover on a group level, and assessors were provided with examples of cases where fines have been imposed on institutions due to deficiencies in management of the risk of money laundering. - FI also has the power to issue sanctions against the CEO and members of the board. - The assessors reviewed two cases where FI assessed a bank’s governance and control with regards to AML. In both cases, FI identified significant findings and issued: - a warning combined with a fine of SEK 4.0 billion against one of the two banks; - a remark combined with a fines of SEK 1 billion against the other. - Supervision of Internal Controls: - Chapter 6, Section 2, of the BFBA requires institutions to identify, measure, control, internally report and verify the risks associated with their operations, including an obligation to ensure that operational and other risks do not, on aggregate, jeopardize the institution’s ability to fulfil its obligations. - FI has issued two binding regulations in the areas of financial and operational risks: - Regulations and General Guidelines regarding governance, risk management and control at credit institutions (FFFS 2014:1) - Regulations and General Guidelines regarding the management of operational risks (2014:4) - These regulations require banks to establish internal control functions and reporting systems and have implications on internal controls aimed at preventing illicit activities. - FI supervises banks based on the AML/CFT Act and relevant guidelines (FFFS 2014:1 and 2014:4), and non-compliance may result in a sanction as provided for under BFBA. - The regulations set out specific requirements in relation to control and reporting, and banks are required to establish specific control and compliance functions. #### Essential Criterion EC2 — Banks’ policies and processes (CDD and AML/CFT) - The supervisor determines that banks have adequate policies and processes that promote high ethical and professional standards and prevent the bank from being used for criminal activities, including prevention, detection and reporting. - Description and findings: - Banks in Sweden are required to identify, measure, control, internally report and verify the risks associated with its operations (Chapter 6, Section 2, of the BFBA). This requirement applies to all aspects of a bank’s operations, including operational risks, and results in an obligation for banks to identify and address risks related to all criminal activities. - The Swedish AML/CFT Act stipulates more detailed requirements in relation to AML/CFT issues and these are specified in FI regulation on measures against money laundering and terrorist financing (2017:11). - Chapter 2, section 1 of the Swedish AML/CFT Act requires banks to conduct a general risk assessment to identify threats and vulnerabilities in their business operations and to use the outcome of the assessment to inform the establishment of adequate policies and procedures to mitigate the ML/TF risks and to detect and prevent criminal activity. - Banks are required to have documented routines and guidelines regarding the measures for customer due diligence (CDD), monitoring and reporting as well as for the processing of personal data. *Source: 1sweea2023008 - 3. may result in the auditor recommending that the balance sheet or profit and loss statement not be adopted or in a notation being filed (IMF content).* ### Chapter 2, section 13, of the Swedish AML/CFT Act also requires banks to have established ### 1sweea2023008 - Chapter 2, section 13, of the Swedish AML/CFT Act also requires banks to have established ### Legal and organisational requirements - Chapter 2, section 13 of the Swedish AML/CFT Act requires banks to have established routines to ensure the appropriateness of employees, consultants and others who on a similar basis take part in its business if their substantial tasks include the prevention of the abuse of the business for money laundering or the financing of terrorism. - Banks are required to ensure that staff continuously receive relevant training and information in order to be able to meet the relevant AML/CFT requirements. - Chapter 4 requires banks to monitor ongoing business relationships and assess individual transactions in order to discover suspicious activities and transactions. - Where a bank has a reason to suspect money laundering or the financing of terrorism or that assets originated from a criminal act, then they should promptly report information on all relevant circumstances to the Swedish Financial Intelligence Unit (FIU). - FI has issued general guidelines on handling ethical issues at institutions under its supervision (FFFS 1998:22). The guidelines require institutions under FI supervision to conduct business in a manner that the public's confidence in the institution and the financial market is maintained and that the business may be deemed to be sound. ### Supervision, reporting, and inter-agency cooperation (EC3, EC4) - FI is responsible for assessing (supervising) whether banks are in compliance with relevant laws and regulations, and has procedures in place for the ongoing assessment of banks to ensure that they are not being used for criminal activities. - As part of its supervisory process, FI collects information annually from the banking sector using a mandatory self-assessment questionnaire “the AML/CFT periodic reporting requirement.” - Banks report suspicious activities and incidents of fraud to the banking supervisor when such activities/incidents are material to the safety, soundness or reputation of the bank. - FI has issued guidelines on reporting events of material significance (FFFS 2021:2). Banks are required to report immediately to FI any events that can result in such changes in the financial situation of the bank that could result in the bank no longer being able to fulfil its obligations to the customers; examples include events resulting in significant economic loss for a large number of clients or a significant loss of reputation for the bank. - As part of the AML/CFT periodic reporting requirement, all banks are required to submit information on suspicious transactions to FI including those that have resulted in reports to the FIU, and FI receives incident reports on, amongst others, suspicious activities and incidents of fraud from the banks. - According to Chapter 4, section 4 of the AML/CFT Act, where FI as part of inspection or otherwise has discovered a circumstance which can be assumed to have a connection with, or constitute, money laundering or terrorist financing, it is required to promptly notify the Swedish Police/FIU. - In 2020 FI signed a cooperation agreement with the Swedish FIU (organized under the Swedish Police Authority), establishing a standing working group for cooperation enabling exchange of confidential information and financial intelligence. - As a designated authority under the Act on Information Sharing and Cooperation to Combat Organized Crime (2016:774), FI is mandated to enter into similar arrangements with other law enforcement agencies and certain other authorities where deemed necessary. ### CDD management program and mandatory CDD elements (EC5) - The CDD management program, on a group-wide basis, has as its essential elements: - (a) a customer acceptance policy that identifies business relationships that the bank will not accept based on identified risks; - (b) a customer identification, verification and due diligence program on an ongoing basis; this encompasses verification of beneficial ownership, understanding the purpose and nature of the business relationship, and risk-based reviews to ensure that records are updated and relevant; - (c) policies and processes to monitor and recognize unusual or potentially suspicious transactions; - (d) enhanced due diligence on high-risk accounts (e.g., escalation to the bank’s senior management level of decisions on entering into business relationships with these accounts or maintaining such relationships when an existing relationship becomes high-risk); - (e) enhanced due diligence on politically exposed persons (including, among other things, escalation to the bank’s senior management level of decisions on entering into business relationships with these persons); and - (f) clear rules on what records must be kept on CDD and individual transactions and their retention period. Such records have at least a five-year retention period. - Under the Swedish AML/CFT Act (Chapter 2, section 8) banks are required to have documented routines and guidelines for customer due diligence (CDD), transaction monitoring and reporting as well as for the processing of personal data, taking into account size, nature and identified ML/TF risks. - For banking groups, the ultimate parent entity is responsible for establishing and ensuring common routines and guidelines are applied group-wide (Chapter 2, sections 9-10). For subsidiaries/branches outside the EEA, the ultimate parent must ensure the application of Swedish regulations where local legislation is less stringent (Chapter 2, section 11); where not possible, the parent must take measures to effectively mitigate the increased ML/TF risk (Chapter 2, section 12). - Chapter 3 Section 7 requires banks to identify and verify a customer’s identity prior to establishing the business relationship; for legal persons, banks must also identify and verify the identity of the natural person acting as representative and determine beneficial ownership (Chapter 3, section 8), which should include a search in the Beneficial Ownership Register. - CDD measures must be conducted on an on-going basis and include gathering information on the purpose and nature of the business relationship (Chapter 3, sections 12-13). - Chapter 4 requires monitoring of ongoing business relationships and transactions, with escalation to enhanced CDD and reporting of SAR/STR to the Swedish Police/FIU where reasonable cause to suspect ML/TF or criminal activity exists. - Chapter 3, sections 14-32 set out that customers may be subjected to simplified or enhanced due diligence measures depending on risk; PEPs and customers in EU-designated high risk third countries require senior management approval (Chapter 3, sections 10-11 and 17-19). - Chapter 5, Section 3-4 requires banks to keep records of CDD documentation and information of transactions for five years; where necessary to prevent, detect, or investigate ML/TF, preservation may exceed five years but the aggregate time may not exceed 10 years. FI’s regulation (FFFS 2017:11) clarifies requirements for safe storage, electronic or paper, and accessibility. ### Supervision, inspections, and compliance findings - FI assesses compliance through on-going supervision and by conducting offsite and onsite inspections; AML staff review internal audit and compliance reports from large and medium sized banks as part of on-going supervision. - From the schedule of AML inspections over the last five years, assessors noted a number involved review of banks’ policies and procedures for CDD and risk classification of customers. - One investigation of a large Swedish bank covered general risk assessment, customer risk classification, policies and procedures, guidelines for CDD, monitoring and reporting, and CDD measures focusing on PEP customers and private banking customers; the investigation identified major deficiencies and FI took corrective measures. - Based on information provided, FI has undertaken 21 inspection of individual institutions in the last 5 years (11 since 2018), with areas covered including general risk assessment and Know Your Customer (KYC), policies and procedures for CDD, transaction monitoring, governance and control, risks classification. - FI has undertaken targeted supervision in relation to 2 banks since 2015 involving follow-up actions including onsite inspection, analysis of customer files, review processes, and follow up of action plans in on-going supervision. ### Correspondent banking (EC6) - Chapter 3, section 18 requires that when establishing correspondent relationships with a credit or financial institution from a country outside the EEA, banks should at a minimum: 1. Obtain sufficient information on the counterparty to understand the business and, based on publicly available information, assess the other party’s reputation and quality of supervision; 2. Assess the counterparty’s controls to prevent ML/TF; 3. Document each institution’s responsibility to take verification measures, and the measures which it takes; 4. Obtain approval from an authorized decision-maker before the correspondent relationship is entered into; and 5. Ascertain that the other party has verified the identity of customers who have direct access to accounts at the credit institution or the financial institution and regularly follow-up on such customers, and, upon request, can provide relevant customer information. (SFS 2021:903). - Chapter 2, section 7 explicitly prohibits Swedish banks from establishing or maintaining correspondent relationships with shell banks and requires banks to ensure correspondent relationships are not maintained with institutions which allow their accounts to be used by shell banks. - FI’s last onsite inspection on correspondent banking compliance was initiated in 2013 covering four of the largest banks; inspections concluded in 2015 with intrusive follow-up for two banks in 2016/17. No subsequent dedicated onsite inspections but the topic has been covered within on-going supervision and internal report reviews. - FI noted a steady decline in correspondent banking relationships: the number of correspondent banking relationships has decreased by ca 50 % over four years. - Reported numbers from the AML/CFT periodic reporting: - In 2017 the total number of correspondent banking relationships for the Swedish banking sector was 4114 relationships outside the EEA and 1947 relationships within the EEA. - In 2020 the numbers were 1901 and 1007 respectively. - FI considers the decline an indication of raised awareness in the Swedish banking sector of the risks and compliance costs with correspondent banking. ### Controls, risk identification and transaction monitoring (EC7) - Chapter 6, Section 2 of the Swedish Banking and Financing Business Act requires all banks to identify, measure, control, internally report and verify the risks associated with operations, including operational risks, providing a basis to identify and report risks related to criminal activities including those subject to AML/CFT regulation. - Chapter 2, section 1 of the AML/CFT Act requires banks to assess how their products and services can be used for ML or TF and the level of risk exposure and to address identified risks by implementing adequate policies and procedures. - Chapter 4, Section 1 requires banks to monitor ongoing business relationships and evaluate individual transactions to identify activities and transactions which: 1. deviate from what the bank has reason to expect given its knowledge of the customer, and 2. deviate from what the bank could reasonably expect given its knowledge of the customers, the products and services which are offered by the customer, the information provided by the customer and other circumstances, or - Where deviations or suspicious activities are observed, banks must determine, through enhanced CDD and other necessary measures, whether there is reasonable cause to suspect ML/TF or criminal activity and, where appropriate, report SAR/STR to the Swedish Police/FIU. *Source: 1sweea2023008 - Chapter 2, section 13, of the Swedish AML/CFT Act also requires banks to have established* ### 3. without deviating from what the bank expects but can be assumed to be part of a ### 1sweea2023008 - 3. without deviating from what the bank expects but can be assumed to be part of a ### Suspicious activity identification, enhanced CDD, and reporting - Banks must determine, through enhanced CDD and other necessary measures, whether there is reason to suspect ML/TF or that assets originate from a criminal act when deviations or suspicious activities/transactions are identified. - If a bank has reason to suspect ML/TF or that assets otherwise originate in a criminal act, information on all indicative circumstances should be promptly reported to FIU (Section 3). - A report should be submitted even if transactions are not executed, and also if, before entering into a business relationship or conducting a transaction, there arises a suspicion that the customer intends to use the bank’s products or services for ML/TF. - Chapter 2, section 14 of the Swedish AML/CFT Act: banks should ensure employees, consultants and others who on a similar basis take part in its business and whose substantial tasks include the prevention of abuse continuously receive relevant training and information to meet AML/CFT Act requirements. ### Supervision, powers, and enforcement (EC8) - Chapter 13, section 2 of the Banking and Financing Business Act (BFBA): the supervisor shall verify that bank operations are conducted pursuant to all governing regulations, including the AML/CFT Act and regulations issued on the basis of the Act. - Sections 3 and 4: supervisory authority may order a bank to provide information and access to documents and may conduct an onsite inspection where necessary. - Chapter 15 (sections 1-9) BFBA: FI’s sanctioning measures include issuing an adverse remark, warnings, and withdrawals of authorizations; remarks and warnings are usually issued together with an administrative fine. - FI can issue orders to take corrective action combined with conditional fines; can take action against the CEO and board members individually, including bans from holding such positions for a certain period or administrative fines. - FI’s measures are aligned with the fourth EU AML Directive. - For branches of foreign banks in Sweden, Chapter 15, section 15a BFBA: FI can order rectification for breaches of Swedish AML/CFT laws/regulation and combine orders with conditional fines. - Assessors noted sanctions in 2020 of 4 billion SEK and 1 billion SEK for two banks related to deficiencies in anti–money laundering work. ### Internal audit, compliance officers, screening, and training (EC9) Findings and legal requirements: - a) Internal audit/expert: - Chapter 6, section 2 of the Swedish AML/CFT Act: when justified by size and nature of business, a bank shall introduce an independent audit function auditing internal guidelines, controls and procedures to fulfil AML/CFT obligations. - Chapter 13, section 3 BFBA: credit institutions and foreign credit institutions with branches in Sweden shall provide FI with information as requested, granting FI access to internal audit reports. - b) Compliance officers: - Chapter 6, section 2 of the Swedish AML/CFT Act: when justified by size and nature, a bank shall appoint (i) a specially appointed executive (member of management committee, CEO, or comparable executive) responsible for execution of AML/CFT measures, and (ii) a Money Laundering Reporting Officer (MLRO) to monitor ongoing performance. - Obligations for these roles are further specified in Chapter 6 of regulation FFFS 2017:11 (e.g., the specially appointed executive shall carry out and update the general risk assessment and ensure common internal procedures and guidelines). - c) Screening policies and processes: - Chapter 5, section 5 of FFFS 2014:4 requires procedures to manage operational risks regarding staff. - Chapter 2, section 13 of the Swedish AML/CFT Act: banks must have routines to ensure suitability of employees, consultants and others who perform tasks important to prevent use of operations for ML/TF. - Chapter 2, section 4 of regulation FFFS 2017:11: ‘fit and proper’ procedures must ensure understanding of ML/TF commensurate with duties and include description of how fitness is ensured. - d) Ongoing training programs: - Chapter 2, section 14 of the Swedish AML/CFT Act: banks should ensure employees, consultants and similar participants whose tasks include prevention continuously receive relevant training and information. - Chapter 2, section 6 of FFFS 2017:11: banks are required to document training provided, including content, participant names, and training dates. Operational observations: - FI has not conducted recent inspections specifically on employee screening in credit institutions; compliance followed via ongoing supervision, internal compliance and audit reports, periodic data reporting and the SREP process. - No inspection on employee training has been conducted. ### Reporting systems, whistleblower protection, and staff reporting (EC10–EC11) - Chapter 6, section 4 of the AML/CFT Act: banks must provide suitable reporting systems for staff who wish to report suspected infringements of AML/CFT law or regulations. - Legal provisions in the Swedish AML/CFT Act and the Swedish Whistleblowing Act require banks to have clear policies and processes for staff to report potential abuse and allow anonymous reporting. - FI inspections in two large banks identified weaknesses in governance and control processes including handling and reporting potential abuse internally; both banks were sanctioned by FI in 2020. - Chapter 4, section 10 of the Swedish AML/CFT Act: a person who provides information pursuant to sections 3 or 6 (SAR/STR reporting or responding to FIU/Security Service requests) may not be held liable for disregarding confidentiality where the person had reason to expect disclosure was necessary; same applies to board members or employees providing information on behalf of the entity. - Chapter 6, section 4a of the AML/CFT Act: banks must have routines and take necessary measures to protect employees from threats, revenge or other hostile action resulting from reporting suspected infringements. - Swedish Whistleblowing Act (2016:749): safeguards employees’ right to report severe misconduct within the employer’s organizations and provides additional protection. ### Cooperation, colleges, and supervisory resources (EC12–EC13) - FI is an integrated supervisor responsible for both prudential and AML/CFT supervision; information from both types of supervision is normally used to inform the other. - Main mechanisms for cooperation with foreign supervisors include FATF and EBA and the EBA AML/CFT Colleges; FI is lead supervisor for five AML/CFT colleges for Sweden’s largest banks and a permanent member of about 60 colleges led by foreign supervisory authorities. - The colleges facilitate exchange of institution-specific information, coordination of supervisory activities, and can act as a forum for sharing information on actual and suspected criminal activities. - Sweden is a member of the Nordic-Baltic AML/CFT Working Group (NBWG) for cooperation among Nordic and Baltic financial supervisory authorities; NBWG meets several times each year. - A similar arrangement has been set up with the ECB. - FI has signed a cooperation agreement with the Swedish FIU (organized under the Swedish Police Authority) for exchange of information and coordination on a regular basis. - FI does not have the explicit responsibility to address criminal activities; the FIU (part of Swedish Police Authority) gathers reports/intelligence on suspicious activities and shares with law enforcement. - FI does not have dedicated in-house resources for addressing criminal activities but must report detected suspicious activities promptly to the FIU per Chapter 4, section 4 of the AML/CFT Act; reporting may occur within ongoing cooperation with the Swedish FIU or as SAR-reports. - FI’s AML/CFT department includes staff with expertise addressing criminal activities, including employees with backgrounds as a Judge in civil and criminal courts, Senior Public Prosecutor, Prosecutor and Forensic Accountant. ### Assessment of Principle 29 — Largely Compliant Findings supporting the assessment: - Laws and regulations establish duties, responsibilities and powers of FI regarding supervision and enforcement of AML/CFT laws and regulations. - FI has exercised powers, including issuing remarks and imposing significant fines for deficiencies in internal governance and AML processes. - Legal protection exists for persons reporting suspicious activities or responding to FIU/security services requests (no liability for breaching confidentiality where disclosure was reasonable). - FI has processes to determine adequacy of banks’ policies and processes to prevent use for ML/TF and to report such activities; assessors confirmed via review of a sample of FI investigations. Areas requiring improvement noted by assessors: - Supervision tools focus on inherent risks and could be improved to collect more granular information to fully assess ML/TF risks for the sector and individual banks. - Questionnaires ask for useful information but would benefit from facilitating collection of more detailed information (e.g., geographic exposure, volume or value of transactions or customers). - Limited information obtained on institutions’ control environments limits assessment of residual risk. - Correspondent banking relationships have not been a focus of more recent AML/CFT inspections; most recent inspections with that focus were concluded in 2015, followed up in 2016/17. - Based on FI information, number of correspondent banking relationships decreased from a total of 4114 relationships outside of the EEA and 1947 relations within the EEA in 2017 to 1901 and 1007 relationships respectively in 2020. - FI noted no red flag indicators in ongoing supervision or recent survey regarding correspondent banking but should consider addressing the area further. - Supervision of compliance with employee screening has been directed to other sectors than credit institutions. Other operational notes: - The questionnaire (AML periodic reporting) has been updated to address identified gaps and is expected to result in more targeted and effective supervision by FI going forward. - FI is lead supervisor for five AML/CFT colleges and a member of numerous other colleges; cooperation and information-sharing arrangements exist domestically and internationally and include a signed cooperation agreement with the Swedish FIU. - FI has specialist staff with backgrounds relevant to addressing criminal activities. - Banks are legally required to: (i) report incidents of fraud, where material, and suspicious activities; (ii) establish appropriate CDD policies and procedures; and (iii) implement appropriate control systems, including independent audit, designated compliance officer and adequate screening when hiring staff or consultants. *Source: IMF staff report text (excerpt).* ### 1. Responsibilities, ### 1. Responsibilities, objectives and powers ### Responsibilities, objectives and powers - LC: FI has multiple mandates which in the absence of clear policy on how to balance between them could result in conflict. - Need for clarity to ensure that the prudential or financial stability objective always takes priority over the other objectives, consumer protection and promotion of sustainable development. ### Independence, accountability, resourcing and legal protection for supervisors - MNC: FI is currently significantly under-resourced, which has impacted on some critical supervisory activities, e.g., supervision of IRB models, onsite inspections, review of quality of reported data, etc. - FI is underfunded and rarely receives the full amount of the funds that it requests from the government resulting in the need for constant reprioritization of work, and delays in improving data analysis tools. - Staff turnover at FI is significant (about 19 percent in 2021) and FI has also had challenges attracting and retaining senior model and cyber security experts. - There is no direct or explicit legal protection afforded to FI or its staff against liability for actions and omissions in discharging their duties in good faith. - The annuals letter of appropriation from the government, which outlines more specific objectives, assignments and reporting requirements for FI, could potentially compromise its effectiveness if the assignment were to become burdensome. ### Cooperation and collaboration - LC: FI has entered into cooperation agreements and MOUS with a number of domestic and foreign regulators. - FI’s involvement in joint onsite inspections with other foreign supervisors is limited. ### Permissible activities - LC: Permissible activities are clearly identified within the law and deposit taking is restricted to institutions that are licensed and supervised by FI. - The law does not explicitly restrict the use of derivatives of the word “bank.” However, it is stated in the preparatory work of BFBA that the derivatives of the word “bank” are also restricted. ### Licensing criteria - LC: The law clearly identifies FI as the authority responsible for licensing of banks in Sweden and empowers FI to set the criteria for licensing of banks. FI also has the power to revoke a license. - As senior management is not a legal body under Swedish Company Law, FI does not formally assess suitability all members of senior management; the scope of formal assessment is limited to board members and the managing director or their replacement. - The requirement to closely monitor and follow-up on new entrants is not documented in the supervisory processes nor does FI, where applicable, impose prudential conditions or limitations on the newly licensed banks. - Note: beside the requirement to start operating within one year of the time the license is granted. ### Transfer of significant ownership - LC: The law clearly defines significant ownership and requires consent from FI prior to acquisition of shares which would result in significant ownership or an increase in significant ownership. - Banks in Sweden are required to inform FI of the significant shareholders including the size of their holding on a yearly basis. - There is currently no specific legal obligation for credit institution to notify FI of any material information that may negatively affect suitability of a major shareholder. ### Major acquisitions - LC: The law and regulation clearly defines the acquisition and investments that banks need prior supervisory approval from FI. - FI has developed appropriate work procedures and templates to facilitate assessments. - The law provides FI with the means to take action to mitigate the risks that nonbank activities may pose to a banking group. - There is currently no Swedish law or regulation which clearly sets out specific criteria by which to judge individual proposals related to acquisition of investment that require prior approval; specific criteria are to be found in the preparatory work. ### Supervisory approach - LC: FI has a methodology for categorizing supervised banks based on their systemic importance to the Swedish financial system, used to inform the SREP cycle and other supervisory activities. - FI has adopted tools: SREP, thematic reviews, deep dives, regular risk reviews, and KRIs covering solvency, liquidity and balance sheets ratios. - The process for assessing resolvability of institutions is still evolving; FI and the resolution authority continue to refine processes including collaboration on resolution and recovery plans. - Limited consideration of risk profile in determining SREP frequency; frequency is predominantly driven by systemic importance of a bank. - Consistency in risk assessment and supervisory outcomes has been affected by lack of risk experts to support lead supervisors. - Need for enhanced supervisory attention on high-risk institutions including smaller ones (category 3 and 4) has not been fully formalized. - Exception: recently introduced list of selected institution for intensified frequent risk assessment. ### Supervisory techniques and tools - MNC: FI has adopted a risk-based approach where SREP focuses on large banks deemed to pose greatest risk to financial stability. - Annual examination program decided based on risk-based priorities and riskiness (informed by KRIs, SREP and other supervisory information). - Level of onsite inspection is generally inadequate: limited time spent onsite, which ranges between 3 to 4 days; actual supervisory work does not involve detailed and extensive testing of effectiveness of banks’ internal controls and risk management practices, and compliance with minimum standards. - Supervision of banks’ stress testing practices and IRB models do not involve: (i) detailed challenge of processes and assumptions, and (ii) deep-dive assessment of the methodologies including their implementation. - Reliance on banks’ internal quality controls and internal audit to ensure high-quality data and information. - Supervisory manuals (procedures) are not adequately detailed to ensure consistency in risk assessment and to facilitate training of new bank supervisors, key given high staff turnover. ### Supervisory reporting - LC: FI does not carry out regular targeted onsite examination to assess how data reported by banks are validated. - FI does not have an explicit requirement for credit institutions senior management to certify the accuracy of the supervisory returns. ### Corrective and sanctioning powers of supervisors - LC: As senior management is not a legal body under Swedish Company Law, FI does not have the power to remove all members of senior management but only the members of the board and managing director. - There are instances where banks were not explicitly required to provide periodical progress reports on their implementation of remedial actions. ### Consolidated supervision - LC: Limited participation by FI in joint onsite inspections with other supervisory authorities due to resource constraints. - FI does not formally evaluate the effectiveness of supervision conducted in host countries where Swedish banks have material operations; such assessments are done by the EBA on an annual basis. ### Home-host relationships - C: FI is involved in 18 supervisory colleges (excluding AML colleges), chairing eight of them including the colleges for the three largest banks in Sweden. - FI is a member of more than 50 AML colleges. - Supervisory colleges are the primary channel for exchanging information and are governed by WCCA in accordance with the EU standards. - FI has entered into MOUs including the Nordic MOU on supervision of significant branches and MOUs with supervisory authorities from the UK, US, and China. ### Corporate governance - LC: “Senior management” is not a legal body under Swedish Company Law. Responsibilities relating to management activities are held by the board of directors or the managing directors according to FI’s regulation. - FI regulation’s definition of senior management does not entail management function responsibilities for others than the board of directors and the managing director. - FI does not assess selection process or succession plans for the members of the management body. - Governance experts have been recently reallocated to other areas within banking supervision, which may make it difficult for FI to perform thematic governance reviews and investigations in the future. ### Risk management process - MNC: FI does not test/verify the adequacy of banks’ risk management processes and procedures due to limited onsite inspections. - FI has not always been able to identify issues in a timely and comprehensive manner; cannot always go deep into assessment details. - Banks’ internal stress testing is assessed under SREP from a high-level perspective and assessments do not fully consider expectation of BCBS stress testing principles. - FI has not required changes to banks’ internal stress testing nor performed deep-dive investigations or onsite engagement with banks on stress testing. - Assessment methods (“handbook”) are too high level, do not clarify supervisor assessment of particular items and do not make direct reference to relevant provisions of EBA guidelines. ### Capital adequacy - MNC: In implementing CRR, Sweden does not make use of all discretions available and approach is more aligned with the Basel framework; criticisms in the EU RCAP still hold, though not considered material. - Sweden has adopted a conservative approach requiring additional capital (P2R and P2G add-ons). - Evidence of supervisory measures other than additional capital is limited. - FI has not shown capacity to evaluate banks’ internal assessment processes nor to approve IRB models (or material changes) in an effective and timely manner. - Review of IRB model performance is currently focused on high level monitoring of model performance and governance; detailed testing including onsite examination is not carried out. - Evidence of material issues in IRB models: when corrected led to a 65% increase in credit risk RWA; captured during EBA benchmarking exercise used as part of regular supervisory process. ### Credit risk - LC: FI has issued regulations on management of credit risks and on consumer credit since the last FSAP. - No specific requirement that big, complex or especially risky exposures be decided by the bank’s board or senior management. - Lack of information to allow monitoring of total indebtedness of consumers. - Credit risk handbook is not adequately detailed and does not make direct references to EBA Guidelines on loan origination and monitoring. - Due to lack of intrusiveness, FI has been unable to fully evidence a supervisory process meeting BCP expectations for credit risk supervision. - Note: The government has appointed a public inquiry to look at consumer indebtedness; conclusion will be presented in May 2023. ### Problem assets, provisions, and reserves - LC: FI reviews banks’ policies and processes for grading and classifying assets as part of regular SREP. - Due to resource constraints, supervisors do not regularly review credit files and therefore cannot challenge banks’ classification of exposures and adequacy of provisions. - FI assesses major changes in classification and remarks by internal or external auditors to prioritize work. - FI uses sampling of loans when assessing portfolio credit quality; assessment normally covers as a minimum the 25 largest exposures (from different perspectives) and focuses on its evolution, not the classification itself. ### Concentration risk and large exposure limits - LC: The CRR sets the large exposures regime and determines limits for banks. - Framework is broadly aligned with Basel with some exceptions related to parent or subsidiaries, institutions within EEA and covered bonds; potential consequences of deviations are not clearly monitored by FI. - FI supervisors do not regularly review credit files and therefore do not routinely verify definition of “group of connected counterparties” adopted by banks. - FI has imposed P2R for concentration risk, which considers name, industry and geographic concentration. - Banks’ internal stress testing are assessed at high level and do not clearly take into account significant concentration risks. - EBA/Rep/2022/16 analyzes European banks use of exemptions from large exposure limits and quantifies impact of potential removal of individual exemptions. ### Transactions with related parties - LC: Swedish law has specific provisions on related parties that curtails conflict of interest and FI has included additional specific provisions on related parties in its credit risk regulation. - No clear and specific power for FI to: (i) impose limits on exposures to related parties; (ii) deduct such exposures from capital when assessing capital adequacy; or (iii) require collateralization of such exposures. - Issues with reporting on aggregated related-party transactions to FI. ### Country and transfer risks - NC: Country and transfer risks are considered an element within credit risk. - Definition of country and transfer risk is in line with the BCP definition, though it does not clearly list important socio-political changes and largely unpredictable events. - Assessors were not provided evidence that supervisors follow an ultimate risk approach. - Supervisory processes do not cover requirements related to country and transfer risk; ICAAP reports and SREP assessments have not evidenced the supervisory approach. ### Market risk - LC: Sweden has not implemented any banking law or supporting regulation that specifically addresses market risk from a risk management perspective; FI finds applicable parts of general national banking laws and supporting regulations and guidelines sufficient. - Number of onsite inspections is inadequate: only six onsite inspections related to market risk in the last five years. - FI relies on second line of defense to monitor banks’ internal trading limits; absence of close monitoring could lead to material breaches not being reported promptly. ### Interest rate risk in the banking book (IRRBB) - LC: Sweden has not implemented any banking law or supporting regulation that specifically addresses IRRBB yet as Sweden is following the EU plan for regulation in this area; EBA Guidelines on management of interest rate risk arising from non-trading activities is applicable. - Sweden has implemented a P2R methodology for IRRBB based on a standardized stress test, used to determine the P2R. - As part of quarterly risk reviews, banks are required to submit granular reports on exposure to IRRBB. - There has been no inspection aimed at IRRBB in the last five years, except for a CSRBB inspection in 2017/2018 in eight banks; there is over-reliance on reports analysis. ### Liquidity risk - LC: LCR and NSFR have been implemented as binding liquidity requirements in Sweden. - The LCR requirement is not fully aligned with the Basel standard; deviation concerning covered bonds in the HQLA definition (covered bonds to Swedish issuers restricted to a maximum of 50 percent of the total liquidity reserve and other issuers to 70 percent). - BCBS disclosure standards are based on daily observations when calculating average LCR values, while in EU and Sweden it is based on the simple average of month-end observations over the 12 months preceding the end of each quarter. - FI has introduced LCR of 100 percent for EU and USD and 75 percent for other significant currencies, including SEK, as P2R. - FI has created an automated Liquidity Risk Dashboard providing a dynamic and graphical view of various Liquidity Key Risk Indicators. ### Operational risk - LC: FI has focused on cyber risks, outsourcing and third-party risk during the last five years, in addition to business continuity plans. - Lack of clarity in definition of significant agreements/outsourcing; no requirement for undertakings to inform changes or terminations of contracts. - Due to lack of a database to collect information on outsourcing providers, FI is unable to identify common points of exposure to operational risk or potential vulnerabilities. ### Internal control and audit - C: FI’s regulations and EBA guidelines provide a comprehensive set of requirements and supervisory expectations for internal control framework of credit institutions, reinforced through the SREP process. - FI does not engage with back-office personnel, nor assess their expertise or authority. ### Financial reporting and external audit - LC: IFRS 9 was fully implemented in Sweden in 2018 and both listed and non-listed banking groups are required to apply IFRS. - FI has ultimate responsibility for supervision regarding accounting including disclosures in listed banks’ financial statements; supervision has been delegated to the Council for Swedish Financial Reporting Supervision. - FI does not have direct powers to reject or rescind the appointment of an external auditor; nor to access external auditors’ working paper. - FI has formal possibilities to initiate the removal of an external auditor by either reporting to the competent authority or by filing for removal through the district court. - FI does not have the power to establish the scope of external audits nor to determine its coverage; scope and coverage are established in regulations and guidelines issued by relevant organizations. *Source: 1sweea2023008 - 1. Responsibilities,* ### 28. Disclosure and ### 28. Disclosure and transparency; 29. Abuse of financial services; Recommended Actions and Authorities’ Comments ### Disclosure and transparency (Section 28) - LC: Disclosure standards are generally sound and promote transparency, reflecting the substance of the BCBS standards. - FI has, in some instances, requested Pillar 3 adjustments following inspections related to other themes, but disclosure is not an area where FI’s supervision has focused on. - Banks do not disclose related-party exposures or transactions as part of the Pillar 3 disclosures. - Disclosures are more often provided using end-of-period values. - FI uses intra-period information, in particular for market and liquidity risk, but this information is mostly gathered from financial reporting. ### Abuse of financial services (Section 29) - LC: There are laws and regulations in place which establishes duties, responsibilities and powers of FI in relation to supervision and enforcement of laws and regulation on criminal activities. - There has been general improvement in the quality of supervision of AML/CFT and supervision is now broadly more intrusive than in the past. - There is, however, room for improvement related to granularity of information and adequacy of the process for ensuring that supervision of ML/TF risks is well targeted. - Correspondent banking relationships have not been a focus of the more recent AML/CFT inspections and FI has also not conducted specific inspection on compliance with employee screening in credit institutions. ### Recommended Actions to Improve Compliance with the Basel Core Principles and the Effectiveness of Regulatory and Supervisory Frameworks - Principle 1 - Explore if FI should consider further how it address any conflict between its multiple mandates if this was to arise and how to ensure that the mandate of ensuring safe and sound banks and banking system always takes priority over or is well complemented by the other objectives, i.e., consumer protection and sustainable development. - Principle 2 - MoF should consider further increase in funding to FI to ensure that it is adequately resourced to effectively supervise banks and the banking system. - The authorities should explore a range of solutions to reduce on the uncertainty created due to dependence on the state for financing. For example, a medium-term plan to increase financing supported by government’s public commitment to fund the plan. - FI should further develop its strategy for attracting and retaining staff including those with specialized skills that is anchored on competitive salaries that is benchmarked to those in the private sector in Sweden. - FI should explore the use of independent external experts for some specific supervisory tasks, to address temporary staff shortage especially in highly specialized areas where there are challenges recruiting staff. - FI should consider conducting salary surveys to compare FI salary levels with those in the financial industry to help inform the staff retention strategy and assessment of additional financing that it would require. - MoF should further consider the need to establish explicit legal protection for FI and its staff in line with the expectation of BCPs. - Principle 3 - Increase FI’s involvement in joint onsite inspections in Swedish banking groups with other foreign supervisors including the ECB once the issue of resource constraint has been adequately addressed. - Principle 5 - The FI should be granted the legal powers to assess fitness and propriety of all members of senior management and not just the board member and the managing director. - FI should develop and implemented a formal policy on close monitoring of newly license entities and this should be appropriately captured through, for example, clarification of drivers of SREP cycle and review of policy on onsite inspections of newly licensed banks. - Principle 6 - Create an explicit obligation for firms to notify FI as soon as they become aware of any material information that may negatively affect the suitability of a major shareholder or a party that has a controlling interest. - Principle 7 - To further consider the possibility of amending the laws or developing new regulations to provide precise criteria by which to judge individual proposals for major acquisitions or investment by a bank that are submitted to FI for approval. The aim should be to further clarify and embed the approach to assessment. - Principle 8 - Formalize an increased attention on high-risk institutions including those in categories 3 and 4. This include ensuring that, beside systemic importance, the SREP cycle is also informed by the risk profile of an institution. To facilitate this, FI could consider introducing a list of objective criteria to be used to identify institutions that would require a higher frequency of SREP. - Put in place measures to continually ensure consistency in the approach to assessment of risks and formulation of supervisory outcome, which could include more detailed guidance for supervisors, use of risk experts to support the lead examiners, etc. - The authorities should continue to enhance the process for assessment of resolvability of institutions while taking into account the relevant standard and guidelines including those issued by the EBA. - FI should consider developing new and enhancing the existing risk monitoring tools and dashboards to further improve the tracking of risks, i.e., tools similar to one that has been established for liquidity risk could be developed for other risks. - Principle 9 - Enhance the intrusiveness of supervision through: (i) more comprehensive onsite inspection exercises; (ii) implementation of a robust process for ongoing assessment of the performance of IRB models (PDs and LGDs); and (iii) improvement in the supervision of banks’ stress testing processes. - Ensure that the lead supervisors are supported by risk experts to facilitate in-depth reviews and detailed supervisory findings to help formulate corrective actions that addresses the root cause of issues at the banks. - Developed more detailed supervisory manual(s) to help ensure consistency in assessment of risks and formulation of supervisory actions for banks. - Consider developing and deploying additional risk monitoring tools and dashboard for facilitate the tracking of risks similar to one that has already been established for liquidity risk. - Principle 10 - Undertake regular risk-based onsite inspection exercises to assess: the quality of data reported by banks, adequacy of banks’ reconciliation and data quality assurance process, effectiveness of the three lines of defense in relation to regulatory reporting process, whether banks are in compliance with BCBS 239, etc. - FI should also consider introducing explicit requirement for credit institution senior management to certify the accuracy of the supervisory returns. That is, the senior management responsible that is responsible for the accuracy of supervisory returns. - The authorities should also explore the possibility of requiring the independent external auditors to provide an opinion on the accuracy of supervisory reporting. - Principle 11 - Require attestation by the internal audit function that supervisory recommendation have been satisfactorily addressed. This may be done from time to time to verify the implementation of certain important recommendations in case of significant corrective actions. - Explore the possibility of amending the law to grant FI with the power to remove all member of senior management and not just the managing director (and members of the board). - Principle 12 - Increase participation of FI supervisors in joint inspections with other supervisors of subsidiaries of Swedish banks. Besides enhancing supervisory outcome, this will also facilitate sharing of experience and knowledge on supervisory techniques between FI’s supervisors and other supervisors of Swedish banking groups such as the ECB. - Principle 13 - No recommendations - Principle 14 - Allocate more resources to governance supervision. - Perform more thematic reviews on governance. - Review FI’s governance chapter of the handbook in order to align with new EBA guidelines (EBA/GL/2021/05). - Establish a formal pre-approve process for board members, since FI already performs an unofficial pre-approval process when assessing suitability. - Principle 15 - Increase intrusiveness of supervision by focusing on assessing the quality of implementation of regulation and of internal risk management processes and procedures. - Update regulation/guidelines on risk management to clarify reporting of exceptions and limit breaches inside the institutions and that reputational risk should be assessed by institutions. - Expand the dashboard to cover other specific risks (other than liquidity) to increase offsite monitoring power. - Elaborate risk reports for supervisors based on the dashboard monitoring. - Perform a comprehensive review of the handbook based on a two-step approach. That is: (i) introduce changes to increase precision in the methods so as to achieve consistency and facilitate supervisors’ assessment; and (ii) enhance comprehensiveness and depth of the manual to increase the level of intrusiveness of supervision. - FI should also: (i) incorporate EBA guidelines on stress testing in a dedicated chapter of the handbook; and (ii) perform a thematic review/deep-dive investigation on banks’ internal stress testing practices and adherence to EBA guidelines. - Principle 16 - Enhance IRB model review in line with EBA guidelines. - FI should, where possible, promote alignment with international standards during policy discussions in European forum. - FI should explore possible ways of addressing the risk of understatement of RWAs as a result of any identified weaknesses the regulatory approved models, especially in the interim while banks are redeveloping or making the required changes to the models. - Principle 17 - Include in regulation requirement that exposures that are especially risky or otherwise not in line with the mainstream of the bank’s activities or major credit risk exposures exceeding a certain amount or percentage of the bank’s capital are to be decided by the bank’s Board or senior management. In the absence of regulation, it is important supervisors assess if banks processes are robust, otherwise self-regulation cannot be relied upon. - Incorporate reference to the EBA guidelines on loan origination and monitoring into FI’s handbook more clearly. - Perform institution specific “light” deep dives, that are not so time consuming, but enhances the supervisory process, and that could be more frequent and include a larger sample of banks than the current deep-dives. - Principle 18 - Perform a one-off across the board thematic review of classification and provision followed by regular onsite inspection including credit file reviews. - Include a representative sample covering different credit modalities when assessing portfolio credit quality, which should be specified in the handbook. Further, onsite inspection on credit risk should include a review of loans. - Principle 19 - FI should perform a thematic review to assess the definition of “group of connected counterparties” or ensure that appropriate checks are included in regular onsite inspections. - Principle 20 - FI should be granted clear and specific power to impose limits for exposures to related parties, to deduct such exposures from capital when assessing capital adequacy, or to require collateralization of such exposures. - Principle 21 - FI should develop a supervisory process to address country and transfer risk. - Principle 22 - Once FRTB is implemented in Sweden, it would be important to perform a deep-dive investigation to assess compliance with the regulation and the boundary between the trading and banking book. - Enhance supervisory reporting of limit breaches and assess the adequacy of banks’ internal reporting. - Principle 23 - Deep-dive inspection should be performed to enhance the assessment of compliance with principles of the Basel standard on IRRBB and to analyze the impact of changes in Swedish interest rate. - Principle 24 - Promote alignment with international standards during policy discussions in European forum. - Dashboard functionalities should be further enhanced to facilitate more effective offsite monitoring. - Standardized liquidity reports should be developed based on dashboard analysis and sent out to supervisors. - Principle 25 - Amend regulation or guidelines to clarify on the interpretation of significant agreements/outsourcing and to require undertakings to inform FI of changes to or terminations of outsourcing arrangements. - Create database on outsourcing providers for financial institutions. - Principle 26 - FI should engage with back-office personnel and assess their expertise or authority, in particular because of FI’s excessive reliance on control functions in its own supervisory process. - Principle 27 - FI should be granted clear powers to reject and rescind the appointment of an external auditor. - Principle 28 - Rules should be amended to require banks to disclose related-party exposures or transactions as part of their Pillar 3 disclosures. - Increase disclosure of average ratios in addition to end-of period for certain ratios. - Principle 29 - FI should carry out detailed assessment on whether the areas of correspondent banking relationships and procedures for employee screening constitute a higher level of ML/TF risk. - Depending on the outcome of such assessment, FI should consider improving its supervisory oversight over correspondent banking relationship and banks’ processes and procedures for screening of employees while taking into account its risk-based approach to supervision. - FI should further enhance the process aimed at deepening understanding of the ML and TF risks in the supervised entities. ### Authorities’ Response to the Assessment - The authorities welcome the IMF’s acknowledgement of Sweden’s continued progress in strengthening banking regulation and supervision since the last FSAP in 2016, and recognize the importance of ensuring that regulatory framework and supervisory capacity is continually enhanced to keep pace with the evolving financial landscape. - The authorities appreciate the IMF for the extensive work and productive engagement during the FSAP which resulting in this Detailed Assessment Report (DAR), and important analysis and valuable recommendations on how to further improve the effectiveness of banking supervision in Sweden. - The authorities broadly agree with the FSAP assessment and recommendations on how to address the identified gaps including, amongst others, the need to further optimize on existing supervisory processes and tools. - The authorities take note of the IMF’s assessment regarding the need to further increase the intrusiveness in the supervision and can confirm that, through the risk based approached used, FI continuously aim at achieving intrusive outcome regardless of which type of supervisory activity used. - The authorities would also like to mention that measures have already been taken to reduce gaps identified, for example within IRB model supervision. *IMF — Detailed Assessment Report excerpts (Disclosure and transparency; Abuse of financial services; Recommended Actions; Authorities’ Response).* --- _Source: https://www.imf.org/-/media/files/publications/cr/2023/english/1sweea2023008.pdf_