## INTRODUCTION AND METHODOLOGY (1eurea2025012) ## Source details **Canonical URL:** [INTRODUCTION AND METHODOLOGY (1eurea2025012)](https://www.imf.org/-/media/files/publications/cr/2025/english/1eurea2025012.pdf) ## Other formats - [Markdown version](/-/media/files/publications/cr/2025/english/1eurea2025012.pdf.md) - [Structured JSON version](/-/media/files/publications/cr/2025/english/1eurea2025012.pdf.json) --- ### Scope, methodology, and context - The Single Supervisory Mechanism (SSM) — comprising the European Central Bank (ECB) and national competent authorities (NCAs) — is exclusively responsible for prudential supervision of credit institutions established in participating EU member states; the SSM became operational in 2014. - Assessment unit covers institutional and market structure; preconditions for effective banking supervision; detailed assessment (Supervisory Powers, Prudential Regulations); summary of compliance with the Basel Core Principles (BCP); recommended actions and authorities’ comments. - Assessment completed as part of the FSAP mission during November 2024 and February 2025 and reflects the framework in place as of February 2025; ECB requested assessment against the Revised BCP Methodology (April 2024) and chose to be assessed against both essential criteria and additional criteria using a five-part qualitative rating system. - Methodology highlights harmonization efforts, use of experts’ networks, evaluation of supervisory tools and processes (SREP, enforcement, fit and proper assessments, internal model approvals). *Source: INTRODUCTION AND METHODOLOGY, EURO AREA — INTERNATIONAL MONETARY FUND* ### High-level summary of main findings - 1. SSM has significantly strengthened supervision since the last FSAP; described as a highly capable, intrusive supervisor with excellent risk analysis and robust skills; on average, euro area banks maintain solid capital and liquidity positions, well above regulatory requirements. - 2. Legal and operational challenges persist: resource stretch (ICT risk, internal model approvals), dependency on NCA staff (more than half NCAs not meeting staffing commitments), complex governance, national transpositions causing fragmentation. - 3. Adoption of the banking package — CRR 3 and CRD 6 — is a major milestone; however, deviations from Basel persist, CRR 3 introduced permanent and temporary deviations, and FRTB implementation was postponed. - 4. Need for more risk-based, proportionate, and impactful supervision: SREP codification creates standardization; initiatives to simplify SREP and implement a risk tolerance framework are early-stage. - 5. ECB leads incorporation of climate-related financial risks into supervision (climate stress tests, binding supervisory decisions, potential imposition of periodic penalty payments (PPP)); supervisory focus on traditional risks should be maintained amid budget stabilization. --- ### Institutional and market structure — overview and key statistics - ECB as supranational supervisor enforces prudential regulations but does not set them. - Banks categorized as Significant Institutions (SIs) or Less Significant Institutions (LSIs); supervisory coverage: - SSM directly supervises SIs comprising "114 banking groups, including 7 G-SIBs, altogether which cover more than 80 percent of euro area banking assets." - NCAs supervise around "2,000" LSIs under ECB oversight. - At a different reference: "ECB supervises directly 113 banking groups in 21 member states (August 2024)." - Banking Union elements: SSM (supervision) and SRM (resolution) operational; European Deposit Insurance Scheme (EDIS) not implemented. --- ### SUPERVISORY GOVERNANCE, RESOURCES, AND INDEPENDENCE ### Governance, decision-making and delegation - Decisions prepared by an independent Supervisory Board and submitted to the Governing Council mainly under the “non-objection procedure” (up to ten days for objections on monetary policy grounds). - Delegation: certain supervisory decisions delegated to Senior Managers of ECB Banking Supervision; "over half of supervisory decisions now taken by delegation" though nearly half remain adopted by Supervisory Board written procedures. - Separation principle: organizational separation between supervisory and monetary policy staff; Vice‑Chair is an Executive Board member (exception). ### Resourcing and budgetary arrangements - ECB banking supervision funded by fees on supervised entities; annual budget allocations constrained by ECB internal budget discipline; Governing Council decision to not increase headcount from 2023 for central banking and supervisory arms constrained hiring. - NCAs supply substantial human resources: NCAs provide "more than 85 percent of heads of mission and team members for on-site inspections"; more than half NCAs have not met staffing commitments for offsite supervisory activities. - Headcount and training: - "50 FTE permanent SSM headcount pool established in 2019." - Number of banking supervisors trained rose from "roughly 1,200 in 2016 to 11,000 in 2024." - Technology and SupTech: IMAS platform, SSM Tech Strategy 2024-2028 approved; ongoing upgrades needed. ### Independence, accountability and legal protections - Operational independence prescribed by SSMR; ECB reports to European Parliament and Council; annual reporting obligations and public engagement noted. - Legal protection: ECB enjoys privileges and immunities under Protocol (No 7); applicants for damages must prove a “sufficiently serious” violation; actions for damages in supervisory context dismissed to date. - Recommendation: further delegate decision-making, improve governance of budgetary processes, ensure legal-cost protection for staff and consideration for external contractors. --- ### LICENSING, ENTRY, OWNERSHIP CHANGES, AND THIRD-COUNTRY BRANCHES ### Licensing and authorization framework - EU legal framework (CRD/CRR, Commission Delegated Regulation 2022/2580, RTS/ITS) sets minimum licensing criteria; NCAs are entry points preparing proposals, ECB decides for SIs. - Key licensing metrics (last 5 years): - "146 license applications received; 23 withdrawn or cancelled." - "40 SIs and 48 LSIs’ licenses were revoked, withdrawn or surrendered." - ECB approvals for financial holding companies (FHCs) in last 5 years: "49 notified to ECB, of which 21 requests for approval and 28 requests for exemptions." - Minimum initial capital: "EUR 5 million" (CRD); member states may authorize categories with initial capital not less than "EUR 1 million" (banks licensed before 1979 exceptions noted). - Fit-and-proper and application requirements: - Applicants must submit a three-year program of operations (base case and stress scenario) and financial projections for first three years; ECB Guide to Fit and Proper Assessments published. ### Third-country branches and supervisory gaps - ECB does not have mandate to authorize/supervise euro area branches of non-EU/EEA banks; such branches supervised by NCAs unless converted into subsidiaries (they will be supervised by ECB if they qualify as SIs). - Limited EU/EA aggregated information on third-country branches; last EBA mapping in 2021. - CRD 6 will improve regulation and supervision of third-country branches (Class 1/Class 2 branch categorization; CRD 6 thresholds referenced: "EUR 40 billion", "EUR 10 billion"), but branches largely remain NCA-authorized and supervised; process to require subsidiarization led by NCAs with no ECB influence. ### Ownership changes, qualifying holdings and major acquisitions - Definitions and activity: - 'Qualifying holding' = "10 percent" or more of capital or votes or ability to exercise significant influence; between 2019 and 2023 "479 qualifying holding procedures were completed." - ECB empowered to assess changes to ownership/controlling structures but must sometimes rely on national law (reporting requirements and remedies inconsistent across member states). - CRD 6 introduces "material holding" concept (holding ≥ "15 percent" of eligible capital) and harmonizes notification/assessment for material holdings, but transposition and RTS/ITS implementation pending. - Assessment: gaps in acquirer-side powers for acquisitions of non-banks and non-EU banks; until full CRD 6 transposition, Principle 7 rated "Materially Non-Compliant." --- ### SUPERVISORY FRAMEWORK, SREP AND TOOLS ### SREP structure and execution - SREP follows EBA Guidelines across four elements: Business Model Analysis; Internal Governance and Risk Management; Assessment of risks to capital by risk type; Assessment of risks to liquidity by risk type. - SREP three-phase assessment: data gathering (Phase 1), automated preliminary anchoring score (Phase 2), thorough supervisory assessment with judgement (Phase 3). - Observed patterns: - Framework fully articulated with comprehensive guidance; resource-intensive and near-continuous process. - SREP scores described as "sticky" with limited differentiation across institutions; mean of distribution increasing; standard deviation reducing. - Multi-Year Approach aims to reduce SREP timeline to "9 months" and shift supervisory dialogue to June/July from September; optionality in review periodicity introduced. ### Supervisory techniques and on-site/off-site mix - SSM uses extensive toolkit: on-site inspections, thematic reviews, horizontal benchmarking, internal model inspections (IMIs), automated analytics, target campaigns. - On-site statistics: in last 5 years ECB performed "90 onsite inspections and 28 internal model inspections (IMIs)" outside the euro area. - Challenges: overlaps between horizontal reviews and on-site inspections; inspection cancellations due to resource constraints. ### Findings, follow-up, escalation and remediation - Comprehensive approach generates many findings; stock of open measures grew (more issues opened than closed in 2023). - ECB introduced an "SSM Playbook on Supervisory Findings and Actions Effectiveness" and escalation framework; Help Desks and horizontal support teams created (examples: climate, RDARR, management bodies). - Use of enforcement tools (periodic penalty payments (PPPs), fines) has increased in early-stage thematic application (climate-related, RDARR), but enforcement tools otherwise "rarely been used." - Recommendation: specify expectations more clearly in SREP letters, make remediation follow-up more effective, and use capital add-ons for sovereign concentration risks more systematically. --- ### SUPERVISORY REPORTING, DATA COLLECTION, AND INTEGRATED REPORTING ### Reporting framework and limits - Harmonized EBA ITS reporting (FINREP/COREP) is primary reporting backbone; ECB may collect additional data via Article 10 SSMR and Short-Term Exercises (STE). - Constraints: - ECB cannot collect additional data where ITS covers the area in a different format or breakdown. - STEs are less standardized than ITS and may yield lower data quality. - Revising ITS/amendments is lengthy (preparation ~9 months + implementation 6–12 months typical). - CNTRL projects: - Integrated Reporting Framework (IReF) and Article 430c CRR2 mandate envisaged; implementation delayed (medium-term). - IReF aims to define a common data dictionary; expected to reduce need for ad-hoc data requests. ### Data governance, quality and supervisory uses - ECB requires directly supervised institutions to underwrite a "Management Report on Data Governance and Data Quality" (since 2023). - AnaCredit, securities holdings statistics and other granular datasets enhance supervisory capabilities. - Data gaps: lack of intraday liquidity reporting harmonized at EU level; related-party reporting lacks granularity and uses narrower definition (IAS 24) than Basel CP 20. --- ### PRUDENTIAL STANDARDS, CAPITAL ADEQUACY, AND INTERNAL MODELS ### Banking package (CRR 3 and CRD 6) and capital framework - Adoption of CRR 3 and CRD 6 is a major milestone; CRR 3 (including output floor) in effect since "January 2025." - Deviations and impacts: - Existing deviations from Basel (Danish compromise, SME supporting factor, CVA scope) remain; new deviations introduced in CRR 3. - FRTB implementation postponed by one year. - EBA methodology for O-SII designation exists, but no harmonized EU calibration for O-SII buffers; heterogeneity persists. - EBA analysis: overall increase in Tier 1 Minimum Required Capital (T1 MRC) under Pillar 1 reduced by "4.4 percentage points (p.p.)" relative to faithful Basel III; ECB analysis: deviation impact reduces CET1 MRC increase by "more than 12 p.p." for SIs in the euro area. ### Internal models, model validation, and resource constraints - Internal models widely used by SIs; ECB approves internal models under Article 9(1) SSMR. - IMIs and model change approvals have been predominantly reactive; ECB faces significant resource constraints in internal model validation and JST follow-up; IMI staffing insufficient relative to needs. - CRR allows permanent use of standardized approach for material sovereign exposures alongside IRB within the same exposure class (supervisory permission), potentially enabling cherry picking (non-compliant with Basel). ### Capital adequacy supervisory powers and ratings - CRR Pillar 1 minima: Common Equity Tier 1 "[4.5 percent]", Tier 1 "[6 percent]", total capital "[8 percent]". - Supervisory powers: - ECB empowered to require additional own funds (Pillar 2R), restrict operations, require divestment, impose specific provisioning policies (within accounting limits), and apply capital adjustments where accounting is imprudent. - Assessment: Principle 16 rated "Materially Non‑Compliant" due to material EU-specific deviations from Basel standards, heterogeneity in O-SII calibration, and resource constraints on internal model validation. --- ### RISK AREAS: CREDIT, CONCENTRATION, MARKET, IRRBB, LIQUIDITY, OPERATIONAL ### Credit risk, problem assets and provisioning - Framework: CRD/CRR and EBA guidance underpin credit risk supervision; AnaCredit and securities-holding statistics improved granularity. - NPLs reduced through supervisory effort; SSM cannot unilaterally impose reclassification to NPL or force specific accounting provisions beyond accounting framework; P2R add-on available but limited in observed use. - Recommendation: consider portfolio-level provisioning quantification and large-scale asset-quality review (AQR)-style exercises with resource planning. ### Concentration risk and sovereign exposures - EBA SREP Guidelines define concentration risks; no EU-wide supervisory guidelines requiring all material concentrations be regularly reviewed and reported to bank boards. - Pillar 2 assessments do not systematically include sovereign concentration; capital add-ons for high sovereign concentration risks are rarely used and imposed only in a few instances. ### Related party transactions - EU framework for related party transactions not comprehensive or consistent with Basel; definitions narrower (CRD/IAS 24) and no EU-wide regulatory limits or harmonized thresholds. - Assessment: Principle 20 rated "Materially Non‑Compliant." Recommendation: EU-level adoption of comprehensive related‑party definitions, materiality thresholds, and reporting requirements. ### Market risk and IRRBB - Market risk: EU framework fully articulated; emphasis on valuation, prudent valuation (AVA), on-site valuation campaigns; Principle 22 rated "Compliant." FRTB postponement noted. - IRRBB: robust legal/guidance framework (EBA Guidelines updates, SOT RTS effective May 2024); supervisory emphasis and new reporting (first reference date September 30, 2024); Principle 23 rated "Compliant." ### Liquidity risk and contingency funding - CRR/CRD implement Basel LCR and NSFR at Level 1/2; LCR minimum 100 percent effective since 2018; NSFR requirement effective from June 2021. - ECB response to 2023 liquidity stresses included weekly reporting activation; supervisory recommendations include prioritizing remediation of contingency funding issues and simulated events for depositor-behaviour shocks. - Principle 24 rated "Largely Compliant." ### Operational risk and resilience (including DORA) - Substantial progress since last FSAP; DORA and CRR 3 deepen supervisory requirements for ICT and operational resilience. - CRR 3 in force "January 1, 2025"; DORA live reporting delayed to May 2025; DORA data expected to feed SSM SREP in "2026." - Cyber Resilience Stress Test 2024 involved "109 banks" with "28" in more extensive testing. - Principle 25 rated "Largely Compliant" with implementation and resourcing challenges. --- ### ENFORCEMENT, SANCTIONS, EARLY INTERVENTION AND REMEDIES ### Corrective and sanctioning powers — structure and limits - ECB can directly impose administrative pecuniary penalties for breaches of directly applicable Union law; penalties can be "twice the amount of profits gained or losses avoided" or "up to 10 percent of total annual turnover in the preceding business year." - For breaches of national law transposing Directives, breaches by natural persons, or when non-pecuniary penalties required, ECB must request the relevant NCA to open national sanctioning proceedings. - CRD 6 enlarges list of sanctionable breaches and introduces PPPs; PPPs upper limit: "5 percent of the average daily turnover per day of infringement" for a maximum period of "six months." - Publication and statistics (2023 Report): - "a total of 168 administrative penalties were imposed by the end of the year;" - "Pecuniary penalties accounted for 53 percent of those, with fines totaling around EUR 25.1 million." - "The highest pecuniary penalty was EUR 6.8 million imposed on an SI." - Additional pecuniary penalty examples in national contexts: "1.5 million for a less significant institution (LSI); EUR 0.23 million for a legal person other than an SI or an LSI; and EUR 0.07 million for a natural person." - Assessment: Principle 11 rated "Largely Compliant"; limitations and fragmentation remain due to national transpositions. ### Early intervention, escalation and enforcement practice - ECB uses moral suasion (informal dialogue) and formal binding supervisory measures requiring Supervisory Board and Governing Council decisions. - Escalation framework and Playbook in place to expedite internal processes and facilitate use of tools ranging from moral suasion through PPPs. - Average length of enforcement proceedings has started to come down; ECB more willing to take on legal risk and escalate enforcement (notably climate-related and RDARR areas). --- ### CONSOLIDATED, CROSS-BORDER SUPERVISION AND COOPERATION ### Consolidated and cross-sector supervision - ECB conducts supervision at consolidated, sub-consolidated and solo levels; JSTs coordinate day-to-day work (ECB coordinator + NCA staff). - ECB is coordinator for "28 financial conglomerates, five of them containing a G-SIB." - FICOD supplementary supervision applied; limited examples of joint onsite work with insurance supervisors. ### Home-host relationships, colleges and third-country cooperation - Colleges of supervisors, Written Coordination and Cooperation Arrangements (WCCAs) and MoUs underpin cross-border cooperation; ECB participates in "47 supervisory colleges" and has published ~30 MoUs on ECB Banking Supervision website. - Third-country cooperation: MoUs with many authorities; negotiations with PRC authorities pending; BRRD/SRB cooperation mechanisms in place for resolution. - Assessment: Principle 13 rated "Compliant"; cooperation network extensive but opportunities remain for more joint inspections and improved information flows. --- ### CORPORATE GOVERNANCE, FIT‑AND‑PROPER, AND CONTROL FUNCTIONS ### Governance and fit-and-proper regime - ECB strengthened governance supervision; CRD/CRR and EBA Guidelines underpin expectations; ECB published Guide to Fit and Proper Assessments and practical manual. - Fit-and-proper outcomes (2023): - "47 conditions, 179 obligations and 21 recommendations." - "Decisions containing an ancillary provision decreased from 32 percent of all decisions in 2022 to 9.5 percent in 2023." - "10 cases" in 2023 where banks withdrew an application after ECB signalled likely negative decision. - CRD 6 harmonizes some aspects (CRO requirements, powers to assess key function holders) but does not require prior supervisory approval for key positions in largest banks in all cases. ### Internal control, audit and compliance - EU law and EBA/ECB guidance comprehensive; SSM regularly assesses internal control, internal audit and compliance via SREP and horizontal reviews. - Internal audit: independent, risk-based plans, coverage over a three-year horizon expected. --- ### AML/CFT FROM A PRUDENTIAL PERSPECTIVE ### ECB mandate, cooperation and supervisory approach - SSMR excludes AML/CFT supervision from ECB’s mandate; ECB focuses on prudential implications of ML/TF and other criminal abuse. - ECB participates in multilateral AML Agreement with "51 signatories" and as observer in "64 AML/CFT Colleges"; contributed "48 submissions related to 14 entities" to EuReCA. - ECB developed a "vigilant approach", prudential warning signals incorporated into SREP, and an AML Coordination Office (AMLCO) within SSM. ### Gaps, findings and recommendations - Information received from AML/CFT authorities heterogeneous; multiplicity of actors complicates cooperation — AMLA expected to improve coordination. - No legal requirement for SIs to report suspicious activities to prudential supervisor; recommendation: banks should be required to promptly report to prudential supervisor material suspicious or criminal activities and fraud incidents material to safety, soundness or reputation. - Recommendation: ECB should incorporate monitoring of correspondent banking selection/access/conduct systematically and undertake more deep dives and thematic reviews with AML authorities per EBA Guidelines on Cooperation. ### Assessment - Principle 29 rated "Largely Compliant" — scope limited by ECB mandate; prudential implications addressed but direct AML/CFT supervision remains with national authorities. --- ### PRINCIPLE RATINGS AND SELECTED ASSESSMENTS (as reflected in the chapter) - Principle 1 (Supervisory framework, responsibilities) — Assessment: Largely Compliant. - Principle 2 (Independence, accountability, resourcing) — Assessment: Largely Compliant. - Principle 3 (Cooperation and collaboration) — Assessment: Compliant. - Principle 4 (Permissible activities and definition) — Assessment: Compliant. - Principle 5 (Licensing criteria and processes) — Assessment: Largely Compliant. - Principle 6 (Transfer of significant ownership) — Assessment: Largely Compliant. - Principle 7 (Major acquisitions and investments) — Assessment: Materially Non‑Compliant. - Principle 8 (Supervisory approach — SREP) — Assessment: Largely Compliant. - Principle 9 (Supervisory techniques and tools) — Assessment: Compliant. - Principle 10 (Supervisory reporting) — Assessment: (Highlights and operational points; integrated reporting delayed). - Principle 11 (Enforcement and sanctions) — Assessment: Largely Compliant. - Principle 12 (Consolidated supervision) — Assessment: Largely Compliant. - Principle 13 (Home-host relationships) — Assessment: Compliant. - Principle 14 (Corporate governance) — Assessment: Compliant. - Principle 15 (Risk management process) — Assessment: Compliant. - Principle 16 (Capital adequacy) — Assessment: Materially Non‑Compliant. - Principle 17 (Credit risk) — Assessment: Largely Compliant. - Principle 18 (Problem exposures, provisioning) — Assessment: Largely Compliant. - Principle 19 (Concentration risk and large exposures) — Assessment: Largely Compliant. - Principle 20 (Related party transactions) — Assessment: Materially Non‑Compliant. - Principle 21 (Country and transfer risk) — Assessment: Largely Compliant. - Principle 22 (Market risk) — Assessment: Compliant. - Principle 23 (IRRBB) — Assessment: Compliant. - Principle 24 (Liquidity risk) — Assessment: Largely Compliant. - Principle 25 (Operational risk and resilience) — Assessment: Largely Compliant. - Principle 26 (Internal control and audit) — Assessment: Compliant. - Principle 27 (Financial reporting and external audit) — Assessment: Largely Compliant. - Principle 28 (Disclosure and transparency) — Assessment: Compliant. - Principle 29 (Abuse of financial services / AML/CFT) — Assessment: Largely Compliant. --- ### RECOMMENDED DIRECTIONS AND NEXT STEPS (as reflected in assessment) - Further delegate decision-making where appropriate to improve agility. - Improve governance of budgetary processes, including early-stage consultation between budgetary function and banking supervision business lines. - Align resources to current and expected workload, prioritizing pressure areas (ICT risk, internal model approvals, IMIs). - Further reduce regulatory fragmentation and harmonize national transpositions of EU Directives, including CRD 6 transposition and supporting RTS/ITS. - Continue implementation of CRR 3 and CRD 6 while addressing remaining deviations from Basel standards and accelerating FRTB implementation where applicable. - Streamline supervisory processes: simplify SREP, make fit-and-proper assessments more risk-based, and streamline internal model approvals. - Enhance follow-up and remediation effectiveness: specify expectations in SREP letters, reduce stock of open measures, actively use escalation and enforcement (including PPPs), and consider more systematic use of capital add-ons for sovereign concentration risks when warranted. - Maintain supervisory focus on traditional risk categories while continuing integration of climate-related and environmental risks; ensure balanced resource allocation amid climate priorities. - Strengthen prudential–AML/CFT interaction: require prompt reporting to prudential supervisor of material suspicious/criminal activities; incorporate correspondent-banking monitoring into prudential supervision; increase joint thematic reviews with AML authorities. --- *Source: 1eurea2025012 — INTRODUCTION AND METHODOLOGY; Sections on institutional and market structure, licensing and ownership changes, SREP and supervisory approach, reporting, climate risk, corrective and sanctioning powers, cooperation, corporate governance, risk management, liquidity, operational resilience, AML/CFT, and BCP assessments (IMF FSAP chapter/section).* ### INTRODUCTION AND METHODOLOGY _______________________________________________________ 20 ### INTRODUCTION AND METHODOLOGY ### A. Introduction and scope - The Single Supervisory Mechanism (SSM) — comprising the European Central Bank (ECB) and national competent authorities (NCAs) — is exclusively responsible for the prudential supervision of credit institutions established in participating EU member states. - The SSM became operational in 2014 and has made significant progress in raising the quality of supervision of Significant Institutions (SIs) and in implementing recommendations from the 2018 assessment of compliance with the Basel Core Principles (BCP). - The assessment unit covers institutional and market structure, preconditions for effective banking supervision, a detailed assessment (Supervisory Powers, Prudential Regulations), a summary of compliance with the BCP, and recommended actions and authorities’ comments. ### B. Information and methodology used for assessment - The legal framework reviewed includes directly applicable EU Regulations (e.g., the SSM Regulation (SSMR), CRR) and EU Directives (e.g., CRD) that require transposition into national law. - The assessment considers the interaction between supranational (ECB) and national (NCA) frameworks, including areas where the ECB must apply different national laws (e.g., governance of banks, licensing, fit and proper assessments, sanctions). - The methodology highlights harmonization efforts, the use of experts’ networks, and evaluation of supervisory tools and processes (e.g., SREP, enforcement actions, fit and proper assessments, internal model approvals). ### Institutional and market structure — overview - The ECB, as the central organ of the SSM, is unique as a supranational supervisor and is responsible for enforcement of prudential regulations (though not for setting them). - The SSM applies both EU-level acquis and, where required, member states’ national law provisions beyond EU-level acquis (e.g., approval of mergers involving SIs, approval of appointment of key function holders). - Identified gaps in the EU framework include: no EU-wide related-party transactions framework, and a limited range of sanctioning powers for the ECB. ### Preconditions and governance - The governance arrangements of the SSM and the independence of the ECB strengthen operational independence and insulate supervisory decisions from industry and government pressures. - Decision preparation: decisions are prepared by an independent Supervisory Board and submitted to the Governing Council, mainly under the “non-objection procedure”. - Delegation: certain supervisory decisions are delegated to Senior Managers of ECB Banking Supervision, but nearly half of decisions are still adopted by the Supervisory Board through written procedures. - Resource constraints: the ECB’s banking supervision is funded by fees on supervised entities, but annual budget allocations can be constrained by ECB internal budget discipline policies. ### Summary and main findings — key points - 1. Banking supervision has significantly strengthened since the last FSAP. The SSM is a highly capable supervisor supported by excellent risk analysis and a robust skill set in all aspects of supervision. The SSM conducts an intrusive approach to supervision, uses a broad range of tools and relies on a fully articulated supervisory framework. On average, banks in the euro area maintain solid capital and liquidity positions, well above regulatory requirements. The SSM is extremely transparent. - 2. The SSM faces legal and operational challenges: resources are stretched (notably ICT risk, approval of internal models); dependency on NCA staff affects planning and delivery, with more than half the NCAs not meeting staffing commitments to the SSM; governance is complex and highly centralized; the ECB must apply different national laws transposing EU Directives, which may not be fully harmonized. The FSAP recommends: further delegating decision-making, improving governance of budgetary processes, aligning resources to workload, and further reducing regulatory fragmentation. - 3. The adoption of the banking package — Capital Requirements Regulation 3 (CRR 3) and Capital Requirements Directive 6 (CRD 6) — is a major milestone. However, some deviations from Basel prudential standards persist, new permanent and temporary deviations were introduced in CRR 3, and implementation of the Fundamental Review of the Trading Book (FRTB) was postponed. CRD 6 will improve national supervision of third-country branches and grant competent authorities the power to assess acquisition of material holdings, but several issues identified in the last BCP assessment persist (e.g., narrow definition of related-party transactions, limited sanctioning powers of the ECB). - 4. There is room for the SSM to be more risk-based, proportionate, and impactful. The SSM’s highly codified approach creates standardization; initiatives to simplify the SREP process and implement a risk tolerance framework are under way but still early. Fit and proper assessments and internal model approvals could be streamlined. The comprehensive approach generates many findings, challenging remediation follow-up; the ECB has begun to use its escalation policy and enforcement actions more actively. Capital add-ons for high sovereign concentration risks are not used systematically and have been imposed only in a few instances. Oversight of Less Significant Institutions (LSIs) via moral suasion has been effective, but more work is needed to improve supervisory convergence and consistency across member states. - 5. The ECB is a leader in incorporating climate-related financial risks into supervision: initiatives include climate stress tests, thematic reviews, firm-specific work, binding supervisory decisions on governance and risk management, supervisory expectations on prudent management of climate and environmental risks, operational letters, and potential imposition of periodic penalty payments (PPP). The ECB should ensure sufficient supervisory focus on traditional risk categories in the context of budget stabilization. ### Main findings — Responsibility, objectives, powers, independence, accountability (CPs 1–2) - 6. The ECB is jointly responsible with NCAs for bank safety and soundness across 21 member states. The distribution of tasks within the SSM is clearly established, and the legal framework gives the ECB powers to authorize SIs and LSIs, conduct ongoing supervision of SIs, and undertake timely corrective action. - 7. The SSM is a successful supranational supervisor but must navigate a complex legal framework: application of EU Regulations and transposed Directives can lead to national law differences (e.g., governance, licensing), creating challenges for consistency and a level playing field. The SSM has taken significant steps to harmonize options and discretions exercised by supervisory authorities and works extensively with NCAs via experts’ networks. - 8. The SSM is independent with a clear decision-making process, but decision-making simplification is warranted: governance and delegation exist, yet nearly half of supervisory decisions are adopted via Supervisory Board written procedures. - 9. Resources are stretched; the ECB has limited control over NCA staff allocation dedicated to SI supervision. The Governing Council decision to not increase headcount from 2023 for central banking and supervisory arms has constrained hiring. Headcount increases are possible for new/expanded tasks (evidenced by budget increase for DORA implementation). Resource pressures exist in key areas (approval of internal models, ICT risk). Early-stage consultation between budgetary function and banking supervision business lines is recommended; access to NCA staff is a strength but also a vulnerability, with more than half the NCAs not meeting staffing commitments for offsite supervisory activities. ### Recommended directions and next steps (as reflected in assessment) - Delegate decision-making further where appropriate to improve agility. - Improve governance of budgetary processes, including early-stage consultation with banking supervision business lines. - Ensure alignment of resources to current and expected future workload, including addressing areas with resource pressure (e.g., ICT risk, internal model approvals). - Further reduce regulatory fragmentation and harmonize national transpositions of EU Directives to limit opportunities for regulatory arbitrage and improve the level playing field. - Continue to implement CRR 3 and CRD 6 while addressing remaining deviations from Basel standards and accelerating FRTB implementation where applicable. - Streamline supervisory processes (e.g., SREP simplification, fit and proper assessments, internal model approvals) and enhance follow-up and remediation effectiveness, including more systematic use of capital add-ons for sovereign concentration risks where warranted. - Maintain supervisory focus across traditional risk categories while continuing the integration of climate-related financial risks into supervisory practices. *Source: INTRODUCTION AND METHODOLOGY, EURO AREA — INTERNATIONAL MONETARY FUND* ### 10. The legal and regulatory framework provides the SSM with a set of instruments and ### 10. The legal and regulatory framework provides the SSM with a set of instruments and tools to ensure that the licensing process of new credit institutions is sound. It retains adequate powers to require applicants and potential shareholders to submit all information required. ### Licensing, entry, and ownership changes - Licensing process: - Entry into the euro area banking system is a carefully vetted process for domestically or foreign-owned entities. - General requirements for granting authorizations are included in EU legislation and guidelines, but licensing criteria based on different national legislation are also applicable in the licensing process of the SSM, adding complexity for the ECB. - ECB does not have the mandate to authorize and supervise euro area branches of non-EU or EEA banks; such branches remain licensed and supervised by NCAs outside the SSM unless converted into subsidiaries (they will be supervised by the ECB if they qualify as SIs). - Limited aggregated information at EU or EA level on the type, importance, risk profile, and booking models of these branches; last mapping by the EBA was conducted in 2021. - CRD 6 will improve regulation and supervision of third-country branches, but branches will remain licensed and supervised by NCAs unless converted into subsidiaries. - The process to require establishment of subsidiaries is complicated and led by NCAs, with no possibility for the ECB to influence the outcome. - The CRD article regulating third-country cross-border provisioning of services opens possibilities for exemptions and different national implementations. - Ownership and controlling-structure changes: - EU legal provisions empower the ECB to approve changes to ownership or controlling structure of credit institutions. - ECB sometimes must rely on national legislation in exercising these powers; national laws are not always consistent (e.g., reporting requirements for notification of supervisors upon awareness of material information affecting suitability of a major shareholder are not uniform). - EU legislation does not require reversal or modification of transfers that occurred without necessary notification/approval or where approvals were based on false information; transfers have in some instances taken place without notification to or authorization of the ECB. - CRD 6 will grant competent authorities the power to assess acquisition or divestiture of material holdings in financial or non-financial sector entities; current ECB intervention on acquisitions of material holdings outside the EU depends on national laws which are inconsistent and incomplete. - Note: BCP references both acquisitions and investments whereas CRD refers only to acquisitions of holdings. ### Methods of ongoing supervision (SREP and supervisory approach) - Supervisory framework and capability: - SSM operates a sound supervisory framework with a broad range of legal enforcement powers and a risk-based approach centered on the Supervisory Review and Evaluation Process (SREP), a holistic, forward-looking assessment. - SSM is described as a highly capable supervisor, supported by excellent risk analysis and robust supervisory skills; intrusive supervision, extensive benchmarking, and transparency are highlighted. - SSM has addressed several key concerns from the 2018 FSAP. - Resource intensity, standardization, and agility: - The supervisory approach is resource-intensive, potentially burdensome and challenging to be agile. - Over years, SSM built a substantial catalogue of internal guidance, methodologies, procedures and support, creating standardization and many processes and checks and balances. - Challenges exist in aligning demands to a realistic resource base amid budgetary discipline, skill shortages, and NCAs' own budget constraints. - Areas of overlap between horizontal reviews and onsite inspections observed; certain risk dimensions may not be sufficiently covered (example: transactions with related parties). - SREP scores noted as "sticky" over time with limited differentiation among institutions. - Need for greater risk-based and proportionate supervision: - SSM acknowledges SREP needs to adapt to reduce administrative burden. - Key initiatives (simplifying SREP process planning; a risk tolerance framework) are in early stages and yet to deliver substantially. - Communication with banks needs improvement: SREP letters are often lengthy and legalistic; Pillar 2 requirements and remediation expectations not always clear. - Comprehensive supervisory approach generates many findings; some severe findings remain outstanding for long periods, posing challenges for follow-up and remediation. - ECB has initiated better monitoring of findings and measures, but more work needed to reduce stock of open measures, specify expectations in SREP letters, and use persuasive measures when remediation stalls. - Early Warning System produces good-quality outputs, but crisis procedures are largely framed for single-institution failures and may be unsuitable when several firms are impacted simultaneously (e.g., operational resilience or cyber events). - Oversight of LSI supervision: - Considerable progress since last FSAP using moral suasion and benchmarking to identify outliers rather than direct intervention. - Some NCAs not using the SREP module in the SSM’s Information Management System (IMAS); NCA priorities may differ slightly from SSM-agreed priorities. - ECB’s in-depth assessment of SREP scores and Pillar 2 requirements (P2R) and Pillar 2 guidance (P2G) for LSIs suggests further work needed to improve supervisory convergence. - Oversight of FMI supervision classified as LSI could be strengthened via benchmarking and harmonization of Pillar 2 calibration. ### Supervisory reporting, data collection, and integrated reporting - Reporting framework and limitations: - Supervisory reporting requirements are specified by the EBA; competent authorities like the SSM can collect additional data not covered by EBA reporting. - Revising and enhancing the standardized suite of regulatory returns at EU level is lengthy due to need to amend the Implementing Technical Standard (ITS) on supervisory reporting. - ECB cannot collect additional data in areas already covered by the ITS, nor require different format or breakdown for that data. - Short-Term Exercises (STE) face limitations: cannot collect data covered by ITS in different format; STE less standardized than ITS reporting, which may reduce data quality. - Need to balance harmonized reporting requirements with flexibility to respond to evolving data needs. - If data were collected at granular level, different competent authorities could combine data as desired; Integrated Reporting System in the EU is a medium-term project and implementation of key component (central data collection point) has been delayed. ### Climate- and environment-related financial risks - ECB leadership and initiatives: - ECB leader in incorporating climate and environmental (nature) related financial risks into supervision: climate stress tests, thematic reviews, firm-specific work. - 2020: ECB published supervisory expectations on how institutions should develop approaches to financial risks from climate change and embed into governance, risk management, scenario analysis, and disclosures. - 2022: ECB set staggered and institution-specific deadlines leading up to year-end 2024 for institutions to have fully embedded ECB supervisory expectations on climate-related and environmental risks (includes nature-related risks as example of emerging risk considered under the BCP). - Monitoring and follow-up on these deadlines included in supervisory work program under supervisory priorities 2024-2026. - ECB regularly assesses banks’ effectiveness in remediating shortcomings in climate risk governance, risk management, scenario analysis, and disclosure. - ECB has issued binding supervisory decisions, including potential imposition of periodic penalty payments when banks fail to implement appropriate risk management and governance systems for climate-related financial risks. - Resource implications and balance: - Supervisory work on climate-related financial risks, including enforcement tools, has been resource intensive. - ECB should ensure, amid budget stabilization, sufficient supervisory focus on all aspects and drivers of traditional risk categories in addition to climate risk. - Temporary imbalance observed in a few Joint Supervisory Teams (JSTs) that focused almost exclusively on climate-related issues over some period of time. ### Corrective and sanctioning powers - Corrective measures and legal harmonization: - SSM has a wide range of corrective measures; scope exists for harmonizing conditions for adopting supervisory and early intervention powers. - Merit in including all supervisory and early intervention powers currently spread across SSMR, CRD and BRRD under a single provision in directly applicable EU legislation subject to the same conditions to ensure ECB can intervene promptly and flexibly even before an infringement materializes. - Sanctioning powers and progress: - Limitations remain in sanctioning powers directly available to ECB under Union law. - ECB can directly impose pecuniary penalties only on SIs that breach directly applicable acts of EU law. - For breaches of national law implementing Union directives, breaches by natural persons, or when non-pecuniary penalties are required, ECB can only request the relevant NCA to open national sanctioning proceedings. - CRD 6 enlarges the list of breaches for which administrative penalties shall be made available in member states (example: capital requirements breaches) and introduces PPPs as an enforcement tool. - Enforcement processes and escalation: - ECB has streamlined processes for corrective and enforcement actions and imposing penalties, involving early NCA involvement and informal consultation of an expert group on Enforcement and Sanctions. - Average length of proceedings has started to come down, reducing dependence on moral suasion. - ECB intends to use its escalation policy more actively, including enforcement actions, to influence wider deterrence. - Escalation framework introduced to expedite internal processes and decision making and facilitate full and timely use of tools by supervisors, e.g., from moral suasion through imposition of PPPs. - Use of enforcement tools such as PPPs is in early stages and currently structured thematically (climate-related issues and risk data aggregation and risk reporting) with support from a central helpdesk via a Project Management Office (PMO). - Apart from climate-related financial risks, enforcement tools have rarely been used. ### Cooperation, consolidated and cross-border supervision - Cooperation networks and gaps: - ECB maintains extensive cooperation, information sharing and collaboration arrangements with domestic and foreign supervisors that generally work well but can be improved. - Opportunities to undertake joint inspections with foreign supervisors as envisaged in MoUs and to investigate impediments to information flow from some peer supervisors. - Similar arrangements with the People’s Republic of China have not yet been concluded; noted previously. - Consolidated and cross-sector supervision: - SSM undertakes intensive supervision of banks and banking groups on standalone and consolidated basis. - For bank-led financial conglomerates where ECB is coordinator, it assesses impact of non-banking activities on banking part of group, group risk profile, profitability, and capital and liquidity position; ensures cross-sectoral requirements for financial conglomerates are fulfilled. - Limited examples of joint supervisory work with insurance supervisors (e.g., joint onsite inspections). - Mixed activity groups and FinTech expansion: - Large and complex mixed-activity groups (distinct from financial conglomerates under EU law) pose challenges to assessing activities/entities in the wider group that impact the banking entity. - Increasing financial activities in EU by mixed groups including FinTech; such groups may deliberately avoid establishing a financial holding company (FHC) to escape prudential consolidated supervision. - Further work needed to ensure competent authorities are adequately informed about direct and indirect financial activities conducted by large and complex mixed-activity groups and that relevant information is shared. ### Corporate governance, internal control and audit - Strengthened supervision and guidance: - ECB has significantly strengthened supervision of corporate governance since last assessment. - More guidance issued by European Supervisory Authorities (ESA) and the ECB via guidelines, handbooks, and supervisory manual updates. - Supervision of internal governance and suitability is comprehensive, intrusive, and detailed; enhanced focus regularly communicated to banking sector. - Fit and proper process and resource implications: - The fit and proper approval process has been substantially delegated but still consumes significant supervisory resources at ECB and NCA levels. - Could benefit from further deployment of risk-based approaches. - EU law and guidelines on internal control and internal audit are generally comprehensive; SSM regularly assesses internal control and audit functions of SIs. *Source: 1eurea2025012 - 10. The legal and regulatory framework provides the SSM with a set of instruments and tools to ensure that the licensing process of new credit institutions is sound.* ### 28. Despite the creditable supervisory efforts, the lack of harmonization still remains an ### 28. Despite the creditable supervisory efforts, the lack of harmonization still remains an issue ### Governance harmonization and fit-and-proper rules - Governance practices, and supervisory responsibilities and powers, vary significantly across member states. - Some requirements not harmonized or addressed in all national laws include: - minimum number of independent directors, - requirement of independent audit committees, - diversity requirements. - CRD 6 advances harmonization by: - subjecting certain key function holders (e.g., CFO and head of internal control function) to supervisory assessment, - strengthening the primary responsibility of banks in appointing suitable candidates, - referring to the necessity to have deadlines for supervisory processes and clarifying some procedural aspects. - CRD 6 does not require: - suitability assessment to be completed by the bank prior to taking up the appointment in all cases, - prior approval by the supervisor for key positions in the largest banks. ### Prudential requirements, regulatory framework, accounting and disclosure (CPs 15-28) - SSM coverage of risk management is substantial and based on CRD/CRR and additional EBA guidelines; SSM has published guides to increase transparency. - SSM priorities include climate risk and digitalization, which have been subject to targeted reviews and enhanced supervision. - Recovery plans: - updated at a minimum annually, - reviewed by supervisors with feedback provided within six months of submission, - remediation measures are usually timed to coincide with the subsequent submission of the recovery plan (adequate in most cases; some risks may warrant a shorter timeframe). - With transposition of CRD 6, legal requirements concerning the Chief Risk Officer (CRO) will be harmonized. - Progress in working arrangements with the Single Resolution Board (SRB) has been substantial. - Use of stress test scenarios typically focuses on recovery and capital and does not consider a broader range (for example, reputation and operational scenarios). ### Banking package (CRR 3 and CRD 6) and capital standards - Adoption of CRR 3 and CRD6 is a major milestone; gaps with international Basel standards for capital requirements remain. - EU application of Basel capital requirements to all EU credit institutions strengthens safety and reduces regulatory arbitrage, but: - existing deviations detailed in the 2014 RCAP have not been corrected (Danish compromise as to the non-consolidation of insurance companies, SME support factor, limited scope of credit valuation adjustments (CVA)), - new deviations were introduced in CRR 3, - FRTB implementation has been postponed by one year (in response to decisions in other jurisdictions). - Impact of EU-specific adjustments on capital requirements is material. - EBA methodology introduced to identify and designate Other Systematically Important Institutions (O-SII), but: - no harmonized EU methodology for calibration of O-SII buffers, - available data suggest significant differences in O-SII buffers across the euro area. ### Internal models, sovereign exposures, and model validation - Credit risk and market risk models are widely used by SIs for regulatory purposes. - ECB has been active to ensure compliance and model reliability; most internal model reviews have been reactive and triggered by model change applications. - ECB faces significant resource constraints in internal model validation and JST follow-up. - CRR allows banks (subject to supervisory approval) to use the standardized approach on a permanent basis for material sovereign exposures, which: - does not comply with the Basel Framework, - may facilitate cherry picking where banks use both approved IRB and standardized approaches for sovereign exposures in the same exposure class. ### Credit risk supervision, NPLs, and provisioning - Supervision of credit risk has reduced nonperforming loans (NPLs), but further improvements needed. - Gaps and limitations: - No explicit EU requirement for a bank’s board or senior management to approve credit risk exposures exceeding a certain amount or percentage of capital. - SSM cannot impose reclassification as NPL. - SSM power to require specific provisioning policy does not allow imposing provisions for specific exposures to produce a certain outcome. - Supervisory tools and outcomes: - SSM can influence provisioning within accounting framework limits and apply capital adjustments where accounting treatment is not prudent. - Insufficient provisioning coverage may lead to a lower credit score and overall SREP score and a higher Pillar 2 requirement (P2R). - Introduction of a P2R add-on or deduction for provisioning shortfalls is a welcome fallback, but: - use of the P2R add-on is limited to instances where banks book accounting provisions lower than minimum levels of provisions for NPLs based on a uniform provisioning calendar, - assessors have not seen evidence of the P2R add-on or capital deduction being used when provisions are considered insufficient from a prudential perspective. - SSM may use escalation tools such as discussing with auditors and requiring certain disclosures. ### Concentration risk and sovereign exposures - Supervision of concentration risk is based on an overall robust process, but sovereign risk concentrations need further attention. - EBA SREP Guidelines define various concentration risks and provide detailed guidance for supervisors, but: - no supervisory guidelines for banks specifying expectations for management of all concentration risks, - no requirement or explicit expectation that all material concentrations be regularly reviewed and reported to a bank’s board. - Deviations from the Basel large exposures standard were identified in the 2022 RCAP; ECB indicates one deviation is not used by any bank. - Sovereign exposures vary widely across banking systems and banks in the euro area. - Pillar 2 assessments do not systematically include concentration to sovereign exposures; such concentration is not in the phase 2 concentration risk indicators for SSM SREP and is only assessed in phase 3 when deemed relevant by JSTs. - Capital add-ons for high sovereign concentration risks are not regularly used and have been imposed only in a few instances. ### Related party transactions - EU framework for related party transactions is neither comprehensive nor consistent. - Definitions in CRD and EBA Guidelines are not as comprehensive as Basel standards and EU law lacks regulatory limits. - Some national frameworks include more detailed provisions, but these are not harmonized. - ECB may look at related party policies and transactions in ongoing supervision of internal governance, but no horizontal or thematic review has been conducted to develop benchmarks for materiality or formalized supervisory expectations. ### Country risk - Country risks are generally considered part of credit risk; EBA SREP Guidelines address country risks under credit risk as a sub-category. - Since 2019, ECB uses a “country risk assessment tool” for emerging market country risk assessment. - Geopolitical developments have increased supervisory focus on these risks. - ECB should consider laying out supervisory expectations for industry more clearly. ### Market risk and IRRBB - EU frameworks for market risk and interest rate risk in the banking book (IRRBB) are fully articulated and receive appropriate SSM attention. - Market risk is growing since the UK’s departure from the EU; IRRBB can be significant given SSM banks’ business models. - Strong emphasis on market risks and IRRBB across supervisory processes; supervisors regularly make findings and adjust capital requirements. - SSM has stepped up oversight of valuation, led by an on-site campaign. - EU framework has kept pace with international standards on IRRBB through EBA Guideline updates and use of stress tests. ### Liquidity risk and contingency funding - SSM delivers thorough assessment and mitigation of liquidity risk and has progressed substantially since the previous FSAP. - SSM response to 2023 liquidity problems included a move to weekly reporting. - Supervision is based on a policy platform judged by the Basel Committee to be largely compliant. - Recommendations for SSM: - prioritize remediation of contingency funding issues identified in recovery plans rather than waiting for annual updates, - conduct further work, including simulated events, to prepare for sudden depositor behavior changes (e.g., social media–sourced mobilization), - continue developing intraday liquidity approach and consider a specific policy towards collateral in an intraday context. ### Operational risk and resilience - Substantial progress since last FSAP in operational risk and resilience. - Prioritization of Cyber and Operational Resilience has been appropriate and supported by significant legislative change. - DORA provides a robust supervisory framework with a ground-breaking approach, but implementation challenges remain, notably resourcing demands on supervisors. ### External audit and reporting powers - Existing EU legislation does not provide the ECB power to influence the scope of external audits or establish audit standards. - Neither CRR nor CRD empowers a competent supervisory authority to reject an external auditor appointment or provides specific powers vis-à-vis external auditors. - Banking supervisors do not have legal power to access external auditors’ work papers. - Overall EU financial reporting and external audit regime appears robust and broadly consistent with the relevant Core Principle. ### Disclosure and transparency - EU has introduced a comprehensive disclosure framework with qualitative and quantitative disclosure requirements. - EBA and ECB publish a wide range of information and data on the banking system. - ECB monitors SIs’ practices through sample testing and thematic reviews. ### AML/CFT from a prudential perspective - EU framework increasingly envisages an enhanced role for prudential supervisors in AML/CFT; ECB recognizes its role in supervising prudential implications of ML/TF. - ECB has developed supervisory expectations and practices via a “vigilant approach” and introduced guidance for supervisory assessment of ML/TF risks in SREP, including prudential warning signals. - ECB supervision covers broader criminal abuse risks (internal, external, transactional fraud) in internal controls and operational risk supervision. - Scope for further work: - ECB should play a greater role in monitoring policies and processes for selection, access to, and conduct of correspondent banking accounts from reputation and operational risk perspectives, - undertake more deep dives and thematic reviews on prudential areas identified with AML/CFT risks, including joint work with AML/CFT authorities. - New AML authority (AMLA) is expected to improve cooperation and information exchange, but: - direct supervision of AMLA will be limited to a few entities, - complexity in the system and potential authority overlaps will need to be resolved (see CP 29). ### Introduction and methodology (assessment context) - Assessment completed as part of the FSAP mission undertaken by the IMF during November 2024 and February 2025 at the request of euro area authorities. - Assessment reflects the regulatory and supervisory framework in place as of the date of completion (February 2025). - Focus of assessment: - ECB supervision of Significant Institutions (SIs) and ECB oversight role regarding Less Significant Institutions (LSIs) supervised by NCAs, - tasks conferred on the ECB with exclusive competence (granting/withdrawal of banking licenses, approval of acquisitions of qualifying holdings, fit and proper assessments). - Supervision of LSIs, national AML/CFT authorities, and supplementary supervision of financial conglomerates were not assessed. - ECB requested assessment according to the Revised BCP Methodology issued by the Basel Committee in April 2024; assessment performed against the revised standard. - ECB chose to be assessed and rated against both essential criteria and additional criteria of the BCP; assessment uses a five-part qualitative rating system. *Source: https://www.imf.org/-/media/files/publications/cr/2025/english/1eurea2025012.pdf* ### 48. As required by the assessment methodology, grades are solely based on the regulatory ### 1eurea2025012 - 48. As required by the assessment methodology, grades are solely based on the regulatory ### Assessment methodology, scope, and caveats - Grades are solely based on the regulatory framework and supervisory practices in place at the time of the BCP assessment. - The FSAP acknowledged and discussed several provisions included in CRD 6 in relation to the supervision of third-country branches, supervisory independence, acquisition of material holdings, and corrective and sanctioning powers; these regulatory developments are not reflected in the grading because the new provisions included in CRD 6 are not yet implemented. - EU Member states have up to 18 months from the entry into force of CRD 6 (June 2024) to adopt measures of national law to transpose the directive. In addition, the EBA has a mandate to develop several technical standards (e.g., a common methodology to assess acquisitions of material holding) and ECB’s internal procedures and processes will be revised (e.g., FAP internal guidance). It is necessary for the purposes of the BCP assessment to verify implementation in practice. - Assessors noted regulatory, policy, or procedural changes, indicated whether they go in the right direction, explained what remains to be done until full deployment/implementation, and stressed that without evidence of implementation, comments only reflect potential. ### Review process and cooperation - The assessment team reviewed the framework of laws, rules, and guidance and held extensive meetings with officials of ECB banking supervision, NCAs, auditing firms, and banking sector participants. - The authorities provided a self-assessment of the CPs described as rich in quality and comprehensiveness, detailed responses to additional questionnaires, and facilitated access to supervisory documents and files, staff, and systems. - The team appreciated the very high quality of cooperation; authorities provided excellent support and responded promptly and accurately to extensive and detailed requests prior to and during the mission. - The assessment team was impressed by the commitment, experience, and knowledge of supervisors; cooperation with the FSAP team was characterized as setting a very high bar for future FSAPs in peer jurisdictions. ### Contextual approach and methodological considerations - Standards were evaluated in the context of the euro area financial system’s structure and complexity. - The BCP methodology requires a proportionate approach in terms of expectations on supervisors and the standards supervisors impose on banks; supervisory practices should be commensurate with the complexity, interconnectedness, size, risk profile, and cross-border operations of supervised banks. - Assessment of compliance with the BCPs involves judgment; the assessment evaluated the euro area supervisory and regulatory framework amid transition challenges created by the implementation of the SSM. - Assessing a cross-national supervisory framework posed additional methodological challenges: the ECB supervises credit institutions in the euro area but not all aspects of banking supervision (e.g., supervision of potential abuses of financial services, including money laundering and the financing of terrorism, is not under the ECB’s mandate). - While several regulatory aspects of the CPs are harmonized in the euro area, different national legal frameworks apply in many cases; the assessment uses national information as a source for a general assessment rather than a detailed picture for each of the 21 banking union member states. ### Ratings framework - Five rating categories were used to determine observance of each CP: compliant, largely compliant, materially noncompliant, noncompliant, and non-applicable. - Definitions: - Compliant: all ECs and ACs are met without any significant deficiencies, including instances where the principle has been achieved by other means. - Largely compliant: only minor shortcomings that do not raise serious concerns about the authorities’ ability to achieve the objective; clear intent to achieve full compliance within a prescribed period. - Materially non-compliant: severe shortcomings where formal rules exist but supervision has not been effective, practical implementation is weak, raising doubts about the authorities’ ability to achieve compliance. - Non-compliant: principle is not substantially implemented, several ECs and ACs are not complied with, or supervision is manifestly ineffective. - Non-applicable: criteria are not relevant to the jurisdiction’s circumstances. ### The 2024 Revised Core Principles (Box 1) — key elements - The revised Core Principles reflect regulatory and supervisory developments, structural changes in banking, and lessons learnt from FSAP assessments since 2012. - Updates took account of: implementation of the Core Principles updated in 2012; impact of, and policy responses to, the COVID-19 pandemic; and FSAP assessments completed since 2013. - The revisions incorporate thematic topics including evolving risks related to: (i) financial risks; (ii) operational resilience, including cyber security risks; (iii) systemic risk and macroprudential supervision; (iv) risks from structural transformations driven by climate change and the digitalization of finance; (v) the sustained growth of nonbank financial intermediation; and (vi) evolving corporate governance and risk management practices, including sound risk culture and sustainable business models. - Greater emphasis on systemic risk and sound risk management practices, including: - Supervisors required to assess banks’ risk profile and the risks they pose to the banking and financial systems. - Raised expectations to incorporate analysis of banks’ business models and risks brought by the wider group, and how macroeconomic environment and business trends may affect banks’ risks. - Reinforced requirements for a group-wide approach to supervision. - Significant updates to operational risk and operational resilience to ensure banks can withstand, adapt to, and recover from severe operational risk-related events (e.g., pandemics, cyber incidents, technology failures, natural disasters). - Revised BCPs reinforce powers and independence of supervisors, expectations about timely, consistent, and conclusive supervisory actions, adequacy of liquidity arrangements, and the interface between daily supervisory practices and crisis management measures. - Six additional criteria were upgraded to essential criteria. - The BCPs remain universally applicable and reinforce proportionality: maintaining stringency through proportionate methods to ensure appropriate responses to global diversity of banks and banking systems. ### Institutional and market structure — overview and key statistics - The euro area hosts a large, complex, and globally interconnected financial system where banks are the dominant players. - Several banks and insurers are classified as globally systemically important. - Interbank and cross-border connections of the euro area banking system are extensive, although contracted since the global crisis. - The euro area hosts the two international central securities depositories (ICSDs) and several central counterparties (CCP). - Banks are the most important single source of financing for households, nonfinancial corporates, and the public sector; nonbanks and financial markets play a greater role since the global financial crisis. - Within the SSM: - Banks (technically, “credit institutions”) are categorized as SIs or LSIs. - The ECB directly supervises the SIs, which currently comprise 114 banking groups, including 7 G-SIBs, altogether which cover more than 80 percent of euro area banking assets. - NCAs directly supervise the LSIs (around 2,000 in number), under the general oversight of the ECB to promote a more consistent supervisory approach across the SSM. - The SSM is one of 3 pillars intended to sustain the European banking union; the second pillar is the single resolution mechanism (SRM). The Banking Union still lacks its intended third pillar: a European Deposit Insurance Scheme (EDIS). The European Commission adopted a proposal in 2015 to establish EDIS, but this has not been implemented. - The Single Rulebook establishes a unified regulatory framework for the EU banking sector, encompassing key legal acts such as the BRRD, CRR, CRD, and the Deposit Guarantee Schemes Directive (DGSD). The EBA develops Delegated Regulations, Technical Regulations and Guidelines to oversee consistent implementation. ### Preconditions for effective banking supervision — macroeconomic and systemic context - The euro area economy has remained resilient despite multiple shocks; record-low unemployment, declining inflation, and a stable financial system are noted. - GDP growth is projected at 0.8 percent this year and 1.2 percent in 2026 (April 2025, WEO). - Higher tariffs, trade policy uncertainty, and geopolitical tensions weigh on activity especially in 2025, more than offsetting an anticipated lift from fiscal policy support and easing monetary policy. - Inflation is projected to return to the 2 percent target in the second half of 2025. - With loosening monetary policy, credit standards have started to ease from their restrictive levels driven by mortgage lending; borrowing costs remain high and credit standards tightened for firms during 2024Q4 and 2025Q1. - Quantitative tightening is expected to progress in an orderly way and warrants careful monitoring of liquidity conditions in banks, NBFIs, and core funding markets, especially given likely volatility from heightened trade policy uncertainty. - Commercial real estate (CRE) remains vulnerable to further asset price declines. - Stretched valuations and risk premia are vulnerable to sharper corrections as investors reassess global growth and inflation outlook. - If fiscal headroom erodes, banks’ exposures to highly indebted sovereigns could act as shock transmitters and adversely affect credit availability to the real economy. - Growing interlinkages of banks to complex and opaque NBFIs could pose significant challenges and amplify systemic risk. ### Macroprudential framework and responsibilities - Macroprudential policy is a shared competency between national authorities and the ECB; the FSAP occurred amid an ongoing review of the EU macroprudential framework for banks. - The multilayered EU institutional framework places the European Systemic Risk Board (ESRB) in charge of macroprudential oversight, while national authorities set policies in coordination with the ECB, which has only a “top-up power” for macroprudential tools. - The SSMR confers to national authorities and the ECB specific tasks relating to macroprudential instruments for the banking sector set out in the CRR and CRD IV. The ECB is a competent authority as well as a designated authority for macroprudential purposes. - Some instruments can be activated only by the microprudential supervisor (NCAs) and other instruments can be introduced by the macroprudential authority (national designated authority (NDA)). - Member states (and not the ECB) can use borrower-based instruments (loan-to-value, debt-service-to-income, loan-to-income ratios) for real estate lending if legislated under national law and not in the CRD/CRR. ### Accounting, auditing, and resolution frameworks - International Financial Reporting Standards (IFRS) are required for publicly traded companies under Regulation 1606/2002 for consolidated accounts of publicly traded companies; member states may permit listed entities to prepare solo financial statements based on IFRS, and non-listed entities may prepare solo or consolidated accounts under IFRS. Entities not applying IFRS apply national GAAP; several banks in the euro area apply national GAAP. - The EU adopted new rules regarding auditing standards in 2014: Directive 2014/56/EU strengthens public oversight of the audit profession and cooperation among competent authorities; Regulation No 537/2014 specifies requirements for statutory audits of public interest entities (PIEs), such as listed companies, banks, and insurance undertakings. Member states may apply national auditing standards where the Commission has not adopted an international auditing standard covering the same topic. - Bank resolution within the Banking Union falls under the SRM; institutional arrangements are defined in the Single Resolution Mechanism Regulation (SRMR). - The SRM is composed of the SRB and the National Resolution Authorities (NRAs). - The SRB has centralized resolution powers over SIs and cross-border groups and can issue binding “resolution schemes” instructing NRAs on the use of resolution powers in the BRRD in accordance with the SRMR. - NRAs are responsible for resolution planning for LSIs that are not part of a cross-border group. *Source: Extracted content unit 1eurea2025012 from the IMF FSAP chapter/section provided.* ### 65. Although many aspects of deposit protection are harmonized by the Deposit ### 65. Although many aspects of deposit protection are harmonized by the Deposit Guarantee Schemes Directive (DGSD), deposit guarantee schemes remain national. ### DGSD, deposit protection harmonization and CMDI reforms - DGSD sets common minimum eligibility criteria for coverage and a common level of coverage of EUR 100,000 per depositor per bank. - DGSD sets target levels for ex ante funding of 0.8 percent of covered deposits. - National implementation differences that could complicate bank resolution or deposit insurance payout: - Differences in coverage for temporary high balances (for example, due to the sale of a house). - Differences in the coverage of depositors in non-EU branches. - One Member State uses a provision allowing a lower ex ante fund size than the 0.8 percent standard. - BRRD and SRMR empower resolution authorities to require Deposit Guarantee Schemes to contribute to the costs of resolution in lieu of insured deposits, up to the costs they would have borne in a payout. - In 2022, after failing to agree on a roadmap to complete the banking union (including the introduction of EDIS), the Eurogroup asked the European Commission to develop a more limited package focused on the EU Crisis Management and Deposit Insurance (CMDI) frameworks. - The CMDI package includes proposed reforms to the DGSD, including proposed harmonization of the minimum level of protection for temporary high balances. ### Supervisory framework, responsibilities and structure (Principle 1) - ECB and NCAs form the Single Supervisory Mechanism (SSM), operational on November 4, 2014; the ECB is responsible for effective and consistent functioning of the SSM. - Significant classification and supervisory responsibilities: - Banks are categorized as SIs or LSIs based on size, importance for the economy of the Union or a Member State, and importance of cross-border activities. - The ECB directly supervises significant banks; NCAs supervise LSIs but the ECB exercises oversight. - Legal instruments referenced and applied by the ECB include Regulation (EU) No 575/2013 (CRR), Directive 2013/36/EU (CRD), Regulation (EU) No 806/2014 (SRMR), Directive 2014/59/EU (BRRD), and Directive 2002/87/EC (FICOD). - Publication and guidance: - SSMR and SSMFR published in the Official Journal of the European Union; ECB published Supervisory Manual in 2018 with an update in 2024. - Use of national powers and harmonization: - ECB may apply national laws where Union law grants options to member states; ECB harmonized exercise of options/discretions for SIs via a Regulation and published guidance for LSIs. - Transposition of Union Directives into national laws can produce material differences; infringement processes and subsequent Union legislation (e.g., Banking Package CRD6/CRR3 adopted in 2024) aim to reduce divergence. - Supervisory coverage and activity: - The ECB supervises directly 113 banking groups in 21 member states (August 2024). - NCAs supervise under ECB oversight 1,937 institutions. - On average, around 30 on-site inspections are conducted by the ECB outside the euro area every year. ### Supervisory powers, corrective measures and resolution interaction (Principle 1 continued) - ECB powers for information, investigations and on-site inspections: - ECB can require submission of documents, examine books/records, obtain explanations, interview consenting persons, and conduct on-site inspections (with or without prior announcement when required). - Corrective and enforcement tools: - ECB can require additional own funds, governance changes, provisioning policies, restrict operations, request divestments, limit variable remuneration, and more (Article 16(2) SSMR and CRD powers). - Enforcement measures include periodic penalty payments (PPPs); sanctions can be imposed for breaches of Union law and ECB decisions; sanctions for breaches of national transpositions of directives may be imposed by NCAs on request of the ECB. - CRD 6 enhanced the range of measures and penalties available to the ECB and NCAs and expanded application situations. - Resolution cooperation: - ECB cooperates with the SRB; ECB assesses whether SIs are failing or likely to fail and informs the Commission and SRB. - SRB adopts resolution schemes when conditions are met; SRB and ECB MoU governs cooperation and information exchange. - For LSIs, NCAs are responsible for crisis management; ECB retains responsibility for license withdrawal and is informed of deterioration and involved in crisis contact groups. ### Assessment of Principle 1 - Assessment: Largely Compliant. - Key observations: - ECB is unique as a supranational supervisor, responsible for enforcement (not rule-setting) and reliant on NCAs and national laws that are not fully harmonized. - CRD 6/CRR3 (2024) further harmonizes supervisory powers and addresses new risk areas (e.g., ESG, third-country branches, sanctions and periodic penalty payments). - Remaining gaps relative to full harmonization and international standards persist in areas such as transactions with related parties and certain national law-dependent powers (e.g., licensing criteria, governance of credit institutions). - ECB relies heavily on NCA human resources, requiring efforts to build a common supervisory culture. ### Independence, accountability, resourcing and legal protection (Principle 2) - Independence and governance: - SSMR prescribes operational independence; Supervisory Board members must act independently and objectively in the interest of the Union as a whole. - Accountability: ECB reports to the European Parliament and the Council; annual report required; Chair appears before Parliament and national parliaments; Interinstitutional Agreement and MoU with the Council detail arrangements. - Separation principle between supervisory and monetary policy functions is legally required, with organizational separation of staff; Vice-Chair is an exception, being an Executive Board member. - Decision-making: legally binding supervisory decisions prepared by the Supervisory Board and submitted to the Governing Council under a non-objection procedure (up to ten days for objection on monetary policy grounds); delegation frameworks exist to senior managers. - Appointment and removal: - Supervisory Board composition: Chair, Vice-Chair, four ECB representatives, one representative per NCA (NCA may be accompanied by an NCB representative without extra voting). - Chair selection via open procedure; Chair and four ECB representatives term: 5 years non-renewable. Vice-Chair term: 5 years (may be extended but not beyond Executive Board mandate of eight years). No fixed term for NCA members. - Removal procedures and grounds described in SSMR; Council may remove Chair after ECB proposal and European Parliament approval. - Transparency and priorities: - ECB publishes objectives and annual supervisory report; top priorities published (top priorities for 2023-2025 and supervisory priorities for 2025-27 cited). - ECB responded to 1,355 public questions on banking supervision-related topics in 2023. - Internal governance and processes: - Internal rules: SSMR, SSMFR, ECB Rules of Procedure, Rules of Procedure of the Supervisory Board, and the SSM Supervisory Manual (updated 2024). - Delegation: over half of supervisory decisions now taken by delegation; delegation frameworks published in the Official Journal. - Emergency procedures allow videoconference and expedited adoption; hearings may be postponed after provisional decisions. - Ethics, conflicts of interest and staff conduct: - Code of Conduct and ethics framework for staff and Supervisory Board members; annual disclosure of Supervisory Board members’ financial interests on the ECB website; enhanced Code of Conduct for high-level officials published in 2022. - Whistleblowing rules and protections introduced since last assessment. - Resourcing and budgetary arrangements: - ECB supervisory funding via fees on supervised entities; Governing Council adopts annual budget after Executive Board proposal in consultation with Chair and Vice-Chair of the Supervisory Board; BUCOM assists Governing Council. - SSM-related headcount augmented in 2015; a 50 FTE permanent SSM headcount pool established in 2019 for short-term versatility. - Headcount growth has levelled off due to ECB cost stabilization commitments; additional budget secured for DORA implementation but hiring had not taken place at time of assessment. - NCAs supply substantial human resources; NCAs provide more than 85 percent of heads of mission and team members for on-site inspections; more than half of NCAs have not been able to meet commitments in recent years. - Training: joint SSM training program; number of banking supervisors trained rose from roughly 1,200 in 2016 to 11,000 in 2024. - Technology: SupTech investments underway; IMAS platform and other supervisory IT require constant upgrades; SSM Tech Strategy 2024-2028 approved to maximize impact of applications and augment analytical capabilities. - Travel: ECB has a travel budget but on-site function constrained in international travel, including for climate reasons. - Legal protection and immunity: - ECB enjoys privileges and immunities under Protocol (No 7) on privileges and immunities of the European Union; ECB actions are subject to judicial control by the Court of Justice of the European Union (time limit for actions: two months). - Liability: ECB must make good damage in performance of duties under general principles; applicants must prove a “sufficiently serious” violation of Union law and causal link; actions for damages in supervisory context have been dismissed to date. - ECB staff and NCA staff participating in ECB bodies enjoy immunities; external contractors are not covered by ECB immunity and ECB contracts do not explicitly provide financial compensation for defending contractors in lawsuits. - Assessment: Largely Compliant. - Key comments: - Strong operational independence and accountability framework, with separation between supervisory and monetary policy functions. - Resource constraints and reliance on NCAs pose challenges to fully meeting supervisory needs; ECA recommended ensuring supervisory staffing levels are set independently of central banking staffing strategy and urging NCAs to meet commitments. - Further delegation of decision-making and clearer early-stage consultation on budget planning would improve efficiency and operational independence in practice. - ECB should ensure support and legal-cost protection for staff and extend similar protection to external consultants performing supervisory tasks where appropriate. ### Cooperation and collaboration (Principle 3) - Domestic cooperation: - CRD, SSMR, SSMFR, FICOD set cooperation frameworks with NCAs and ESFS on microprudential, macroprudential, consolidated supervision, crisis preparedness, management and statistics. - JSTs are the operational building blocks of the SSM; Supervisory Board includes one representative per NCA. - Close cooperation arrangements allow non-euro area member states to participate in SSM (example: Bulgaria established close cooperation in July 2020); close cooperation limits some activities (e.g., co-leading joint inspections). - European and supervisory bodies: - ECB cooperates closely with EBA, ESMA, EIOPA, and ESRB; EBA is a key partner for RTS and guidance and ECB participates in EBA technical groups and has non-voting status on EBA’s Board of Supervisors. - MoUs: ECB has MoUs with ESMA and selected National Market Authorities (CONSOB, AFM, BaFin, AMF, CNMV) for cooperation and information-sharing. - ECB is coordinator for 28 financial conglomerates under FICOD and concluded individual coordination arrangements with relevant competent authorities. - AML/CFT cooperation: - ECB exchanges information with national AML/CFT authorities in the EEA under a multilateral AML Agreement with 51 signatories; ECB participates as observer in 64 AML/CFT Colleges and contributes to EBA reporting systems and AMLA policy streams. - Macroprudential coordination: - ECB shares macroprudential responsibility with NDAs/NCAs; NDAs/NCAs must notify the ECB before activating macroprudential tools enshrined in CRR/CRD; ECB can apply higher requirements if necessary. - Macroprudential Forum holds quarterly meetings bringing together Supervisory Board and Governing Council members. - ESRB issues warnings and recommendations; General Board chaired by ECB President; Chair of Supervisory Board is a non-voting member. - Cross-border and third-country cooperation: - Colleges of supervisors are central for cross-border group supervision; participation for third-country authorities in colleges depends on equivalence of confidentiality regimes (EBA evaluations inform this). - ECB participates in the Trilateral Principal Level Exercise with the United States and the United Kingdom for cross-border resolution coordination. - ECB has negotiated bank-specific Written Coordination and Cooperation Arrangements (WCCAs); ECB participates in 47 supervisory colleges. - ECB has published around 30 MoUs on the ECB Banking Supervision website and is negotiating additional supervisory MoUs with third-country authorities. - Information confidentiality and onward use: - CRD and SSMR impose strict professional secrecy and limit uses of confidential information to supervisory purposes; onward sharing generally requires originating authority’s express agreement. - ECB complies with EBA recommendations on equivalence of third-country confidentiality regimes; where not equivalent, ECB negotiates specific clauses limiting onward sharing without consent. - EUDPR applies to ECB for transmission of personal data; transmission occurs only under strict conditions of EUDPR and is outside scope of supervisory MoUs. - Resolution cooperation: - SRB is primary partner for resolution; ECB-SRB MoU covers cooperation and information exchange across supervisory and crisis management phases. - SRB has access to supervisory reporting data and recovery plans; SRB granted shared access to parts of ECB supervisory platform; information sharing is automatic once an SI is assigned a certain SREP rating. - Cross-border arrangements: 10 institution-specific cross-border cooperation agreements for CMGs of G-SIBs; ECB has joined/is joining Written Arrangements for resolution colleges led by the SRB; MoUs with 6 EU non-participating NCAs/NRAs concluded in 2024. - Assessment: Compliant. - Comments: - Extensive network of cooperation and information-sharing arrangements with domestic and foreign authorities; 37 MoUs with third-country authorities and 33 WCCAs in place for supervisory colleges noted. - Opportunities remain for more joint inspections with foreign supervisors, closer cooperation with EIOPA, and addressing information flow impediments from some peer supervisors. ### Permissible activities and definition of banking (Principle 4) - Definition and licensing: - EU law uses the term “credit institution” (not “bank”) defined as “an undertaking the business of which is to take deposits or other repayable funds from the public and to grant credits for its own account”. - Following prior FSAP recommendations, this definition extended to include certain investment firms carrying out activities listed in Annex I to MIFID (dealing on own account, underwriting of financial instruments, and/or placing of financial instruments on a firm commitment basis) that meet thresholds in the CRR. - Permissible activities: - The permissible activities of credit institutions (and qualifying investment firms) are defined by Union law and national transpositions; a license is required only if proposed activities fulfil essential elements of the CRR definition (functional link between deposit-taking and credit-granting). - Types of activities a credit institution can carry out are not exhaustively determined at EU level; licensing requires that proposed activities meet the essential definition elements. *Source: IMF Detailed Assessment (EURO AREA) — selected sections on deposit protection, SSM supervisory framework, independence, resourcing, cooperation, and permissible activities.* ### Annex I to the CRD provides a list of activities that can be performed by credit institutions ### Annex I to the CRD provides a list of activities that can be performed by credit institutions ### Mutual recognition and scope of Annex I - Annex I to the CRD provides a list of activities that can be performed by credit institutions authorized in one of the member states without acquiring additional authorization from the host authorities (‘List of activities subject to mutual recognition’). - A Member State may allow credit institutions to perform fewer or other activities in the same Member State; in such a case, the additional activities would not be subject to mutual recognition and therefore the credit institution could only carry them out in its home Member State. ### National authorization regimes - Different regimes are in place at the national level. - Where ‘universal authorization’ regimes are in place, the authorization covers all the activities listed in the CRD Annex I and in accordance with national law. - Where no such ‘universal authorization’ is in place, the authorization is issued on an activity-by-activity basis and only covers the specific activities for which the authorization is granted. ### Application requirements - The CRD requires applications for authorization to be accompanied by a program of operations setting out the types of business envisaged and the structural organization of the credit institution. ### Permitted activities under national law - National law defines whether a credit institution is allowed to undertake activities other than the taking of deposits or other repayable funds from the public and the granting of credits for its own account, including activities 3 to 15 of CRD Annex I. ### Authorization procedure and competent authorities - The procedure for authorization to take up the business of a credit institution as entrusted to the ECB and national competent authorities applies to all activities permitted to credit institutions, including: - activities subject to mutual recognition within the meaning of CRD Annex 1, and - other regulated activities which under national law require authorization to undertake the business of a credit institution. - This procedure also applies if a credit institution, which already has a banking license, plans to undertake a new regulated activity listed in CRD. *Source: Annex I to the CRD provides a list of activities that can be performed by credit institutions* ### Annex 1 or one that requires an authorization only under national law. ### Annex 1 or one that requires an authorization only under national law. ### Use and restriction of the word “bank” (EC3) - Legal framework: - SSMFR (Article 78(5)): “the decision granting authorization shall cover the applicant’s activities as a credit institution as provided for in the relevant national law, without prejudice to any additional requirements for authorization under the relevant national law for activities other than the business of taking deposits or other repayable funds from the public and granting credit for its own account”. - CRD (Article 19): permits credit institutions to “use throughout the territory of the Union the same name that they use in the Member State in which their head office is situated,” and allows host Member States, “in the event of there being any danger of confusion,” to require explanatory particulars. - Findings: - The ECB does not have powers to restrict use of the word “bank”; such restrictions are at national level and vary across member states. - In some member states usage may be grandfathered or permitted if activities preclude impression of banking business; NCAs have investigated and sanctioned unlicensed use in some cases (including domain names). - Assessment: EC3 described; related supervisory powers noted (restriction/divestment powers exist for activities posing excessive risk). ### Deposit-taking and scope of reserved activities (EC4) - Legal framework: - CRD (Article 9): “member states shall prohibit persons or undertakings that are not credit institutions from carrying out the business of taking deposits or other repayable funds from the public”. - Exemptions: “the taking of deposits or other funds repayable by a Member State, or by a Member State's regional or local authorities, by public international bodies…or to cases expressly covered by national or Union law, provided that those activities are subject to regulations and controls intended to protect depositors and investors.” - Findings: - Responsibility for prohibitions and enforcement rests with member states. - Member states must notify the Commission and EBA of any national laws that allow non-credit institutions to take deposits from the public. - ECB is not involved in authorizations provided by national law for activities by non-CRR credit institutions because these do not fall under the definition of credit institution. ### Public register of licensed banks (EC5) - Legal & operational arrangements: - EBA publishes and updates a credit institution register with names of all institutions granted authorizations (institutions set up in member states; branches of EEA institutions; branches of foreign banks). - ECB publishes lists of supervised institutions and groups directly supervised by it and lists of entities supervised by NCAs; lists updated based on authorization decisions, withdrawals/lapsing, and significance amendments (LSIs and SIs). - Assessment of Principle 4: Compliant - Comments and observations: - Classes of credit institutions not authorized or supervised by the ECB (non-CRR credit institutions such as specialized banks and third-country branches). - CRD 6 requires third-country undertakings seeking to provide core banking services in the Union to establish a branch in a Member State and be authorized under Union law unless they operate via a subsidiary. - Need for clearer definitions in Union legislation for key terms: ‘deposits’, ‘other repayable funds’, ‘grant credits’, 'the public'. ### Licensing criteria and processes (Principle 5; EC1–EC11) - Legal framework and allocation of duties: - SSMR and SSMFR identify the ECB as the ultimate competent authority for licensing credit institutions; NCAs are the entry point and prepare proposals; ECB assesses compliance with relevant Union law while NCAs assess national law compliance. - The CRD defines minimum licensing criteria and information requirements; Commission Delegated Regulation 2022/2580 and RTS/ITS detail required application content and templates. - Key observed metrics: - In the last 5 years, 146 license applications received; 23 withdrawn or cancelled. - In the same period, 40 SIs and 48 LSIs’ licenses were revoked, withdrawn or surrendered. - ECB approvals for financial holding companies (FHCs) in last 5 years: 49 notified to ECB, of which 21 requests for approval and 28 requests for exemptions. - EC1 (authority identification and withdrawal): - Description: NCAs propose, ECB decides; duty to cooperate in good faith; withdrawals follow similar processes with consultation depending on initiator and significance. - Finding: strong cooperation observed between ECB and NCAs. - EC2 (power to set criteria and reject): - CRD defines minimum criteria (program of operations; structural organization; governance; initial capital; fit and proper; absence of close links preventing supervision; co-location of head office and registered office). - Both NCA and ECB may reject applications; ECB may object to NCA draft authorization proposals; both can request all relevant information. - Implementing technical standards and templates exist to standardize information submission. - EC3 (supervision and prevention of shell banks): - Authorization conditions include fit and proper requirements and direct link between incorporation and supervision jurisdictions. - Authorization refused where shareholders unsuitable, close links prevent supervision, or third-country laws impede supervisory functions. - ECB practice: does not license shell banks; supervisory expectations established. - EC4 (major shareholders and beneficial owners): - CRD Article 14: suitability of major shareholders; major shareholders include qualifying holdings (10 percent) or, if none, the top 20 largest shareholders. - Commission Delegated Regulation 2022/2580 Article 6: applicants must explain funding sources and evidence of availability of funding for own funds. - Supervisory practice: assessors reviewed licensing files where shareholders, ultimate controllers/beneficiary owners were identified and suitability/funding reviewed; supervisors assess financial soundness for first three years of business. - EC5 (minimum initial capital): - CRD sets minimum initial capital: EUR 5 million (held as CET1). - For banks licensed before 1979: EUR 1 million; increases above EUR 1 million must be retained until EUR 5 million reached. - CRD Article 12(4): member states may authorize specific categories of credit institutions with initial capital less than EUR 5 million but not less than 1 million. - NCAs may impose additional initial capital requirements; initial capital may differ across member states. - EC6 (fit and proper assessments): - CRD lists expected criteria; EBA/ESMA Joint Guidelines specify notions of time commitment, collective knowledge, honesty, integrity, independence and diversity. - ECB published ‘Guide to Fit and Proper Assessments’ and a practical manual for interviews; suitability reassessments required in certain events (e.g., change of control, AML concerns). - Observed practice: licensing files include fitness and propriety checks (reputation, experience, education, conflicts, criminal background). - ECB relies on NCAs to collect criminal background and AML information; differing national deadlines can challenge process. - EC7 (strategic and operating plan review): - Commission Delegated Regulation (EU) 2022/2580 sets program of operations content and requires a three-year program (base case and stress scenario) including structural organization, governance, risk management, outsourcing, IT, business continuity, remuneration, ICT and AML/CFT policies. - Observed licensing files included structural organization, governance policies, program of operations, projections and plans. - EC8 (financial projections and adequacy): - Applicants must provide forecast accounting plans for first three years (forecasted balance sheets, P&L, cash flow), planning assumptions, forecasts of own funds and liquidity, internal liquidity adequacy assessment, indebtedness outline, etc. - EC9 (foreign banks establishing branches/subsidiaries): - EU/EEA established credit institution branches: passporting; home supervisor notified and may oppose based on administrative structure or financial situation. - Third-country branches: NCAs (not ECB) are competent for supervision and licensing. - CRD 6: will require efforts to conclude administrative agreements with relevant third-country authorities; CRD 6 introduces Class 1/Class 2 branch categorization and differentiated authorization criteria. - Class 1 criteria include: larger than 5 billion EUR asset size; collect deposits more than 5 percent of their total liabilities in a member state; or not defined as qualifying branches. - CRD 6 thresholds mentioned: EUR 40 billion (EU-wide branch asset threshold for requiring subsidiary), EUR 10 billion (member-state branch threshold). - Material holding threshold introduced elsewhere: 15 percent of eligible capital (see Principle 7). - Observations: - ECB faces difficulties assessing third-country global consolidated supervision; limited EU/EA-wide information on third-country branch activities, booking models and risks. - CRD 6 improves information exchange and creates college of supervisors for Class 1 third-country branches, but ECB may still lack access to relevant information where only branches exist in euro area and no college is established. - EC10 (monitoring new entrants): - SEP (Supervisory Evaluation Program) determines minimum JST activities; no specific SSM requirement for special supervisory approach to newly licensed banks despite higher early-years risk. - Conditions attached to authorization monitored by JSTs for SIs; national-law-based conditions monitored by NCAs in coordination with JSTs. - EC11 (consistency of licensing and ongoing supervision): - CRD requires withdrawal if conditions under which authorization was granted no longer hold. - ECB focuses ongoing supervision on capital, program of operations, structural organization, suitability of managers and shareholders, and AML/CFT; authorization conditions are part of ongoing monitoring. - Assessment of Principle 5: Largely Compliant - Comments: - Clear EU legal provisions and ECB empowerment for licensing/withdrawal, but complexity arises from differing national transpositions and laws. - Guidance published (EBA/ESMA guidelines; ECB guides for license assessments and fintech applicants; ECB Guide to Fit and Proper Assessments). - In last 5 years ECB assessed 146 license applications. - ECB is not licensing authority for third-country branches; CRD 6 brings changes but large third-country branches may remain supervised by NCAs unless converted into subsidiaries and deemed significant. - No mandatory requirement for a host supervisor to obtain a non-objection statement from a home supervisor before issuing a license; assessors note an ITS being drafted where a no objection statement will be mandatory. ### Transfer of significant ownership (Principle 6; EC1–EC6) - Definitions and thresholds: - CRR: ‘qualifying holding’ = 10 percent or more of capital or votes, or ability to exercise “significant influence”. - “Control” defined with reference to Accounting Directive Article 22 and accounting standards; indirect control recognized. - Where no qualifying holdings, top 20 largest shareholders must be identified. - EBA/ESMA/EIOPA Joint Guidelines (JC/GL/2016/01) provide clarifications on significant influence, acting in concert and indirect acquisition methodologies (control criterion and multiplication criterion). - Observed activity and metrics: - Between 2019 and 2023, 479 qualifying holding procedures were completed. - EC1 (definitions): clear definitions exist for qualifying holding and control; “significant influence” not defined in CRR but clarified in Joint Guidelines. - EC2 (requirements to obtain approval/notify): - Notification required for acquisitions leading to thresholds: 10 percent, 20 percent, 30 percent or one-third, 50 percent or resulting in subsidiary status, or where significant influence is obtained. - Competent authorities must oppose within assessment periods and inform reasons in writing within two working days of completion. - SSMR: ECB exclusive competent agency for assessing acquisitions/increases of qualifying holdings in SSM member states; NCAs are entry points via IMAS. - EC3 (power to reject/change ownership; false information): - CRD Article 23 criteria for opposition: reputation of acquirer; fitness/propriety of new managers; financial capacity/soundness of acquirer; ability of target to comply with prudential requirements; suspicion of ML/TF. - If acquisition occurs despite opposition, national law should provide for suspension of voting rights, nullity or annulment of votes, or other penalties. - No explicit EU-wide statement on reversing ownership obtained by false information; remedies depend on national law; ECB may, as last resort and if proportionate, withdraw bank authorization under Article 18 CRD. - ECB guidance and joint guidelines detail supervisory practices and stricter assessment approaches for specific acquirer types (private equity, sovereign funds, third-country acquirers). - EC4 (data on significant shareholders): - AML Directive (EU) 2015/849: obligation for companies to obtain and hold accurate current beneficial ownership information. - CRD: listed credit institutions must annually inform competent authorities of names and sizes of shareholders with qualifying holdings; general requirement to inform upon becoming aware of acquisitions/disposals crossing thresholds. - Observed gap: not all banks covered; ultimate beneficial owner identification depends on national law; assessors did not find evidence that ECB systematically collects all required information via periodic reporting or on-site exams. - EC5 (remedies for unauthorized changes of control): - CRD requires member states to apply administrative sanctions or suspension of voting rights; some national frameworks provide automatic suspension. - EU framework does not mandate ownership reversal/voiding; only some member states have national provisions for unwinding/forced divestment. - Observed practice: suspension of voting rights used in several cases; 19 member states allow suspension based on unauthorized acquisition, 8 have automatic suspension; suspension of indirect shareholders limited (17 of 21 SSM participating member states). - Limitations: suspension of voting rights may not remove reputational, financial or governance risks posed by unauthorized shareholders. - EC6 (bank notification obligations about shareholders): - No EU-level requirement in CRD/CRR for banks to notify the supervisor as soon as they become aware of material information affecting suitability of major shareholders; some national frameworks (Latvia, Netherlands) require such notification. - Assessment of Principle 6: Largely Compliant - Comments: - SSMR empowers ECB as exclusive competent authority for qualifying holdings assessments in euro area; cooperation with NCAs via IMAS. - Between 2019 and 2023, 479 qualifying holding procedures completed. - Dependence on national law limits uniformity: not all jurisdictions impose immediate notification obligations or unwinding powers; suspension of voting rights widely available but has limitations. ### Major acquisitions and investments (Principle 7; EC1–EC6) - Scope and legal landscape: - Prior to full transposition of CRD 6, a patchwork of national provisions governs acquisitions by EU credit institutions. - CRD 6 introduces a new concept of “material holding” (Article 27a): holding ≥ 15 percent of eligible capital of the acquirer triggers notification and assessment requirements. - Distinction: “qualifying holding” focuses on target institution; “material holding” focuses on acquirer exposure. - EC1 (types/amounts requiring approval vs notification): - EU banks: acquisitions of qualifying holdings governed by CRD (notification/approval thresholds tied to 10 percent, 20 percent, 30 percent/one-third, 50 percent). - EU investment firms and insurance undertakings: MiFID II and Solvency II notify authorities; banking supervisor consulted where acquirer is a credit institution. - Non-bank targets or non-EU banks: current CRD/CRR coverage limited; national laws determine whether prior approval or notification required. Examples: - Germany and Portugal: national law may only require simple notification (no ex ante objection power). - Spain: authorities can object to acquisition of holdings in non-EU banks. - France: competent authority can object to acquisition of holdings in insurance firms outside the EEA. - Prudential constraints for acquisitions in non-financial sector: - If significant ownership in nominal capital exceeds 15 percent of eligible capital, or total of such holdings exceeds 60 percent of eligible capital, any excess is subject to a 1,250 percent risk weight; alternative is deduction from CET1. - EC2 (criteria to judge proposals): - Historically, criteria and procedures for acquisitions rest at national level. - CRD 6 harmonizes notification/assessment for material holdings (≥ 15 percent of eligible capital) and aligns acquisition-of-qualifying-holding rules with material holding assessment where both apply. - Competent authorities must assess whether acquirer can comply with prudential requirements post-acquisition and whether AMLD concerns arise; negative AML supervisor opinion within 30 working days is duly considered. - EC3 (supervisory power to prohibit due to host country restrictions): - ECB assesses undue risk as part of ongoing supervision; ability to prohibit or object to acquisitions of non-banks/non-EU banks depends on national law powers; CRD 6 will enhance ability to oppose acquisitions of material holdings that jeopardize effective consolidated supervision. - EC4 (adequacy of acquirer’s resources): - No uniform requirement for pre-acquisition assessment of adequacy of financial, managerial, organizational resources for acquisitions outside the financial sector prior to CRD 6; risks managed via CRR 15 percent limit and risk-weighting/deduction regime. - ECB expects to be informed of material transactions and assesses comprehensive impact (capital, liquidity, governance, organization); SREP may set new requirements post-transaction. - ECB can impose measures under SSMR (capital/liquidity add-ons, governance/organizational reinforcements, divestment requests) where preconditions met. - EC5 (non-banking activities risk awareness and mitigation): - ECB aware of risks; has power under SSMR to restrict/limit business or request divestment of activities posing excessive risk. - Timeliness of action may be limited where national laws do not require pre-notification/assessment. - CRD 6 will subject acquisitions that meet material holding definition to uniform notification/assessment. - EC6 (acquisitions by other group entities): - ECB expects to review major acquisitions by other entities in the banking group as part of ongoing supervision and SREP; will use supervisory measures where undue risks arise. - For acquisitions in non-banks or non-EU banks, ECB’s powers depend on national law. - Assessment of Principle 7: Materially Non-Compliant - Comments: - Principle intent: supervisors should be notified and have power to approve/reject material acquisitions or investments by banks (domestic or cross-border). - Current gap: EU-level rules historically cover mainly acquisitions of EU banks and non-bank financial sector; acquirer-side powers for acquisitions of non-banks or non-EU banks are uneven and depend on national law. - Until CRD 6 is fully transposed and supporting RTS/ITS finalized, national laws will continue to create inconsistent coverage (ranging from prior approval to mere notification or no notification). - CRD 6 represents significant progress: harmonized notification/assessment for material holdings (15 percent threshold) and other alignments; full compliance depends on national transposition and final RTS details. - Observed supervisory practice: ECB has used general powers to address acquisition risks ex post (e.g., enhanced P2R add-ons) but lacks consistent ex ante powers across jurisdictions. *Source: 1eurea2025012 - Annex 1 or one that requires an authorization only under national law. https://www.imf.org/-/media/files/publications/cr/2025/english/1eurea2025012.pdf* ### references both acquisitions and investments, whereas the CRD text refers to acquisitions of ### 1eurea2025012 - references both acquisitions and investments, whereas the CRD text refers to acquisitions of ### Principle 8 — Supervisory approach - Core expectation: supervisor develops and maintains a forward-looking assessment of banks’ risk profiles, proportionate to systemic importance; identifies, assesses and addresses bank- and system-level risks; has early intervention framework; plans with other authorities for orderly resolution of non-viable banks. - SREP structure (EBA Guidelines): four elements - Element 1: Business Model Analysis and profitability assessment - Element 2: Internal Governance and risk management assessment - Element 3: Assessment of risks to capital by risk type - Element 4: Assessment of risks to liquidity by risk type - SSM SREP Process components: - a) assessment by supervisors - b) benchmarking against suitable comparator banks - c) decision-making step and preliminary assessment (“the supervisory dialogue”) prior to finalization by the Supervisory Board - Three-phase assessment of each SREP element: - Phase 1: supervisors gather data from the bank - Phase 2: automated preliminary anchoring score for risk level and formal compliance check for risk control - Phase 3: thorough supervisory assessment with supervisory judgement on bank specificities - Findings on SREP execution: - Framework fully articulated; internal SREP guidance comprehensive and a version published - High resource burden and near-continuous process; SSM acknowledges need to adapt to reduce administrative burden - Multi-Year Approach introduces optionality in review periodicity (some areas move from annual to tri-annual), aims to reduce SREP timeline to 9 months and shift supervisory dialogue to June/July from September - Benchmarking and data-supported assessment continue; benchmarking uses business model clustering and other approaches - Observed statistical patterns: standard deviation of SREP scores reducing; mean of distribution increasing; asymmetrical score movements (quicker to increase perceived risk than to reduce) - SREP typical timeline for risk management is one to three years; incompatible with some climate- or nature-related risks (EBA reflecting on this) - EC2 (systemic importance) - Legal basis: SSMFR; significance assessment determines annual ECB supervision list - Currently 113 institutions designated significant; NCAs supervise over 2,000 LSIs - Important institutions comprise over 80 percent of banking assets in the Eurozone - Gradual increase expected in proportion of firms classified significant due to nominal criteria; increases heterogeneity and benchmarking difficulty - Five FMIs with banking licenses are considered LSI and supervised by NCAs; one FMI met size criterion for SI but remained LSI under Article 6(4) SSM Regulation; potential options: single regulator vs strengthened ECB oversight of LSI supervision (benchmarking, harmonizing Pillar 2 calibration) - EC3–EC8 summary findings: - EC3: Compliance with prudential regulations assessed regularly in SREP across risk categories (own funds, securitization, large exposures, liquidity, leverage, reporting, governance, ICAAPs, IRB models) - EC4: Macroeconomic environment, climate-related and emerging risks considered in SREP and strategic planning; ECB active on climate/biodiversity supervisory issues; internal audit noted challenges incorporating macro perspective into SREP - EC5: SSM conducts detailed system-wide risk identification leveraging NCAs, EU and international bodies; outputs considered high quality - EC6: Resolvability assessments conducted with resolution authority; legal framework CRD, BRRD, SSMR, SRMR; SRB guidance (“Expectations for Banks”) and resolvability reporting exist; SRB powers to require removal of resolvability impediments rarely used to date - EC7: Framework for early intervention and crisis management exists (EAP for SIs); decision-making respects ECB Treaty rules (Supervisory Board proposes complete draft decisions; Governing Council adopts); emergency meeting procedures exist; crisis procedures largely single-firm focused and may not suit simultaneous multi-firm events - EC8: Supervisors expected to act on bank restructuring to avoid regulatory perimeter or bank-like activities outside perimeter, but assessors saw no examples in practice and no internal guidance - Assessment of Principle 8: Largely Compliant - Comments: SSM delivers an intensive, codified, transparent supervisory approach and has raised supervisory quality and convergence; resource-intensity and administrative burden limit agility; Multi-Year Approach marks a shift toward risk-based supervision but full efficiency gains uncertain ### Principle 9 — Supervisory techniques and tools - Core expectation: supervisor uses appropriate mix of on-site and off-site techniques, deploys resources proportionately to risk and systemic importance - EC1 (mix on-site/off-site): - Framework: CRD, SSMR, EBA SREP Guidelines - SSM uses a variety of tools; likely greater use of on-site inspections compared with peers - SREP determines priorities and feeds Supervisory Examination Programme (SEP); thematic inspections conducted via campaigns; horizontal supervision function performs benchmarking and industry-wide assessments - On-site and off-site processes documented in SSM Manual; reviewed outputs high-quality and detailed - Staffing challenges for inspections noted; instances of overlap between horizontal and inspection resources - EC2 (planning/execution): - Strategic planning follows SSM Risk Management Framework; supervisory priorities defined annually covering three-year horizon - Planning is lengthy and complex; demand-side intensity sometimes disconnected from resourcing (supply side), contributing to inspection cancellations and resource overstretch - EC3–EC5 (information and supervisory actions): - EC3: Wide range of information sources used (see EC3 in Principle 10 for full list); supervisors determine reliability of information - EC4: Variety of tools used for assessments includes analysis of financial statements, business model analysis, horizontal peer reviews, corporate governance reviews, stress test outcomes, capital and liquidity adequacy under adverse scenarios; SREP is backbone - EC5: Supervisory findings communicated via recommendations, operational letters, draft and formal decisions; process typically includes informal dialogue, formal notification, bank’s right of reply, monitoring, escalation to enforcement - Communication issues: letters often lengthy and legalistic; measures sometimes not SMART; Executive letters and Help Desks introduced to improve clarity - EC6–EC12 (specific tools and processes): - EC6: Internal audit function evaluated within SREP; can be used as additional assurance - EC7: JSTs engage frequently with bank boards, management, mid-level managers; JSTs may attend boards as observers - EC8: On-site inspection reporting lifecycle: status meetings during investigation; draft report sent 3-5 days in advance; inspected entity has two weeks to submit written comments; final report produced after exit meeting and feedback; findings structured as Criteria, Condition, Root Cause(s), Effect - EC9: Follow-up challenges—number of outstanding issues remained high in 2023 with more issues opened than closed; tendency to identify symptoms rather than root causes; escalation framework early in roll-out and currently more thematic than idiosyncratic - EC10: Level 1 requires notification of acquisitions/disposals of holdings crossing thresholds, immediate notification when recovery plan indicators met, reporting on cyber incidents, and breaches; assessors noted no requirement for substantive changes in activities or internal structure - EC11: Use of external experts limited; framework agreement with twelve firms for external professionals to support on-site missions; external professionals act as team members under SSM lead; conflict-of-interest checks and cooling-off periods in place - EC12: SSM information systems extensive, supporting compliance, issue tracking, data analysis, benchmarking, network analysis, ML/AI solutions - Additional criterion 9 AC1 (independent reviews) - SSM risk management function responsibilities include strategic risk, consistency and effectiveness risk, implementation risk, operational risk - Internal audit provides independent assurance and evaluates effectiveness of risk management, control and governance - Assessment of Principle 9: Compliant - Comments: Highly sophisticated supervisory architecture supported by analytics and technology; challenges include overlaps between horizontal and inspection work, resource constraints, need for improved prioritization and clearer communication (especially Pillar 2); continued work needed to improve supervisory convergence across NCAs, oversight of newly licensed banks, timeliness of inspections, and breach reporting framework ### Principle 10 — Supervisory reporting - Core expectation: supervisor collects, reviews and analyses prudential reports and statistical returns on solo and consolidated basis and independently verifies them - EC1 (power to require information) - All EU banks must submit FINREP (financial) and COREP (prudential) reports under CRR and ITS on Supervisory Reporting (Commission Implementing Regulation (EU) 2021/451) - FINREP and COREP provide detailed data on capital adequacy, liquidity, Pillar 1 risks, balance sheet, P&L, off-balance sheet items, large exposures, asset quality, related party transactions - Note: related parties definition for FINREP based on IAS 24, narrower than CP 20; related party transaction reporting not sufficiently granular (grouped by type of counterparties) - Some Pillar 2 elements included in harmonized EU COREP; IRRBB harmonized reporting started in 09/2024; ESG risks to be covered during 2025 - ECB can require additional data (Article 10 SSMR); uses Short Term Exercises (STE) for SREP and climate data, among others - Data collected on solo and consolidated basis as required by ITS; ECB may waive solo reporting per CRR derogations (Articles 7, 8, 10) - FINREP extension via ECB Regulation (EU) 2015/534 to non-IFRS reporters and solo level; proportionality applies for less complex institutions - AnaCredit provides detailed harmonized dataset on individual bank loans - Work on integrated reporting system (Article 430c of CRR2 mandate) could radically change reporting landscape if completed - EC2 (reporting instructions) - ITS on Supervisory Reporting includes detailed templates and instructions based on IFRS and local GAAPs; ECB disclosures of additional STE instructions on SSM website - ECB Regulation (EU) 2015/534 provides nGAAP templates harmonizing reporting for non-IFRS entities - EC3 (valuation and governance) - CRD requires management body attention to valuations, use of external ratings, internal models - Prudential valuation EBA RTS sets approaches (simplified and core) and verification requirements; independent pricing verification at least monthly where applicable - ECB not formally empowered to require accounting adjustments but SSMR provides broad powers; ECB can influence provisioning policy within accounting limits and require adjustments to own funds calculations where accounting treatment not prudent - EC4 (reporting frequency) - Minimum frequencies under EU harmonized reporting: - Capital requirements/COREP (quarterly) - IRRBB/COREP (quarterly) - FRTB (preparatory reporting) (quarterly) - Benchmarking internal models (annually) - Financial information/FINREP (quarterly with some templates semi-annually or annually) - Large exposures (quarterly) - Losses from immovable property (annually) - Leverage ratio (quarterly) - Liquidity (LCR and additional liquidity metrics monthly, NSFR quarterly, asset encumbrance quarterly, funding plans annually) - Remuneration policies (annually) - G-SII reporting (quarterly) - Frequencies adjusted by institution complexity and risk profile; ECB used CRD Article 104(1) paragraph j to request additional/frequent reporting 85 times over last 4 SREP cycles for 55 banking groups (examples: weekly liquidity reporting, NPE coverage reporting, IT governance action plans) - STE collections offer flexible frequency and can be adjusted as needed - EC5 (comparability) - Harmonized EBA reporting provides comparable data; reporting reference dates adjusted for institutions with non-calendar year-ends per ITS - EC6 (power to request group-wide information) - SSMR empowers ECB to collect recurring and specified-format information from credit institutions, MFHCs, FHCs, mixed activity holding companies and third-party outsourcers - Ad hoc reporting complements ITS; JSTs obtain intra-group information where needed; recent Commission Implementing Regulation (EU) 2022/2454 effective Dec 31, 2023 improved collection on intra-group transactions and risk concentration for financial conglomerates; capital adequacy collection for FCs still under JCFC discussion - Assessors note reporting related party definition narrower than BCP definition - EC7 (enforcement & accountability) - SSMR grants ECB power to apply administrative penalties and enforcement measures (e.g., periodic penalty payments) for reporting breaches; SSM has applied sanctions for inaccurate reporting - Since 2023 ECB requires management bodies to underwrite a Management Report on Data Governance and Data Quality covering punctuality, accuracy, completeness and qualitative self-assessment of reporting capabilities - EC8 (data validation) - EBA ITS defines data items and binding validation rules; EBA additional quality checks available to NCAs - ECB Banking Supervision Data Division (BSDD) responsible for collection and quality review; close cooperation with NCAs; automated checks and dedicated database for failing data quality checks - Quality Findings Report (QFR) sent to NCAs targeting SIs with pending failing checks for past 5 quarters - ECB performs data quality checks in on-site and off-site activities - EC9 (periodic review of information collected) - EBA ITS periodically updated per Article 430(8) CRR; SSM reviews STE templates annually and assessed STE template utilization in 2021 to inform relevance - Article 430c CRR2 mandate for EBA feasibility assessment of integrated system for statistical, resolution and prudential data; feasibility study published (work in progress) - STE processes improved operationally though STE less standardized and dynamic, possibly leading to lower data quality initially - Assessment highlights and operational points: - STEs are used to fill gaps not covered by ITS (examples: SREP STE, climate risk, CIB benchmarking, ALM governance, EBA stress test data, Basel monitoring to 84 selected SIs) - Timelines for ITS amendment and implementation typically ~9 months preparation + 6–12 months implementation; fast-track possible in critical situations - Data collections can be imposed on case-by-case basis in crises (e.g., COVID-19 examples) - Going forward, integrated reporting could materially change supervisory reporting if completed *Source: IMF staff summary of the provided chapter PDF content.* ### 2021. Since then, European authorities have been working on developing an integrated ### Assessment of Principle 10 and Principle 11 ### Integrated reporting and data harmonization (Principle 10) - European authorities are developing an integrated reporting system; completion is a medium-term project and "has already been delayed." - All authorities agree on the need to define a common data dictionary for prudential, statistical and resolution data as a key building block for an integrated reporting system. - The Integrated Reporting Framework (IReF) is investigating possibilities to increase the granularity of reported statistical data so that granular data collected from banks can be re-used for several purposes (e.g., "there would be several ways of combining such data to generate, but not necessarily replicate, supervisory reports, as desired by each competent authority"). - A Joint Bank Reporting Committee (JBRC) involving all relevant EU bodies (including the EBA and ECB), as well as national authorities and banking industry representatives, has been established to enhance cooperation on development and implementation of the integrated reporting system. - Expected benefit: integrated reporting would reduce the need for ad hoc-data requests. ### Supervisory reporting framework, gaps, and interim solutions - Supervisory reporting requirements are predominantly governed by a harmonized EU regime under the EBA; standard returns include FINREP and COREP under the ITS on supervisory reporting. - Banks submit standardized regulatory returns on a quarterly frequency and more often for certain types of information. - Limitations identified: - Credit institutions report using both nGAAP and IFRS; differences can be material and make comparisons and outlier identification more difficult. - Revising and enhancing the standardized suite of regulatory returns at EU level is a lengthy process because it requires amending the ITS on supervisory reporting. - Relevant data may be lacking for SSM needs (example: "there is no reporting on intraday liquidity and discussion at the EBA level is still ongoing"). - Where EBA reporting does not address SSM data needs, the ECB may undertake additional data collections (e.g., the Short-Term Exercise (STE)): - First limitation: the ECB cannot collect additional data in areas already covered by the ITS on supervisory reporting, nor require reporting in a different format or breakdown. - Second limitation: STEs are less standardized compared to ITS reporting, which "may lead to a generally lower data quality." - Collecting management information from banks is possible but "does not facilitate peer group analysis." - Conclusion: critical to expedite implementation of the integrated reporting system to better balance harmonization and flexibility, but this project remains medium-term and delayed. ### Data governance, management accountability, and supervisory adjustments - Since 2023, the ECB requires the management body of directly supervised institutions to underwrite a "Management Report on Data Governance and Data Quality", including information on punctuality, accuracy, and completeness of supervisory reporting and a qualitative self-assessment on reporting capabilities. - The ECB cannot formally require a bank to adjust its regulatory reporting if valuations are deemed not sufficiently prudent, but under the SSMR the ECB can require a bank to apply a specific provisioning policy or treatment of assets in terms of own funds requirements. - This allows the ECB to require adjustments (deductions, filters or similar measures) for determining capital ratios for prudential purposes where the accounting treatment is considered not prudent from a supervisory perspective. - Data collection on transactions with related parties is "not sufficiently granular and the scope is too restricted" because the definition in use (IAS 24) is narrower than that of CP 20. ### Corrective and sanctioning powers of supervisors (Principle 11) — EC1 findings - Legal and supervisory basis: - The CRD and the SSMR empower the ECB to require supervised entities to take necessary measures at an early stage to address problems regarding compliance with prudential requirements, management soundness, and sufficiency of risk coverage. - The ECB conducts at least annually the SREP under the CRD and related EBA Guidelines and adopts appropriate supervisory measures through supervisory decisions. - ECB supervisory decisions are required to be adopted following provisions in the SSMR and SSMFR and "are notified in writing" as a rule. - Early-stage engagement and measures: - The ECB may identify need for immediate measures via ongoing off- or on-site activities, meetings with management or key staff, or letters of intervention; methods include non-binding routine or ad hoc requests, letters, and statements listing goals, time frames and steps while leaving banks the duty to identify appropriate actions. - Monitoring and follow-up: - Joint Supervisory Teams (JSTs) perform follow-up monitoring using periodical or ad hoc reports, meetings, or follow-up inspections. - A dedicated IT tool ("IMAS") supports JST monitoring; the follow-up process, including frequency and type of monitoring, is defined by the JST and communicated to banks when initial measures are issued. - JSTs must include follow-up of supervisory measures in the supervisory calendar for the relevant credit institution. - JSTs produce regular follow-up notes describing progress and forward information to ECB horizontal divisions and, if relevant, to the Supervisory Board and/or the Governing Council. - Escalation and enforcement: - If a credit institution does not comply with a supervisory measure, JSTs must consider additional actions according to an escalation framework; responses range from informal notifications to use of additional supervisory powers, enforcement measures or sanctions depending on nature and extent of non-compliance. - Suspected breaches of prudential requirements or ECB regulations/decisions are referred to the ECB’s Enforcement and Sanctions Division. - If additional supervisory measures (different from enforcement or sanctions) are needed, the ECB will evaluate which supervisory measures should be applied to the significant credit institution. - Decisions on measures and sanctions are taken by the Supervisory Board and the Governing Council following general decision-making procedures. - For LSIs, NCAs should notify the ECB of any material supervisory procedures or material draft supervisory decisions, especially for riskier and larger LSIs. - Internal governance of supervisory practice: - The ECB has codified practices in an "SSM Playbook on Supervisory Findings and Actions Effectiveness" available to all supervisors in ECB and NCAs since December. *Source: IMF staff report text excerpt* ### 2023. A series of horizontal support teams have been created to address topic-specific issues ### 2023. A series of horizontal support teams have been created to address topic-specific issues ### Horizontal support teams and playbook - Help Desks created to address topic-specific issues, fostering supervisory effectiveness for key SSM priorities (examples: climate and environmental risks, risk data aggregation and reporting, management bodies). - The playbook contains guidance on how to manage findings and measures, including practical examples. - Principles 7 (timely remediation) and 8 (escalation) emphasize: - the need for timely action in remediating banks’ issues once findings are detected; - the need to issue corrective measures for banks to implement and to follow up on those measures or to request others if needed. ### EC2 — Range and use of supervisory tools - The supervisor uses an appropriate range of supervisory tools in a timely manner when a bank is non-compliant, engaged in unsafe or unsound practices, or when depositors’ interests are threatened. - ECB powers mirror those in the CRD and the SSMR and additionally: - may directly exercise all powers conferred on the NCAs by national law transposing Union law directives; and - may require NCAs, by way of instructions, to make use of their powers under national law where necessary to carry out ECB tasks. - Two modes of action: - Informal dialogue / operational acts: do not require Supervisory Board and Governing Council decisions and have no legal effect (examples: letters describing insufficiencies, meetings recorded in SSM database). These act as moral suasion. - Formal binding supervisory measures: require Supervisory Board and Governing Council decisions; used where moral suasion fails or breach is significant. Examples include drawing up an action program and timetable, replacing managers, requesting shareholders’ meetings, appointing special managers. - Distinction between supervisory measures, enforcement measures (to compel compliance), and sanctions (to punish infringements). ### EC3 — Early intervention, SREP, and enforcement/sanctions framework - CRD requires competent authorities to require institutions to take necessary measures at an early stage if they do not meet CRD/CRR requirements or are likely to breach them in the following 12 months. - SSMR requires the ECB to ensure compliance with Union law and national law provisions transposing Directives on own funds, securitization, large exposures, liquidity and leverage. - Actions when prudential requirements are not met or likely to be breached: - ECB may exercise supervisory powers under the SSMR and apply enforcement measures to compel compliance. - SSM can use early intervention powers under the BRRD. - SREP process: - Documents Pillar 2 assessment of SIs including decisions on adequate capital, liquidity and additional supervisory measures. - Steps and timing detailed in the SSM common timeline. - SREP updates outside the annual procedure considered in cases of significant change (examples: risk profile, operating environment, significant acquisition). - Quarterly dashboard provides oversight of regulatory breaches, warnings, and potential referrals; includes capital ratios, liquidity ratios, Leverage ratio, and Large Exposures. - Limitations and developments: - ECB lacked express authority to adopt "cease and desist" orders directly in all cases; may apply them directly where national law qualifies them as enforcement measures under CRD transpositions, otherwise indirectly via NCAs (Articles 9(3) and 18(5) SSMR). - Sanctions: pecuniary penalties can be imposed directly by the ECB; non-pecuniary penalties generally imposed indirectly via NCAs. - CRD 6 reinforces enforcement and sanctioning powers by broadening sanctionable breaches, distinguishing ‘administrative sanctions’ and ‘enforcement measures’, and enlarging scope of PPPs; CRD 6 remained to be transposed into national legislations at time of assessment. ### EC4 — Breadth of early-stage corrective measures and harmonization issues - ECB can require corrective actions and impose enforcement measures and sanctions. - Supervisory measures (examples listed in SSMR and used in SREP letters and Article 16 SSMR decisions): - require institutions to hold own funds in excess of capital requirements; - require reinforcement of arrangements, processes, mechanisms and strategies; - require presentation of a plan to restore compliance with supervisory requirements; - require specific provisioning policy or treatment of assets for own funds requirements; - restrict or limit business, operations or network; request divestment of risky activities; - require reduction of risk in activities, products and systems; - require limiting variable remuneration as a percentage of net revenues; - require use of net profits to strengthen own funds; - restrict or prohibit distributions to shareholders, members or holders of Additional Tier 1 instruments; - impose additional or more frequent reporting requirements; - impose specific liquidity requirements; - require additional disclosures; - remove members from management bodies who do not fulfil requirements. - ECB may directly adopt measures that NCAs have under national law implementing relevant directives and may instruct NCAs to use purely national powers beyond CRR/CRD where necessary. - Recommendation noted: include all supervisory and early intervention powers currently in SSMR and BRRD under a single directly applicable EU provision to harmonize conditions and ensure prompt ECB intervention. - Early intervention under BRRD vs SSMR: - BRRD early intervention powers include requiring restructuring plans, limiting lending, requiring recovery plan options, dismissing management; triggers under BRRD are more restrictive and have been rarely used. - Article 16(2) SSMR includes most of these powers and can be used when arrangements, strategies, processes and mechanisms do not ensure sound risk management. ### Sanctions and enforcement measures — scope and procedures - Allocation of sanctioning powers depends on: - type of regulation allegedly infringed (directly applicable Union law, national law implementing Directives, ECB decisions or regulations, national law relating to tasks not conferred on the ECB); - type of person responsible (supervised entity or natural person); - sanction to be imposed (pecuniary or non-pecuniary). - For breaches of directly applicable Union law, the ECB may impose administrative pecuniary penalties: - penalties can be twice the amount of profits gained or losses avoided because of the breach (where determinable) or up to 10 percent of total annual turnover in the preceding business year; - this maximum also applies to breaches of ECB regulations or decisions. - Guide setting out principles and method for determining administrative pecuniary penalties published on ECB website (as referenced in source). - ECB can require NCAs to open proceedings for penalties under national law transposing Directives, penalties against natural persons or non-pecuniary penalties; NCAs must notify the ECB once a requested national procedure is completed. - Enforcement measures directly available to ECB include Periodic Penalty Payments (PPPs) under Art. 18(7) SSMR, Reg. 2532/98, Art. 129 SSMFR: - PPPs upper limit: 5 percent of the average daily turnover per day of infringement for a maximum period of six months. - Upon CRD 6 transposition, enforcement powers expected to be enhanced, recognition of PPPs as measure for restoring compliance distinct from administrative penalties, and extended scope of application of PPPs. ### EC5 — Sanctions on natural persons and parallel use of measures - ECB may directly impose sanctions only on legal entities (significant institutions); it does not have power to directly impose sanctions on natural persons. - SSMR allows ECB to require NCAs to open proceedings to take action against natural persons; NCAs may impose sanctions on natural persons belonging to SIs only at the ECB’s request and must inform the ECB of outcomes. - Supervisory measures, enforcement measures and sanctions may be used in parallel or sequentially depending on case circumstances. ### EC6 — Ring-fencing and structural measures - SSMR provides power to ringfence a bank from related companies: “to restrict or limit the business, operations or network of institutions or to request the divestment of activities that pose excessive risks to the soundness of an institution.” - This authority has been used, including together with imposing specific liquidity requirements, to ringfence banks from their network of institutions. ### EC7 — Transparency and publication of sanctions - ECB required to publish on its website penalties imposed pursuant to CRD and SSMFR, unless disclosure would: - jeopardize financial stability; - affect ongoing criminal proceedings; or - cause disproportionate damage to the supervised entity. - Publication includes: name of supervised entity, type and nature of penalty, period during which breach occurred, and root cause. - ECB publishes on its website the list of sanctions imposed by NCAs in proceedings opened at the ECB’s request. - Annual publication: ECB publishes a report on sanctioning activities conducted by the ECB and the NCAs in prudential supervision within the SSM. - Data from the 2023 Report: - a total of 168 administrative penalties were imposed by the end of the year; - Pecuniary penalties accounted for 53 percent of those, with fines totaling around EUR 25.1 million. - The highest pecuniary penalty was EUR 6.8 million imposed on an SI. *Source: 1eurea2025012 - 2023. A series of horizontal support teams have been created to address topic-specific issues* ### 1.5 million for a less significant institution (LSI); EUR 0.23 million for a legal person ### 1eurea2025012 - 1.5 million for a less significant institution (LSI); EUR 0.23 million for a legal person ### Enforcement and sanctioning outcomes - Pecuniary penalties reported: "1.5 million for a less significant institution (LSI); EUR 0.23 million for a legal person other than an SI or an LSI; and EUR 0.07 million for a natural person." - "The remaining 47 percent of penalties were non-pecuniary in nature." - Sanctioning activity distribution: - "LSIs ... accounted for 62 percent of all proceedings conducted and percent of all administrative penalties imposed." (text contains the "62 percent" figure; the second percent value is not provided in the source excerpt) - "Sanctioning activities concerning natural persons accounted for 30 percent of all proceedings conducted and 14 percent of all administrative penalties imposed." ### Crisis management and bank resolution (EC8) - Legal framework: "BRRD and SRMR" set out crisis management and resolution; cooperation arrangements between the ECB and the SRB/NRAs detailed in CP 1. - ECB compliance: "decided to comply with the relevant EBA Guidelines on ‘failing or likely to fail’ (EBA/GL/2015/07)." - Coordination procedures: - "A MoU has been signed (and subsequently updated) between the ECB and SRB" to ensure early coordination and information sharing. - Before a failure/likely-failure determination, competent and resolution authorities must consult each other. - If the SRB intends to make a determination it "must first inform ECB Banking Supervision ... and allow the ECB three calendar days to make an assessment." - Resolution roles: - "Decisions on mergers, restructuring, etc., in a resolution context fall within the remit of the SRB, with the ECB playing primarily a consultative role." - ECB may perform BRRD-envisaged supervisory tasks at resolution stage (e.g., assessment of acquisitions; temporary authorization for bridge banks). - "Whenever ECB Banking Supervision acts either as a home or host supervisor ... it actively participates in resolution colleges and shares information with all participating authorities as appropriate." ### Coordination with non-bank supervisors and corrective action (EC9) - Legal basis: "The CRD envisages the exchange of information between competent authorities and the authorities entrusted with the public duty of supervising other financial sector entities..." - Practical constraints: - ECB "has the ability to exchange information with the supervisors of related non-bank financial entities and is thus in a position to, although not obliged to, inform them before taking corrective action against a related bank." - For entities outside the SSM, "a MOU will be required" and it must meet CRD confidentiality equivalence. - Published MoUs sampled "show provisions for request-based information sharing, which also includes corrective action but not necessarily coordinated action." ### Assessment of Principle 11 — Enforcement, corrective measures and sanctioning - Overall assessment: "Largely Compliant" - Key developments since 2018: - CRD 6 introduced "periodic penalty payments" (PPPs) as an enforcement tool distinct from administrative penalties; "the ECB is the unique competent authority for imposing periodic penalty payments" for SIs. - CRD 6 "enlarges extensively the list of breaches for which administrative penalties are available" (examples given). - ECB lacks express authority to adopt "cease and desist" orders directly in Union law but "it may adopt such measures – directly or indirectly - if the NCAs have them in their toolkit." - Limitations and fragmentation: - Under SSMR, ECB can directly impose administrative pecuniary sanctions only on SIs for breaches of directly applicable EU acts (e.g., CRR). For breaches of national law implementing directives, breaches by natural persons, or non-pecuniary penalties, "the ECB can only request the relevant NCA to open national sanctioning proceedings." - "Material differences between the various national laws transposing the CRD" affect sanctioning practice (e.g., limitation periods, appeals to administrative bodies like Ministries of finance). - Assessors: current mix of centralized and decentralized sanctioning "is not a substitute for a more integrated framework whereby all corrective and sanctioning powers rest with one supervisory authority." - Supervisory practice improvements: - ECB streamlined enforcement and sanctions processes: "early involvement of NCAs ... use of an informal consultation with an expert group on Enforcement and Sanctions." - "The average length of proceedings has started to come down." - ECB "appears to be more willing to take on legal risk" and escalate enforcement, e.g., on climate-related and environmental financial risks; clarified in 2022 it "would take enforcement action, if necessary." - Enforcement tools remain "rarely been used" outside of climate-related actions to date. - Supervisory priorities: - ECB aims to "further strengthen banks’ efforts to effectively address material shortcomings" in 2025-27, focusing on RDARR, climate-related and environmental financial risks, and reducing the stock of pending measures. - Assessors recommend specifying expectations more clearly in SREP letters and using stricter measures for long-standing unaddressed issues. ### Consolidated supervision (Principle 12) — structure and practices - Overall assessment: "Largely Compliant" - Supervisory levels and roles: - ECB conducts supervision "at consolidated, sub-consolidated, and single-entity levels." - JSTs (Joint Supervisory Teams) perform day-to-day supervision; JSTs comprise ECB and NCA staff and are coordinated by an "ECB coordinator." - "Findings of sub-consolidated or single entity (i.e. solo) supervision feeds the consolidated supervision of banking group." - Legal and operational tools: - ECB may waive solo prudential requirements under "Articles 7, 8 and 10 of CRR" in certain cases. - For financial conglomerates, outcome of supplementary supervision under "FICOD" is taken into account. - Financial conglomerates and mixed-activity groups: - Identification under "FICOD"; ECB is "the coordinator for 28 financial conglomerates, five of them containing a G-SIB." - Supplementary supervision targets cross-sector risks (double gearing, contagion, concentration, conflict of interest, complexity). - Limited examples of joint onsite work with insurance supervisors; supplementary supervision "does not substitute sectoral supervision." - ECB raised concerns that "FICOD does not provide an adequate framework for the supervision of mixed activity groups" and is exploring policy options; legislative changes would be required to introduce group-wide supervision for mixed-activity groups. - Supervisory intensity and mapping the group perimeter: - JSTs map subsidiaries on dimensions including: (a) degree of relevance; (b) degree of significance; (c) degree of centralization/decentralization; (d) level of perceived risk. - Mapping identifies "material subsidiaries" warranting supervisory intensity comparable to consolidated level vs "non-material subsidiaries" with lower intensity. - Prudential standards and consolidated reporting: - Prudential standards (own funds, capital requirements, large exposures, liquidity, leverage, disclosure) imposed "on a consolidated basis." Reporting required "on both a solo and consolidated basis (and sub-consolidated basis where applicable)" unless waiver applies. - On-site and cross-border supervision: - Article 12 SSMR empowers ECB to conduct on-site inspections where it is consolidating supervisor. - "In the last 5 years, the ECB performed 90 onsite inspections and 28 internal model inspections (IMIs)" in countries outside the euro area. - Identified gaps: - Lack of methodology within ECB to use FICOD’s discretionary alternative identification parameters has limited risk-based identification of conglomerates. - Harmonizing reporting on solvency of financial conglomerates and introducing liquidity reporting "would certainly facilitate and enhance the analysis." ### Home‑host relationships (Principle 13) - Overall assessment: "Compliant" - College and JST framework: - JSTs are primary mechanisms for information sharing and coordination inside the SSM; ECB "chairs the college of supervisors as consolidating supervisor." - College membership determined based on mapping per "Article 2 Commission Delegated Regulation (EU) 2016/98" and "Commission Implementing Regulation (EU) 2016/99." - Observers and participants can include EBA (invited by default), resolution authorities, AML/CFT college lead supervisor, market supervisors, consumer protection authorities, and third-country supervisors as observers. - Information sharing and confidentiality: - Legal basis in "CRD"; operational framework and WCCAs (college-specific Written Coordination and Cooperation Arrangements) set for "going concern and in emergency situations." - Colleges exchange "outcomes of the SREP and a set of commonly agreed indicators"; confidentiality regime of the CRD applies. - Joint planning and collaborative work: - College-specific WCCA includes a "college supervisory examination program" (SEP) specifying joint work areas, planned on-site inspections, responsibilities and timelines. - Joint inspections and on-site visits are "rarely undertaken" due to resource constraints or scheduling conflicts. - Communication and crisis coordination: - College communication policies set in WCCAs; ECB as consolidating supervisor communicates to parent undertaking; hosts convey messages to local entities. - For emergency situations, colleges coordinate external communications per "Commission Implementing Regulation 201/99." - Framework for cross-border crisis cooperation strengthened by SSM, SRM and BRRD; "group-level resolution authority participates in these colleges as an observer." - Group recovery plans and resolvability are developed "in the framework of the college" with joint decision processes and involvement of resolution authorities. - Third-country relationships: - ECB signed and published supervisory MoUs with supervisors of G-SIBs excluding China; negotiations with China "are in process with the NFRA." - BRRD empowers the Commission and EBA regarding cooperation with third-country authorities for recovery and resolution information sharing. - Host supervision equivalence: - Within EU, CRD/CRR ensure "prudential, inspection and regulatory reporting requirements similar to those for domestic banks." - Subsidiaries of third-country parents authorized by ECB "subject to the same prudential and other supervisory requirements as domestic banks"; third-country branches remain authorized by Member States and supervised by NCAs under national law. - CRD 6 will change treatment of third-country branches by categorizing them and laying down prudential and authorization requirements. - On-site access and booking offices: - On-site cooperation via MoUs; ECB entitled to conduct on-site inspections where it is consolidating supervisor and may request host supervisors to carry out checks per Article 118 CRD. - No explicit legal prohibition on shell banks, but CRD licensing criteria and ECB supervisory expectations (2018 guidance) reduce likelihood of new shell banks being licensed. - CRD 6 introduces requirements on booking arrangements for third-country branches and tasks EBA to prepare technical standards. ### Corporate governance (Principle 14) - Overall assessment: "Compliant" - Legal and supervisory framework: - CRD requires "robust governance arrangements" and places responsibilities on the management body. - ECB applies EBA and joint EBA/ESMA Guidelines on internal governance and suitability in FAPs and the Supervisory Manual. - Under Article 91 CRD 6, supervisors will be able to "assess that key function holders meet the suitability criteria at all times ... and remove key function holders who are not suitable." - Fit and proper assessments and statistics: - ECB carries out suitability assessments for members of management bodies of SIs via FAP and ongoing supervision. - "An appointee is either considered fit and proper or is rejected." ECB may include "conditions and/or obligations" in positive decisions. - Ancillary measures data: "Decisions containing an ancillary provision decreased from 32 percent of all decisions in 2022 to 9.5 percent in 2023." - Fit and proper outcomes in 2023: "47 conditions, 179 obligations and 21 recommendations." - "10 cases" in 2023 where banks withdrew an application after the ECB signalled a likely negative decision. - Board composition, independence and diversity: - No EU-level requirement for a minimum number of independent directors; national laws determine specifics. FAP Guide "expects" sufficient independent directors; for less significant and unlisted banks, "at least one" independent director is expected. - ECB has issued expectations (e.g., at least one non-executive member with expertise in ICT and security risks). - Governance assessments and supervisory tools: - Governance is a core SREP module; ECB uses on-site inspections, horizontal analyses (e.g., governance data collections, risk culture and incentives), and targeted thematic reviews. - Identified supervisory findings include shortcomings in SIs' risk data aggregation & risk reporting (RDARR) and persistent governance deficiencies. - CRD 6 introduces enhancements (e.g., obligations to provide individual role statements, mapping of duties) but does not fully require suitability assessments to be completed prior to appointment in all cases. - Identified gaps: - Variation in national transposition limits supervisory harmonization across member states (e.g., gender diversity, minimum independent directors, key function holders). - No authority to perform ongoing fit and proper reviews of senior management of nonfinancial parent companies under current framework. ### Risk management process (Principle 15) - Overall framework and priorities: - CRD and EBA Guidelines on SREP underpin supervision of risk management. - Risk management assessment in SREP covers: (a) internal governance, (b) risk management framework, (c) risk culture, (d) data governance and IT infrastructure, data aggregation and reporting. - Climate-related and environmental risks, and digitalization, are SSM priorities and have been subject to targeted reviews and enhanced supervision. - ICAAP / ILAAP and capital/liquidity adequacy: - ICAAP and ILAAP are integrated into SREP; supervisors perform quantitative and qualitative assessments (governance, use in decision-making, data quality). - Models and validation: - Models reviewed via on-site and off-site supervision; backtesting and validation used to identify deficiencies. - Since 2019, SSM has "access to standardized reporting" allowing validation and benchmarking of IRB models. - 2023 improvements: "automated solutions ... to simplify and standardize the submission process for non-material model changes" and enhancements for standardized reporting of banks’ validation results. - Risk data aggregation and reporting (BCBS239 priorities): - Data aggregation is a current SSM priority; a Targeted Review on BCBS239 principles occurred during the BCP Assessment. - Joint initiative with ECB Directorate General Statistics launched an annual "Management Report on Data Governance and Data Quality." - "In 2024, a Targeted Review of 15 SIs was performed to assess banks’ progress in this area." - Supervisory expectations on new products and major initiatives: - Banks should maintain a documented "new product approval policy (NPAP)" approved by the management body covering new markets, products, services, significant changes and exceptional transactions; NPAPs should ensure consistency with risk strategy and risk appetite. - Key supervisory findings and actions: - JSTs assess RAF adequacy, independence of the risk management function, and escalation processes for limit breaches. - SSM has identified persistent deficiencies in RDARR and prioritized remediation in supervisory priorities for 2025-27. - Supervisors use scenario analysis typically focused on recovery and capital stress testing; emerging risks (e.g., nature-related) are being assessed and integrated into reviews. *Source: Excerpt from IMF assessment chapter (1eurea2025012).* ### 21. This review specifically examined the controls surrounding new products and the role of ### 1eurea2025012 - 21. This review specifically examined the controls surrounding new products and the role of ### Risk management functions and governance (EC10–EC11) - EC10: Supervisor determines banks have risk management functions covering all material risks with sufficient resources, independence, authority and access to the banks’ boards to perform duties effectively; duties segregated from risk-taking; direct reporting to board and senior management; subject to regular review by internal audit. - Legal and guidance framework: CRD and EBA Guidelines on SREP and Internal Governance. - Expectations: - Holistic bank-wide risk management across business lines and units. - Regular, transparent reporting so management body receives timely, accurate, concise, understandable, meaningful reports on identifying, measuring, assessing, monitoring, and managing risks. - Risk Management Function access to all business lines, relevant subsidiaries and affiliates; staff with sufficient knowledge, skills and experience. - Supervisory practice: - On- and offsite supervision reviews resources and performance of risk management function. - Horizontal credit-risk governance review conducted in 2022 across SSM banks. - EC11: Requirement for larger/complex banks to have dedicated risk management unit overseen by CRO or equivalent; removal should involve board approval, disclosure and discussion with supervisor. - Findings: - National transposition of CRD produces fragmented CRO framework (fit-and-proper assessments vary by whether CRO is in management body or classified as key function holder under national law). - EBA Guidelines require banks to inform SSM of decision to remove head of internal control function and main reasons. - SSM requires significant banks to appoint a CRO at management committee level; CRO responsible for designing risk appetite framework and ongoing monitoring of compliance. - SSM accepts alternative arrangements (Chief Governance Risk Officer, Chief Credit and Market Risk Officer). - Annual benchmarking of governance of risk management function. - CRD6 transposition will harmonize CRO legal requirements: CRO required for all larger banks in SSM and subject to fit-and-proper assessment by SSM; SSM powers under Articles 91 and 91a of CRD6 to request removal for suitability concerns. ### Risk standards, contingency and stress testing (EC12–EC15) - EC12: Supervisor issues standards for credit risk, market risk, liquidity risk, interest rate risk in banking book, operational risk and large exposures. - CRD addresses credit risk, market risk, interest rate risk, operational risk, liquidity risk. - EBA SREP guidelines describe supervisory activities to review and evaluate bank risk management. - SSM publications: Guide to the ICAAP, Guide to the ILAAP, 2023 Guide on counterparty credit risk (CCR) governance and management, 2017 guide on nonperforming loans, Credit Risk and Market Risk SREP methodologies including risk control module ‘governance and organizational framework’. - EC13: Contingency arrangements and recovery plans. - Legal framework: BRRD, CRD, SRM Regulation and Commission Delegated Regulations (Level 1 and 2); EBA Guidelines (Level 3). - Recovery plans updated at a minimum annually; supervisors provide feedback within six months; assessment focused on measures to maintain or restore bank/group viability and overall recovery capacity (ORC). - Supervisors consider capital/funding structure, organizational complexity, risk profile, idiosyncratic/system-wide events. - Assessors noted remediation measures often timed to coincide with subsequent recovery plan submission; some risks (e.g., contingent liquidity requirements and access to central bank funds) may warrant shorter remediation timeframes. - SSM can supplement supervisory resources for priority banks facing challenges. - EC14: Forward‑looking stress testing programmes covering all material risks. - CRR requires use of Stress Testing (Level 1); EBA Guidelines on SREP and Stress Testing (Level 3); SSM Guides on ICAAP and ILAAP. - Banks expected to identify key vulnerabilities, combine into plausible adverse scenarios, assess impact on regulatory and economic capital adequacy; severity should be highly severe (crisis-like). - Assessors noted scenario use typically focused on recovery and capital; suggested broader scenarios (reputation, operational). - EC15: Internal pricing, performance measurement and new product approval processes to account for risks (including liquidity). - CRD/CRR Level 1 framework; SSM Manual on Business Model Analysis sets assessment aims: sound understanding of bank, key vulnerabilities, viability over 12-month and minimum three-year horizon. - SSM Manual references loan pricing, new product pricing, and fund transfer pricing (FTP). - Supervisory activity: internal document on FTP good practices shared in 2023; ECB examined FTP design and calibration in targeted review in 2024. - Assessment summary for Principle 15: Compliant. - SSM provides substantial coverage; active in publishing guides; intensive supervisory work; progress on long-horizon risks (digitalization, climate-related, nature-related). - Remaining reliance on SSM Manual for internal pricing, performance measurement, new product approval processes. ### Capital adequacy — Framework and supervisory powers (Principle 16; EC1–EC7, AC1–AC3) - EC1: Laws/regulations require calculation and observation of prescribed capital requirements; define qualifying capital components. - CRR establishes requirements and qualifying components: Common Equity Tier 1, additional tier 1 and tier 2. - CRR 3 (transposing final elements of Basel III including output floor) in effect since January 2025. - CRR Pillar 1 minimums: Common Equity Tier 1 [4.5 percent], Tier 1 [6 percent], total capital [8 percent]. - SSMR empowers ECB to require additional own funds beyond CRR; ECB assesses need for excess capital in SREP. - CRD provides capital buffers: capital conservation buffer (CCoB), G-SIIs and O-SIIs buffers, systemic risk buffer (SyRB), countercyclical capital buffer (CCyB); must be met with CET1 to form combined buffer requirement (CBR). - Consequences for breaching CBR: restrictions on distributions and obligation to submit capital conservation plan. - EC2: Alignment with Basel standards for internationally active banks. - CRR/CRD apply Basel-based provisions; RCAP (December 2014) previously concluded “materially non-compliant” in some areas. - EU-specific deviations persist (Danish Compromise, SME supporting factor, limited scope of CVA). CRR3 introduced some new deviations and transitional arrangements; filtering of OCI unrealized gains/losses for 2025 only for CET1. - CRR allows, upon competent authority permission, permanent use of standardized approach for sovereign exposures within an exposure class where IRB is also used (non-compliant with Basel). - EBA impact analysis: overall increase in T1 MRC under Pillar 1 reduced by 4.4 percentage points (p.p.) relative to faithful Basel III implementation. - ECB analysis for SIs in euro area: deviation impact reduces CET1 MRC increase by more than 12 p.p. - EC3: Supervisor power to impose specific capital charge and/or limits on material risk exposures. - SSMR empowers ECB to require additional own funds, restrict business/operations, require divestment, reduce risk, impose specific capital charges (including securitisations). - SSM SREP evaluates risks including those not covered by Article 1 CRR; includes capital and liquidity quantification methodology; supervisory stress tests inform SREP, including P2G and governance assessments. - ECB has imposed additional own funds requirements based on SIs’ risk profiles; P2R buffers applied to SIs are disclosed on SSM web page. - EC4: Prescribed capital requirements reflect risk profile and systemic importance; focus on loss absorbency, risk weights, provisions, and risk management quality. - CRR Pillar 1 subject to “maximum harmonization”; limited exceptions (immovable property exposures, Article 458 national measures with 2-year duration subject to review/veto). - ECB assesses capital adequacy in SREP and may require additional capital (Pillar 2R); CRR requires Pillar 1 minimum leverage ratio of 3 percent. - ECB developed methodology to determine elevated risk of excessive leverage and potential Pillar 2 leverage requirement; banks expected to follow leverage ratio Pillar 2 guidance. - National competent authorities designate O-SIIs and calibrate buffers; ECB introduced minimum floor methodology for O-SIIs; heterogeneity in O-SII buffers persists. - EC5: Use of banks’ internal assessments (internal models) for regulatory capital subject to rigorous supervisory approval and oversight. - CRR requires prior permission for internal assessments; ECB approves internal models for SIs under Article 9(1) SSMR. - ECB practices: in-depth independent reviews, TRIM (2016–2021) outcomes, Guide to internal models (updated February 2024) clarifying inclusion of climate/environmental risks, permanent partial use, reversion to less sophisticated approaches. - Material changes to approved internal models and cessation require prior permission; ECB developed EGMA for materiality assessment; IMIs driven by on-site investigations and consistency checks with NCAs. - CRR3 introduces changes (FRTB, new operational risk standardised approach, IRB/CVA changes) requiring supervisory permissions and model adjustments; ECB preparing updates and strategies. - Resource constraints: ECB facing significant resourcing constraints in internal model validation; 2023 SEP staffing of IMIs significantly below needs; delays in model change approvals; recommendation for more structured proactive review approach. - EC6: Power to require forward‑looking capital management and stress testing. - CRD requires strategies/processes to assess and maintain internal capital; ECB ICAAP Guide details forward-looking capital management (normative and economic perspectives). - Stress-testing scenarios to reflect entity’s vulnerabilities and severe external developments; banks expected to act if management buffers breach. - ECB sets non-binding Pillar 2 guidance using two-step bucketing based on EU-wide stress test performance. - EC7: Simple, transparent, non-risk-based measure to capture on- and off-balance sheet exposures — leverage ratio. - CRR introduced minimum leverage ratio requirement of 3 percent; Pillar 2 leverage requirement possible and legally binding if imposed by ECB. - ECB sets leverage ratio Pillar 2 guidance based on EU-wide stress tests. - Additional criteria: - AC1: Non-internationally active banks subject to CRR/CRD framework; differences to Basel III explained in EC2. - AC2: Adequate distribution of capital in group by consolidation levels and solo assessments; Art.7 CRR waiver conditions narrowly defined. - AC3: SyRB and CCyB permit additional capital that can be released; responsibility for macroprudential tools shared between national authorities and ECB with notification and ECB top-up power (Article 5 SSMR). - Assessment of Principle 16: Materially Non‑Compliant. - Key reasons: material EU-specific deviations from Basel (EBA analysis: -4.4 p.p.; ECB for SIs: >12 p.p. reduction in CET1 MRC increase), resource constraints for internal model validation (IMIs), deviations such as permanent standardized approach for sovereign exposures, heterogeneity in O-SII buffer calibration and use of ECB top-up power as partial remedy. - Recommendations captured in comments: EBA and ECB should regularly monitor effects of deviations on banks’ capital ratios; ECB should ensure banks do not unduly maximize benefits from non-deduction of unconsolidated insurance holdings. ### Credit risk (Principle 17; EC1–EC7) - EC1: Laws/regulations require sound credit risk management, comprehensive bank‑wide view, early identification and measurement of credit losses; consistency with risk appetite, profile, systemic importance, capital strength. - Framework: CRD (Level 1), EBA guidance on loan origination and monitoring, accounting for expected credit losses (IFRS 9), internal governance, SREP and supervisory stress testing. - Expectations include governance of credit-granting and decision-making, criteria for identifying/assessing/approving/monitoring/mitigating credit risk, differentiated creditworthiness assessment by portfolio/borrower, ongoing monitoring with early warning indicators, and ECL methodologies incorporating forward-looking information. - EC2: Board approval and review of credit risk strategy and policies; board oversight of implementation. - CRD and EBA Guidelines specify management body responsibilities; SREP verifies expression and implementation of credit risk strategy and alignment with risk appetite. - EC3: Policies/processes for credit risk environment: underwriting standards, approval criteria, renewal/refinancing rules, credit administration, information systems, prudent limits, exception tracking, model controls. - CRR/CRD and EBA Guidelines set expectations; supervisors review credit risk mitigation quality, model validation for IRB banks; resource constraints noted for internal model reviews affecting prioritization and triage. - EC4: Monitoring indebtedness and risk factors (including unhedged FX risk). - EBA Guidelines require consideration of over-indebtedness and indicators of unlikeliness to pay; SREP assesses FX lending risk frameworks and hedging reviews. - EC5: Credit decisions free of conflicts of interest and on arm’s length basis. - CRD provisions on loans to management body and related parties; EBA Guidelines on internal governance and loan origination set policies to manage conflicts; EU framework does not explicitly require arm’s-length basis at Union level (some jurisdictions do). - EC6: Board/senior management decision thresholds for major credit exposures. - CRR includes large exposure regime; EBA Guidelines expect risk-based escalation and veto rights; no EU-wide explicit requirement for board approval of exposures exceeding specific thresholds (some national jurisdictions have such requirements). - EC7: Supervisor access to information on credit and investment portfolios and personnel. - CRD/CRR, EBA supervisory reporting, AnaCredit and securities holdings statistics provide extensive data; on-site inspections check data quality; Article 10 SSMR allows SSM to require all necessary information. - Assessment of Principle 17: Largely Compliant. - Comments: Good base from CRD/CRR and EBA Guidelines; AnaCredit and securities-holding data major improvements; resource constraints on internal model reviews persist; no EU-wide explicit arm’s-length requirement and no EU-wide requirement for board approval thresholds (EC5 and EC6) though national frameworks may fill gaps. ### Problem exposures, provisions and reserves (Principle 18; EC1–EC12) - EC1–EC4: Legal and guidance framework: CRR/CRD and EBA Guidelines on SREP, loan origination, definition of default, and NPL management; expectations on grading, classification, monitoring, provisioning (IFRS 9), write-offs and independent validation. - EC5–EC8: Expectations on early warning mechanisms, NPL KPIs, customer engagement and collections; supervisory tools include on-site inspections, F18/F19 reporting templates, ECB Guidance on NPLs, collateral valuation requirements and reviews including climate/environmental considerations. - EC9–EC11: Definitions and criteria for problem exposure, non-performing exposure (90 days past due or UtP), forbearance, reclassification rules and expectations for board reporting and KPIs. - EC12: Supervisors assess trends and concentrations in problem exposures and adequacy of provisions; supervisors may require NPL reduction strategies for portfolio concentration even if gross NPL ratio below 5 percent. - Assessment of Principle 18: Largely Compliant. - Comments: - Supervision progressed on NPLs; policy framework improved but much remains soft law. - Limitations: SSM cannot impose reclassification as NPL or require specific accounting provisions; P2R add-on is available but limited in scope and usage. - Recommendation: ECB should consider quantifying provisions at portfolio level using its own tools in addition to reviewing ECL methodologies and transaction testing; regular large-scale AQR-style exercises would require preparatory work and resource considerations. ### Concentration risk and large exposures (Principle 19; EC1–EC6, AC1) - EC1: CRD Article 81 requires member states ensure concentration risk is addressed via policies/procedures; CRR regulates large exposure limits aligned with Basel; no EU-wide supervisory guidance directly applying to banks on all forms of concentration risk; CEBS Guideline (2010) repealed in 2014 and not replaced. - EC2: Information systems must identify and aggregate exposures; CRR requires procedures for large exposures (>= 10 percent of Tier 1 capital); ECB internal guidance requires banks to have data architecture supporting risk data aggregation and reporting, though internal Operational Guidance not published/applicable to banks. - EC3: Banks expected to set thresholds/limits reflecting risk appetite and capital; EBA SREP Guidelines require assessment of documented risk appetite and limits; CEBS guidance had more prescriptive limit structures (repealed). - EC4: Supervisors regularly obtain information to review concentrations; reporting includes large exposures (>= 10 percent of Tier 1 capital), LEI usage encouraged; AnaCredit provides granular credit register data (debtor commitments >= EUR 25,000) used for concentration analysis. - EC5: CRR defines group of connected counterparties (control relationship or economic interdependence); EBA guidelines and RTS 2024/1728 specify circumstances for connected clients; supervisors may exercise discretion and enforce views where disagreement arises. - EC6: CRR sets large exposure limits: large exposure defined as >= 10 percent of Tier 1 capital; individual exposure limit generally 25 percent of Tier 1 capital (exceptions: institutions/investment firms: 25 percent or EUR 150 million, whichever is higher); intra-group exposure waiver subject to conditions and transitional rules until 2028. - AC1: Limits for non-internationally active banks follow CRR 10 percent/25 percent thresholds; small banks and certain exceptions described (EUR 150 million threshold, EUR 600 million Tier 1 capital carve-out). - Assessment of Principle 19: Largely Compliant. - Comments: - Only credit concentration risk explicitly defined in EU laws; no comprehensive guidance on all concentration types (funding, market) since repeal of CEBS Guidelines. - RCAP (2022) identified deviations in large exposure framework, including potentially material finding for trading book (temporary exceedance up to 600 percent of Tier 1 capital), but ECB confirms no bank currently benefits. - Heterogeneity in O-SII buffer calibration persists; recommendation for comprehensive guidance on management of concentration risks. - LEI usage increasing but not yet mandatory for all corporate clients; AnaCredit uses national identifiers where LEI not available. ### Transactions with related parties (Principle 20; EC1–EC7) - EC1: No EU‑wide comprehensive definition of “related parties” aligned with Basel standard; CRD Article 88(1) definition limited to management body members, their family, and entities with qualifying holding of 10 percent or more or significant influence; national transpositions vary. - EC2: No Union-law explicit requirement that related party transactions not be on more favourable terms, though EBA Guidelines require objective, arm’s-length decision-making, with national differences. - EC3: EBA Guidelines expect thresholds for management body loans/transactions requiring management body approval and exclusion of conflicted members; national laws vary in approval practices (some require unanimous board approval, some require supervisor notification/consent). - EC4: EBA and loan origination guidance require policies/processes to prevent conflicted persons participating in approval and management of related-party transactions; supervisors review as part of internal governance assessment. - EC5: No Union-law limits for exposures to related parties; EBA Guidelines require documentation and availability of information on loans to management body and related parties including additional info for loans above EUR 200 000; national laws differ (examples: Portugal: single related party exposure limit 10 percent of own funds, aggregate 30 percent; Germany: case-by-case upper limits possible). - EC6: CRD general governance requirements plus EBA Guidelines require identification, monitoring and documentation; ECB supervises internal governance including related party processes. - EC7: No supervisory requirement for periodic reporting of individual or aggregate related-party exposure at EU level; EBA ITS FINREP templates include aggregate related party reporting under IAS 24 (IFRS), but not all member states use IFRS and reporting is aggregate. - Assessment of Principle 20: Materially Non‑Compliant. - Comments: - EU framework not comprehensive or consistent with Basel standard: definitions, limits, approval and reporting requirements are not harmonized across member states. - ECB has advocated further harmonization; assessors concur that achieving compliance requires EU‑level legal adoption of a comprehensive related‑party definition and materiality limits to trigger approvals, remedial actions and reporting. - Supervisory coverage exists via internal governance reviews, but no horizontal/thematic review has established formalized benchmarks or materiality thresholds. ### Country and transfer risk (Principle 21; EC1–EC2) - EC1: EU framework silent on country and transfer risk at Union level; some jurisdictions (Ireland, Latvia, Luxembourg) have dedicated frameworks or regulations. - Country and transfer risks covered under EBA SREP Guidelines as part of credit risk; SSM internal Guidance on SREP includes country risk in ‘Loan monitoring’ module with identification, monitoring, classification and provisioning. - SREP guidance: supervisors consider degree of concentration, allocation across risk-grouped countries, economic performance, political/regulatory/institutional frameworks, payment capacity and record; macro and financial indicators list provided for assessments. - Assessors reviewed supervisory examples of country risk assessments. - EC2: Supervisors verify that bank strategies/policies for country and transfer risk are approved by board and integrated into risk management (EBA SREP guidelines). - Assessment: (material content ends mid-sentence in provided extract for EC2) — supervisory framework relies on EBA SREP guidelines and SSM internal guidance; national practices vary and some member states have specific country/transfer risk regulations. *Source: Excerpt from the IMF EUR Area supervisory assessment (1eurea2025012 - 21. This review specifically examined the controls surrounding new products and the role of), as provided.* ### 1. the management body clearly expresses the credit risk strategy and appetite, ### 1eurea2025012 - 1. the management body clearly expresses the credit risk strategy and appetite, ### Management body responsibilities - "the management body clearly expresses the credit risk strategy and appetite, as well as the process for their review;" - "the management body approves the policies for managing, measuring and controlling credit risk and discusses and reviews them regularly, in line with risk strategies;" - EURO AREA - INTERNATIONAL MONETARY FUND 215 ### Senior management responsibilities - "the senior management properly implements and monitors the credit risk strategy approved by the management body, ensuring that the institution’s activities are consistent with the established strategy, that written procedures are drawn up and implemented, and that responsibilities are clearly and properly assigned." ### Supervisory verification - "Further, supervisors are required to verify whether:" *Source: 1eurea2025012 - 1. the management body clearly expresses the credit risk strategy and appetite, (https://www.imf.org/-/media/files/publications/cr/2025/english/1eurea2025012.pdf)* ### 2. senior management is responsible for drawing up and implementing the ### 1eurea2025012 - 2. senior management is responsible for drawing up and implementing the ### Country and transfer risk (Principle 21 — EC3, EC4, EC5) - 21 EC3 — Requirement: senior management is responsible for drawing up and implementing the policies and procedures for managing, measuring and controlling credit risk, with country and transfer risk included as a subcategory. - Supervisory expectations and findings: - The ECB guide on ICAAP expects banks to identify sub-categories of risks (for example country risk) and their materiality. - SSM internal Guidance requires supervisors to verify that institutions: - (i) effectively implement adequate procedures to identify, assess and monitor potential sources of country risk, concentration within all types of exposures to country risk and to trigger necessary measures on a timely basis; - (ii) policies and procedures capture all risks under country risk scope, including indirect exposure affected by country deterioration and potential contagion effects; - (iii) institutions can follow up on evolution of such risks and have mechanisms to trigger necessary management or mitigating actions in a timely manner. - Institutions should have procedures to assess and group countries by overall risk and allocate exposures to risk-based groups; JSTs should assess methodologies and information sources used for country classification and transaction allocation. - 21 EC4 — Provisioning and supervisory oversight: - Supervisory approaches may include: - (a) supervisor sets fixed minimum provisioning percentages for exposures to each country and reviews them. - (b) supervisor sets percentage ranges for each country; banks choose provisioning within ranges; supervisor reviews ranges. - (c) bank sets provisioning percentages/guidelines/decisions for individual exposures; adequacy judged by external auditor and/or supervisor. - SSM SREP methodology: supervisors consider adequacy of country risk impairment estimation and provisioning in assessments. - Guidance expects institutions to estimate credit risk losses taking into account both insolvency and country risk, and to implement procedures to group countries and allocate exposures accordingly. - On-site inspection guidance: inspections should verify mapping of country risk for provisioning, sample institution-identified country risk exposures to assess provisioning levels, review exposures not denominated in the functional currency, exposures of non-resident borrowers, and review sovereign risk by country for loss calculation and capital impact criteria. - ECB Country Risk Assessment Tool (CRAT): - Produces quarterly (and ad-hoc) reports identifying and quantifying potential credit losses from emerging markets exposures by combining supervisory reporting exposures with IRB PDs and LGDs floored by market-based estimates. - CRAT informs discussions and investigations; JSTs of SIs with relevant exposures can initiate further analyses of indirect exposures and transition channels. - CRAT has been used extensively during events such as the run-up of the Russian war against Ukraine, the crisis of Chinese real-estate companies, debt sustainability concerns regarding non-EU European countries, and to monitor exposures and provision levels to overseas jurisdictions (esp. Latin America, Africa, non-EU Southeastern European countries). - Finding: onsite inspection manual covers provisioning against country risk but assessors did not come across examples evidencing implementation. - 21 EC5 — Information and reporting: - Banks required quarterly supervisory reports: - FINREP 20.01-20.03 (geographical breakdown of assets, liabilities and main income by location of activities — domestic vs non-domestic). - FINREP 20.04-20.07 (geographical breakdown of assets, liabilities and off-balance exposures by residence of counterparties). - C 09 (geographical breakdown of exposures by residence of the obligor available on a quarterly basis). - C33 (exposure to general governments of every country). - Complementary statistical reporting by NCBs includes country and currency breakdown by asset class. - Large exposure reporting: C 26-29 includes residence of the counterparty. - Other granular data sources: AnaCredit (exposures to non-natural persons with country of residence), securities holding statistics (issuer’s country and currency), EMIR and SFTR reporting for derivatives and repo positions. - JSTs may reference political risk analysis, credit rating agencies, and international organization country analyses. - Within SREP, country risk is assessed for Risk Level and Risk Control; when material, assessed in-depth at least once during a 4-year period. - Example: in the 2024 SREP cycle, country risk was assessed in-depth for ten supervised institutions and included in credit risk SREP assessments. - JSTs can request any information needed under Council Regulation (EU) No 1024/2013; ECB initiated ad-hoc analyses and data collections during the build-up phase of the Russian war against Ukraine. - Assessment of Principle 21: Largely Compliant - Comments: - No EU-wide harmonized regulatory framework for country risk introduced since prior FSAP; SREP methodology and tools have been developed and EBA SREP Guidelines address these risks as a sub-category of credit risk. - ECB has used a specific CRAT module since 2019 for emerging markets and updated internal Operational Guidance with dedicated sections for country risk assessment and management. - Recommendation: ECB should consider laying out supervisory expectations for industry more clearly and implement existing supervisory guidance; assessors saw limited evidence of onsite inspection implementation for provisioning against country/transfer risk. *Source: 1eurea2025012* ### Market risk (Principle 22) - Principle 22 — Requirement: supervisor ensures banks have an adequate market risk management process considering risk appetite, profile, market/macro conditions and significant deterioration in market liquidity. - 22 EC1 — Legal and supervisory framework: - CRR and CRD form Level 1 basis for Market Risk supervision, supplemented by EBA Guidelines and inclusion in SREP. - Internal SREP Guidance assesses market risk across five categories: Governance and organizational framework; Strategy and risk appetite; Framework for internal capital allocation; Risk identification, measurement, monitoring and reporting; Internal controls of market risk. - Annual assessment uses scorecard plus expert judgement. - 22 EC2 — Governance and board oversight: - EBA Guidelines require documented market risk strategy approved by management body; management body must express market risk strategy and appetite and review process. - Supervisor verifies management body and senior management involvement, adequacy of information provided to management body, and assessment of governance effectiveness. - Internal guidance: supervisors request governance documentation, meeting minutes; evidence of bank documentation was observed. - 22 EC3 — Policies, measurement, limits, controls: - EBA Guidelines require bank market risk policies to cover main businesses and processes for managing, measuring and controlling market risks. - Supervisory checks include: - (a) MIS and management control area reporting to management body and senior management. - (b) operating limits consistent with risk appetite and understood/communicated to staff. - (c) procedures to keep traders updated on limits. - (d) internal controls ensuring timely reporting of breaches/exceptions. - (e) awareness and periodic validation of model risk in pricing and measurement models. - (f) policies for allocation of exposures to trading book. - Internal guidance requires checking MIS, reporting content (current exposures, P&L, risk measures), controls around models, and allocation policies. - IMIs for banks with internal models are performed. - 22 EC4 — Valuation and marking-to-market: - CRR requirements: - documented valuation policies and procedures; reporting lines independent of front office; - trading book positions revalued at least daily; - marking to market using the more prudent side of bid/ask when possible; - marking to model when market prices unavailable, with conservative approach and independent validation; - independent price verification and procedures for valuation adjustments; appropriate treatment for less liquid positions. - Banks required to deduct Additional Valuation Adjustments (‘AVA’) from CET1. - RTS on Prudent Valuation (EU Commission Delegated Regulation 2016/01) prescribes AVA calculation and full deduction from CET1; two AVA approaches: - simplified approach for institutions with fair-valued assets/liabilities < EUR 15 billion (in absolute value); - “core” approach for institutions above that threshold. - EBA SREP Guidelines recommend supervisors assess frameworks for prudent valuation adjustments and stress testing for illiquidity/gapping, concentration and one-way markets. - ECB conducted on-site valuation risk campaign 2019-22 covering Level 2 and Level 3 fair-valued instruments (20 SIs); follow-up on-site inspections remain part of toolkit. - EBA consulting on RTS revisions to enhance harmonization and definitions of “extraordinary circumstances” in Prudent Valuation. - 22 EC5 — Capital and valuation adjustments: - CRD requires supervisors ensure internal capital adequacy for material market risks not subject to own funds requirement; supervisors verify ICAAP and can apply judgement/challenge. - On-site campaign provided requirements on prudent valuation; assessors saw evidence supervisors applied additional capital. - Assessment of Principle 22: Compliant - Comments: - Fully articulated EU framework for Market Risk; delay in implementing FRTB noted in CP 16. - Market risk smaller relative to Credit and Operational risks but growing post-UK departure. - Strong supervisory emphasis with evidence of findings and capital adjustments; stepped-up oversight of valuation via on-site campaign. - Resourcing IMIs has been challenging at times. *Source: 1eurea2025012* ### Interest rate risk in the banking book (IRRBB) (Principle 23) - Principle 23 — Requirement: supervisor ensures banks have adequate systems to identify, measure, evaluate, monitor, report and control or mitigate IRRBB, considering risk appetite, profile and market/macro conditions. - 23 EC1 — Legal and guidance framework: - CRD is Level 1 basis for IRRBB supervision; supplemented by EBA Guidelines (2018, updated 2022) and EBA “High level principles for Risk Management”. - CRD duties: - (a) management body to approve and periodically review strategies and policies; - (b) banks implement systems to identify, evaluate and manage interest rate and credit spread changes affecting EVE and NII; - (c) supervisory powers applied when: - i. EVE declines by more than 15 percent of CET1 under supervisory shock scenarios; - ii. NII declines by 5 percent of CET1 under supervisory shock scenarios. - EBA guidance defines CSRBB and provides a framework for satisfactory internal measurement systems (IMS). - From SREP 2024, CSRBB assessed within revised SREP methodology for IRRBB & CSRBB to align with EBA Guidelines. - 23 EC2 — Governance and board oversight: - CRD specifies management body duties: approve/review strategies and policies, allocate resources, oversee implementation. - EBA Guidelines require robust governance with ultimate responsibility on management body; supervisors assess approvals, reviews, implementation, communication, reporting frequency and adequacy. - On-site inspections complement off-site checks and evidence was observed. - 23 EC3 — Policies, measurement, limits, validation: - EBA SREP Guidelines require supervisors to assess availability of information systems, measurement techniques, staff and methodologies, risk limits, communication and escalation processes, monitoring and reporting. - Supervisory assessment covers: - IMS scope to capture on/off-balance exposures and optionality; - access of management to timely results; - organizational framework and competent staff; - outputs analyzed for EVE and NII impacts including MVC. - Supervisors verify internal/external validation of models (especially behavioral models like prepayment, modeled duration of deposits), Internal Audit review, and Senior Management awareness of model risk. - Risk limits consistency with risk appetite, internal consistency between EVE and NII limits, review/update processes, monitoring and exception capture assessed. - On-site inspections check documentation, limit systems, early warning indicators, structured reporting and report quality/completeness. - 23 EC4 — Supervisory outlier test and reporting: - EBA RTS (entered into force May 2024) specifies supervisory shocks and assumptions for SOT on EVE and NII: - SOT identifies banks where: - (a) EVE would decline by more than 15 percent of Tier 1, or - (b) NII would experience a large decline (5 percent of Tier 1). - If thresholds breached supervisors may exercise powers (additional own funds, activity limits, specifying modelling/parametric assumptions) unless exposure/management judged adequate. - EBA developed ITS on supervisory reporting for IRRBB with uniform formats, frequencies and IT solutions; first reference date for ITS application was September 30, 2024. - ITS reporting covers SOT results and granular fixed-interest balances, model parameters and MVC in NII SOT stress scenarios. - 23 EC5 — ICAAP and internal capital: - CRD requires a “sound, effective and comprehensive” ICAAP subject to regular review. - ECB Guide to the ICAAP (Principle 6) sets expectations on risk quantification methodologies. - EBA SREP Guidelines require supervisors to assess internal capital allocation for IRRBB. - For SIs, adequacy of IMS for IRRBB assessed in SREP; internal guidance supports supervisor assessment of methodologies and processes for ICAAP quantitative outcomes. - Supervisory benchmarking against peers and supervisory models covers optionality, NMDs, loan prepayment risk, and EVE/NII sensitivities to NMD behavioral assumptions. - Supervisors analyze sensitivity with and without hedging and behavioral assumptions; can set additional capital under P2R and assessors saw examples in practice. - ECB supervisory stress tests and targeted reviews supplement on/off-site work; targeted IRRBB sensitivity analysis in 2017 and ad-hoc analyses in EBA stress tests referenced; 2022-2023 targeted review of interest rate and credit spread risk management conducted. - Ad-hoc 2023 data collection assessed unrealized losses on debt securities held at amortized cost across EU banks; bank-specific and aggregate analyses published with 2023 stress test results. - IRRBB has been an SSM supervisory priority since 2022. - Assessment of Principle 23: Compliant - Comments: - Fully articulated EU framework for IRRBB; IRRBB can be significant for SSM banks and has strong supervisory emphasis. - New reporting had only two quarters of live data at assessment finalization; too early to judge full impact though templates and dry runs indicate material improvement. - SSM has kept pace with international standards via EBA updates and stress tests. *Source: 1eurea2025012* ### Liquidity risk (Principle 24) - Principle 24 — Requirement: supervisor sets prudent liquidity requirements reflecting banks’ liquidity needs; banks must have a strategy for prudent liquidity risk management and compliance with requirements; internationally active banks’ requirements not lower than Basel standards. - 24 EC1 — Legal and reporting framework: - CRR, CRD, Delegated Regulations and an EBA ITS implement Basel LCR and NSFR at Level 1 and 2. - ECB ILAAP guide, SSM Operational Guide and EBA SREP Guidelines supplement requirements. - RCAP (2017) rated LCR and NSFR as Largely Compliant due to findings on covered bonds inclusion in HQLA (LCR) and nine non-material NSFR denominator findings. - Update: assessors saw SSM data on materiality of RCAP findings; as of September, 30 2024 the share of Level 1 covered bonds amounted to 5.1 percent of the aggregate liquid assets (before application of haircuts or caps). The 5.1 percent figure is twice the proportion noted by BCBS in 2017. - CRR sets prudential liquidity requirements at consolidated and individual level; competent authorities may grant waivers (including partial and conditionally subject waivers) with ECB specifying conditions/process; liquidity requirements remain applicable at consolidated group level. - LCR and NSFR minima: - Banks generally required to maintain NSFR and LCR of at least 100 percent on an ongoing basis. - LCR 100 percent minimum effective since 2018. - NSFR requirement effective from June 2021 (a delay of 30 months from Basel timetable). - Comprehensive liquidity reporting: LCR (monthly), NSFR (quarterly), additional liquidity monitoring metrics mirroring Basel tools (contractual maturity ladder, available unencumbered assets), reporting amended in 2022 to reflect lessons from 2019 ECB Sensitivity Analysis. - Reporting in significant currencies required if materiality criteria met. - ECB activated weekly liquidity reporting for SIs in September 2023. - 24 EC2 — Reflecting banks’ liquidity profiles: - LCR and NSFR supplemented by annual bank-specific review potentially resulting in higher outflow rates or different stable funding factors. - SREP Pillar 2 holistic assessment covers: - (a) capacity to meet short-term obligations (short-term liquidity risk), - (b) longer-term funding sustainability risk, - (c) liquidity and funding risk management. - Assessments consider short/long term, market position and macro circumstances; assessors saw examples of supervisors imposing quantitative and qualitative liquidity measures. - 24 EC3 — Liquidity management framework and stress testing: - Assessment via annual SREP, ILAAP review, on-site inspections, horizontal reviews, and deep dives. - Supervisors assess whether banks: - (a) have adequate stress testing frameworks; - (b) identify, measure and monitor liquidity/funding risk in normal and stressed conditions; - (c) provide assurance of sufficient market access under stress; - (d) use internal stress testing to develop liquidity strategies; - (e) have management body approval and periodic review of liquidity strategies/policies considering macro environment; - (f) ensure policies align with liquidity risk tolerance, profile and systemic importance; - (g) have documented evidence of liquidity risk tolerance and strategy approval and updates; - (h) determine liquidity risk appetite/tolerance/strategy through comprehensive processes with adequate definitions and documentation and frequent reviews/updates; - (i) implement and communicate liquidity risk tolerance and strategy to relevant staff; - (j) integrate liquidity risk strategy within overall risk appetite framework. - Standardized supervisory stress scenario includes retail and wholesale stress assumptions; supervisors also use adverse/extreme idiosyncratic scenarios and top-down supervisory stress leveraging contractual maturity ladder reporting. - 24 EC4 — Policies, controls, intraday liquidity: - SREP assesses compliance on existence of strategies/policies and evaluates Governance, Risk Appetite, Risk Management and Internal Control, and Internal Audit. - Q1 2024 thematic review: six SIs assessed on monitoring and management of intraday liquidity risk using BCBS monitoring tools and Principles for Sound Liquidity Risk Management and Supervision; SSM shared observations via November supervisory newsletter. *Source: 1eurea2025012* ### 2024. This set out seven principles in relation to: Risk Management, Governance, Forecasting, ### 1eurea2025012 - 2024. This set out seven principles in relation to: Risk Management, Governance, Forecasting, ### Liquidity and Funding Risk (Principle 24: EC5–EC9) - Supervisory expectations and bank requirements: - Banks must establish and regularly review funding strategies, policies and processes for ongoing measurement and monitoring of funding requirements and effective management of funding risk. - Funding policies/processes must consider interactions with other risks (credit, market, operational and reputational) and include: - (a) an analysis of funding requirements under alternative scenarios; - (b) maintenance of a cushion of high-quality, unencumbered, liquid assets that can be used, without impediment, to obtain funding in times of stress; - (c) diversification in sources (counterparties, instruments, currencies and markets) and tenor of funding, with regular review of concentration limits; - (d) regular efforts to establish and maintain relationships with liability holders; - (e) regular assessment of the capacity to monetise assets. - Regulatory and supervisory frameworks referenced: - CRD requires methodologies for identification, measurement, management and monitoring of funding positions, including current and projected material cash flows and possible reputational impacts. - EBA SREP Guideline expectations when assessing liquidity and funding: evaluation of (a) funding profile; (b) risks to stability of funding profile; (c) actual market access; (d) expected change in funding risks based on funding plan; (e) feasibility and appropriateness of funding plans; (f) interactions with other risks. - SSM collects standardized qualitative and quantitative data on projected assets and liabilities relative to funding plans and assesses strategies to cover TLTRO repayments and diversification of funding sources. - Supervisory assessment methods: - Compliance assessed via: (a) ITS data on liquidity and asset encumbrance and performance of supervisory stress tests; (b) analysis of bank internal reporting and internal determination of liquidity needs (stressed and unstressed) at least annually; (c) deep dives, on-site inspections, and horizontal analyses. - Contingency funding plans (EC6): - Banks required to have formally articulated, documented contingency funding plans addressing liquidity shortfalls across stress environments without reliance on lender of last resort; plans must set lines of responsibility, communication plans (including with supervisor) and be regularly tested and updated. - ECB ILAAP Guide expectations for SIs: formal CFP linked to recovery plan; supervisors assess CFP feasibility and may require remediation. - 2023/2024 ECB targeted reviews examined contingency funding planning (sample of 28 selected SIs) and collateral optimization (sample of 26 SIs); various deficiencies identified and remediation timed with recovery plan submissions. - Assessors reviewed CFPs showing mixed risk profiles, with some cases showing extensive delays accessing central bank liquidity beyond desirable crisis periods. - Stress testing (EC7): - Banks must include short-term and protracted bank-specific and market-wide liquidity stress scenarios using conservative, regularly reviewed assumptions; stress test results must inform liquidity risk management and CFPs. - ECB performed a 2019 sensitivity analysis (adverse and extreme idiosyncratic stress), calibrating shock scenarios from previous euro area stress cases; outcomes informed SREP. - An SSM-internal stress test tool incorporates those scenarios plus more severe institution-specific scenarios; outcomes feed annual liquidity SREP scoring. - ECB ILAAP Guide expectations checked in annual liquidity SREP assessment covering identification/measurement/monitoring of liquidity risk, market access, stress testing framework, and frequency of stress testing. - 2023 banking turmoil highlighted more volatile depositor behaviour (social media, online banking, non-bank competitors). Supervisors acknowledged developments; recommended further work including simulated events to prepare for social media-driven mobilization of depositors. - ECB examined banks’ behavioral NMD models in 2023/2024 (sample of 24 selected SIs) as part of targeted review of ALM Governance & Strategy; deficiencies identified and JSTs following up. - Move to weekly liquidity reporting during 2023 events was challenging but well managed. - Foreign currency liquidity (EC8): - CRR requires reporting LCR separately in currencies where a bank has more than 5 percent of total liabilities or a significant branch in an EU Member State using a different currency; COREP collects LCR/NSFR per significant currency (at least 5 percent of aggregated liabilities). - Supervisor considers FX convertibility, access to FX markets and ability to transfer liquidity across entities; may set limits for liquidity transformation under stress via foreign currency LCR. - Banks must maintain a liquidity coverage ratio of at least 100 percent in the reporting currency; no binding foreign currency LCR but ECB may impose quantitative foreign currency LCR requirements. - Supervisors assess access to foreign central banks (direct access, collateral already pledged). - Asset encumbrance (EC9): - CRR requires reporting of all forms of asset encumbrance with breakdowns; EBA ITS and RTS provide templates and disclosure requirements. - CRD requires authorities ensure institutions distinguish pledged vs unencumbered assets available at all times, considering legal entity, country of legal recording and eligibility; supervisors assess mobilization timeliness. - SREP ILAAP assessment may impose liquidity measures where internal limits or survival periods are inadequate, liquidity buffer too concentrated, or excessive funding concentration exists. - Collaboration with ECB central bank unit extended to obtain information on pledgable unencumbered central bank-eligible assets and already pledged assets. - Key numeric and sample references: - 28 selected SIs (CFP targeted review sample) - 26 SIs (collateral optimization sample) - 24 selected SIs (behavioral NMD models sample) - 2019 (ECB sensitivity analysis) - 2023/2024 (ECB reviews; examinations) - Weekly liquidity reporting (response to 2023 events) - LCR requirement: at least 100 percent (reporting currency) - Reporting threshold: more than 5 percent of total liabilities (currency significance) - Assessment and comments: - Assessment of Principle 24: Largely Compliant. - Comments: SSM delivers thorough assessment and mitigation of liquidity risk and progressed substantially since 2018; responded well to 2023 liquidity problems. Supervisory practice on CFPs shows good practice but variable urgency in remediation. SSM has good grip on changing deposit liability profiles but remains vulnerable to sudden depositor behaviour shifts. Noted good articulation on intraday liquidity (Supervision Newsletter on “Sound practices for intraday liquidity risk management”). ### Operational Risk and Operational Resilience (Principle 25: EC1–EC10; AC1–AC2) - Scope and legislative context: - CRR 3 came into force on January 1, 2025; DORA supplemented and in some cases superseded CRR 2, CRD, and some Delegated Regulations. - DORA imposes significant resource and specialized skill demands on supervisors. At finalization, additional budget secured but hiring not completed; delays in infrastructure for DORA reporting delayed live reporting from February to May 2025, implying data feed into SSM SREP process in 2026. - EU-SCICF announced July 2024; role of ESA DORA Coordinator filled on 1 October 2024. - CRR 3 operational risk requirements include (exact wording preserved): - (a) a well-documented assessment and management system for operational risk; - (b) an operational risk management function independent from business and operational units; - (c) a system of reporting to senior management providing operational risk reports to relevant functions; - (d) a system of regular monitoring and reporting of operational risk exposures and loss experience; - (e) procedures for taking appropriate corrective actions; - (f) routines for ensuring compliance; - (g) policies for the treatment of noncompliance; - (h) regular reviews of operational risk assessment and management processes by internal or external auditors with necessary knowledge; - (i) internal validation processes operating in a sound and effective manner; - (j) transparent and accessible data flows and processes associated with the operational risk assessment system. - Board, management and mapping of critical operations (EC2–EC3): - Supervisors review board approvals and oversight of operational risk strategies and operational resilience approach, including Business Continuity Management Plans and maximum tolerable downtimes. - DORA enshrines management board duties (Article 5(2)) and mapping of ICT assets (Article 8) and interdependencies concerning BCM measures (Article 11(5)). - Response, recovery and testing (EC4–EC6): - Supervisors expect banks to develop response and recovery plans, continuously improve via lessons learned; DORA Article 11 requires development and testing. - EBA Guidelines on SREP require comprehensive and tested business resilience and continuity plans. The 2024 Cyber Resilience Stress Test involved 109 banks (28 with more extensive testing) and showed response/recovery frameworks in place but areas for improvement. - IT security, cyber risk and outsourcing (focus 2024–2026 SSM workplan): supervisors monitor audit clauses, data location control, private data confidentiality, IT security conditions, reversibility/exit plans. - Monitoring, reporting and third-party risk (EC7–EC9): - Supervisors assess information systems for monitoring operational risk, event data collection (internal/external), and reporting to board/senior management/control functions. - Incident reporting established (including PSD requirements); DORA Articles 17–23 cover ICT incident management, classification and reporting. - Third-party risk management expectations include due diligence, contract structuring (ownership/confidentiality/termination), oversight (register of outsourced activities, metrics, reporting), contingency and exit strategies, right to inspect provider’s books and permit supervisor access. - SSM Supervisory Manual requires assessment of outsourcing strategy, decision-making, inclusion of audit/reversibility/security clauses, outsourcing register and oversight. - Change management and concentration risk (EC10; AC1–AC2): - Supervisors assess change management frameworks for ICT projects, software acquisition, design and development, and ICT project governance; on-site inspections evaluate risks from new products/technologies/outsourcing. - DORA requires registers of contractual arrangements with ICT third-party providers; such information will feed SSM SREP in 2026 to identify interconnections and systemic concentrations. - DORA Articles 29, 32(2) and 35(1dii) provide the Lead Overseer powers to assess and issue recommendations on ICT concentration risks and systemic concentration providers. - Key numeric and date references: - January 1, 2025 (CRR 3 in force) - May 2025 (expected start of DORA live reporting) - July 2024 (EU-SCICF announced) - 1 October 2024 (ESA DORA Coordinator appointed) - 2024 (Cyber Resilience Stress Test) - 109 banks tested; 28 underwent more extensive testing - 2026 (DORA data to feed SSM SREP process) - Assessment and comments: - Assessment of Principle 25: Largely Compliant. - Comments: Substantial progress since prior BCP Assessment. DORA provides robust supervisory framework but implementation challenges (resourcing, specialized skills, infrastructure) remain; SSM must resource up and deliver against budget narrative to meet DORA demands. ### Internal Control, Audit (Principle 26) - Core requirements and supervisory practice: - CRD, CRR and EBA Guidelines (notably Guidelines on Internal Governance) establish internal control and audit expectations including segregation of duties, accounting controls, checks and balances, safeguarding assets, independence of control functions and internal audit. - Supervisors assess internal control and audit via SREP Element 2 and on-site examinations; annual data collection on internal control functions since 2018 and horizontal thematic reviews (compliance, internal audit). - For climate-related risks, ECB Guide on climate-related and environmental risks sets expectations for compliance and internal audit consideration; deep dives conducted. - Internal audit and compliance function expectations: - Compliance function: permanent, independent, adequately resourced, chartered, with reporting lines to management body; assessed under SREP Element 2 – Module 4. - Internal audit: independent, permanent, effective, assesses policies/processes/controls and compliance; assessed under SREP Element 2 – Module 5. 2022 horizontal review of internal audit performed. - Internal audit standards: audit charter, compliance with international/European professional standards, institution-wide access, risk-based audit plan covering all relevant activities within a three-year horizon. - Assessment and comments: - Assessment of Principle 26: Compliant. - Comments: EU laws and guidelines are comprehensive; SSM regularly assesses internal control and audit functions with horizontal reviews and benchmarking; climate-related expectations integrated. ### Financial Reporting and External Audit (Principle 27) - Legal framework and supervisory scope: - Accounting Directive (Directive 2013/34/EU), IAS Regulation (Regulation (EC) No 1606/2002), CRD and CRR define responsibilities for financial statements, reporting frameworks (IFRS or nGAAP), and supervisory enforcement boundaries. - ECB does not have mandate to set accounting standards or scope of statutory audits; communicates supervisory expectations via Dear CEO Letters, blogs, public reports. - ECB cannot generally access external auditors’ working papers directly; Article 56 CRD allows information exchange subject to professional secrecy. - External audit standards, oversight and auditor rotation: - Audit Directive and Audit Regulation (Regulation (EU) No 537/2014) require audits in compliance with international auditing standards and set additional public-interest entity requirements (independence, audit rotation, audit committee responsibilities). - Maximum audit engagement duration: 10 years, or 20 years subject to tendering, or 24 years in joint audits; renewal only after a 4-year period. Key audit partners must cease participation by 7 years; can restart after a three-year period. - Supervisory powers and limitations: - ECB lacks general power to reject auditor appointments under EU law; national laws vary—some allow supervisory approval/objection. Where national powers exist, ECB exercises them for significant credit institutions since January 1, 2017. - ECB cannot sanction external auditors for negligence; may exchange information with auditor oversight authorities per CRD Article 57.1(c). - Article 12(2) of Audit Regulation mandates dialogue between supervisory authority and external auditors; ECB meets regularly with external audit firms and group auditors. - Auditors required to report promptly to prudential supervisors any material breaches, threats to continuity, or refusals/adverse/qualified opinions (Audit Regulation Article 12(1); CRD Article 63 duties). - Assessment and comments: - Assessment of Principle 27: Largely Compliant. - Comments: EU financial reporting and external audit regime is robust but ECB’s limited powers (influencing audit scope, preventing auditor appointment, accessing auditors’ working papers) constrain alignment with best international practices; suggestion that ECB be empowered to prevent an auditor from being put in office and to access working papers for full supervisory value. ### Disclosure and Transparency (Principle 28) - Disclosure requirements and supervision: - Pillar 3 disclosures transposed into CRR require periodic public disclosures on consolidated and, where appropriate, solo basis, covering own funds, capital adequacy, risks and risk management procedures; EBA ITS 2021/637 specifies harmonized templates and mapping. - Pillar 3 complements financial statement disclosures (IFRS or nGAAP). CRR Article 431 requires policies to verify disclosures convey risk profile; Article 432 allows materiality-based omission where appropriate; EBA Guidelines on materiality/proprietary/confidentiality apply. - CRR Part Eight requires risk profile disclosures (including ESG), governance and remuneration disclosures. - Scope, frequency and enforcement: - Pillar 3 disclosures assessed annually by JSTs with thematic focuses and ad hoc reviews (e.g., ESG risk disclosures); SSM publishes annual reconciliation exercise results. - CRR Article 447 requires LCR-related disclosures as averages of end-of-month observations over preceding 12 months per quarter (different from Basel simple averages of daily observations over previous quarter). - For groups, CRR defines prudential scope of consolidation for Pillar 3; institutions must disclose differences between accounting and regulatory consolidation scopes. - System-wide and aggregate disclosures: - ECB and EBA publish aggregate banking statistics; ECB quarterly market data covers aggregate SIs and LSIs, with LSI data starting May 2023. - ECB disclosures include general statistics, balance sheet composition, profitability, capital adequacy and leverage, asset quality, funding, liquidity and data quality. 2022 additions included loan impairment stages, NSFR and NPL ratio (excluding central bank cash/demand deposits); 2023 expanded to net interest margin, additional NSFR breakdown and debt securities by counterparty. - Published data based on ITS on Supervisory Reporting and FINREP; scope covers SIs and LSIs in SSM-participating member states at highest consolidation level. - Assessment and comments: - The disclosure regime and supervisory review processes support comparability and public understanding; Pillar 3 regime found compliant in 2014 RCAP and has seen subsequent enhancements (templates, additional indicators, ECB dashboard). *Source: 1eurea2025012 - 2024 (https://www.imf.org/-/media/files/publications/cr/2025/english/1eurea2025012.pdf).* ### Part 1: Consolidated data per Competent Authority; ### Part 1: Consolidated data per Competent Authority ### Part 1: Consolidated data per Competent Authority - Indicates the consolidated dataset organized by Competent Authority. ### Part 2: Data on credit risk - Contains data specifically related to credit risk. ### Part 3: Data on market risk - Contains data specifically related to market risk. ### Part 4: Data on operational Risk - Contains data specifically related to operational risk. ### Part 5: Data on supervisory measures and administrative penalties - Contains data on supervisory measures and administrative penalties. *Source: 1eurea2025012 - Part 1: Consolidated data per Competent Authority* ### Part 6: Data on waivers. ### Part 6: Data on waivers. ### Publication and data access - The publication takes place in July for the data of the preceding calendar year and is updated on an annual basis. - ECB disclosures are accessible online: - Banking supervision website: https://www.bankingsupervision.europa.eu/banking/statistics/html/index.en.html - ECB Data portal for interactive visualizations: https://data.ecb.europa.eu/main-figures/supervisory-banking-data - The EBA publishes supervisory information for risk analysis, including risk monitoring tools (indicators, dashboards), EU-wide stress test outcomes, and an annual transparency exercise to complement banks' Pillar 3 disclosures. ### Principle 28 — Disclosure framework - Assessment: Compliant - Key findings: - The EU has introduced a comprehensive disclosure framework with qualitative and quantitative disclosure requirements. - Quarterly, semi-annual and annual disclosures by SIs allow assessment of capital adequacy, risk exposures, risk management processes and financial performance. - The EBA and ECB publish a wide range of information and data on the banking system. - The ECB monitors SIs’ actual practice via sample testing and thematic reviews. - Related party exposure disclosures required under Pillar 3 use a definition narrower than CP 20; this narrower definition is reflected in the grading of CP 20. - CRR changes require banks to disclose non end-of-period data; LCR disclosure requirements are not fully aligned with Pillar 3 Basel standards. ### Principle 29 — Abuse of financial services (summary and overall assessment) - Assessment: Largely Compliant - High-level comment: - Many requirements do not fully apply to the ECB because AML/CFT supervision lies with national AML/CFT competent authorities. - ECB focuses on prudential implications of ML/TF and other criminal activities through a “vigilant approach,” integration of relevant EBA Guidelines, supervisory methodology adjustments, and development of prudential warning signals to reflect ML/TF risks in SREP. - Cooperation and information exchange with AML/CFT authorities has improved but remains heterogeneous; the establishment of AMLA and related MOU with the ECB is expected to streamline cooperation. - The ECB can use prudential powers (including Article 18(f) CRD withdrawal in proportionate cases) to address prudential consequences of AML/CFT deficiencies; there have been supervisory measures, reassessments of board members, and some license withdrawals triggered by AML/CFT deficiencies. - The ECB is encouraged to be more proactive and systematic in incorporating AML/CFT inputs into its supervisory program, including deep dives and joint work with AML authorities. ### EC1 — Laws/regulations on supervisor duties and powers - Description and findings: - CRD requires credit institutions to have a clear and robust control framework for sound and effective risk management; ECB supervision has integral focus on controls but does not specifically focus on criminal activities. - Under the SSMFR, if ECB suspects a criminal offence, it should request the relevant NCA to refer the matter to national criminal authorities. - SSMR specifically excludes AML/CFT supervision from the ECB; national AML/CFT competent authorities supervise obliged entities’ compliance with AML Directive 2015/849. - CRD 5 introduced AML/CFT-related requirements for prudential supervisors (authorization/withdrawal, SREP, cooperation with AML/CFT supervisors and FIUs, notification to EBA). - EBA SREP Guidelines and EBA Guidelines on AML/CFT Cooperation elaborate prudential supervisors’ responsibilities and information sharing. ### EC2 — Policies/processes promoting ethical standards and preventing criminal use - Description and findings: - ECB ensures banks set up governance policies, processes and controls addressing risks, including prudential implications of criminal activities. - EBA Guidelines on Internal Governance assign the management body responsibility for corporate culture, values and a code of conduct; assessments are ongoing and part of SREP. - Horizontal assessments (tax fraud, risk culture, mis-selling of Swiss franc loans) and targeted reviews (sanctions adaptation following Russia’s war in Ukraine) have been performed; anonymized reports were shown to assessors. - Prudential warning signals developed to flag potential ML/TF risks across governance, business model, operational risk, credit risk and liquidity risk. ### EC3 — Reporting of suspicious activities to supervisor when material - Description and findings: - Banks must file suspicious transaction reports to national FIUs. - No legal requirement exists for SIs to report suspicious activities or fraud incidents to the prudential supervisor; ECB expects to become aware via ongoing supervision (meetings, documents, minutes). - Internal SSM Operational Guidance covers JST review of incidents (internal fraud, external fraud, transaction fraud, conduct risk); anonymized examples showed banks proactively communicating incidents to JSTs. ### EC4 — Supervisor informs FIU and other authorities of suspicious transactions - Description and findings: - Information sharing governed by EBA Guidelines on AML/CFT cooperation; these require prudential supervisors to request and provide AML/CFT-relevant information for SREP. - Where ECB becomes aware of potential illegal activities, it shares information with relevant AML/CFT supervisors, who are asked to onward share with authorities. - The FIU and ECB have set up common folders to facilitate exchange, though this channel is not frequently used. - SSMFR process: ECB requests NCAs to refer criminal-suspect matters to national criminal authorities via initial technical request and formal letter approved by Chair or Vice-Chair of the Supervisory Board; anonymized examples were seen by assessors. ### EC5 — CDD policies and processes - Description and findings: - AML/CFT-specific implementation of CDD, enhanced due diligence and ongoing monitoring is the remit of national AML/CFT competent authorities. - ECB may encounter CDD deficiencies via SREP assessments of governance and operational risk and follows up on prudential implications, informing AML/CFT authorities as needed. - JSTs use SREP Manual operational risk module to assess boarding, account opening/closing, account/product management, and client record issues. ### EC6 — Correspondent banking policies and processes - Description and findings: - ECB does not assess correspondent banking from an AML/CFT perspective but may assess prudential implications where such activities affect compliance with prudential requirements. - Core principle expects prudential supervisors to ensure correspondent banks are effectively supervised, not shell banks, and require senior management approval for new correspondents; ECB could integrate these aspects more actively into prudential supervision per EBA SREP Guidelines. ### EC7 — Controls/systems to prevent, identify and report abuses - Description and findings: - Effectiveness of AML/CFT controls for ML/TF and proliferation financing is not assessed by the ECB; national AML/CFT authorities hold that remit. - ECB assesses governance and internal control frameworks under EBA Governance Guidelines; under EBA AML/CFT cooperation, ECB expects to request information on material AML/CFT weaknesses relevant to SREP. - Where information on weaknesses is received (including via prudential warning signals), JSTs assess prudential concerns and reflect them in SREP elements, potentially leading to remedial measures or score downgrades. ### EC8 — Powers to take action against non-compliance with criminal activity laws - Description and findings: - ECB has no competence to address criminal activities directly; SSMFR requires referral to relevant NCA to involve criminal authorities. - ECB uses prudential powers under SSMR to address deficiencies in risk management stemming from abuse of financial services. - If serious AML/CFT breaches are established by AML/CFT supervisors, the ECB can withdraw bank authorization under Article 18(f) CRD if proportionate. - Supervisory measures have required banks to strengthen control frameworks, adopt de-risking strategies, reassess board members, and in some cases triggered license withdrawal. ### EC9 — Internal audit, compliance function, screening, training, reporting by staff - Description and findings: - a. Internal audit: ECB expects robust, fully independent internal audit; internal audit reports are reviewed in ongoing supervision; a 2022 horizontal benchmarking on internal audit informed the draft ECB Guide on Governance and Risk Culture. - b & c. Compliance function: EBA Guidelines require a permanent and effective compliance function with independence, authority, resources and training; proportionality may allow combination with other functions if no conflict of interest. No universal requirement for a separate financial-crimes officer is in the Guidelines, though national law may require one. - Annual governance data collection includes reporting lines and staffing of internal control functions; a horizontal compliance function analysis was undertaken and deficiencies were followed up with banks. - d. No explicit ECB expectation on staff screening at hiring (FATF Recommendation); EBA Outsourcing Guidelines require due diligence of service providers prior to agreements. - e. Staff training: EBA Internal Governance Guidelines require risk culture and staff awareness; JSTs review preconditions to prevent internal fraud (risk culture, background verifications, job rotation, training). - f. Reporting criminal activities by staff: CRD Article 71 provides protection for employees who report breaches; EBA Guidelines expect whistleblowing systems. SSM Supervisory Manual asks JSTs to assess internal fraud investigation functions and whistleblowing mechanisms. ### EC10 — Staff reporting channels and MIS - Description and findings: - ECB expects banks to have whistleblowing systems per CRD and EBA Internal Governance Guidelines; draft ECB Guide links whistleblowing to risk culture. - SSM Supervisory Manual requests JSTs assess whistleblowing policies, channels, usage and management involvement; a 2019 stock take found all banks have speak-up mechanisms with varying formality and usage. - Where whistleblowing indicated ML/TF risks, ECB shared information with AML/CFT competent authorities; ECB supervision covers MIS adequacy via RDARR supervisory priority and published a guide on effective data aggregation and reporting. ### EC11 — Legal protection for good-faith reporters - Description and findings: - CRD Article 71 requires member states to ensure appropriate protection for employees reporting breaches against retaliation, discrimination or other unfair treatment. - EBA Guidelines require appropriate whistleblowing procedures enabling reporting without reprisal and clear rules on whistleblower treatment. - ECB has its own breach reporting mechanism treating reports as protected and safeguarding reporter identity unless disclosure is required by court order; SSM whistleblowing platform provides safe harbor. - Assessors saw an anonymized whistleblower complaint (fictitious credit cards) that was shared with relevant agencies and followed up by the ECB. ### EC12 — Cooperation with domestic and foreign authorities - Description and findings: - ECB exchanges information regularly with national AML/CFT competent authorities via multilateral AML Agreement with 51 signatories. - ECB participates as active observer in 64 AML/CFT Colleges and supervisory colleges may engage AML/CFT representatives. - Annual information exchange includes ML/TF risk assessments, AML/CFT sanctions information, and high-risk subsidiary details; ECB shares excerpts of SREP decisions and ad-hoc inspection reports. - Revised SSM Operational Guidance 3 Annex on AML/CFT in On-Site Inspections (approved August 2024) includes joint meeting provisions for simultaneous on-site inspections; none occurred by assessment time. - ECB contributes to EuReCA: 48 submissions related to 14 entities; ECB is a main contributor among prudential supervisors. - ECB is active at the EBA and as observer at the EBA AML/CFT Standing Committee; coordinated thematic work with AML/CFT supervisors was requested by EBA Guidelines but assessors did not find instances. - AMLA and an MOU with ECB are expected to streamline coordination. ### EC13 — In-house expertise and communication to banks - Description and findings: - AML/CFT expertise primarily resides with national AML/CFT competent authorities; ECB retains expertise on governance, controls and compliance. - ECB established AML Coordination Office (AMLCO) as center of expertise within SSM and to coordinate SSM AML/CFT NCA Network (51 signatories noted earlier). - Network supports JSTs via training, benchmarks, thematic analysis, and methodology/tools contribution. - ECB engages industry via dialogue, conferences, published FAQs and draft guides; prudential AML/CFT issues are discussed bilaterally with bank boards and key function holders. ### EC14 — Group-wide AML/CFT programmes - Description and findings: - Assessment of group-wide AML/CFT programs is within AML/CFT authorities’ remit (AML Directive (EU) 2015/849 requires policies, controls and procedures to mitigate ML/TF risks). - ECB assesses group coordination, reporting lines and implementation of policies as part of SREP governance and risk management modules. - A few on-site inspections and JST deep-dives have focused on group oversight (notably oversight by parent of smaller local entities); 2022 stocktake on central steering of cooperatives found no AML/CFT-relevant findings. ### Additional supervisory tools, cooperation and operational notes - ECB developed draft Guide on Governance and Risk Culture (2024, under consultation) clarifying prudential expectations on abuses of financial services (AML/CFT, tax offences, sanctions violations). - Prudential warning signals have been developed to reflect potential ML/TF risks in SREP. - EBA Guidelines on AML/CFT Cooperation require information exchange, SREP-relevant inputs, and foresee coordinated work; implementation varies across Member States. - AML Agreement signatories: 51. - ECB active observer participation: 64 AML/CFT Colleges. - EuReCA contributions by ECB: 48 submissions related to 14 entities. *Source: Part 6: Data on waivers.* ### 1. Responsibilities, objectives and powers LC The ECB has a broad set of powers ### 1eurea2025012 - 1. Responsibilities, objectives and powers LC The ECB has a broad set of powers ### Powers, harmonization, and legislative developments - The ECB’s powers derive from Union law and the national laws of the NCAs, supplemented by the technical standards and guidelines of the ESAs and the ECB’s own supervisory guidance and expectations. - Inconsistencies persist across member states due to differences in transposition of Union directives. - The 2018 FSAP identified gaps vis-à-vis international standards; several gaps will be addressed by recent EU legislative initiatives that remained to be transposed and implemented in national legislative frameworks at the time of the BCP assessment. - CRD 6 is referenced repeatedly as introducing harmonizing measures (e.g., prudential regime for Third Country Branches, acquisition rules) but requires transposition into national law. ### Independence, accountability, resourcing, and legal protection for supervisors - Governance arrangements of the SSM help insulate against industry and government interference; forthcoming legislative changes impose term limits on heads of agencies in member states. - Connection with an independent central bank strengthens independence but has implications for the budgetary autonomy demanded by the BCP. - Access to staff from NCAs is an advantage; inability of NCAs to meet staffing commitments can affect planned deployment of supervisory resources. ### Cooperation and collaboration - The ECB has been growing an extensive network of cooperation and information sharing arrangements with both European and foreign supervisory authorities that works well. ### Permissible activities and third-country branches - Investment firms have been brought into the supervisory ambit of the ECB following the 2018 FSAP recommendations. - CRD 6 introduced a more harmonized regime for prudential regulation of Third Country Branches and several safeguards, but supervision of such branches remains with NCAs, which retain discretion to require subsidiarization for large branches. - Situations may persist where branches are comparable to SIs but are not supervised by the ECB, creating potential regulatory and supervisory arbitrage opportunities. - Entry of new actors and bank-like products presents an opportunity to harmonize banking-related definitions and powers. ### Licensing criteria and cross-border assessment - Licensing criteria are clearly articulated in the EU legal framework and supervisory guidance; ECB and NCAs cooperate effectively in licensing. - No requirement exists that the host supervisor obtain non-objection from the home supervisor. - The ECB faces challenges in assessing whether third-country authorities apply global consolidated supervision. - The ECB does not have authority to authorize and supervise euro area branches of non-EU or EEA banks; such branches are regulated and supervised by local NCAs. - Under CRD 6, NCAs lead the process to require establishment of subsidiaries for systemic third-country branches without ECB influence. ### Transfer of significant ownership - The SSM has a rigorous process to assess transfer of qualifying holdings. - EU legislation does not require notification to supervisors of material information that may negatively affect the suitability of a major shareholder or controlling party. - Annual informing requirements about shareholders and qualifying holdings are limited to institutions traded on a regulated market and do not cover all institutions. - EU legislation does not require reversal or modification of transfers that occur without necessary notification or approval, or where approval was based on false information. ### Major acquisitions - CRD 6 introduces a harmonized regime for prudential regulation of acquisition of material holdings by a credit institution in other financial and non-financial institutions—a key recommendation from the earlier FSAP. - Until CRD 6 is transposed into national frameworks by January 2026, assessment of acquisition of material holdings depends on specific national powers, which are not present in all member states. - Existing national provisions are not as comprehensive as this Core Principle requires. ### Supervisory approach - The SSM applies a highly intensive supervisory approach, aligned with its mandate to raise supervision quality and level the playing field. - The approach is resource-intensive, can be burdensome, and challenging to be agile. - Noted issues: stickiness of SREP scores over time and limited differentiation among institutions. ### Supervisory techniques and tools - The SSM is a highly sophisticated regulator with comprehensive supervisory approach, excellent risk analysis, and strong skills. - SREP letters are often lengthy and very legalistic; Pillar 2 requirements and remediation actions were not always clear to banks. - The intensive approach generates many findings, posing challenges for follow-up and remediation. - New priorities and budget stabilization may reduce focus on some supervisory areas. ### Supervisory reporting - EU has a well-developed common supervisory reporting system ensuring maximum harmonization; revision/enhancement processes at EU level are lengthy. - ECB can collect ad-hoc data but faces limitations (less standardization, potentially lower quality). - FINREP data collection on transactions with related parties is not sufficiently granular and scope is too restricted. ### Corrective and sanctioning powers - The framework is asymmetrical, potentially producing inconsistent sanctioning approaches across the SSM. - Limitations remain in corrective and sanctioning powers available to the ECB in Union law; national laws may go beyond CRD minimum harmonization. - CRD 6 will enhance enforcement powers of competent authorities and reduce (though not eliminate) asymmetry. - ECB has streamlined enforcement and sanctions processes, introduced an escalation framework to expedite internal processes, and is internalizing these improvements to facilitate timely redress. ### Consolidated supervision - The ECB undertakes intensive supervision on both standalone and consolidated bases. - EU legislation does not provide an adequate framework for supervision of mixed activity groups. - Competent authorities lack appropriate mandates for group-wide and cross-border activities for mixed-activity groups. - No authority exists to conduct ongoing fit and proper reviews of senior management of corporate parents that own banks. ### Home-host relationships - The ECB participates effectively in groupings and colleges as home and host supervisor and has formal/informal cooperation and information-sharing arrangements. - College meetings and industry feedback indicate colleges are working well; opportunity for joint work remains untapped. - Receiving data and information from some peer jurisdictions under MoUs remains a work in progress. - No explicit legal authority to prohibit shell banks as mentioned in 2018, though CRD 6 introduces provisions to limit use of third-country branches as booking offices; no information confirms whether all legacy shell banks have discontinued operations. ### Corporate governance - ECB has significantly strengthened supervision of corporate governance; it remains a top supervisory priority and more guidance has been issued. - Supervision is comprehensive and intrusive; governance is a major element of formal sanctioning proceedings. - Fit and proper process is delegated but absorbs significant supervisory resources; lack of EU harmonization remains an issue as practices, responsibilities, and national powers vary. - CRD 6 will help by bringing key function holders into suitability assessments and strengthening banks’ primary responsibility in appointing suitable candidates. ### Risk management process - SSM provides substantial coverage of risk management based on CRD/CRR and additional EBA guidelines; SSM publishes its own guides and conducts an intensive approach. - Significant progress in assessing longer-horizon risks, including digitalization, climate-related financial risks, and emerging risks. - Climate and digitalization are SSM priorities and have been the subject of targeted reviews and enhanced supervision. ### Capital adequacy - Deviations with international standards persist from past RCAP reviews and new ones are introduced in CRR 3. - The impact of EU-specific adjustments on capital requirements is material. - ECB faces resourcing constraints in internal model validation. - CRR allows banks, subject to supervisory approval, to apply IRB to sovereign exposures while continuing to use the standardized approach for sovereign exposures towards EU member states; this may facilitate cherry picking. - No harmonized EU methodology exists for calibration of O-SII buffers, which may result in unwarranted heterogeneity across the euro area. - Use of the ECB’s top-up powers is not a substitute for a harmonized calibration methodology. ### Credit risk - CRD, CRR and EBA Guidelines provide a good base for banks’ credit risk management requirements but not all aspects envisaged by this Core Principle are covered. - Improvements since the last assessment include AnaCredit (loan-by-loan information on credit exposures to all legal entities including SMEs) and Security Holding Statistics (security-by-security database). - These data enhance supervisory uses such as monitoring NPL reduction, loan forbearance, and early warning signals on indebtedness of borrowers and connected groups. ### Problem assets, provisions, and reserves - Supervision has progressed on NPLs, resulting in a much-reduced level of NPLs in banks. - Policy framework has improved, but much remains soft law. - Ability to use P2R provides a fallback to ensure appropriate prudential treatment where provisions are inadequate based on a uniform provisioning calendar and supports supervisors’ moral suasion on classification and provisioning. ### Concentration risk and large exposures - EU large exposures framework is largely compliant with the Basel Framework. - Various forms of concentration risk are addressed in EBA SREP Guidelines, but no supervisory guidance provides detailed expectations on management of all concentration risk forms. - No requirement or supervisory guidance specifying that all material concentrations be regularly reviewed and reported to the bank’s supervisory board. - ECB does not systematically consider sovereign risk concentrations when setting Pillar 2 requirements. ### Transactions with related parties - EU framework for related party transactions is neither comprehensive nor consistent; definitions are not aligned with the Basel standard. - No limits or thresholds triggering supervisory notification or approval are prescribed in EU law or harmonized across member states. - No horizontal or thematic review has been conducted to develop benchmarks for materiality or formalize supervisory expectations. ### Country and transfer risks - No harmonized EU framework for country risk, but developments in SREP methodology and tools help assess these risks. - EBA SREP Guidelines now address country and transfer risks as a sub-category within credit risk. - No supervisory expectations for industry have been issued; evidence was not provided that applicable SSM supervisory guidance on oversight of provisions against country risk and transfer risk is implemented. ### Market risk - A fully articulated and distinct framework within the EU exists for Market Risk. - Market risk is smaller relative to credit and operational risks given SIs’ business models, but it has been growing since the UK’s departure from the EU. ### Interest rate risk in the banking book (IRRBB) - A fully articulated and distinct EU framework exists for IRRBB. - IRRBB can be significant for SSM banks and has been a supervisory priority since 2022, receiving appropriate attention through EBA Guideline updates and stress tests. ### Liquidity risk - SSM delivers thorough assessment and mitigation of liquidity risk and has progressed substantially since the 2018 report. - SSM responded well to 2023 liquidity problems in some banks, including a move to weekly reporting. - Gaps remain with international standards. ### Operational risk and resilience - SSM has made substantial progress on operational risk and resilience since the last BCP Assessment. - Prioritization of Cyber and Operational Resilience provided appropriate focus; significant legislative change supports this. - DORA provides a robust supervisory framework but imposes substantial implementation and resourcing challenges for supervisors. ### Internal control and audit - EU framework provides a comprehensive approach to internal control and audit. - Strong emphasis on internal control, compliance, and audit throughout supervisory processes. ### Financial reporting and external audit - ECB has limited scope under EU law to engage in assessments of integrity and external audit of SIs’ financial statements; overall EU financial reporting and external audit regime appears robust. - EU laws do not empower the ECB to reject appointment of external auditors or access external auditors’ working papers. ### Disclosure and transparency - EU has a comprehensive framework promoting transparency through qualitative and quantitative disclosure requirements. - Definition of related parties used for disclosure is not as comprehensive as in CP 20. - LCR is disclosed based on end of month averages instead of end of period values, which is not fully aligned with Basel Pillar 3 standards. *Source: 1eurea2025012 - 1. Responsibilities, objectives and powers LC The ECB has a broad set of powers* ### 29. Abuse of financial services LC ### 29. Abuse of financial services LC ### Overview and ECB mandate - The ECB mandate specifically excludes AML/CFT supervision; the ECB’s focus in this area is to supervise the prudential implications of AML/CFT weaknesses identified by AML/CFT authorities or encountered otherwise. - The ECB has been strengthening its supervisory training and toolkits for this purpose. - The cooperation and information exchange between the ECB and AML/CFT authorities has improved, though considerable heterogeneity has been noted in the information received from others. - The multiplicity of actors and forums increases the complexity of prudential–AML/CFT interaction; the new AML/CFT authority (AMLA) is expected to ensure more effective cooperation and information exchange. - ECB supervision also covers risks from other types of criminal abuse of the financial system, including internal, external and transactional fraud, addressed through supervision of internal controls and operational risks. - Areas of potential overlap with AML authorities include policies and processes related to correspondent banking, CDD and recruitment; these should be systematically incorporated by the ECB to avoid gaps. ### Key findings relevant to prudential‑AML interaction - The ECB’s role is prudentially focused: it does not perform AML/CFT supervision but monitors prudential implications of AML/CFT weaknesses. - Information received by the ECB from other authorities is heterogeneous, complicating consistent prudential oversight. - Multiple supervisory actors and forums complicate cooperation; AMLA is expected to improve the effectiveness of cooperation and information exchange. - ECB supervision covers criminal abuse beyond AML/CFT, including internal, external and transactional fraud, within internal controls and operational risk supervision. - Specific processes that risk falling through supervisory cracks include correspondent banking, customer due diligence (CDD), and recruitment practices. ### Recommended actions (selected and AML/CFT‑relevant) - Principle 29 — Recommended Actions: - Banks should be required to promptly report to their prudential supervisor material suspicious or criminal activities and incidents of fraud which can be material for the safety, soundness and reputation of the bank. - The ECB should incorporate more systematically the monitoring of policies and processes for the selection, access to and conduct of correspondent banking accounts in their prudential supervision. - The ECB should, where appropriate, undertake more deep dives and thematic reviews on prudential areas identified with AML/CFT risks including through joint work with AML authorities as envisaged in the EBA Guidelines on Cooperation. - The EU should devise a cooperative process that will enable AML concerns to be taken into account for license withdrawal decisions while leaving the ECB as the ultimate authority for the exercise of the decision. - Other cross‑cutting recommendations that affect AML/CFT‑prudential interaction: - Promote further regulatory harmonization consistent with international standards by reducing the ECB’s reliance on national legislative frameworks and introducing more detailed common EU‑wide standards limiting differences in implementation at national level (Principle 1). - Ensure more effective joint inspections with non‑SSM supervisors using capabilities in MoUs (Principle 3). - Intensify cooperation through joint initiatives, such as joint onsite inspections, and consider expanding mandates or supervisory powers where mixed‑activity groups operate (Principle 12). - The ECB should incorporate monitoring of correspondent banking selection, access and conduct processes into prudential supervision more systematically (Principle 29 reiteration). ### Authorities’ responses (selected points) - European Commission: - Welcomes the IMF assessment and largely agrees with findings with notable exceptions. - Disagrees with IMF team assessment on Basel Core Principle 7; states that Directive (EU) 2024/1619 (CRD6) published on 19 June 2024 and in application in the Union since 9 July 2024 already addresses the issue. Member states must transpose CRD6 provisions concerning bank mergers into national laws by 11 January 2026. - Contends that licensing procedures are harmonized under the CRD and, in the context of the Banking Union, are tasks entirely attributed to the ECB‑SSM (“common procedure”). - Notes that Basel standards are applied at all levels of consolidation and highlights a strong Pillar 2 framework and active use of macroprudential measures that go beyond Basel standards—these, the Commission argues, should be given more weight in the assessment of capital adequacy. - European Central Bank: - Welcomes the IMF assessment and its overall positive assessment of SSM supervision quality and transparency. - Notes significant progress since the 2018 euro area FSAP and highlights supervisory work on operational resilience, business model sustainability, risk management, governance, crisis management and climate‑ and nature‑related risks. - Views many IMF recommendations as consistent with initiatives already underway (e.g., SREP reform, delegation framework, escalation ladder, tiered approach to findings and measures, risk tolerance framework, recent changes to the P2R methodology). - Regrets the IMF’s decision not to consider regulatory improvements introduced by EU legislation implementing final Basel III standards (notably CRD6) when performing the assessment, asserting that certain issues identified are already addressed under existing EU law (for example, CP7 on major acquisitions). - Agrees with the IMF recommendation to promote further regulatory harmonization by reducing reliance on national legislative frameworks and options/discretions, and to introduce more common EU‑wide standards where relevant. *Source: 29. Abuse of financial services LC (excerpts).* --- _Source: https://www.imf.org/-/media/files/publications/cr/2025/english/1eurea2025012.pdf_