## _cr16196 ## Source details **Canonical URL:** [_cr16196](https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2016/_cr16196.pdf) ## Other formats - [Markdown version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2016/_cr16196.pdf.md) - [Structured JSON version](/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2016/_cr16196.pdf.json) --- ### INTRODUCTION AND METHODOLOGY — context and scope - FSAP mission: undertaken by IMF during March of 2016 at request of German authorities; assessment reflects framework as of completion date. - Scope: focused on BaFin, Deutsche Bundesbank (BBk), and the European Central Bank (ECB) as joint supervisors; assessed against the Revised Core Principles (BCP) Methodology (September 2012). - Assessment grading system used: compliant; largely compliant; materially noncompliant; and noncompliant. - Key institutional changes since 2011: - Approval/transposition of CRD IV and CRR; establishment of EBA; creation of the Single Supervisory Mechanism (SSM). - ECB direct supervision of 21 of Germany’s largest banks, including one G‑SIB. - Major methodological elements applied: SREP, RAS, SEP, on‑site inspections, thematic reviews, external auditor long‑form reports, FINREP/COREP reporting and Short‑Term Exercises (STEs). ### SSM implementation, institutional effects, and supervisory organization - Joint Supervisory Teams (JSTs) for Significant Institutions (SIs): - JSTs led by ECB staff with sub‑coordinators from BaFin and Bundesbank and include multinational staff. - JSTs created operational and motivational challenges due to differing supervisory cultures and languages. - Decision‑making and legal constraints: - ECB supervisory decisions prepared by Supervisory Board, submitted to Governing Council under a non‑objection procedure; complex procedures reduce timeliness. - ECB often enforces measures through BaFin using national law powers; enforcement and sanctioning powers of ECB directly are limited. - Recommendation: streamline ECB day‑to‑day decision processes to improve timeliness. - LSIs (Less Significant Institutions): - Over 1,500 LSIs remain under BaFin/Bundesbank direct supervision under ECB oversight. - Transition from qualitative relationship‑based supervision to a more quantitative, SREP‑based approach underway. - BaFin/Bundesbank rely heavily on external auditors’ long‑form (EA) reports; reliance can leave gaps in related party lending, country risk, concentration risk, and operational risk. - Resource implication: increased reporting/monitoring may increase resource needs for LSI supervision. ### GOVERNANCE, FIT‑AND‑PROPER, BOARDS AND INTERNAL CONTROLS (CPs 1–7, 14, 26) - Division of responsibilities: - Legal framework: KWG, MaRisk, CRD IV/CRR, SSMR and SSMFR. - Management Board: primary responsibility for internal controls, governance, business strategy, internal audit (KWG). - Supervisory Board: oversight role; described as "weak and passive" in practice; collective knowledge not routinely assessed in licensing. - Fit‑and‑proper and board processes: - Licensing: license application must include names and qualifications of executive board and up to 20 biggest shareholders; Section 32 (1) KWG and Section 14 AnzV detail requirements. - BaFin issued guidance in January 2016 emphasizing professional qualification of the Board. - No legal requirement for banks to notify the supervisor when they become aware of events that may cause a significant shareholder to no longer be fit‑and‑proper. - Recommendation: expand fit‑and‑proper review and strengthen supervisory board qualification expectations. - Internal audit, compliance and independence: - Internal audit reports to Management Board and is an instrument of Management Board (MaRisk AT 4.4.3); ex‑post notification to Supervisory Board for replacements. - Concerns: reporting lines may weaken independence of internal audit, compliance and CRO; recommended stronger direct reporting links to Supervisory Board and prior notification of CRO removal. ### SUPERVISORY APPROACH, SREP, RAS, SEP, AND SUPERVISION TOOLS (CPs 8–11, 30) - SREP and risk frameworks: - SREP core elements: business model analysis; internal governance; risks to capital; risks to liquidity/funding. - SREP implementation status: SSM methodology adopted; only one full SREP cycle completed for SIs at time of assessment; RAS in use for day‑to‑day work. - Minimum engagement levels (MELs) and SEP: - MELs: Intense (I), Enhanced (E), Standard (S), Basic (B) mapped via cluster and risk score matrix. - SEP horizons: off‑site ongoing activities typically one year; on‑site inspections/internal model investigations typically 6 months. - Supervisory techniques and findings: - On‑site inspections: SIs at least annually; LSIs inspection cycle ranges from one year to 12 years (12‑year for lowest risk smallest LSIs flagged as too long). - About 15 percent of all LSIs are inspected (special audits) annually. - Identified gaps: supervisory reporting not sufficiently granular (related party exposures, loan segmentation, operational risk loss data), mapping differences between nGAAP and IFRS complicate comparisons; priority to address timely and accurate data. - Recommendation: collect more granular supervisory reporting, improve data quality and mapping between accounting frameworks, and shorten LSI inspection intervals where warranted. ### LICENSING, SIGNIFICANT OWNERSHIP, ACQUISITIONS, AND MAJOR INVESTMENTS (CPs 4–7) - Licensing authority: - ECB is exclusive competent authority for authorization of credit institutions in SSM member countries (SSMR Articles 4(1)(a), 14); BaFin prepares draft decisions under national law. - Initial capital requirements: EUR 5 million minimum for deposit‑taking credit institutions; EUR 1 million for e‑money only institutions (CRD IV Article 12; transposed). - Ownership transparency and acquisition controls: - License applications must provide names/amounts of qualified participating interests and group structure (Section 32 (1) sentence 2 nos. 6 a)–e) KWG). - Section 2c KWG transposes CRD IV acquisition/notification rules; ex‑ante notification required for qualifying holdings reaching 20, 30, 50 percent thresholds. - BaFin traces indirect qualified holdings and may aggregate concerted actors. - Major acquisitions and investments (Principle 7): - No general prior supervisor approval for major acquisitions or investments other than acquisitions of significant holdings in other German supervised institutions. - Assessment: Materially Noncompliant for Principle 7 — lack of ex‑ante approval for major acquisitions (outside significant holdings regime) can allow investments that increase group risk beyond management skills; supervisor remedies are largely ex‑post. - Recommendation: stronger ex‑ante consideration of major acquisitions, especially where group risk could increase materially. ### CAPITAL, LEVERAGE, ICAAP/ILAAP, INTERNAL MODELS (CPs 15–16) - Capital regime and national discretions: - CRR/CRD provide Basel‑III based framework; national discretions used (e.g., extended transitional period for DTAs to 2023; Art. 89 ART 1250 percent risk weight for certain qualifying holdings). - Minimum capital thresholds: CET1 4.5 percent; Tier 1 6 percent; Total capital 8 percent; capital conservation buffer CET1 2.5 percent. - RCAP (2014) found EU implementation Materially Non‑Compliant overall; for Germany deviations noted in sovereign exposures, covered bond risk weights and counterparty credit risk. - Supervisory practice: - Both ECB and BaFin can impose Pillar 2 capital add‑ons (Section 10 (3) KWG); at assessment time practice was limited — ECB had concluded one SREP cycle with some Pillar 2 add‑ons. - Leverage considered in SSM SREP methodology; less systematically by BaFin. - Internal models: - Advanced approaches approvals and change controls governed by CRR and national SolvV; any material change to an approved internal model requires prior permission (CRR Articles 143(3), 312, 363(3); SolvV provisions). - At assessment: 11 banks authorized for market risk models; 50 for IRB Approach; 14 for AMA; 3 for IMM. ### CREDIT RISK, LOAN CLASSIFICATION, NPLs, PROVISIONS (CPs 17–18) - Legal and supervisory framework: - MaRisk and KWG require robust credit risk management, documented policies, risk classification, collateral valuation and stress testing. - Supervisory verification via on‑site inspections, off‑site monitoring and external auditor reports. - Key findings and gaps: - Supervisors have not provided detailed guidance on loan portfolio management/loan classification definitions (non‑performing, restructured, forborne, cured). - Granularity of credit portfolio data limited; external auditors play a large role in related valuation and provisioning assessment. - On provisioning/valuation: thematic reviews (AQR 2014) produced recommendations; supervisors are building capacity to challenge bank valuations but independent verification and routine loan file review remain limited. - Assessment: Principle 17 — Compliant; Principle 18 — Largely Compliant. - Recommendation: issue supervisory guidance on loan classification and provisioning, strengthen supervisor capacity to challenge valuations, and improve data granularity. ### CONCENTRATION RISK, LARGE EXPOSURES (CP 19) - Regulatory framework: - CRR Articles 387–403 (Large Exposures); Article 392 defines 10 percent of eligible capital as large exposure threshold; Article 395 sets 25 percent limit for single exposures. - Bundesbank central credit register (CCR) reports loans ≥ EUR 1 million quarterly; provides sector and geographic data. - Findings: - Supervisory expectations for concentration risk management not clearly communicated beyond credit concentrations; broader concentration types (funding, market, currency) receive less systematic attention. - No requirement that all material concentrations be regularly reviewed and reported to Supervisory Board. - Assessment: Largely Compliant. - Recommendation: communicate clearer supervisory expectations on broad concentration risk management and require regular reporting of material concentrations to Boards. ### RELATED‑PARTY TRANSACTIONS (CP 20) — critical shortcomings - Legal basis and provisions: - Section 15 KWG defines related parties and requires loans to related parties be on market terms; unanimous management board decision and supervisory board consent required prior to grant (with limited narrow exceptions). - Supervisory powers to impose limits exist (Section 15 (2) KWG) but rarely used. - Key gaps and supervisory weaknesses: - No requirement that conflicted individuals be excluded from the granting and managing process beyond commonly applied practice; no requirement to monitor related party exposures separately and in aggregate; no regular reporting of related party exposures. - Supervision of related party risk largely dependent on external auditors; auditors’ analyses are limited. - No statutory limits on related party exposures; supervisors have powers but have not used them. - Assessment: Principle 20 — Materially Non‑Compliant. - Recommendation: implement a comprehensive regime for management, monitoring, aggregate reporting and supervisory oversight of related‑party transactions and exposures; consider limits and stronger supervisory use of section 15 powers. ### COUNTRY AND TRANSFER RISK (CP 21) - Framework and reporting: - Länderrisikoverordnung (LrV) requires reporting of lending to borrowers domiciled outside specified low‑risk countries when total > EUR 10 million and details on transactions ≥ EUR 1 million. - MaRisk includes country risk as part of credit risk; CCR and other data sources used. - Gaps: - Supervisory guidance on expectations for country risk management limited; no specific requirement to include country risk in stress testing systematically. - Assessment: Largely Compliant. - Recommendation: provide clearer guidance on country risk MIS, require inclusion in stress tests and standardize reporting across banks. ### MARKET RISK, IRRBB (CPs 22–23) - Market risk: - MaRisk establishes market risk requirements; supervisory intensiveness greater for large trading banks; targeted internal model reviews planned over several years. - Assessment: Market risk — Compliant. - IRRBB: - IRRBB key priority; banks must measure, calculate and report IRRBB quarterly and conduct stress testing using standardized and bespoke scenarios. - Supervisors assess IRRBB in SREP; short‑term data collections performed to identify systemic exposure. - Assessment: IRRBB — Compliant. ### LIQUIDITY RISK, ILAAP, LCR, NSFR (CP 24) - LCR implementation and EU deviations: - EU LCR in force with phase‑in: 60 percent minimum from October 1, 2015; 70 percent from January 1, 2016; 80 percent from January 1, 2017; 100 percent from January 1, 2018. - EU LCR includes elements less stringent than Basel (wider HQLA definitions; treated covered bonds as Level 1 assets with haircut rules). - NSFR: no formal EU decision at assessment date; institutions expected to monitor NSFR. - Supervisory practice: - SREP Element 4 covers liquidity: Block 1 metrics, Block 2 ILAAP assessment, Block 3 supervisory stress tests. - For LSIs LiqV and MaRisk apply; approved internal liquidity models possible with supervisory approval. - Assessment: Principle 24 — Largely Compliant. - Recommendation: develop benchmarks for liquidity indicators, complete ILAAP guidance and harmonized ILAAP information collection. ### OPERATIONAL RISK, IT RISK, BUSINESS CONTINUITY (CP 25) - Developments and weaknesses: - Enhancements since 2011, including strengthened IT risk specialists and targeted DR testing attendance. - Weaknesses: limited operational risk loss data collection/benchmarking; reliance on external auditors; need for more systematic verification of implementation; DR/BCP testing frequency and standards not prescriptively specified. - Assessment: Principle 25 — Materially Non‑Compliant. - Recommendations: expand loss data collection and benchmarking, increase targeted operational risk on‑site inspections (including for AMA banks), strengthen DR/BCP testing expectations and supervisory verification. ### SUPERVISORY REPORTING, DATA QUALITY AND AUDIT (CPs 10, 27) - Data and reporting issues: - Supervisory reporting insufficiently granular for off‑site supervision (gaps in related party exposures, loan loss segmentation, operational risk loss data). - Mixed use of nGAAP and IFRS complicates peer comparisons; technical mapping work ongoing. - Supervisors lack legal power to access external auditors’ working papers; reliance on external auditors is significant. - Assessments: - Principle 10 — Materially Non‑Compliant. - Principle 27 — Largely Compliant but gap: no legal right to external auditors’ working papers; recommended to address gap given reliance on auditors. - Recommendations: enhance granular supervisory reporting, accelerate mapping nGAAP↔IFRS, and establish legal access or workable alternative to auditors’ working papers for supervisors. ### CORPORATE GOVERNANCE AND BOARD OVERSIGHT (CP 14) — findings and recommendations - Two‑tier system: - German corporate law and KWG adopt a two‑tier structure (Management Board — executive; Supervisory Board — oversight). - Section 25d (2) KWG: supervisory board as a whole must have necessary knowledge, skills and experience. - Findings: - Supervisory boards generally passive; fit‑and‑proper and technical knowledge requirements for Supervisory Board are streamlined. - External measures and MaRisk amendments (2016) aim to strengthen supervisory board qualifications and involvement. - Recommendations: - Supervisory guidance should clarify ultimate supervisory responsibilities and require adequate board reporting frequency and quality. - Consider enhancing fit‑and‑proper and knowledge requirements proportionate to institution complexity. - Strengthen direct access routes for Supervisory Board to heads of control functions; draft MaRisk revisions aim to require earlier notification for control function removals. ### RESOLUTION, RECOVERY, AND CRISIS COOPERATION (EC5, SAG, SRM) - Legal and institutional frameworks: - SAG transposes BRRD and establishes FMSA as national resolution authority for LSIs not in SRB remit; SRB assumed responsibility for SRM from January 1, 2016. - Recovery plans required; resolution planning and resolvability assessments implemented progressively. - Colleges and cross‑border coordination: - Resolution colleges envisaged; membership and coordination rules specified in SAG sections 156–157 and related provisions. - Recommendation: continue strengthening cooperation with non‑EU countries despite gaps in EU framework. ### AML/CFT SUPERVISION (CP 29) — strengths and priorities - Legal framework: GWG, KWG, PrüfBV, and 3AMLD transposition; BaFin responsible for AML/CFT supervision with dedicated divisions. - Practices and gaps: - BaFin uses risk‑based matrix; heavy reliance on EA (external auditor) reports; number of BaFin targeted on‑site examinations limited relative to sector size. - STR flows to FIU/LEAs; BaFin receives limited STR‑related notifications via LEAs; BaFin received between 5‑10 notifications by LEAs in 2015. - Annex 6 to the PrüfBV requires EA to rate ML/TF deficiencies using F0–F4 scale. - Assessment: Principle 29 — Largely Compliant. - Recommendations: refine risk‑based inputs, increase first‑hand supervisory verification and on‑site coverage, enhance cooperation and systematic information flow from FIU/LEAs to BaFin, strengthen correspondent banking monitoring. ### SUMMARY OF CORE PRINCIPLE RATINGS — selected - Principle 1 (Responsibilities, objectives and powers): Compliant. - Principle 2 (Independence, accountability): Largely compliant. - Principle 5 (Licensing): Largely compliant. - Principle 7 (Major acquisitions): Materially Non‑Compliant. - Principle 8 (Supervisory approach): Largely compliant. - Principle 10 (Supervisory reporting and data): Materially Non‑Compliant. - Principle 14 (Corporate governance): Largely compliant. - Principle 16 (Capital adequacy): Largely compliant. - Principle 18 (Problem assets / provisioning): Largely compliant. - Principle 20 (Related‑party transactions): Materially Non‑Compliant. - Principle 25 (Operational risk): Materially Non‑Compliant. - Principle 27 (External audit / financial reporting): Largely compliant (gap: access to auditors’ working papers). - Principle 29 (AML/CFT): Largely compliant. ### KEY POLICY RECOMMENDATIONS (selection, preserved technical references) - Improve SSM decision‑making timeliness: streamline Supervisory Board → Governing Council procedures for day‑to‑day supervision. - Strengthen fit‑and‑proper reviews and supervisory board qualification expectations; BaFin January 2016 guidelines to support reforms. - Issue supervisory guidance on loan classification/provisioning definitions (non‑performing, restructured, forborne, cured) and conservative collateral valuation; train staff to challenge valuations. - Introduce ex‑ante review for major acquisitions/investments where group risk could increase materially (address Principle 7 gap). - Develop more granular supervisory reporting templates to capture related party exposures, loan loss segmentation, operational risk loss data, concentration metrics; accelerate mapping between nGAAP and IFRS. - Reinforce related‑party transaction regime: require aggregate monitoring/reporting, exclude conflicted individuals from decision chains, and consider supervisory limits or stronger supervisory action under section 15 KWG. - Expand operational risk supervision: collect loss data, enhance benchmarking, increase frequency/depth of on‑site examinations (especially for AMA banks), and strengthen DR/BCP testing expectations. - Address auditor access gap: establish legal or procedural remedy to allow supervisors to obtain external auditors’ working papers or effective alternative. - Enhance AML/CFT supervision: increase first‑hand supervisory verification, expand on‑site coverage, and formalize STR information flows from FIU/LEAs to BaFin. *Italic: International Monetary Fund. FSAP mission during March of 2016 — Detailed Assessment Report excerpts from _cr16196 (provided content).* ### INTRODUCTION AND METHODOLOGY _______________________________________________________ 13 ### INTRODUCTION AND METHODOLOGY ### A. Introduction and context - Since the last FSAP (2011), German banking supervision has undergone profound changes: - Approval and transposition of the CRD IV and CRR framework. - Establishment of the European Banking Authority (EBA). - Creation of the Single Supervisory Mechanism (SSM). - The ECB took over direct supervision of 21 of Germany’s largest banks, including one G-SIB. - The German legal framework has been amended to transpose CRD IV, and CRR and regulatory technical standards developed by EBA and issued by the European Commission became directly applicable. ### B. Progress since the 2011 FSAP - Areas where progress was made: - Strengthened resources and capacity for on- and off-site supervision of risks. - More detailed guidance to banks on supervisory expectations regarding risk management. - Establishment of internal ladder of actions to foster more timely and consistent supervisory response. - Areas with little or no progress: - Level of reporting to the MoF. - Related party exposures. - Country risk. - Topics dependent mainly on the EU-wide framework (capital requirements, major acquisitions, supervisory reporting). ### SSM implementation and institutional effects - SSM impact: - For Significant Institutions (SIs): day-to-day supervision is conducted by Joint Supervisory Teams (JSTs) led by ECB staff with sub-coordinators from BaFin and Bundesbank (and from countries where the bank has significant subsidiaries). - JSTs are multinational, involving supervisors with different backgrounds, supervisory cultures, and languages, creating operational and motivational challenges. - For smaller German SIs, shift to ECB supervision represented deep changes in reporting, engagement, intrusiveness, and supervisory requirements — including capital add-ons from the SREP process. - For larger SIs, supervision benefits from better cross-country views and benchmarking, but supervisory response seems reduced due to complex ECB decision-making procedures. - Decision-making and legal constraints: - ECB supervisory decisions, after approval by the Supervisory Board, are submitted to ECB’s Governing Council for approval under a no-objection procedure. - ECB must comply with local legislation to execute many tasks (e.g., licensing applications filed with national authorities in compliance with national legislation). - Enforcement and sanctioning powers of the ECB are largely based on national legislation; ECB mostly acts by giving instructions to BaFin for measures under German law. - Recommendation: streamline decision making processes in ECB day-to-day supervision to improve timeliness of supervisory response. ### LSIs (Less significant institutions) supervision - Over 1500 LSIs remain under direct supervision of BaFin and Bundesbank, under general guidance of the ECB supervision. - ECB has designated some LSIs as High Priority with enhanced supervisory monitoring and reporting. - ECB is developing joint standards for elements of the Supervisory Review Process to apply SSM supervisory manual elements to LSIs. - Transition for LSIs: - Supervision is changing from qualitative, relationship-based approach to a more quantitative, SREP-based approach. - BaFin and Bundesbank rely heavily on external auditors’ long-form reports covering MaRisk, with supervision using these reports, on-site inspections, reports, and direct contact with banks. - This reliance can leave gaps in areas lacking guidance: related party lending, country risk, concentration risk, operational risk. - Resource implication: increased reporting and monitoring may increase resource needs for LSI supervision; authorities must balance supervisory objectives with resources for very small entities. ### Supervisory communication and guidance - Importance of supervisors communicating expectations and developing guidelines and regulations to substantiate enforceable measures: - Areas needing clear guidance: loan portfolio management (loan classification parameters and provisioning, collateral valuation considerations, effective credit risk management), concentration risk, country and transfer risk, related party risk, operational risk. - In the German framework, supervisory communication is effected through circulars, ordinances, and guidelines; SSM-wide, good practices and SSM internal procedures should be made public in structured instruments. ### A. Main findings (by topic) Responsibility, Objectives, Powers, Independence, Accountability (CPs 1–2) - Legal framework: well established by German laws and regulations, directly applicable EU regulation, and SSMR. - Division of responsibilities between BaFin and Bundesbank for LSIs is well established; SSM framework is evolving with uncertainties on operational roles. - Supervisory agencies enjoy operational independence from government or industry interference in individual decisions; potential for indirect influence exists via: - Budget approval process. - Mandatory approval of BaFin’s internal organization and structure by the MoF. - ECB decision-making process is complex and does not foster effectiveness and timeliness of day-to-day supervisory decisions (though emergency decision processes exist). Ownership, Licensing, and Structure (CPs 4–7) - The ECB is the licensing authority and makes decisions based on applicable German and EU laws. - Financial suitability assessment of shareholders is generally limited to availability of initial capital; supervisory board assessment has limited role in licensing but is being gradually incorporated. - No requirement for banks to notify the supervisor when they become aware of events that may cause a significant shareholder to no longer be fit-and-proper. - Recommendation: expand review of fit-and-proper qualifications and standards; BaFin’s January 2016 guidelines (issued) emphasize prudential importance of professional qualification of the Board. - There is no need for prior supervisor approval of investments below a 10 percent threshold, except investments in other German institutions (significant holdings regime); this can allow acquisitions that increase group risk beyond management skills — ex-ante review is more prudent. Methods of Ongoing Supervision (CPs 8–10) - Transition to SSM for SIs has benefits; supervision framework established with SREP as core element; some methodology elements still being implemented and will take time to mature and be applied consistently. - Supervisory approach for LSIs is established but evolving; greater verification of compliance with regulations is needed to complement current activities. - On-site examinations verify adherence with MaRisk via testing and interviews. - MaRisk Inspection Guide lays foundation for consistent examinations; external auditor reports are key. - Annual meetings with Management Board, ICAAP analysis, and risk profile assessment form core elements. - Greater emphasis needed to verify reliability, accuracy, and integrity of information used for risk assessments and forward-looking risk views. - Supervisory reporting is not sufficiently granular to support off-site supervision: - Not all data needs covered by EBA ITS reporting. - Short-term exercises (STEs) and surveys used for gaps (e.g., concentration, liquidity, IRRBB). - Differences between reporting based on nGAAP and IFRS complicate consistent comparisons; technical work is underway. - Timely and accurate data issues need to be addressed as a matter of priority. Corrective and Sanctioning Powers of Supervisors (CP 11) - German law and SSMR provide broad range of supervisory actions. - ECB direct enforcement powers and sanctions are limited; ECB can use BaFin’s enforcement and sanction powers. - Complex legal framework may make it operationally difficult and time consuming for ECB to impose enforcement actions. - Actual use of formal powers by BaFin and ECB in practice is not intensive. Cooperation, Consolidated and Cross-Border Banking Supervision (CPs 3–12–13) - Collaboration and coordination with domestic and cross-border supervisors is highly developed: - EU supervisory coordination process based on joint supervision through SSM, colleges of supervisors led by home country coordinator, and MOUs with third-country supervisors and nonbanking sector regulators. - Consolidated supervisory approach in place at SI and LSI levels: - Detailed planning through supervisory colleges and MOUs results in comprehensive consolidated group review. - Ring-fencing powers available to insulate group from related companies that may adversely impact the group. - Banking groups may be required to reorganize to correct a non-transparent structure. Corporate Governance (CP 14) - Role of supervisory boards is described as weak and passive; most policy and risk management duties are placed on the management board. - Some evolution observed in supervisors’ focus on supervisory board within the SREP process. - Thematic review on Risk Governance produced recommendations aimed at making supervisory board involvement more robust. - MaRisk is being amended and will include code of conduct requirements. *Detailed Assessment Report prepared by Fabiana Melo, Christopher Wilson, and Jose Tuya.* ### 18. Supervisory guidance should clearly delineate that ultimate responsibility for ### 18. Supervisory guidance should clearly delineate that ultimate responsibility for ### Governance and assignment of responsibilities - Ultimate responsibility for establishing the risk culture, developing business plans and risk appetite statement rests with the supervisory board. - The fit-and-proper process is streamlined for supervisory board members and technical knowledge requirements are streamlined for them. - As established by KWG, the primary responsibility for internal controls, governance, business strategy, and internal audit is assigned to the management board. - The internal audit function: - Is an instrument of the management board and reports to the management board. - Can be under the direct control of one management board member, who could be the chairperson. - Replacement of the internal auditor, compliance officer, and risk officer is communicated to the supervisory board ex-post. ### Risk management reporting lines and independence - Risk reporting currently flows through the Management Board and the CEO, who set the business plan and risk taking. - The internal risk control function and the CRO report to the Management Board and therefore to the CEO, not directly to the Supervisory Board. - Potential consequences noted: - This reporting line may weaken the independence of the risk management function and the CRO to raise issues. - The structure may inhibit the independence of the CRO and risk function to report weaknesses in the Risk Management Framework (RMF). - The ex-post notification of removal of the CRO by the management board is the prescribed minimum under MaRisk and further aggravates independence concerns. - Supervisory recommendations implied: - Strengthen the reporting line between the internal risk control function and the Supervisory Board. ### Prudential framework, capital and leverage (CPs 15–29) - Banks are well capitalized and supervisors have powers to impose additional requirements. - Deviations of the EU capital framework relative to Basel standards regarding the definition of capital: - Do not seem to be material for German banks in general, although some may be for specific banks (deduction of participation in insurance, for instance). - Elements in risk weighted asset calculation where RCAP found deviations that may be significant for Germany: - Sovereign exposures under the permanent and temporary partial use. - Lower risk weights for covered bonds. - The counterparty credit risk framework. - Observations on supervisory practice: - Some deficiencies were being addressed by banks’ internal capital adequacy assessments and supervisory action. - It is impossible to determine that the existing framework is not in general resulting in overstated CET1 ratios. - Both ECB and BaFin can require banks to hold capital in excess of the minima under Pillar 2; however, the practice was not commonly used by German authorities. - ECB as a supervisor has only concluded one SREP cycle, in which some banks were required to implement Pillar 2 add-ons. - Leverage is specifically taken into account in the SSM SREP methodology, while for BaFin it is not yet systematically incorporated in the analysis. ### Loan classification, provisioning, and supervisory guidance - Supervisors have not provided guidance on expectations for loan portfolio management, including: - Broad guidelines on general characteristics of various loan risk buckets. - Definitions of non-performing, restructured, forborne, and cured loans. - Granularity of data on credit portfolios is limited. - Role of supervisors in loan classification: - Primarily involves a review of policy and procedures. - Focus is to provide bank management with considerations when setting loan classification parameters and provisioning (e.g., residential mortgages and commercial real estate triggers). - Emphasis on collateral valuation (conservative valuations of realizable net values). - Recent supervisory actions and needs: - Thematic review of loan valuation and impairment was conducted. - To implement supervisory review of loan files and valuation where practice was not present, ex-ante discussions with bankers and accountants and clear communication of supervisor expectations on loan valuation and provisioning are needed. - Staff training and support are important to enable challenge of management valuation of collateral or failure to rate an asset as impaired. - The process of developing supervisor capacity to challenge bank management valuation of loans has started. ### Market risk, IRRBB, and concentration risk - Market risk: - MaRisk establishes requirements for effective market risk frameworks. - Supervisory intensiveness is greater for larger, more systemic, trading-biased banks. - Market risk was a focus during 2014 and 2015; a targeted review of banks’ internal models will be carried out over several years. - Banks with the largest trading books are subject to enhanced focus (mostly SIs); remaining banks are on a normal cycle based upon their SREP score and risk profile. - Interest Rate Risk in the Banking Book (IRRBB): - A key priority for both SIs and LSIs. - Banks are required to measure, calculate, and report IRRBB exposure on a quarterly basis. - Banks must conduct regular stress testing using both standardized and bespoke scenarios, especially those with complex business models and optionality. - Supervisors assess IRRBB through the SREP process and it is a key topic in discussions with senior management. - German authorities have conducted short term data collection exercises to deepen understanding of systemic exposure. - Concentration and country risk: - Generally considered part of credit risk. - Definition of concentration risk is limited to credit exposures, not broader exposures. - Supervisory expectations for concentration risk and country risk management are not clearly communicated to banks. - No requirement that all material concentrations be regularly reviewed and reported to the supervisory board. - Reporting and monitoring of country risk and concentrations can be improved; inclusion in banks’ stress tests should be specifically required. ### Related-party transactions and controls - Framework weaknesses: - Definition of related parties is wide and detailed and covers loans broadly including off-balance sheet exposures and leasing operations, but excludes dealings such as service contracts, asset purchases and sales, and construction contracts. - Related party loans must be granted on market terms, but there is no requirement that individuals with conflicts of interest be excluded from the granting and managing process. - No requirement that related party exposures be monitored and controlled separately and in aggregate. - No regular reporting of exposures to related parties. - Supervision of related party risk is mostly carried out by external auditors; their analysis is very limited. - No limits on related party exposures are imposed by laws, regulation, or the supervisor. ### Liquidity risk, ILAAP, and LCR - Supervisors increased frequency and intensity of interaction with credit institutions on liquidity risk, contingency plans, and funding. - Supervisors have built in-depth understanding of liquidity funding risks at individual institutions; they periodically meet with treasury staff and receive monthly monitoring of LCR data. - Funding plans and stress testing results are reported and periodically evaluated. - LCR adopted in EU includes elements less stringent than Basel, most notably a wider definition of HQLA; German banks use the wider definition mainly via covered bonds included as Level 1 assets. - Guidance for assessing ILAAPs will be implemented for 2016 to strengthen liquidity risk management assessment as part of SREP; SSM issued a letter at the beginning of the year on Supervisory Expectations on ILAAP and harmonized information collection on ILAAP. - Benchmarks for liquidity risk indicators will be developed during 2016. ### Operational risk and IT risk supervision - Operational risk has seen several enhancements since the last FSAP, notably strengthening of dedicated IT risk specialists. - IT risk specialists conduct on-site examinations and develop supervision approaches for IT risk. - The team deepened institutional knowledge of IT risks and vulnerabilities and identified where standards need to be raised. - Example: IT risk specialists attended DR testing for several of the larger LSIs. ### Internal audit, compliance, and external auditors - Independence concerns: - Internal audit and compliance independence is undermined because they report to the management board. - Supervisory board is informed ex-post of replacements of internal auditor, compliance officer, and risk officer. - Access to external auditors’ work papers: - Banking supervisors do not have legal power to access external auditors’ work papers. - Germany chose to be assessed against best international practices; given reliance on external auditors for financial statement reliability and compliance reporting, this gap should be addressed. ### AML/CFT supervisory practices - AML/CFT framework appears strong overall, but weaknesses remain in supervisory practices: - BaFin has a risk-based framework to discriminate banks’ risk profiles and exposures to AML/CFT risks. - Inputs into the process need refinement to be fully risk-based. - The framework is heavily reliant on the EA report to identify deficiencies in risk management. - Ongoing monitoring of banks’ compliance needs to be more systematic through ongoing receipt of a range of inputs. - Coverage via on-site examinations needs to be expanded. ### Assessment context and methodology (introduction excerpts) - The assessment: - Was completed as part of the Financial Sector Assessment Program (FSAP) mission undertaken by the International Monetary Fund (IMF) during March of 2016 at the request of the German authorities. - Reflects the regulatory and supervisory framework in place as of the date of completion of the assessment. - Scope and approach: - Focused on BaFin, Deutsche Bundesbank (BBk), and the European Central Bank as the joint supervisors of the banking system. - Assessed against the Revised Core Principles (BCP) Methodology issued by the BCBS in September 2012. - Germany chose to be assessed against both the Essential Criteria and the Additional Criteria. - Compliance assessments used a four-part grading system: compliant; largely compliant; materially noncompliant; and noncompliant. - Proportionality was emphasized given the breadth of bank types and systemic importance. - Notes on the Revised BCPs: - Number of principles increased from 25 to 29. - Number of essential criteria expanded from 196 to 231, including 35 new essential criteria and 16 additional criteria for jurisdictions that choose to be assessed against them. *International Monetary Fund. FSAP mission during March of 2016.* ### 42. The banking sector comprises three main “pillars,” private commercial banks, public ### _cr16196 - 42. The banking sector comprises three main “pillars,” private commercial banks, public ### Structure and consolidation of the banking system - The banking sector comprises three main “pillars,” private commercial banks, public savings banks, and cooperative banks. - The three-pillar structure has been fairly stable over the past decade, but the German banking system has undergone a sustained period of consolidation. - The number of banks has declined by about 100 compared with the time of the last FSAP. - Compared with 1995, the number of banking institutions has declined by about 50 percent. - Consolidation mainly took place at local savings and cooperative banks level. ### Pillar 1 — Private commercial banks - Composition: big banks, regional and other commercial banks, and branches of foreign banks. - Asset share: private commercial banks accounted for 39.4 percent of the system in May 2015, slightly above the share in 2010. - Business models: - “Big banks” operate large branch networks domestically and internationally, covering retail, corporate, and investment banking, and act as principal banking partners of Germany’s major industrial enterprises. - Regional and other commercial banks are smaller, operate within particular regions, focus on credit to households and non-financial corporates, with deposits as the primary source of funding. - The “big bank” group includes Commerzbank, Deutsche Bank, Deutsche Postbank, and UniCredit. ### Pillar 2 — Public savings banks (Landesbanken and Sparkassen) - Asset share: about 27 percent of banking system assets. - Savings banks (Sparkassen): - Operate under a regional principle. - Provide banking services to households and SMEs in their region. - Compete with commercial banks but do not tend to compete with each other. - Mandated to provide public good and support local economic development. - Landesbanken: - Central institutions of the savings banks. - Increased involvement in wholesale banking and capital market activities, competing with commercial banks. - Some Landesbanken endured large losses from structured finance and derivative products during the crisis; several were consolidated and merged after the crisis, with a resulting number of nine institutions in 2015. - Historical note: the savings banks and the Landesbanken were backed by mutual guarantees in the past; however, the guarantees were phased out in 2005. ### Pillar 3 — Cooperative banks - Composition: more than 1,000 financial institutions. - Asset share: about 13.5 percent of banking assets. - Characteristics: - Subject to a regional principle with extensive networks of regional branches and mutual guarantees. - Owned by members (depositors and borrowers) and usually offer core banking services. - Two regional central institutions: DZ-Bank-AG and WGZ-Bank-AG; DZ-Bank-AG also operates as a large commercial bank. - Regional institutions play an active role in redistributing liquidity among affiliated institutions, operating chiefly in interbank and capital markets. ### Other institutions and asset shares - Remaining sector: mortgage banks, building and loan associations and special purpose banks comprise twenty percent of the banking sector. - Mortgage banks: suffered losses during the financial crisis, underwent restructuring and resolution; their asset size declined to under five percent of the banking system in 2015. ### Asset and liability structure - Assets: banks mainly focus on lending to banks and non-banks; the role of Landesbanken and mortgage banks has decreased over time. - Liabilities: primary funding sources are liabilities to non-banks, liabilities to the MFI sector, and securitized debt. - Liabilities to non-banks were the primary source of funding for the banking sector as a whole at 42.5 percent in March 2015. ### Banking supervision framework - Supervisory authorities: BaFin, Bundesbank, and, since 2014, the ECB. - Single Supervisory Mechanism (SSM): - Entered into operation on 4 November 2014. - Credit institutions are categorized as “significant” (SIs) or “less significant” (LSIs). - The ECB directly supervises the SIs; 21 banking groups in Germany are SIs directly supervised by the ECB. - The ECB may decide to exercise directly all relevant powers for one or more credit institutions when necessary to ensure consistent application of supervisory standards. - ECB published its Guide to banking supervision to explain SSM functioning and supervisory practices. - Global Systemically Important Bank: one German bank (Deutsche Bank) is included in the Financial Stability Board list of Global Systemically Important Banks (G-SIBs) for 2016. - National competent authorities (NCAs): BaFin and Bundesbank supervise LSIs under the general oversight of the ECB. - BaFin supervised institution counts (as given): - commercial banks (182) - institutions belonging to the savings bank sector (425) - institutions belonging to the cooperative sector (1,052) - other institutions (121) - Other institutions group includes building societies (Bausparkassen), Pfandbrief banks, securities trading banks, and development banks operated by the federal government and the federal states. - At the close of 2014, BaFin was supervising 12 private and 9 public sector building societies. ### Preconditions for effective banking supervision and macro environment - Macroeconomic environment: - Favorable recent performance of the banking industry with low borrower related credit risk and low stock of nonperforming loans compared to other European countries. - Bank Lending Survey: borrower related risk and general macroeconomic situation did not alter lending policies to a large extent in recent years, though they had sizeable impact at the peak of the 2008/2009 financial crisis. - Low interest rate environment: banks in traditional business managed to keep interest margins stable so far but extended balance sheets and maturity transformation risk; persistent low interest rates could shrink interest rate margins and drive banks to seek alternative business opportunities, potentially raising new risks. - Financial Stability Committee (FSC): - Legal framework provided by the Financial Stability Act. - Members with voting representatives: Federal Ministry of Finance (MoF), BaFin, and Bundesbank each have three voting representatives; the Federal Agency for Financial Market Stabilization (FMSA) has one non-voting advisory member. - FSC functions: discusses factors key to financial stability, strengthens cooperation, advises on handling ESRB warnings and recommendations, reports annually to the Bundestag, and can issue warnings and recommendations to public bodies subject to a “comply or explain” mechanism. - Credit culture: - Dominated on the supply side by Sparkassen and Volks- und Raiffeisenbanken (co-operative banks) conducting retail and SME business. - Traditional credit culture where collateralization (e.g., mortgages) prevails. - Trend: larger corporates increasingly funding directly on capital markets, possibly driven by investor willingness to take risk and higher funding costs for larger banks due to rating downgrades. ### Legal, regulatory and market infrastructure - Legal system: well-developed public infrastructure including corporate law, accounting provisions, and rules regarding mergers and acquisitions. - Regulatory coverage: financial sector regulation covers banking, insurance, and securities; large parts of the framework are rooted in EU directives and regulations; BaFin is member of the European Supervisory Authorities (EBA, ESMA, and EIOPA) and obliged to cooperate and implement ESA guidelines and recommendations. - Auditing and accounting: - Independent external audits and comprehensive accounting principles are contained in the German Commercial Code (HGB). - Public accountants organized in the Chamber of Public Accountants (WPK); Auditor Oversight Commission (AOC) carries out public oversight. - Consumer protection and contract law: - Terms and conditions of contracts generally regulated in civil law (e.g., Civil Code (BGB) for consumer credits; Insurance Contract Act (VVG) for insurance). - New law adopted to improve protection of retail investors (“Kleinanlegerschutzgesetz”). - BaFin supervises compliance with consumer protection provisions in supervisory laws (KWG, VAG, WpHG). - Deposit insurance: - Deposit Insurance Act (Einlagensicherungsgesetz - EinSiG) entered into force on July 3, 2015, transposing the European directive on deposit guarantee schemes (DGSD) into national law. - All credit institutions must be allocated to a statutory guarantee scheme or an institutional protection scheme officially recognized as a deposit guarantee scheme. - Customers have a legal claim to compensation for covered deposits up to an amount of € 100,000. - Recovery and resolution: - German Act for Recovery and Resolution of Institutions and Financial Groups (SAG) specifies responsibilities and tools for crisis management and bank resolution, complementing powers in the Banking Act (KWG). - The Federal Agency for Financial Market Stabilization (FMSA) appointed as national resolution authority. - Supervisory authority reviews and assesses recovery plans in consultation with the Bundesbank. - Deposit-taking banks as defined in section 1 (3d) first sentence KWG must be members of a deposit insurance scheme. - Market discipline and disclosure: - German Corporate Governance Code (GCGC) aims to maintain adequate flows of information, including disclosure of stock option programs and material facts to shareholders. - SIs must disclose information on remuneration per Art. 450 CRR, including governance process, link between pay and performance, design characteristics of remuneration systems, ratios between fixed and variable remuneration, aggregate quantitative information, and number of individuals remunerated EUR 1 million or more per financial year. - HGB provisions require disclosure of total remuneration of every management board and supervisory board member in fiscal year in the annex of the profit and loss account and consolidated profit and loss account. - Securities Trading Act (WpHG) requires listed companies to disclose ad hoc facts that could influence financial instrument prices and mandates annual financial statements, half-yearly financial reports, and interim management statements; annual and half-yearly reports must include a compliance statement by the company’s legal representatives. ### Detailed assessment — supervisory responsibilities (introduction) - Three authorities with responsibilities regarding banking supervision: the ECB, BaFin, and Deutsche Bundesbank (BBk). - The SSM: - Objectives and responsibilities defined in the SSM Regulation (Council Regulation (EU) No 1024/2013 of 15 October 2013 – SSMR) and supplemented by the SSM Framework Regulation (Regulation (EU) No 468/2014 of 16 April 2014 – SSMFR). - Banks are qualified as SIs or LSIs based on defined criteria including size, importance to the economy of the Union or a Member State, and cross-border activity. - SIs are under direct ECB supervision; BaFin and Bundesbank assist the ECB. - LSIs are under direct supervision of BaFin and Bundesbank, with the ECB exercising oversight over system functioning. - BaFin and Bundesbank maintain national distribution of tasks established in section 7 (1a) KWG; BaFin, in consultation with Bundesbank, issued a Supervision Guideline to regulate division of tasks and avoid duplication. *Source: _cr16196 - 42. The banking sector comprises three main “pillars,” private commercial banks, public* ### introduction of the SSM it is in a sense only applicable for the cooperation in supervision of ### _cr16196 - introduction of the SSM it is in a sense only applicable for the cooperation in supervision of ### Objectives and separation of functions (EC2) - Article 1 SSM Regulation objectives (verbatim): “This Regulation confers on the ECB specific tasks concerning policies relating to the prudential supervision of credit institutions, with a view to contributing to the safety and soundness of credit institutions and the stability of the financial system within the Union and each Member State, with full regard and duty of care for the unity and integrity of the internal market based on equal treatment of credit institutions with a view to preventing regulatory arbitrage.” - Article 25 SSM Regulation: ECB shall pursue only the objectives set by the SSM Regulation and sets a framework to separate supervisory from monetary policy functions (separation of objectives, decision‑making processes and tasks, including organizational and procedural separation at the level of the Governing Council). - Separation and governance measures implemented: - Decisions in banking supervision are prepared by an independent Supervisory Board and submitted to the Governing Council mainly under a “non-objection procedure”. - ECB Rules of Procedure amended to separate Governing Council deliberations on supervisory matters with separate agendas and meetings. - Mediation Panel established by Regulation ECB/2014/26 (June 2, 2014) to resolve NCA differences regarding Governing Council objections. - Decision ECB/2014/39 adopted September 17, 2014 on implementation of separation between monetary policy and supervision. - National authorities’ objectives and mandates: - BaFin: competent administrative authority pursuant to section 6 (1) KWG; primary objectives in section 6 (2) KWG to “counteract undesirable developments that may endanger the safety of institutions’ assets, impair proper conduct of banking business or entail major disadvantages for the economy as a whole.” Section 4 (1a) FinDAG empowers BaFin with collective consumer protection. - Bundesbank: mandate to safeguard financial stability in the Act concerning the BBk (Gesetz über die Deutsche Bundesbank) and KWG; responsible for ongoing monitoring of German institutions. ### Supervisory review powers and corrective measures (EC3 & EC6) - ECB competence under Article 4(1)(f) SSM Regulation: carry out supervisory reviews, stress tests, coordinate with EBA, and determine adequacy of arrangements, processes and own funds. - Outcomes and powers stemming from SREP: - SREP outcome is the basis for determining capital and liquidity adequacy of the credit institution. - ECB may impose measures listed in Articles 9–18 SSM Regulation, in CRR, and instruct NCAs to use national law powers. - Specific ECB powers under Article 16 SSMR (applicable to SIs and LSIs) include the ability: - to require reinforcement of arrangements, processes, mechanisms and strategies; - to require institutions to present a plan to restore compliance and set deadlines; - to require a specific provisioning policy or treatment of assets for own funds requirements; - to restrict or limit business, operations or network, or request divestment of activities posing excessive risk; - to require reduction of risk inherent in activities, products and systems; - to require institutions to limit variable remuneration as a percentage of net revenues when inconsistent with a sound capital base; - to require institutions to use net profits to strengthen own funds; - to restrict or prohibit distributions to shareholders or holders of Additional Tier 1 instruments where prohibition does not constitute an event of default; - to impose additional or more frequent reporting requirements, including on capital and liquidity positions. - National powers (Germany): - Article 92 CRR applies for institutions directly supervised by German authorities. - Section 10 (3) KWG: BaFin may order own funds requirements for risks not covered by Article 1 CRR exceeding CRR requirements. - Section 10f KWG: BaFin will order G-SII buffer consisting of Common Equity Tier 1 capital. - Section 10g KWG: BaFin may order O-SII buffer of up to 2.0 percent of the total risk exposure amount determined pursuant to Article 92 (3) CRR consisting of Common Equity Tier 1 capital. - Sanctions, license withdrawal and resolution: - ECB has somewhat limited direct sanctioning power but can use sanctioning powers available to German supervisors; ECB can withdraw authorization for SIs and LSIs. - Administrative measures under German law for LSIs include written admonition, formal orders (sections 6 (3), 25 a (2) KWG), fines under section 56 KWG, transfer of governing powers to a special representative (section 45 c KWG), and revocation of license (section 35 (2) KWG) — revocation proposed by BaFin and decided by the ECB. - Resolution process for SIs involves the Single Resolution Board (SRB) since January 2016; determination of “failing or likely to fail” by ECB triggers SRB involvement; Art. 81 and 83 BRRD / section 138 and 140 SAG require informing national resolution authorities, deposit guarantee schemes, competent ministries, ESRB and designated national macro‑prudential authority. - German Recovery and Resolution Act (SAG): recovery planning (sections 13–21 SAG), early intervention (section 36 SAG), and determination of failing or likely to fail (section 62 (2) SAG); FMSA acts as national resolution authority (section 3 SAG). ### Regulatory update processes and consultations (EC4) - EU and ECB rulemaking: - European legislation and regulation updated and subject to public consultation; EBA technical standards and guidelines subject to formal public consultations; ECB regulation and guidelines subject to public consultation. - ECB may adopt guidelines, recommendations, decisions and regulations under Article 4(3) SSM Regulation; public consultations and cost–benefit analyses precede ECB regulations. - ECB public consultations held on: - Draft ECB Regulation on reporting of supervisory financial information; - Draft ECB Regulation on supervisory fees; - Draft ECB SSM Framework Regulation; - Draft ECB Regulation on the exercise of options and discretions and draft ECB Guide on options and discretions available in Union law; - Draft ECB Guide on the approach for the recognition of institutional protection schemes for prudential purposes. - German rulemaking powers: - BaFin empowered to issue prudential regulations and guidelines; regulations legally binding where BaFin has a specific mandate in the KWG or other supervisory law. - Binding regulatory acts require legal mandate in a parliamentary act (Parlamentsvorbehalt); MoF frequently delegates regulatory authority to BaFin (example: AnzV). - Guidelines are non‑binding but document BaFin’s interpretation and administrative practice and have binding effect on BaFin itself; public consultation mandatory for regulations and customary for guidelines. - Non-compliance with guidelines may indicate breach of legal provisions. ### Access, inspections, group and cross‑border supervision (EC5 & EC7) - ECB powers in SSM area: - Article 10 SSMR: ECB may require necessary information at recurring intervals in specified formats from credit institutions, financial and mixed financial holding companies, and persons belonging to these entities or third parties to whom functions are outsourced. - Article 11 SSMR: ECB may conduct investigations, require submission of documents, examine books and records, obtain written/oral explanations, and interview persons. - Article 12 SSMR: ECB may conduct on‑site inspections and enter business premises and land of legal persons subject to investigation. - Limitations and scope: - ECB direct supervisory competence for significant groups and significant branches in SSM area; limited powers to supervise branches located in other EU Member States (limited capacity to request information and cannot undertake on‑site inspections of such EU branches except in context of a college under article 159 CRD IV). - Non‑EU banks establishing affiliates in the SSM area are authorized by the ECB and supervised if classified significant; non‑EU branches or cross‑border services remain supervised by BaFin (Recital 28 SSMR). - For LSIs, BaFin responsible for cross‑border inspections (section 8a (1) no. 2 KWG). - German statutory powers: - Sections 44 et seq. KWG grant BaFin and Bundesbank information and audit rights, including rights vis‑à‑vis governing body members, employees, third persons, outsourced entities, subordinated enterprises, and holders of qualified participations. - KWG reporting and submission requirements enable BaFin/Bundesbank to judge structure of institutions at group level. - Consolidated supervision: - Article 4(1)(g) SSMR: ECB supervises on a consolidated basis parents established in participating Member States, including financial holding and mixed financial holding companies, and participates in consolidated supervision including colleges. - KWG: refusal of license can be based on corporate ties impairing effective supervision (section 33 (2) no. 1 KWG); financial holding companies must annually submit aggregated reports (section 24 (3a)) and report establishment/changes/discontinuation of participating interests (section 24 (3a) sentence 4). ### Cooperation, information sharing and confidentiality (Principle 3 / EC1–EC4) - Domestic cooperation: - Extensive legal and collaboration framework: BaFin supervises banks, insurance, investment firms and collaborates closely with Bundesbank; Section 7 KWG establishes division of responsibilities and information exchanges. - Financial Stability Commission (FSC) operational since March, 2013: composition three from MoF, three from Bundesbank, three from BaFin, one from FMSA (no voting rights); meets quarterly. - Cross‑border cooperation and standards: - CRD Articles 6, 7 and 50 provide cooperation obligations among NCAs; EBA/EC standards (Regulation 524/2014 and Implementing Regulation 620/2014) specify information exchange, templates and procedures for going concern and liquidity stress situations. - EBA RTS (Delegated Regulation (EEU) 2016/98) and ITS (Implementing Regulation (EU) 2016/99) specify conditions for supervisory colleges, coordination and cooperation in going concern and emergency situations. - SSM architecture: Supervisory Board includes ECB members and one representative per competent authority; joint supervisory teams (JSTs) include ECB and NCA staff. - BaFin/Bundesbank have multiple MOUs with third countries; Article 152 SSMFR allows ECB to participate in NCAs’ MOUs or negotiate new MOUs; ECB is automatic participant in SSM member NCAs’ MOUs and negotiates with non‑SSM NCAs lacking MOUs. - Confidentiality safeguards: - ECB/SRB MoU to ensure coordination and information sharing where ECB determines failing or likely to fail and SRB notifies intentions (ECB allowed 3 calendar days to assess). - Germany: section 9 (1) KWG entitles BaFin (or ECB where applicable) to share information with foreign supervisors provided confidentiality will be observed; BaFin must treat information obtained from foreign supervisors confidentially. - BaFin passes foreign supervisory information to Bundesbank where necessary and on basis that Bundesbank uses it only for lawful supervisory purposes; confidentiality obligations apply equally to Bundesbank. ### Independence, governance, staffing and resources (Principle 2 assessment highlights) - Independence and governance: - ECB independence defined in Article 130 TFEU; Article 19 SSMR requires ECB and NCAs to act independently; Supervisory Board members must act independently and objectively in interest of the Union. - BaFin governance: FinDAG, Geschäftsordnung, OsBaFin and Satzung der BaFin define structure; BaFin operates as institution of public law functionally and organizationally independent from MoF (section 1 FinDAG). - Bundesbank independence: confirmed in section 12 Bundesbank Act; required to observe ECB/BaFin guidelines in supervisory tasks. - Appointment and removal processes: - ECB Executive Board term: eight years, not renewable (article 283 Treaty); Supervisory Board Chair, Vice‑Chair, four ECB representatives and NCA representatives structure detailed in SSMR and ECB decisions; Chair/Vice‑Chair term of office 5 years, non‑renewable. - BaFin president and chief executive directors appointed by the Federal President on proposal of German Government (section 9 FinDAG); minimum term generally eight years, in exceptional cases at least five years; removal for good cause, disclosure of reasons for dismissal not explicitly required. - Bundesbank Executive Board members appointed by the President of the Federal Republic of Germany for 8 years or in exceptional cases not less than 5 years; president relieved only if no longer fulfils conditions or guilty of serious misconduct. - Accountability and transparency: - ECB accountable to European Parliament and European Council (Article 20 SSMR); Inter‑institutional Agreement with EP and MoU with Council describe practical arrangements; ECB publishes annual SSM report (first published March 31, 2015). - SSM interactions with national parliaments under Article 21 SSMR: SSM annual report transmitted to EP and NPs; written questions by Members of NPs; exchanges of views possible — five exchanges in National Parliaments have taken place so far. - BaFin and Bundesbank publish objectives and annual reports; BaFin reports to MoF per Guidelines for control of BaFin by MoF (16.02.2010). - Ethics, conflict‑of‑interest and legal protection: - ECB revised Ethics Framework effective January 1, 2015; Compliance and Governance Office established; SSM ethics rules adopted with restrictions on post‑employment activities and strict rules on private financial transactions and professional secrecy. - BaFin code of conduct for corruption prevention (Dienstanweisung zur Korruptionsprävention) and share‑dealing rules (Dienstanweisung zur Überwachung der Mitarbeitergeschäfte); Bundesbank internal rules DB 1‑11 and DB 1‑11 section 38 for conflicts of interest. - Legal immunity/protection: - ECB staff immune from legal proceedings for acts in official capacity per Protocol on Privileges and Immunities (Article 11(a)); ECB liable under Article 340 TFEU and subject to judicial review by European Court of Justice (2‑month action period). - BaFin/Bundesbank staff as civil servants cannot be individually held liable for actions in good faith; liability attaches to employing authority except in cases of gross negligence or willful intent. - Resources, staffing and training (exact figures preserved): - BaFin financing: entirely from levies and fees by institutions (sections 14 to 16j FinDAG); no federal budget funding. - BaFin staff: about 2,535 staff members end of December 2014; 72 percent civil servants; recruited 187 new staff in 2014 (mainly fully qualified lawyers and graduates). - Bundesbank supervision staff: 1,301 staff members as at 31 December 2014; 68.4 percent civil servants; recruited 70 new staff in 2014. - ECB budget and governance: budget adopted by Governing Council; BUCOM supports budget evaluation; supervisory fees borne by entities under ECB supervision. - Training and external expertise: dedicated SSM training curriculum; ECB and NCAs can hire external consultants subject to professional secrecy; BaFin and Bundesbank founding members of the European Supervisory Education Initiative (ESE) and provide in‑house and external training. - Salary and retention issues: salaries at Bundesbank and BaFin relatively low compared with ECB; difficulty retaining staff with highly technical skills especially in a strong market (Frankfurt); ECB salaries higher. - Resource allocation and supervisory planning: - SSM Supervisory Examination Program (SEP) defined with JSTs and NCAs; SEP translates Supervisory Priorities into activities and classifies each SI in risk categories (Intense, Enhanced, Standard or Basic) dependent on risk score, size and complexity. - For LSIs, NCAs retain final responsibility for supervisory planning though ECB receives annual information on LSI priorities and SEPs. - German joint SREP: Bundesbank prepares bank‑by‑bank risk assessments at least once a year; BaFin finalizes risk profile and decides supervisory measures; SEP and SREP cycle can be adjusted during year as new information arrives. - BaFin on‑site inspection planning and resource allocation based on risk matrices and criteria including systemic importance, scope and complexity, overseas ties, market significance and overall risk situation. ### Key assessment findings and comments (Principles 1–2) - Principle 1 assessment: Compliant. - Legal framework established by EU regulation, German laws and SSMR; all banks subject to supervision and can face individually determined prudential requirements based on risk profile and systemic importance. - Noted uncertainties: division of responsibilities for SIs evolving; operational roles and powers of each agency in the new environment still raise questions in practice (noted on imposition of sanctions and enforcement actions) but do not appear to impair overall market or authority understanding. - BaFin consumer protection responsibilities expanded by Retail Investor Protection Act (Kleinanlegerschutzgesetz); consumer protection staff located in securities and conduct supervision directorate may affect resources for banking supervision. - Principle 2 assessment: Largely compliant. - All three supervisory agencies enjoy operational independence; no government or industry interference in individual supervisory decisions observed. - Public disclosure of reasons for dismissal of heads is not explicitly required. - Concerns and constraints: - Guidelines for MoF control of BaFin and ex‑ante notifications may exceed oversight needs and can indirectly affect execution of supervisory priorities. - BaFin budget approved by Administrative Council with 17 voting members including six appointed by MoF, potentially allowing government/industry influence via budget; recent BaFin resources did not reflect increased consumer protection responsibilities, and assumptions about resource shifts following SIs transfer to ECB did not materialize. - Decision‑making under SSM: lack of delegated decision rights leads to high volume of supervisory decisions submitted to Supervisory Board and Governing Council, affecting timeliness and operational complexity; ECB efforts to streamline include written procedures, standardization, shortened timelines and teleconferences, and emergency teleconference processes (Article 31(4) SSMFR). *Italic source: IMF staff report content from the provided PDF excerpt.* ### Section 9 (1) KWG entitles BaFin to share information with a foreign banking supervisory ### Section 9 (1) KWG entitles BaFin to share information with a foreign banking supervisory authority provided that the foreign supervisor will treat the information confidentially ### Section 9 (1) KWG — confidentiality and information sharing - Section 9 (1) KWG entitles BaFin to share information with a foreign banking supervisory authority provided that the foreign supervisor will treat the information confidentially. - Section 9 (1) KWG sets forth that BaFin shall treat information obtained from foreign supervisory authorities confidential. - BaFin’s employees are only entitled to share information in the cases set out in section 9 KWG; BaFin is able to deny any demand from other bodies than those set out in said provision. - Information that originates in another country shall not be disclosed without the expressed agreement of the competent authorities which have disclosed it and solely for the purposes for which those authorities gave their consent (section 9 (1) sentence 8 KWG). - The confidentiality obligation of section 9 KWG also applies to Bundesbank. ### EC5 — Processes to support resolution authorities (description and findings) - EC5 statement: Processes are in place for the supervisor to support resolution authorities (e.g., central banks and finance ministries as appropriate) to undertake recovery and resolution planning and actions. - A well-developed legal framework and specialized institutions are in place for the management of possible recovery and resolution of banks. - The SAG provides for cooperation between BaFin and FMSA, in their capacity as competent supervisory authority and competent resolution authority for LSIs that do not fall in the remit of the SRB, including exchange of information (section 6 SAG). - Cooperation duties are supplemented by a cooperation agreement between BaFin and FMSA defining principles and processes for cooperation and coordination with regard to recovery and resolution. - The competent supervisory authority must involve the resolution authority at an early stage where there is a potential gone-concern situation and shares all supervisory information that is relevant for resolution. - The resolution authority must consult with the supervisory authority on matters within their competence that might have repercussions on the going-concern, to strike the right balance between supervisory and resolution objectives. - Responsibilities and processes: - The competent supervisory authority is responsible for recovery planning (Article 9 of the cooperation agreement; section 13 – 21 SAG) and imposing early intervention measures (section 36 SAG). - The competent authority provides the recovery plan to the resolution authority so the resolution authority can identify actions in the recovery plan which may adversely impact resolvability and make recommendations (section 15 (1) SAG). - The resolution authority assesses, in consultation with the competent authority, the resolvability of each LSI that is not part of a group subject to consolidated supervision (article 11 of the cooperation agreement; section 57 – 60 SAG). - The resolution authority draws up a resolution plan in coordination with the competent authority for those institutions (Article 10 of the cooperation agreement; section 40 - 48 SAG). - The resolution plan shall provide for the resolution actions which the resolution authority may take where the institution meets the conditions for resolution. - The resolution authority can intervene when an institution is failing or likely to fail and additional conditions are met (Article 13 of the cooperation agreement, section 62 – 66 SAG). - The competent supervisory authority, after hearing the competent resolution authority, or the competent resolution authority, after hearing the competent supervisory authority, are able to decide that an institution is failing or likely to fail (Article 13 (1) of the cooperation agreement; section 62 (2) SAG). ### Assessment of Principle 3 - Assessment: Compliant - Comment: Cooperation channels are highly developed and effective. ### Principle 4 — Permissible activities (overview) - Principle 4: The permissible activities of institutions that are licensed and subject to supervision as banks are clearly defined and the use of the word “bank” in names is controlled. ### EC1 — Definition of “bank” - EC1: The term “bank” is clearly defined in laws or regulations. - At the European level, there is no definition of the term “bank”; CRR and CRD IV use the term “credit institution,” defined as “an undertaking the business of which is to take deposits or other repayable funds from the public and to grant credits for its own account” (CRR Article 4.1 (1)). - In Germany, KWG defines "banking business" by specifying the range of permitted activities to credit institutions. - Section 1 (1) sentence 1 KWG: credit institutions are enterprises which conduct banking business commercially or on a scale which requires a commercially organized business undertaking. - As a criterion for determining commercial conduct, it is sufficient that there is an intention that the business should be conducted over a certain period of time and that the party conducting the business is doing so with the aim of making a profit. - Section 1 (1) sentence 2 KWG provides a definitive list of what comprises banking business: deposit business, lending business, discount business, principal broking services, safe custody business, guarantee business and underwriting business. - A credit institution may in principle engage in all, several or single categories of banking business. ### EC2 — Permissible activities clearly defined - EC2: The permissible activities of institutions that are licensed and subject to supervision as banks are clearly defined either by supervisors, or in laws or regulations. - EU level: - Activities are not exhaustively determined at EU level, but must include at least taking deposits or other repayable funds from the public and granting credits for its own account. - A bank license can only be granted if proposed activities at least fulfill the essential elements of the definition of credit institution in the CRR. - Authorization is required if at least both activities 1 and 2 of CRD IV Annex I are included in the business plan (Taking deposits and other repayable funds; lending including, inter alia: consumer credit, credit agreements relating to immovable property, factoring, with or without recourse, financing of commercial transactions). - CRD IV Recital 14 allows national laws to provide special supplementary authorizations permitting credit institutions to carry out specific activities. - CRD IV Annex I lists activities that can be performed by credit institutions authorized in one member state without additional host authorization (mutual recognition). - CRD IV Article 10 obliges Member States to require applications for authorization to be accompanied by a program of operations setting out types of business envisaged and structural organization. - German law: - Section 1 (1a) KWG defines financial services that qualify as financial services institutions; the KWG gives a definitive list of activities requiring a license. - Financial services listed include: investment and contract broking, investment advice, operation of multilateral trading facility, placement business, portfolio management, proprietary trading, non-EEA deposit broking, foreign currency dealing, factoring, financial leasing, asset management and limited custody business. - Specific rules for licensing payment services and e-money businesses are in the Payment Services Supervision Act (Zahlungsdiensteaufsichtsgesetz - ZAG). - E-money business rules were transferred from KWG into ZAG by April 30, 2011; conducting e-money business no longer requires a license as a credit institution but as an e-money issuer under ZAG. - The ECB authorization procedure for credit institutions in SSM applies to all activities allowed to credit institutions including activities subject to mutual recognition and other regulated activities which under national law require authorization. - SSMFR Article 78(5): “the decision granting authorization shall cover the applicant’s activities as a credit institution as provided for in the relevant national law, without prejudice to any additional requirements for authorization under the relevant national law for activities other than the business of taking deposits or other repayable funds from the public and granting credit for its own account.” ### EC3 — Use of the word “bank” in names and domains - EC3: The use of the word “bank” and any derivations such as “banking” in a name, including domain names, is limited to licensed and supervised institutions in all circumstances where the general public might otherwise be misled. - No EU level restrictions on the use of the word “bank”; restrictions are at national level. - CRD IV Article 19: credit institutions may use throughout the Union the same name they use in their head office Member State; host Member State may require explanatory particulars in the event of danger of confusion. - Germany: - Section 39 (1) KWG restricts use of "bank", "banker" or expressions including these words in firm names or advertising to: - a) credit institutions with a license under section 32 KWG or branches of enterprises when home state is a member state of the EEA; - b) other enterprises which, on entry into force of the KWG, were using such a term legally under existing regulations. - KWG protects terms for certain types of credit institutions: "cooperative bank" [Volksbank], "savings bank" [Sparkasse], "building and loan association" [Bausparkasse], and "savings and loan bank" [Spar- und Darlehenskasse]. - Section 41 KWG: sections 39 and 40 KWG do not apply to enterprises that use the words in a context which precludes the impression that they conduct banking business. - Use of the word “bank” in domain names is not specifically named; interpretation may be a consumer protection question. Assessors had access to a case where BaFin acted regarding domain names. - Credit institutions with head office abroad may use the specified terms when operating in Germany only if entitled to do so in their home country and provided they add a reference to their home state, except when home state is a member state of the EEA. - No powers are conferred on the ECB regarding restrictive use of the word ‘bank’; BaFin’s powers are conferred by KWG. - Section 39 (3) KWG grants BaFin power to determine that enterprises may not use specified terms if nature and scope of activities do not justify their use. - Section 42 KWG: BaFin decides in doubtful cases whether an enterprise is entitled to use the protected terms specified in sections 39 and 40. ### EC4 — Taking deposits reserved to licensed banks - EC4: The taking of deposits from the public is reserved for institutions that are licensed and subject to supervision as banks. - CRD IV Article 9: “Member States shall prohibit persons or undertakings that are not credit institutions from carrying out the business of taking deposits or other repayable funds from the public”. - CRD IV Article 8 requires Member States to require credit institutions whose business includes collecting deposits to obtain authorization before commencing activities. - Germany: - KWG determines deposit business (acceptance of funds from others as deposits or other repayable funds from the public, except issuance of order and bearer notes, irrespective of interest) is considered banking business per section 1 (1) sentence 2 no. 1 KWG and may only be conducted by a credit institution in possession of a written license. - All authorizations for credit institutions to operate in SSM participating Member States are granted by the ECB. SIs will be under direct ECB supervision and LSIs under direct supervision of BaFin and Bundesbank. - The ECB has no power enforcing the prohibition on non-banks taking deposits; BaFin has broad statutory powers to investigate and intervene in unauthorized banking business (section 37 and 44c KWG). * _cr16196 - Section 9 (1) KWG entitles BaFin to share information with a foreign banking supervisory_ ### section 54 KWG punishable by fine or imprisonment of up to five years. ### _cr16196 - section 54 KWG punishable by fine or imprisonment of up to five years. ### Investigatory and enforcement powers under the KWG - Section 54 KWG punishable by fine or imprisonment of up to five years. - Pursuant to section 44c (1) KWG, staff of BaFin and the Bundesbank are entitled to request information and documents from an undertaking, its governing bodies or a staff member where there is evidence to suggest that they conduct banking business or provide financial services without the authorization required pursuant to section 32 (1) sentence 1 of the KWG. - To ascertain the nature and scale of the business or activity, staff of BaFin and the Bundesbank are also entitled to carry out inspections pursuant to section 44c (2) of the KWG on the premises of the undertaking operating without authorization as well as on the premises of the persons and undertakings obliged to provide information and submit documents pursuant to section 44c (1) of the KWG, or to search premises pursuant to section 44c (3) of the KWG. - BaFin's investigatory powers extend to persons and undertakings in relation to whom there is evidence to suggest involvement in the initiation, conclusion or settlement of banking business and provision of financial services under the Banking Act without authorization. - Once the nature and scale of the business conducted without authorization has been ascertained, BaFin, in accordance with section 37 (1) of the KWG, can: - order the undertaking and the members of its governing bodies, as well as those involved, to cease business operations immediately and to settle this business promptly; - appoint a suitable person as liquidator if necessary. - BaFin cooperates with the Federal Office of Criminal Investigation, their Länder counterparts, and regulatory and criminal prosecution authorities of other member states of the European Economic Area and third countries, reflecting increasing internationalization of illicit financial undertakings. ### Publication of licensed banks (EC5) — description and findings - CRD IV Article 20(2) requires EBA to publish on its website, and update regularly, a list of the names of all credit institutions that have been granted authorization; frequency not defined. - The Credit Institution Register on the EBA website contains names of: - institutions set up in the member states, - branches of institutions established in EEA countries, - branches of other foreign banks. - The Credit Institution Register is updated on a real-time basis with notifications of newly licensed institutions or withdrawal of authorization by competent authorities. - In accordance with SSMFR Article 49(1) and (2), the ECB publishes on its website: - a list with supervised institutions and supervised groups directly supervised by the ECB, - a list of entities supervised by the NCAs. - The ECB lists are updated regularly, based on relevant decisions regarding authorizations, withdrawal or lapsing of authorizations, changes in significance of SIs, or notifications received from NCAs. - BaFin maintains on its website (“www.bafin.de”) in accordance with section 32 (5) KWG: - a current list of licensed banks, - current lists of branch offices, branches of foreign institutions, representative offices and branches of EEA-OGAW-management companies; - these lists are updated every month. - Branches established under the European passport are supervised by the supervisory authority of the home country and only on a limited basis by BaFin; where a foreign bank has various branches, these branches are considered a single institution. Supervision of the branch office is carried out by BaFin. - Assessment of Principle 4: Compliant. - Comments: Permissible activities are well defined in German legislation and the use of the word “bank.” While licensing is done by the ECB (see CP 5), BaFin has powers to investigate and prosecute the taking of deposits by non-authorized persons. Legislation doesn’t specifically cover the use of the term “bank” in domain names, but undue use can be investigated by BaFin. Assessors had access to several cases where the use of the term “bank” or similar by unlicensed institutions was investigated and sanctioned by BaFin, including for a domain name. ### Principle 5 — Licensing criteria (overview and findings) - Principle statement: The licensing authority has the power to set criteria and reject applications for establishments that do not meet the criteria. At a minimum, the licensing process consists of an assessment of the ownership structure and governance (including the fitness and propriety of Board members and senior management) of the bank and its wider group, and its strategic and operating plan, internal controls, risk management, and projected financial condition (including capital base). Where the proposed owner or parent organization is a foreign bank, the prior consent of its home supervisor is obtained. - Essential criteria (EC1–EC5) are described below. #### EC1 — Authority responsible for granting and withdrawing a banking license - CRD IV does not mandate which body is responsible for granting authorization. For SSM member countries, in accordance with SSMR Articles 4(1)(a) and 14, and SSMFR Article 78, the ECB is the exclusive competent authority for authorization of credit institutions. - The ECB is the exclusive competent authority for withdrawal of authorization (SSMR Articles 4(1)(a) and 14, and SSMFR Article 83). - The ECB is competent authority for supervision of significant banks (SSMR, Articles 4 and 6). - In practice: - Analysis of all license applications takes place initially at BaFin; only viable applications are sent to ECB as a draft decision. - ECB decisions are taken on the basis of applicable German law. - Applications must be submitted to BaFin in accordance with national law requirements. - If applicant complies with all conditions of authorization, pursuant to Art. 14 (2) SSMR BaFin shall prepare a draft decision to propose to the ECB to grant the authorization; the draft decision is based on prerequisites in section 32 et seq. KWG, which implement Art. 8 et seq. CRD IV. - The draft is deemed adopted by the ECB unless the ECB objects. - BaFin requires additional own funds of institutions at commencement of business operations, usually at least during the first three years (section 10 (3) sentence 2 no. 6 KWG). - For less significant institutions (LSI), licensing authority and supervisor differ: ECB is licensing authority and BaFin the primary supervisor (Articles 4 (1)(a) and 6(4) SSMR). Supervisor’s right to have its views addressed is secured (Article 14(2) SSMR and Article 76 SSMFR). - For withdrawal initiated by ECB regarding a German LSI, ECB must consult with BaFin at least 25 working days before decision date, reducible to 5 working days in duly urgent cases (Article 82 SSMFR). - Article 6(2) SSMR: ECB and NCAs subject to duty of cooperation in good faith and obligation to exchange information. - Current SSM approach: ECB and BaFin share all relevant findings during assessment of an authorization application; any information with ECB material to BaFin is shared. #### EC2 — Power to set criteria and reject applications - Relevant articles of CRD IV transposed in Germany through KWG. In practice, ECB applies licensing criteria as included in German law because final decision is based on BaFin’s draft. - Sections 32 et seq. KWG govern licensing comprehensively: - Section 32 (1) sentence 1 KWG: written license required to conduct banking businesses listed in section 1 (1) sentence 2 KWG or provide financial services listed in section 1 (1a) sentence 2 KWG in Germany. - Section 32 (1) sentence 2 KWG: particulars that license application must contain. - Reports and documents specified in greater detail in section 14 AnzV. - ECB may make granting of the license subject to conditions (section 32 (2) sentence 1 KWG). - License may be restricted to particular types of banking business or financial services (section 32 (2) sentence 2 KWG). - Before granting license, BaFin consults the deposit guarantee scheme appropriate to the institution (section 32 (3) KWG) and Bundesbank. - An application may be rejected by BaFin (Section 33 KWG) and by the ECB. ECB may object to BaFin’s draft only where conditions set out in relevant EU law are not met (SSMR Article 14(3)). - Section 33 KWG distinguishes: - Mandatory reasons for refusal (section 33 (1) sentence 1 KWG) — license must be refused in all cases. - Discretionary reasons (section 33 (2) KWG) — BaFin may refuse after due consideration. - Mandatory reasons for refusal include: - a) resources for initial capital are not available in Germany, - b) facts are known which suggest that an applicant or an executive board member is not trustworthy, - c) facts are known which warrant the assumption that the holder of a qualified participating interest is not trustworthy or fails to satisfy the requirements of the sound and prudent management of the institution, - d) facts are known which suggest that the proprietor or executive board member does not have the necessary professional qualifications, - e) facts are known which suggest that an executive board member does not have sufficient time to perform tasks, - f) the applicant will become subsidiary of a financial holding company or a mixed financial holding company and facts are known, which warrant the assumption that an executive board member of these companies is not trustworthy or does not have the professional qualifications necessary for managing the company, - g) a credit institution does not have at least two full-time executive board members (principle of dual control), - h) the institution has its head office or domicile outside Germany and/or is not prepared or not in a position to make the organizational arrangements necessary for the proper operation of the business, - i) the applicant is a subsidiary of a foreign credit institution and the foreign supervisory authority responsible for this credit institution has not given its consent to the establishment of the subsidiary. - Section 33 (2) KWG (discretionary) examples where BaFin may refuse: - a) institution associated with others in a corporate network impairing effective supervision due to cross-shareholdings or inadequate transparency, - b) effective supervision impaired by legal or administrative provisions of a non-EEA member state applicable to related individuals or enterprises, - c) institution is a subsidiary of an institution domiciled in a non-EEA member state that is not effectively supervised in its home country or whose competent authority is not prepared to cooperate satisfactorily with BaFin, - d) application contains insufficient information or documents. - Power to revoke an authorization granted based on false information is set out in CRD IV Article 18(b). If ECB becomes aware, pursuant to SSMFR Article 82(1), it may withdraw the license. - Section 35 (2) KWG governs expiry and revocation of licenses and refers to provisions of the VwVfG. A license (administrative act) may be withdrawn subject to section 48 (2) to (4) VwVfG qualifications. Beneficiary cannot invoke protection of confidence if administrative act procured through fraudulent misrepresentation, menaces or bribery or by providing information that was materially false or incomplete. #### EC3 — Consistency of licensing criteria with ongoing supervision - Pursuant to CRD IV Article 18, one reason for withdrawing authorization is that the credit institution “no longer fulfils the conditions under which authorization was granted.” - Minimum requirements for licensing must be met at any time; license may be revoked if criteria cease to be met. - Conditions for revocation include all reasons for refusing a license in the first place (section 35 (2) no. 3 KWG). - ECB may withdraw authorization in cases set out in Union law on its own initiative, following consultations with NCA, or on proposal from the NCA (SSMR Art 14(5)). #### EC4 — Assessment of legal, managerial, operational, and ownership structures - A banking license can be refused if the institution's structures hinder effective supervision (section 33 (2) sentences 1 and 2 KWG). - Section 33 (2) sentence 2 no. 1 KWG authorizes BaFin to refuse a license if effective supervision on solo and consolidated basis would be impaired due to group structure. - Section 35 (2) no. 3 KWG: supervisory authority may revoke a license if it becomes aware of facts warranting refusal pursuant to section 33 (2) numbers 1 to 3. - Section 2b (1) KWG: a credit institution may not be operated in the form of sole proprietorship, ensuring separation of institution capital and proprietor's personal assets. - Assessors reviewed files where licensing authority raised issues that applicants had to address prior to authorization. #### EC5 — Suitability of major shareholders and ownership transparency - CRD IV: major shareholders are qualifying holdings or the 20 largest shareholders if no qualifying holdings. - Suitability requirements in Article 23 include reputation, knowledge, skills and experience, and financial soundness. - ECB has developed guidance to SSM members to assist assessment of fit and proper criteria; guidance was still under discussion at time of assessment. *Source: _cr16196 - section 54 KWG punishable by fine or imprisonment of up to five years.* ### Section 32 (1) sentence 2 nos. 6 a) to c) KWG, if qualified participating interests are held in ### _cr16196 - Section 32 (1) sentence 2 nos. 6 a) to c) KWG, if qualified participating interests are held in ### Qualified participating interests and disclosure requirements - License application must provide the names of the holders of qualified participating interests, the amount of these participating interests and the data required to assess the trustworthiness of the holders or of the legal representatives or of the general partners (section 32 (1) sentence 2 nos. 6 a) to c) KWG). - If these holders are required to draw up annual accounts, the license application must include the annual accounts for the last three financial years, together with audit reports compiled by independent external auditors (section 32 (1) sentence 2 no. 6, d) KWG). - If these holders are part of a group, the license application must include particulars of the group structure and, if applicable, the consolidated group accounts for the last three financial years, together with auditor’s reports compiled by independent external auditors (section 32 (1) sentence 2 no. 6, e) KWG). - If applicants or holders of qualified participating interests are members of groups, the license application must describe the group structure, with an organizational chart of the group attached (section 14 (5) AnzV in conjunction with section 11 no. 1 a) InhKontrollV). - Where no qualified participating interests are held in the institution, the license application must provide the names of the up to 20 biggest shareholders. - The license application must include any facts which indicate a close link between the institution and other natural persons or other enterprises (section 32 (1) sentence 2 no. 7 KWG). ### Assessment of trustworthiness, burden of proof, and indirect holdings - Existing reporting system enables BaFin to understand ownership structures and to take appropriate measures as circumstances dictate. - Under section 1 (9) KWG in conjunction with article 4 (1) no. 36 CRR, a qualified participating is also deemed to exist if a significant influence can be exercised on the management of the enterprise in which a participating interest is held. - Regulations concerning acquisition of a qualified participation apply to the legitimate owner as well as to the beneficial owners (association with section 22 (1) no. 2 WpHG). - If the trustworthiness of holders of participating interests cannot be established beyond doubt, the doubts will count against them (procedural reversal of the normal burden of proof). - BaFin calculates indirect qualified holdings up the chain for the purposes of assessing fitness and propriety, until the holding no longer meets the qualifying thresholds. - BaFin has required two or more shareholders to have their participation aggregated as a qualified holding where evidence indicates they were acting in concert. ### Powers to prohibit acquisitions where funds are suspect - BaFin requires only evidence that the necessary initial capital is available. - In the case of qualified participating interests, section 33 (1) no. 3 in conjunction with section 2c (1b) sentence 1 no. 1 KWG stipulates that, within three months of receiving the complete reports, BaFin may prohibit the intended acquisition or increase in the qualified participating interest if facts are known which warrant the assumption that the funds used were obtained by criminal offences. ### EC6 — Minimum initial capital (description and findings) - CRD IV Article 12 sets out a minimum amount of EUR 5 million, and in some particular cases (mainly grandfathering of banks that had less than the threshold amount in 1992, paragraph 4) it might be of EUR 1 million. - The initial capital must be held in the form of common equity tier 1 (via cross reference to CRR Article 26(1)(a)). - The initial capital is a floor — a bank may not fall below the amount of EUR 5 million of CET1. - In Germany, the initial capital for deposit-taking credit institutions is an amount equivalent to at least EUR 5 million; and for institutions which conduct only e-money business, EUR 1 million. - Minimum requirements may also be contained in separate special Acts; example: a mortgage bank/ship mortgage bank may only be granted a license if the paid in original own funds amount to at least EUR 25 million according to section 2 (1) sentence 2 no. 1 PfandBG. - If the resources required to conduct business, in particular adequate initial capital, are no longer available, the license may be revoked (section 35 (2) no. 3 KWG in conjunction with section 33 (1) sentence 1 no. 1 KWG). ### EC7 — Fit-and-proper assessment of Board and senior management (description and findings) - Licensing authority evaluates proposed Board members and senior management as to expertise and integrity (fit-and-proper test), and any potential for conflicts of interest. - Fit-and-proper criteria include: (i) skills and experience in relevant financial operations commensurate with the intended activities of the bank; and (ii) no record of criminal activities or adverse regulatory judgments that make a person unfit to uphold important positions in a bank. - Germany has a two-Board structure: Supervisory Board (oversight) and Management Board (executive). For assessment, “Board” means Supervisory Board and “senior management” means Management Board. - Under section 32 (1) sentence 2 nos. 2 to 4 KWG, the license application must include the names of the executive board members, certificates of good conduct and information regarding professional qualifications and experience. - Information in the license application is used to assess mandatory reasons to refuse a license under section 33 (1) sentence 1 KWG (e.g., lack of trustworthiness or professional qualifications). - Mandatory refusal example: credit institution does not have at least two full-time executive board members. - Requirements for professional qualifications of management board specified in section 25c (1) KWG: must have necessary professional qualifications, be trustworthy and dedicate sufficient time. - Professional qualification prerequisite: adequate theoretical and practical knowledge and managerial experience; three-year record of working in management capacity at an institution of comparable size and type of business (section 25c (1) sentence 3 KWG). - Exceptional acceptance of specialist candidates (e.g., IT) only for institutions with several executive board members. - For Supervisory Board, section 25(d) requires members to be trustworthy, have necessary expertise and devote sufficient time; KWG establishes that “the supervisory board as a whole shall have the necessary knowledge, skills and experience to fulfill its control function as well as to assess and monitor the management board of the institution”. - Collective knowledge of the Supervisory Board is not customarily assessed in the licensing process. ### EC8 — Review of business plan, governance, risk management, outsourcing (description and findings) - Under section 32 (1) sentence 2 no. 5 KWG, license application must include a viable business plan detailing proposed business, organizational structure, risk management and internal control procedures. - Section 14 (7) AnzV requires business plan to contain: a) nature of planned business with substantial indication of its future course and projected balance sheets and profit and loss accounts for the first three full financial years; b) description of organizational structure with organization chart; c) description of planned internal monitoring procedures. - Section 14 (2) sentence 2 AnzV: license applications must be accompanied by certified photocopies of formation documents and management's proposed Internal Rules of Procedure. - Section 25a KWG: institutions must have suitable arrangements for managing, monitoring and controlling risks and compliance; appropriate arrangements to gauge financial situation with sufficient accuracy at all times; proper business organization; appropriate internal control system; appropriate security precautions for electronic data processing. - Records of business transactions must permit full and unbroken monitoring by BaFin (section 25a (1) sentence 6 no. 2 KWG). - Safeguards against money laundering and other fraudulent activities are required. - Outsourcing requirements in section 25b KWG: outsourcing may impair neither proper conduct of business nor manager's ability to manage and monitor nor BaFin's right to audit and ability to monitor; contractual powers to issue instructions to external provider and inclusion of outsourced areas in internal monitoring procedures. - BaFin has expanded upon sections 25a and 25b KWG in the MaRisk. ### EC9 — Pro forma financials, projections and shareholder financial information (description and findings) - License application must include a viable business plan with projected balance sheets and profit and loss accounts for the first three full financial years following commencement of operations (section 14 (7) no. 1 AnzV). - These documents form the basis for assessing the institution's financial capacity. - Evidence of resources required to conduct business: confirmation by a deposit-taking credit institution domiciled in an EEA member state that the initial capital has been paid up, is unencumbered and is freely available to the managers (section 14 (3) AnzV). - BaFin obtains financial information on the bank's principal shareholders via section 32 (1) sentence 2 no. 6 KWG. ### EC10 — Cross-border establishment, home supervisor non-objection and consolidated supervision (description and findings) - Section 33 (1) sentence 1 no. 8 KWG: license must be refused if applicant is a subsidiary of a foreign credit institution and the foreign supervisory authority has not given its consent to establishment of the subsidiary. - Licensing for subsidiaries (of EU or non EU institutions) is the responsibility of the ECB. - Section 53 (2a) KWG: provision also applies to branches of an enterprise domiciled abroad. - Pursuant to section 53d KWG, BaFin must assess appropriateness of supervision on a consolidated basis of a foreign supervisory authority of a non-EEA member state if a foreign institution wants to establish a subsidiary or branch in Germany. - Authorization for branches is under responsibility of BaFin. - For branches of deposit-taking credit institutions domiciled within the EEA, plans about setting up a branch in Germany are forwarded to BaFin (and then to the ECB) by the competent authorities, which can be regarded as approval (section 53b (1) KWG). ### EC11 — Monitoring new entrants (description and findings) - No particular mention in laws or regulations of special monitoring mechanisms for new entrants. - In BaFin, new institutions in their first years are subject to enhanced surveillance. - Based on section 10 (3) sentence 2 no. 6 KWG, institutions are granted licenses subject to the condition that their solvency ratio should not fall below 12 percent in their first three financial years. ### Assessment of Principle 5 (licensing) - Assessment: Largely Compliant. - Comments and observations: - ECB (licensing institution for new banks and for subsidiaries of foreign banks establishing in Germany) and BaFin (licensing institution for branches of non-EEA banks) have a clear set of criteria and can reject non-compliant applications. - Analysis of all license applications initially takes place at BaFin; viable applications are sent to ECB as a draft decision. - From the start of the SSM to the time of assessment, 9 licensing procedures for Germany had been initiated. - BaFin analyses ownership structure and assesses suitability of shareholders through documentation requirements. - Financial suitability of shareholders is generally limited to availability of initial capital; legal/regulatory framework does not foresee denial for lack of financial capacity to provide additional capital as required by EC5. Assessors had access to one case where a “no objection” was informed conditional to the shareholder demonstrating additional available capital for the initial three years. - Supervisory Board assessment does not play a relevant role in licensing; collective knowledge of Supervisory Board was not customarily assessed. BaFin issued in January 2016 new guidelines emphasizing professional qualification of Supervisory Board. - Assessors reviewed recent licensing files at the ECB and observed growing concern with collective qualification of the board and availability of additional resources in the first years; deficiencies regarding this CP are expected to reduce as these elements are increasingly incorporated into routine licensing. ### Principle 6 — Transfer of significant ownership (intro and EC1) - Principle statement: The supervisor has the power to review, reject and impose prudential conditions on proposals to transfer significant ownership or controlling interests held directly or indirectly in existing banks to other parties. - EC1 — Definitions and legal basis (description and findings): - Under the KWG, a “significant holding” is a “qualifying holding” pursuant to Article 4 (1) of the CRR. - Rules on significant ownerships are found in section 1 (9), section 2c and section 44b KWG. - Section 290 HGB: a controlling interest exists if a parent: - holds the majority of shareholder voting rights of another enterprise; - has the right of appointment or removal of the majority of members of the administrative, management body or supervisory corporate body which controls financial and business policy and simultaneously is a shareholder; - has the right to exercise controlling influence with regard to financial and business policy by reason of a control agreement or a provision of the statutes; or - carries, in economic terms, the majority of risks and opportunities of an enterprise (special purpose entity). - EC2 — There are requirements to obtain supervisory approval or provide immediate notification of proposed changes that would result in a change in ownership, including beneficial ownership, or the exercise of voting rights over a particular threshold or change in controlling interest. (Description and findings continued in source.) *Source: _cr16196 - Section 32 (1) sentence 2 nos. 6 a) to c) KWG, if qualified participating interests are held in* ### Section 2c of KWG transposes relevant CRD articles. CRD Article 22(8) requires ex-ante ### _cr16196 - Section 2c of KWG transposes relevant CRD articles. CRD Article 22(8) requires ex-ante ### Transposition and ex-ante notification requirements - Section 2c of KWG transposes relevant CRD articles; CRD Article 22(8) requires ex-ante notification to BaFin and BBk and permits the supervisor to object to the acquisition. - Article 22(8) states that member states cannot impose notification or approval requirements which are more stringent than those in the CRD. - Articles 22 and 25 of CRD IV address acquisitions, increases and divestitures of qualifying holdings. - It is required that legal and natural persons wishing to acquire, directly or indirectly, a qualifying holding in a credit institution or to further increase, directly or indirectly, such a qualifying holding as a result of which the proportion of the voting rights or of the capital held would reach or exceed 20, 30, or 50 percent seek pre-approval from the supervisor. ### Ultimate Beneficial Owner (UBO) and ownership tracing (EC3) - BaFin reviews ownership structure of acquirers and continues to trace until it identifies all qualifying holders; an example case was provided to assessors. - EC3: The supervisor has the power to reject any proposal for a change in significant ownership, including beneficial ownership, or controlling interest, or prevent the exercise of voting rights in respect of such investments to ensure that any change in significant ownership meets criteria comparable to those used for licensing banks. - If the supervisor determines that the change in significant ownership was based on false information, the supervisor has the power to reject, modify or reverse the change in significant ownership. - Article 23(2) of CRD was transposed in Section 2c KWG and the Holder Control Regulation sets out conditions under which an application may be rejected: - rejection grounds include reasonable grounds based on criteria set out in Article 23(1) of CRD IV or incomplete information by the proposed acquirer. - the criteria are: reputation, knowledge, skills and experience of senior management, financial soundness, group structure, compliance with prudential requirements, suspicion of money laundering activities or terrorist financing. - Because Article 22(8) applies a maximum harmonization standard, only the criteria used in Article 23 may be used to assess a change in ownership; additional criteria used in initial licensing that are not in Article 23 cannot be used to reject the proposed acquisition. ### Suspension of voting rights, annulment, and consequences (Article 26 and Article 66) - Article 26(2) of CRD IV deals with suspension of voting rights, nullity of votes cast and possibility of their annulment where the proposed investment was objected-to by the supervisor, and suspension of voting rights for acquirers having failed to comply with notification requirements. - Example: a significant holding was acquired without ex-ante notification; the acquirer was asked to submit required information, acquisition was objected-to by BaFin, shares were placed in a trust and exercise of voting rights was suspended; the shares were sold by the acquirer. - Article 66(1) of CRD IV requires Member States to ensure laws provide for administrative penalties and other administrative measures at least in respect of, inter alia, the acquisition, directly or indirectly, of a qualifying holding or a further increase that would reach or exceed thresholds in Article 22(1) of CRD IV, without notifying in writing the competent authorities during the assessment period, or against the opposition of the competent authorities, in breach of Article 22(1). - Article 66(2) sanctions include possible pecuniary penalties, order to cease the conduct and desist, suspension of voting rights. ### Reporting, disclosure, and ongoing information (EC4 and EC6) - EC4: The supervisor obtains from banks, through periodic reporting or on-site examinations, the names and holdings of all significant shareholders or those that exert controlling influence, including identities of beneficial owners of shares held by nominees, custodians and through vehicles that might disguise ownership. - Section 24 (1) no. 10 and (3c) KWG obliges an institution to notify the competent authority (BaFin or ECB) and Bundesbank (and BaFin if the competent authority is the ECB) about acquisition or disposal of a significant ownership in its own institution, the reaching, exceeding or falling below thresholds for significant ownerships of 20 percent, 30 percent and 50 percent of the voting rights or capital, and the fact that the institution becomes or ceases to be the subsidiary of another undertaking, as soon as the forthcoming change comes to its attention. - On an annual basis, institutions must provide the name and address of any holder of a significant ownership in the reporting institution and in subordinated enterprises domiciled abroad, as well as the amounts of these participating interests (section 24 (1a) no. 3 KWG; section 10a KWG). - Section 44b (1) sentence 1 KWG in conjunction with section 44 (1) sentence 1 KWG stipulates the proposed acquirer is obliged to provide information and present documentation to BaFin and Bundesbank and ECB on their request to supplement the information originally provided. - EC6: CRD IV remains silent on ongoing notification requirements; Article 22(8) deals with acquisitions and does not address on-going notification requirements applicable to all shareholders. - At country level, no specific laws require institutions to notify BaFin of any material information which may negatively affect the suitability of a major shareholder or controlling party; however, section 29 (3) sentence 1 KWG requires the external auditor to inform BaFin and Bundesbank immediately about facts learned in the course of audit which warrant the assumption that a holder of a significant ownership is not trustworthy. ### Powers to modify, reverse or otherwise address unauthorized changes (EC5) - EC5: The supervisor has the power to take appropriate action to modify, reverse or otherwise address a change of control that has taken place without necessary notification or approval. - BaFin has the power to nullify the acquisition by transferring voting rights to a trustee according to section 2c (2) KWG. - BaFin may commission the trustee to sell the shares insofar as they establish a significant ownership if the holder does not provide proof of a trustworthy buyer within an appropriate deadline set by BaFin (section 2c (2) sentences 1 to 3 KWG). - Example of a relevant case was discussed with the mission. ### Fit-and-proper assessments and enforcement (Assessment of Principle 6) - Assessment of principle 6: Compliant. - Comments: - There is no legal requirement for the bank to notify the supervisor when they become aware of events that may cause a significant shareholder to no longer be fit-and-proper. - The annual external audit reviews trustworthiness and a report to regulator is required on fit-and-proper deficiencies. - Detailed fit-and-proper requirements were issued in early 2016; issues concerning this are incorporated into CP 5 rating. ### Major acquisitions and investments (Principle 7; EC1–EC5; AC1) - Principle 7: The supervisor has the power to approve or reject, and impose prudential conditions on, major acquisitions or investments by a bank, against prescribed criteria, including establishment of cross-border operations, and to determine that corporate affiliations or structures do not expose the bank to undue risks or hinder effective supervision. - EC1 description and findings: - The acquisition of a non-EU bank is not covered by the CRR or CRD. - When German law provides specific criteria or diligence requirements applicable to acquisitions by German banks, and if the acquiring banking group is a SI, the ECB may instruct BaFin to enforce such national requirements (Article 9(1) 3rd subparagraph of SSMR, e.g., section 12a KWG). - The KWG contains no rule requiring a German credit institution to obtain prior approval before making acquisitions or investments. - Section 24 (1) no. 13 KWG requires institutions to notify the competent authority and Bundesbank immediately after acquisition of a significant ownership in another enterprise or if amount of such significant ownership changes or is disposed. - Acquisitions or investments other than significant ownerships in institutions do not normally need to be specifically notified; BaFin and ECB will be informed through audits of annual accounts or its own special audits. - Only where an institution acquires a significant ownership in another German regulated entity is there a requirement to notify BaFin and Bundesbank in advance and wait for the competent supervisor (or ECB for SIs) to prohibit acquisition within timeframe set out in section 2c KWG. - ECB may withdraw license pursuant to section 35 para 2 no. 3 in conjunction with section 33 para 2 KWG if—due to the acquisitions—the resulting corporate affiliations or structures hinder effective supervision. - Summary: in general there is no obligation for prior approval for major acquisitions or investments under German banking law, except for acquisition of a significant ownership in a regulated entity; multiple provisions ensure notification after acquisitions and set limitations. - Additional measures and requirements: - Section 24 (1) no. 13 KWG: immediate notification requirement after acquisition of participating interest in another enterprise or if amount changes or disposed. - BaFin general decree March 2013 (Article 89 (3) CRR): in cases of acquisitions by a bank in an undertaking outside the financial sector for capital requirements, institutions must apply a risk weight of 1,250 percent to the greater of either the amount of such significant ownerships in excess of 15 percent of the eligible capital of the institution or the total amount of such significant ownerships that combined exceed 60 percent of the eligible capital of the institution. - Section 12a (1) sentence 3 KWG: institution, financial holding company or mixed financial holding company must notify BaFin and Bundesbank of establishment, modification or discontinuation of a significant ownership or of corporate ties for companies whose head office is located abroad and which become subordinated enterprises and part of consolidated banking group. - EC2 findings: - Acquisition of participating interest in other enterprises does not require supervisory approval; KWG does not contain criteria for judging individual proposals. - Section 2c KWG sets out criteria for prohibition of acquisition of significant ownerships in an institution. - EC3 findings: - Section 2c KWG allows supervisor to prohibit acquisition of a significant ownership if it would create non-transparent structures and impede effective supervision; provision applies only to acquisitions in institutions domiciled in Germany and not on cross-border acquisitions by German institutions. - For investments in non-financial institutions, neither KWG nor CRR grant power to prohibit new acquisitions or investments as described. - EC4 findings: - Article 89 of CRR and associated measures ensure participating interests can only be acquired by institutions with enough capital to cover risk; section 25a KWG requires adequate organizational structure and risk management on single-entity and group-wide basis. - EC5 findings: - Compulsory notification immediately after acquisition of participating interest (section 24 (1) no. 13 KWG) enables competent authority to discuss problematic acquisitions with institution; there is no general legal possibility to prohibit the participation. - AC1 (supervisory review of acquisitions by other entities in banking group) — description and findings provided but truncated in source content. *Source: IMF staff report excerpt on Germany transposition of CRD IV into KWG (Sections cited: Section 2c KWG; section 24; section 44b; section 29; section 10a; section 12a; section 25a; section 2c (2); references to Articles 22, 23, 25, 26, 66, 89 of CRD/CRR and SSMR).* ### Section 24 (1) no. 13 KWG requires institutions to notify the competent authority (BaFin or ### _cr16196 - Section 24 (1) no. 13 KWG requires institutions to notify the competent authority (BaFin or ### Notification requirements and scope - Section 24 (1) no. 13 KWG requires institutions to notify the competent authority (BaFin or ECB) and Bundesbank immediately after: - the acquisition of a participating interest in another enterprise; or - if the amount of such a participating interest changes; or - if it has been disposed. - Requirement applies to direct participating interests as well as indirect participating interests. ### Supervisory powers under KWG (related provisions) - Section 25a KWG: institutions are required to have an organizational structure and risk management adequate to its size, complexity and business structure on a single entity basis and on a group-wide basis. - BaFin may take measures to: - ensure the integration in the risk management system (section 25a (2) sentence 2 KWG); - ensure the reduction of risks (section 45b KWG); - stipulate higher capital charges (section 10 (3) No. 10 KWG). ### Assessment of Principle 7 — Findings and concerns - Assessment: Materially Noncompliant - Key findings and concerns: - No requirement for prior supervisor approval of significant investments, other than investments in other German supervised institutions (significant holdings regime). - Possible consequence: acquisitions may occur that increase risk to the banking group due to financial products that exceed the bank’s risk appetite or managing ability, creating group impact that greatly exceeds the size of the investment. - Regulator’s ex-post remedies (e.g., forcing unwind) exist but ex-ante discussion of investments would be more prudent. - For acquisition of EU banks, CP6 applies: acquisition of a qualifying share in a bank is governed solely by requirements surrounding the change of shareholding of the target; no requirement to ensure the relevant supervisor(s) consider whether the acquiring bank can manage absorption of the target. - NCA responsible for the target will assess suitability of the acquirer but this does not necessarily include clear consideration of the acquirer’s capacity to manage and absorb the target. - More careful consideration is more likely when the same authority supervises both target and acquirer but this is not guaranteed in law. ### Investment regimes — scope and gaps (EU, non-EU, non-banks) - Investments in undertakings outside the financial sector: - Financial sector defined to include activities ancillary to banking, and leasing, factoring, managing of trusts, and data processing. - Governed, both in respect of type and amount, by Articles 89 to 91 of CRR. - Neither approval nor pre-notification is required. - Acquisition of a non-EU bank: - Not covered by the CRR or CRD or German law (except for the notification under art 24(1) of 13 KWG). - Acquisition of non-banks (in the EU or outside the EU, except for other supervised German entities of the financial sector such as insurance companies): - No requirement for authorization or approval. - Notification required starting from a 10 percent threshold. - At EU level, for acquisition of non-banks within the thresholds or above the thresholds, as long as the RW/deduction is observed, there are no criteria or requirement or risk assessment by the supervisor prior to the acquisition. - No requirement of risk assessment at EU level for acquisition of non-EU banks. ### Principle 8 — Supervisory approach (EC1) and SREP as main tool - Principle 8: supervisor must develop and maintain forward-looking assessment of risk profile of individual banks and groups; identify, assess and address risks; have early intervention framework; and have resolution plans. - EC1: supervisor uses a methodology for determining and assessing on an ongoing basis the nature, impact and scope of risks: - (a) which banks or banking groups are exposed to, including risks posed by entities in the wider group; and - (b) which banks or banking groups present to the safety and soundness of the banking system. - The main tool for assessing risks for German SIs is the SREP (Supervisory Review and Evaluation Process). - ECB as the competent authority for SIs is required to carry out a SREP and to take decisions for SIs. - Within a group, SREP applies at the consolidated, sub-consolidated and single-entity levels unless an entity has been waived from supervision in accordance with Articles 7, 8, 10 of the CRR. - For financial conglomerates, SREP decisions need to take into account outcome of supplementary supervision as required by FICOD. ### SREP methodology — structure and application - SSM SREP: - Harmonized methodology developed along the lines of the EBA GL on SREP (EBA/GL/2014/13). - Applied in a proportionate manner depending on nature, scale, complexity, group situation, overseas and interbank ties, significance for overall market or sub-segment, and institution’s overall risk situation. - SREP combines quantitative and qualitative analysis, following a principle of “constrained judgment”. - Four key analytical modules: - Business model analysis; - Assessment of internal governance and institution-wide control arrangements; - Assessment of risks to capital and adequacy of capital to cover these risks; - Assessment of risks to liquidity and adequacy of liquidity resources to cover these risks. - Outcomes: - Assessments of the four elements result in an overall SREP assessment underpinning supervisory actions, including decisions on capital (Pillar 2), liquidity adequacy, or other measures. - Monitoring and indicators: - Regular monitoring of key indicators derived from ITS reporting based off FinRep and CoRep templates and Short Term Data exercises (STEs). - STEs complement COREP data for special purpose analytical processes. - JST members perform periodic analysis based on reported data; examples seen of ongoing monitoring reports on credit risk and operational risk demonstrating forward-looking analysis prompting follow-up. - Scoring and ratings: - Changes in risk profile should be reflected in ratings scored on a scale of 1–4 (1 equating to ‘no discernible risk’ and 4 ‘high risk’) and one negative grade (F) for an institution that is failing or likely to fail (within the meaning of Article 32 BRRD). - SREP guidelines contain detailed descriptions to assist assignment of a rating to achieve consistency of risk profiling. - Newness of framework and only one JST SREP cycle completed, but consistency of ratings enhanced via extensive horizontal analysis; ECB working on consistency through training. - Frequency and intensity of supervision: - Determined largely by outcome of supervisory risk assessment including RAS and SREP. - SIs assigned a minimum engagement level (MEL) and a supervisory examination program (SEP). - MEL prescribes engagement (e.g., meetings) during supervisory cycle. - SEP is a plan of on-site examinations for the next 12 months. - Each of the four SREP elements assigned a rating and an overall SREP score underpinning supervisory actions. - Strategic priorities of the ECB are applied to all SIs directly supervised by the ECB, providing bottom up and top down approach to risk identification. - Observations: - Evidence of direct link between off-site supervision and follow up reflected in SEP. - Less evidence that SREP score had been adjusted during supervisory cycle to reflect results of supervisory activity. - Risk Assessment System (RAS) and operational workflow: - RAS supports JST’s day-to-day supervisory work, evaluating banks’ risk levels and controls, business model, internal governance, capital adequacy and liquidity adequacy on an ongoing basis. - Assessment of capital and liquidity needs based on ongoing RAS, supplemented by periodic comprehensive review in light of ICAAP/ILAAP, considering normal and stressed conditions. - New information updated in RAS and documented in information management system (IMAS) on ongoing basis. - At least once a year, a SREP decision is undertaken. ### SREP review modules (ten modules) 1. Categorization of the institution and period review of this categorization 2. Monitoring of key indicators 3. Business model analysis 4. Assessment of internal governance and institution-wide controls 5. Assessment of risks to capital 6. Assessment of risks to liquidity and funding 7. Assessment of the adequacy of own funds 8. Assessment of the institutions liquidity resources 9. The overall SREP assessment 10. Supervisory measures ### Group-wide risk assessment and LSI treatment - SREP methodology includes instructions for assessment of group-wide risks: - At consolidated level, NCA should assess organizational and legal structure, effectiveness of group-wide MI, group RAS and effectiveness of group-wide risk management frameworks. - Guidance for JST is EBA ITS on joint decision on institution specific prudential requirements (EBA/ITS/2013/06). - At time of field mission: - SREP methodology was in process of being applied to material entities. - Formal SREP for material entities within the group had not been consistently conducted for German SIs; supervisors aware and included plans for 2016. - LSI sector: - Risk assessment methodology shared between ECB (through SSM), BaFin and BBk. - ECB carries out oversight tasks in line with Article 6 SSM Regulation and Part VII of SSM Framework Regulation, following proportionate, risk-based approach. - Direct supervision of LSIs conducted jointly by BaFin and BBk with periodic reporting to ECB (through DGIII). - BBk and BaFin to implement SREP commencing in 2016 based on EBA SREP guideline; BaFin and BBk will conduct SREP jointly (cooperation governed by section 7 KWG). - Supervisory Guideline specifies cooperation between BaFin and BBk. - BBk responsibilities: - Ongoing monitoring of credit institutions and prepares at least once a year a bank-by-bank risk assessment (“risk profile”) incorporating ongoing monitoring and on-site inspection results. - Suggests supervisory measures based on assessment; BaFin decides final risk profile and sovereign supervisory measures. - Supervisory process: cyclical pattern producing annual risk assessment for each LSI; individual risk assessment can be adjusted during the year based on new information. - Supervisory planning coordinated annually between ECB, BaFin and BBk; planning is a rough plan adaptable to new information. - Overall risk assessment based on: - (i) evaluation and assessment of institutions’ risks, - (ii) how institution’s risk situation is internally assessed, - (iii) its importance for financial stability. - Risk profile forms basis for decisions on supervisory measures and other responses; supervisory planning includes inspections, meetings with senior management, evaluation of external audit reports, and audit priority setting. *Source: https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2016/_cr16196.pdf* ### section 30 KWG. ### section 30 KWG. ### Risk profiling and supervisory prioritization - Two decisive features of the risk profile: - The risk matrix helps supervisors deploy resources efficiently and in a risk-oriented manner by identifying institutions that, owing to their risk profile classification, represent a heightened risk to the stability of the financial sector (principle of proportionality). - Risk profiling reveals areas where weaknesses have come to light or which cannot be judged owing to a lack of information, guiding targeted supervisory actions. - Intensive supervision is applied to institutions based on their individual risk situation or where the type and scope of their business activities is relevant to financial stability. ### SREP framework, ICAAP/ILAAP and LSIs - The introduction of the SREP framework for LSIs structures assessment of ICAAP and governance according to the EBA guidelines. - ICAAP assessment had been conducted annually and is a well-established process; a new feature will be the Pillar 2 decision at the end of the process. - Meetings with the management Board occur to discuss ICAAP results and key risk issues; assessors reviewed example ICAAP files and annual meetings which were demonstrated to be effective. - Ongoing monitoring of LSIs’ risk profile should place greater emphasis on first-hand verification by the BBk rather than relying primarily on external audit reports to detect emerging risks earlier and make more accurate assessments. ### RAS, SEP, JSTs and supervisory activity planning - The EBA SREP guidelines establish a forward-looking framework focused on business model analysis and strategy. - The RAS framework includes key risk indicators submitted quarterly by banks to input into overall risk assessment and annual SREP. - The ECB’s supervisory process starts with planning regular supervisory activities in the SEP covering ongoing supervision and on-site missions, in line with available resources. - For SIs these tasks fall under the responsibility of JSTs; on-site inspections are organized by inspection teams that are organizationally independent but cooperate closely with JSTs. - On-site activities typically result in supervisory measures (recommendations, requirements, decisions). Final decisions are taken at the level of the Supervisory Board and the Governing Council, followed by communication, hearing, monitoring, and enforcement steps. ### MELs, clustering and engagement levels (matrix) - The systemic importance of institutions is taken into account via a clustering approach which feeds into the MELs. - Four categories of minimum engagement levels (MELs): basic, standard, enhanced and intense. - MEL for each RAS category is driven by two inputs: the cluster of the SI and the score assigned to the SI for a given risk category. - Matrix used to determine the MEL for each RAS category: - Combined Risk scores: 4 3 2 1 — Engagement levels by Cluster - Cluster 1: I I E E - Cluster 2: I E E E - Cluster 3: I E S S - Cluster 4: I S S B - Cluster 5: I S B B - I: Intense; E: Enhanced; S: Standard; B: Basic - Clustering: biggest and most complex banks in cluster 1; smallest and less complex banks in cluster 5. - MELs implemented by individual risk category and the overall risk profile; supervisory activities categories: regular, thematic and additional. - Regular activities: core supervisory activities performed every year. - Thematic activities: specific focus areas of Supervisory Priorities for a given year. - Additional activities: not included in MELs; JSTs have discretion on frequency. ### Assessment horizons, stress testing and capital/liquidity review - For SIs, SREP assesses an institution’s viability at a 12-month horizon, in the medium term (3 to 5 years), and over the cycle. - RAS supports JSTs day-to-day supervisory work, evaluating risk levels and controls, business model, internal governance, capital adequacy and liquidity adequacy on an ongoing basis. - Assessment of capital and liquidity needs is based on ongoing RAS, supplemented with periodic comprehensive review of capital and liquid positions and the institution’s own ICAAP/ILAAP. - Supervisors challenge ICAAP/ILAAP using supervisory “proxies” and supervisory stress tests (e.g., EBA or ECB comprehensive assessments) providing static and forward-looking perspectives. - Stress tests in ICAAP: at least one comprehensive adverse scenario reflecting severe but plausible adverse developments for capital planning; assessment explores assumptions and stressed capital and risk projections over at least the upcoming 3 years and scrutinizes embedded management actions. ### Data reporting, peer benchmarks and analysis - SIs regularly submit supervisory data (mainly FINREP and COREP) which generate risk indicators. - Scope to increase analysis of this data and use outputs in ongoing assessment of business model (e.g., trend comparisons against business plans and peer group data). - Development and application of peer group benchmarks is a work in progress; expected to help understand bank risk profiles and emerging risks. ### On-site inspection frequency and practices - On-site inspections are generally carried out by BBk and can focus on MaRisk requirements, internal model approvals, or special topics (e.g., remuneration). - For SIs, on-site inspections are generally carried out at least once (up to several inspections) a year. - For LSIs, on-site inspections are subject to a minimum frequency of every 3 to 12 years; the 12-year frequency is applied only to a limited number of small/low risk LSIs. - Assessors found the length of time between on-site examinations for LSIs can be too long and should be reduced, notwithstanding external auditor work and annual meetings with senior management. - JSTs typically meet periodically with management; BBk and BaFin meet at least annually with LSIs in a formal setting to discuss risk profile, business strategy, new developments and supervisory concerns. ### Compliance assessment (EC3) - Article 4(1)(d) of the SSM Regulation requires the ECB to ensure banks comply with Union law on governance, fit-and-proper requirements, risk management processes, internal control mechanisms, remuneration policies, and effective ICAAPs, including IRB models. - Assessment of compliance with prudential regulations and other legal requirements is made regularly in the SREP via meetings, on-site examinations, thematic reviews and information from internal/external audits. - For small/low risk LSIs, testing and verification for compliance with MaRisk undertaken proportionally on a cycle of approximately 5 - 10/12 years. - For larger/more complex LSIs and those with higher risk profiles, frequency of testing and verification of compliance with regulations is intended to be conducted at least annually for a specific risk type. - A key input into LSI MaRisk assessment is the annual external audit report submitted in parts from January to late Spring. ### Macroprudential and cross-sectoral risk assessment (EC4, EC5) - For SIs, Article 97 CRD IV requires competent authorities to evaluate risks institutions are or might be exposed to, risks an institution poses to the financial system, and risks revealed by stress-testing, taking into account nature, scale, complexity. - Phase 3 of RAS: JSTs consider external micro and macro risks for each risk category/subcategory; RAS Risk Level Phase 3 is the place to include macro-prudential factors in individual institution risk assessments. - Macro risks are classified by dimension: global/European, cross-border sectoral, domestic country-wide, or domestic sectoral; JSTs assess country/sector-specific risks only where the supervised bank has significant exposures. - The Risk Analysis Division within the SSM performs quantitative impact studies and cross-sectional analyses and cooperates with the macro-prudential function; it exchanges views with other regulators. - For LSIs, BaFin Risk Committee (established in 2013) addresses cross-sectoral risks on micro- and macro-level and meets at least quarterly; BaFin insurance and securities supervision represented. - BBk set up a separate Financial Stability Department to identify and analyze macro-level risks; it is an observer in the BaFin Risk Committee. - The Committee on Ongoing Monitoring aggregates, evaluates and analyses risks regularly; main priority areas include pressures on banks’ business models due to the low interest rate environment, strained earnings potential to internally generate capital and cyber resiliency. - Outputs from these committees translate into supervisory actions (e.g., thematic reviews of IRRBB, data collections, stress testing). ### System-wide risk identification and coordination (EC5) - SREP process combines bottom-up bank analysis and strategic priorities across the ECB’s mandate; horizontal analysis by SSM’s horizontal function ensures consistency and identifies common trends; results communicated to the Supervisory Board. - Specialist teams (DGIV) enable cross-cutting identification and assessment of risks across large banks. - There is a risk that division of supervision responsibilities between SIs and LSIs may make system-wide risk identification and coordinated responses more difficult; DGIII of the SSM plays an indirect supervisory role for LSIs and the Ongoing Committee for Supervision (joint BaFin and BBk) supports coordination. ### Resolvability, recovery planning and resolution authorities (EC6) - Legal basis for resolvability of SIs: Articles 10, 11, 15, 16, 17, 18, 45 BRRD and Article 10(10) SRM Regulation. Resolution authority — not the SSM — is responsible for resolution planning and resolvability assessment; ECB has a consultative role and should cooperate with NRAs and the SRB. - At mission time, process not fully developed; recovery plans of several larger German banks were considered and discussed in supervisory/crisis management colleges; results of recovery plan analysis for SIs directly supervised by the ECB had been shared with the SRB or FSMA on a systematic basis. - For approximately 1,600 LSIs, FMSA is the resolution authority (section 3 SAG) since 1 January 2015, including cross-border institutions not in the SRB remit. - FMSA responsibilities: develop resolution plans (section 40 to 48 SAG), conduct resolvability assessments and address or remove impediments to resolvability (section 57 to 60 SAG). - If FMSA determines significant impediments, it notifies the institution and relevant competent authorities including BaFin and the EBA in writing; the institution must propose measures; FMSA consults BaFin and can require implementation of proposed or alternative measures without delay. ### Crisis management, decision-making and emergency procedures (EC7) - Legal basis for handling SIs in stress: Articles 97 and 107 CRD IV, Articles 27, 30, 32(1)(a), 81(3) BRRD and Article 18(1) SRM Regulation. - SSM crisis management framework spans phases from preparatory ongoing supervision to involvement in resolution decisions; resolution authorities are main decision-makers during resolution, with SSM in an advisory/cooperative role. - ECB Emergency Action Plan defines operational crisis management/mitigation steps; JST follows a stylized escalation process when deterioration is identified and informs Crisis Management Division and NCAs. - Crisis Management Division develops early warning indicators and a traffic light approach; may propose establishment of an institution specific Crisis Management Team (IS CMT) to coordinate internal supervisory response. - IS CMT: central internal coordination body for institution-specific supervisory actions; proposes draft decisions for ECB decision-making bodies and coordinates interaction with NRAs and the SRB via CRM. - Decision-making procedure: Supervisory Board proposes complete draft decisions to the Governing Council; the Supervisory Board cannot take legally binding ECB decisions of its own initiative nor have delegated decision powers. - In emergencies, Chair of the Supervisory Board convenes meetings (including teleconferencing); decisions by the Governing Council can occur in physical meeting, conference call, written procedure or tacit non-objection; a specific “fast-track” procedure speeds decision-taking with sequential steps undertaken back-to-back. ### SAG, BaFin, BBk and recovery plan assessment for LSIs - The SAG (entered into force on January 1, 2015) establishes FMSA as German resolution authority for approximately 1,600 LSIs and supplements BaFin’s KWG powers for weak institutions. - SAG defines coordination and cooperation principles among BaFin, BBk and FMSA and is specified in the SAG-Kooperationsvereinbarung. - LSIs must prepare and regularly update recovery plans identifying credible measures to restore their financial position after significant deterioration; plans submitted to BaFin and BBk for assessment. - BaFin’s Gruppe R: dedicated department in charge of assessing recovery plans from both line supervisory and horizontal perspectives and taking corrective action to enhance recovery planning quality. - BBk: line supervisors assess individual recovery plans, with BBk’s central office horizontal function supporting consistency and quality. - Gruppe R and BBk central horizontal function cooperate; Gruppe R can take corrective action and support line supervisors in exercising early intervention measures if recovery options prove insufficient to prevent likely failure. *Source: section 30 KWG.* ### section 46 KWG and section 36 SAG provide BaFin with a comprehensive set of regulatory ### _cr16196 - section 46 KWG and section 36 SAG provide BaFin with a comprehensive set of regulatory ### Regulatory powers and cooperation (section 46 KWG; section 36 SAG) - BaFin has a comprehensive set of regulatory powers, including measures ranging from requiring the management body of the institution to implement measures set out in the recovery plan to a temporary closure of business (for further details concerning individual measures compare section 36 to 39 SAG). - The SAG and the SAG-Kooperationsvereinbarung: - Ensure BaFin involves the FMSA at an early stage and provides information when appropriate, particularly important in cases of fast deterioration of an institution’s financial situation. - Define segregation of tasks and cooperation between BaFin and the FMSA. - Stipulate obligations to inform and coordinate with external stakeholders, in particular with foreign supervisory and resolution authorities, and the relevant colleges (colleges of supervisors and resolution colleges). ### FMSA competence and resolution framework - Competence and decision-making: - If an institution is likely to fail or failing despite early intervention measures, or if early intervention measures are unlikely to prevent failure, the FMSA has competence for dealing with failing less significant and cross-border institutions that do not fall in the remit of the SRB. - Determination that an institution is failing or likely to fail can be done either by the FMSA or BaFin after consultation with the other authority. - The decision whether the conditions for resolution are met as a whole is made by the FMSA. - Resolution powers and principles: - The FMSA can assess whether applying specific resolution tools is preferable to normal insolvency proceedings. - Resolution is governed by the principle that shareholders and creditors shall bear losses to the same extent as in insolvency proceedings that would have been initiated as of the resolution order. - Resolution tools pursuant to section 77 SAG include: - bail-in of the shareholders and creditors of the failing institution, - sale of the business or shares of the institution under resolution, - setting up of a bridge institution, - transfer of shares, assets and liabilities. - Use of resolution tools may disrupt rights of shareholders and creditors; resolution action should be taken only where necessary in the public interest, particularly where liquidation under normal insolvency proceedings might jeopardize financial stability, interrupt provision of critical functions, and affect protection of depositors. - Implementation status: - The framework for handling problem banks entered into force on 1 January 2015 and has not yet been tested. ### Preventive measures and macroprudential tools - Recent amendments to the regulatory framework aim to reduce likelihood of future crises and enhance resilience of institutions by: - strengthening capital and liquidity buffers, - providing better tools for macro-prudential policies. ### Regulatory perimeter, authorization, and enforcement (EC8) - Where the supervisor becomes aware of bank-like activities being performed fully or partially outside the regulatory perimeter, the supervisor takes appropriate steps to draw the matter to the attention of the responsible authority. - Where the supervisor becomes aware of banks restructuring activities to avoid the regulatory perimeter, the supervisor takes appropriate steps to address this. - ECB/SSM practices: - The SSM takes appropriate steps to draw such matters to the attention of the responsible authority. - For authorization regime changes, the SSM expects institutions to notify by filing an authorization request when there is a change in business activities. - Changes aimed at avoiding the perimeter are identified through on-site inspections. - LSIs (less significant institutions): - Supervisory action related to potential circumvention, and other material supervisory procedures or draft supervisory decisions, should be notified to the ECB as part of its oversight function pursuant to Article 6(5)(c) and 6(7)(c) of the SSM Regulation and Articles 97 and 98 of the SSM Framework Regulation. - A credit institution may in general only conduct banking business as defined in section 1 (1) KWG with a written license from BaFin/ECB. Qualification as banking business and necessity for a license depends on the type of business and its volume. - Conducting banking business without a banking license leads to criminal offence. - When aware of restructuring to avoid the regulatory perimeter, the supervisory authority takes appropriate steps to address this strictly within the limits set by law (rule of law). ### Assessment: Principle 8 — Supervisory approach and transition status - Overall assessment: Largely compliant - Key findings and comments: - New supervision methodologies are in transition and have had positive benefits for supervision of German SIs, including a greater focus on quantitative analysis and application of a SREP process aligned with EBA guidelines. - Main elements (SREP, RAS and SEPs) are still in the process of being integrated to maintain forward-looking risk profiles of SIs. - Currently the main tool in use by the ECB is the annual SREP, performed once per year with the process approximately 6 months from start to finish. - More time is needed for full implementation and for SREP scores to be used more dynamically and integrated with RAS and SEPs. - The approach for the LSI sector is largely established but evolving: - Introduction of the SREP and formalized Pillar 2 approach to determining capital add-ons at SREP completion. - BaFin/BBk supervision has typically been principles-based and is being strengthened. - Greater reliance on verification and more time allocated to ongoing analysis of supervisory reporting is needed to identify early emerging issues. - SREP process has been mainly focused at the consolidated level and has not penetrated deep into organizational structures; broader application across group structures would help identify pockets of risk for incorporation into SEPs. - Scope exists to increase frequency of business model analysis for LSIs as part of ongoing assessment, for example by comparing trends against business plans and peer group data. ### Principle 9 and EC1 — Supervisory techniques and SREP operational details - Principle 9 summary: The supervisor uses an appropriate range of techniques and tools and deploys resources proportionately, taking into account risk profile and systemic importance. - EC1 description and findings: - ECB powers: carry out off-site supervision (Article 4 SSMR); adopt supervisory measures (Article 16 SSM Regulation); carry out on-site inspections (Article 12 SSM Regulation and Articles 143 to 146 SSMFR). - SREP scope and frequency: - SSM SREP assessment comprises nine analytical modules: business model analysis; internal governance and controls; credit and counterparty risk; market risk; operational risk; IRRBB; capital adequacy; liquidity risk; and funding risk. - Frequency of assessment depends on institution category: - complete review at least annually for Category 1, - at least every 2 years for Category 2, - at least every 3 years for Category 3 & 4 (see SREP Guideline section 2.4). - A summary of overall SREP assessment should be performed at least annually for all institutions. - Engagement with senior management: - Minimum level of ongoing engagement is a key aspect. - For Category 1 & 2 institutions engagement is ongoing and at least annual. - For Category 3 & 4 engagement is expected to be continuous and risk-based. - Core SREP activities: Monitoring of key indicators; Business model analysis; Assessment of internal governance and institution-wide controls; Assessment of risks to capital; and Assessment of risks to liquidity and funding. - Off-site monitoring: - Framework for regular monitoring of key financial and non-financial indicators to support SREP. - Changes in indicators prompt updates to SREP and potential adjustments in supervisory stance. - Supervisory Examination Program (SEP) and IMAS: - SSM supervisory process starts with planning in the SEP covering off-site and on-site tasks in line with resources. - Off-site activities are conducted regularly or ad hoc; for SIs these tasks fall under JSTs. - Examples were seen where off-site monitoring took place in line with SEP maintained in IMAS. IMAS provides management with a detailed view of current and planned supervision activities. - On-site inspections and in-depth reviews: - JSTs conduct in-depth reviews by dedicated on-site missions (inspections or internal model investigations). - On-site inspections typically carried out by an inspection team organizationally independent but working closely with the JST. - Risk Assessment System (RAS): - Supports JSTs’ day-to-day supervisory work, evaluating risk levels, controls, business model, internal governance, capital and liquidity adequacy on an ongoing basis. - Assessment of capital and liquidity needs is based on RAS and periodic comprehensive review considering ICAAP/ILAAP under normal and stressed conditions. - Supervisory decisions and follow-up: - Supervisory activities typically result in measures (recommendations, requirements, decisions). - Final decisions are taken at the Supervisory Board and Governing Council. - Routine follow-up steps include communication to the credit institution, hearing, monitoring of compliance, and, if necessary, enforcement and sanctioning. - Early SSM/JST phase: - In the early stages, primary objective was to build up knowledge of institutions; JSTs and DGIV worked with German authorities to build this base knowledge and apply the SSM framework. *Source: IMF staff summary of content in _cr16196 - section 46 KWG and section 36 SAG provide BaFin with a comprehensive set of regulatory* ### part in the SEP has been sectoral themes aligned with a centralized priority setting process. ### _cr16196 - part in the SEP has been sectoral themes aligned with a centralized priority setting process. ### SEP, supervisory priorities and resource allocation - SEPs for Significant Institutions (SIs) are set by the JST and must be aligned with Supervisory Priorities, the risk-based approach and proportionality. - Typical SEP time horizons: - off-site on-going activities: typically one year; - on-site inspections and internal model investigations: typically 6 months. - SEPs may be amended throughout the year to reflect new information or off-site analysis. - Draft SEPs are prepared by JSTs, cleared with ECB intermediate structures and senior management, reviewed by the Planning and Coordination of SEP Division for minimum engagement level compliance, and consolidated into a single SEP. - Final consolidated SEP: - is submitted for information to the Supervisory Board; - the list of on-site inspections and internal model investigations is submitted for approval to the Supervisory Board and the Governing Council (non-objection procedure). - Monthly proposals for adjustments to the approved on-site program can be submitted to the Supervisory Board to ensure pragmatic implementation and rapid adaptation. - For Less Significant Institutions (LSIs) under BaFin/BBk: - intensity of supervision is flexibly geared to institution-specific risk and systemic importance; - about 15 percent of all LSIs are inspected (special audits) annually. - BBk proposes an on-site examination schedule by October 31 each year; the schedule is jointly finalized by December 15 each year. ### Planning and execution of on-site and off-site activities (EC2) - Legal and guidance framework referenced: CRD Articles 97–99, EBA SREP guideline, EBA ITS on joint decisions (Article 113 CRD). - SEP planning process: - JSTs build individual SEPs using minimum engagement levels and add institution-specific activities; - Planning and Coordination Division performs final compliance checks and consolidates SEPs; - Centralized On-Site Inspections and Internal Models Divisions perform content quality checks; - ECB horizontal Divisions coordinate resource allocation with NCAs and external providers; - Heads of Division and senior management confirm selected missions for the next half year. - Implementation: - SEPs are implemented by JSTs, on-site inspections and internal model teams with Planning and Coordination Division support; - Execution is monitored semi-annually by the Planning and Coordination Division in cooperation with Centralized On-Site Inspections and Internal Models Divisions. - For LSIs: - on-site schedule proposed by BBk (based on individual risk profile, stability importance, urgency) and reviewed/adjusted by BaFin to avoid overlaps and consider audit cycles; - audits are principally conducted by BBk staff, in special cases by audit firms, with BaFin staff joining as appropriate; - assessors saw evidence the planning process works effectively. ### Use of information and inputs for risk assessment (EC3, EC4, EC5) - ECB powers: Article 10 SSM Regulation authorizes ECB to require necessary information from institutions and parent undertakings. - Information types used in SREP and ongoing monitoring: - key macroeconomic variables, competitive indicators, market trends, stress testing outcomes, external audit reports, ratings agency reports; - quantitative sources: FINREP and COREP (consolidated since mid-2014), other risk indicators, economic/market indicators (GDP, sector NPL, market volatility), central credit register data, internal estimates (ICAAP, ILAAP, stress tests), financial statements, Pillar 3, peer group indicators, supervisory stress test results. - Off-site reporting frequency and examples: - liquidity: monthly; - FINREP/COREP: quarterly (with some FINREP templates semi-annually or annually); - large exposures: quarterly; - losses from immovable property: semi-annually; - leverage ratio: quarterly; - asset encumbrance: quarterly; - supervisory benchmarking: annually. - Short Term Exercises (STEs) supplement ITS reporting (examples in 2015: interest rate in the banking book, sovereign risk, liquidity). - SREP methodology elements (applied to SIs): - business model and profitability assessment; - internal governance and risk management assessment; - risk-by-risk assessment of risks to capital; - risk-by-risk assessment of risks to liquidity and funding. - Business model analysis process (example guidance): - preliminary assessment; identification of focus areas; business environment assessment; quantitative and qualitative analysis of current business model; forward-looking strategy and financial plans; viability and sustainability assessment; identification of key vulnerabilities; summarizing findings and scoring. - Stress testing and system-wide risk: - EBA and ESRB support EU-wide stress tests; Article 100 CRD IV requires NCAs to carry out supervisory stress tests at least annually as appropriate; - SSM horizontal risk analysis function conducts regular micro-prudential analysis, identifies trends and emerging risks, and supports JSTs with stress-test inputs (institution internal stressed projections, SSM stressed proxies, supervisory bottom-up/top-down stress-tests). - LSIs specifics: - analysis uses an ECB analytical tool for business model assessment with an automated profitability rating based on Return on Assets, Cost-Income-Ratio and Recurring Earnings Ratio (supervisor judgment can adjust score); - on-site inspection cycle for LSIs ranges from one year to 12 years; assessors noted a 12-year cycle for lowest risk and smallest LSIs is too long and should be shortened. - Communication of findings: - results of routine analysis communicated in ongoing meetings with bank management and boards where necessary; - on-site examination results communicated in closing meeting and later in writing after decision procedures. ### Supervision of internal audit, governance, and direct engagement (EC6–EC9) - Internal audit (IA) evaluation: - SREP Element 2 assesses IA functionality; IA reports are key qualitative inputs; - JSTs determine whether and to what extent IA work can be relied upon; on-site inspection of IA may be conducted; - for LSIs, MaRisk and KWG govern IA; internal audit reports are available to external auditors, BaFin, and BBk. - Supervisor contacts and escalation: - for SIs, focus is on Management Board and senior management (Cat 1 & 2: ongoing engagement; Cat 3: risk-based engagement; Cat 4: engagement at least every three years); - JSTs maintain contact with management to discuss capital, liquidity, credit quality and sectoral themes; JSTs may participate in Board meetings where appropriate. - Communication and follow-up: - JSTs decide monitoring and remediation approaches for SIs; possible responses range from informal notifications to enforcement and sanctions; referral to Enforcement and Sanctions Division if necessary (no such cases observed). - For LSIs: BBk assigns on-site grades F1 (low priority) to F4 (high priority); final examination report submitted to BaFin, typically communicated to the institution approximately four weeks after receipt by BaFin; LSIs must respond with remediation plans and timeframes and provide status reports until deficiencies closed. - Observations on follow-up timeliness: - follow-up on-site examinations to verify remediation for F1–F3 findings took approximately three years (assessors viewed as too long); - greater emphasis needed on verifying remedial actions, as follow-up often waits until next inspection cycle (which for LSIs can be up to 12 years). ### Use of third parties and independence safeguards (EC11) - External consultants and audit firms: - ECB has a framework agreement with six audit firms for external support on on-site or internal model missions; - external consultants may participate as team members but cannot act as Head of on-site examination; - head of mission must provide rationale and task description prior to appointment; external firms must disclose relationships and self-assess potential conflicts of interest; - presence of external consultants is transparently communicated to inspected institutions. - For LSIs, reliance on external auditors is greater; for SIs, majority of on-site examinations are delivered by ECB with BBk and BaFin representatives. ### Information systems, data quality and monitoring (EC12) - Directorate General Information Systems provides and maintains SSM ICT and information governance/security services and end-user support. - DG Statistics: - ensures availability of reliable and accurate supervisory data across the SSM; - checks completeness and data accuracy via automated validation rules and monitors submission deadlines; - liaises with rapporteurs and NCAs on erroneous/missing data; history data kept but clearly marked. - IMAS provides an integrated supervisory tool for prudential data analysis, prioritization, monitoring and SREP performance. - BBk provides information systems for German banks with automated triggers and manual processes; Committee on Ongoing Monitoring summarizes and analyzes prudential information and prepares a risk profile. - Last change to German prudential information systems took place in 2011. ### Quality assurance, internal review and audit (AC1) - ECB internal control framework uses a three-line-of-defense model. - Supervisory Quality Assurance Division (SQA) provides regular feedback on supervisory output quality; issues annual lessons learnt report to Supervisory Board. - ECB Directorate Internal Audit (D/IA) and Internal Auditors Committee (IAC) provide independent assurance; IAC scope covers Eurosystem/ESCB and SSM tasks. First IAC audit planned for late 2015 (as noted). - BaFin and BBk have internal quality assurance and internal audit departments; Bundesrechnungshof (BRH) audits BaFin’s and BBk’s accounts annually. ### Key observations, gaps and recommendations from assessors (Assessment of Principle 9) - Overall assessment: Largely compliant. - Strengths and processes: - supervisory manual and frameworks provide sound basis for comprehensive risk assessments using on-site and off-site activities; - SEPs promote consistency across German SIs through centralized thematic priorities. - Identified gaps and issues: - early phase SSM activities were heavily influenced by centralized thematic priorities at expense of bottom-up institution-specific risk priorities; a more balanced thematic vs bottom-up approach is warranted; - SI on-site examination results are not ranked by severity in communications to banks, making prioritization of remediation unclear; a ladder of severity is recommended; - insufficient emphasis on verifying that remedial actions appropriately address on-site findings, particularly important given long LSI inspection cycles (up to 12 years); - supervisors focus more on Management Boards than Supervisory Boards, limiting evidence of challenging Supervisory Boards on strategy/business model assumptions; - banks are not obliged to report breaches of prudential requirements; absence of formal breach notification may delay supervisory awareness until external audit reports. - Specific numerical and timeline facts preserved: - about 15 percent of all LSIs are inspected (special audits) annually; - SEP horizons: typically one year (off-site) and 6 months (on-site/internal model investigations); - BBk proposes supervision schedule by October 31 and finalizes jointly by December 15 each year; - LSI on-site inspection cycle ranges from one year to 12 years; - follow-up on-site examinations to verify remediation of F1–F3 findings: approximately three years; - LCR binding minimum standard at 100 percent in 2018. *International Monetary Fund — content unit: _cr16196 - part in the SEP has been sectoral themes aligned with a centralized priority setting process.* ### section 44 KWG). The examinations will select a sample of supervisory reports and check ### _cr16196 - section 44 KWG). The examinations will select a sample of supervisory reports and check whether the data reconciles with the accounts. ### EC4 — Frequency of collection and analysis - Supervisor collects and analyses information from banks "at a frequency commensurate with the nature of the information requested, and the risk profile and systemic importance of the bank." - Frequency for SIs can be adjusted depending on risk profile and systemic importance as per the CRD (Article 104 paragraph 1(j)) and EBA SREP guideline. - ITS data and data collected through short term exercises (STEs) feed into ongoing supervision and the SREP process throughout the supervisory cycle. - Data is a key input into the first two phases of the assessment of the four elements of the SREP decision and is automatically populated into a two-page high level summary for reporting to senior management. - Regular reporting requirements for LSIs contain standard reporting days or periods commensurate with nature, significance and availability (e.g., annual accounts). - CRR institutions (other than significant institutions) submit information under the EU harmonized supervisory reporting framework according to described frequencies. - National supervisory reporting is conducted on a quarterly frequency; a comprehensive analysis such as ICAAP is annual. - Bundesbank conducts regular in-depth analysis of specific risk areas of LSIs including NPLs, LEs and IRRBB. - CRR institutions submit balance sheet positions monthly ("Monthly balance sheet statistics"); other institutions submit quarterly (FinaRisikoAV). - Institution-internal ICAAP information is generally submitted yearly (FinaRisikoAV, section 8 to 12); SSM institutions or other institutions with potential systemic risk submit this information twice a year. ### EC5 — Comparability of data across banks and groups - Supervisor collects data from all banks and relevant entities covered by consolidated supervision on a comparable basis and related to the same dates (stock data) and periods (flow data). - EBA publishes papers for benchmarking internal approaches to calculate own-funds requirements for credit and market risk; JSTs use cohort benchmarks and peer group averages. - SIs adjust financial information based on accounting year-end so reporting is done every three, six or twelve months from their accounting year-end (according to art 2 of Commission Implementing Regulation (EU) No 680/2014). - Bundesbank maintains a central credit register (CCR) to strengthen credit risk analysis for German banks: - Lenders must report loans to an individual counterparty or group of connected counterparties of EUR 1 million or more (large loans) to the CCR quarterly (section 14 KWG). - Reports include client identifiers, geographical and sectoral data, group of connected counterparties, and credit data (on-/off-balance, provisions, collaterals, probability of default, code of default). - CCR collates reporting, performs quality checks for total indebtedness and regularly analyzes data for banking supervision and financial stability. - CCR provides feedback of total indebtedness to all involved lenders. - Institutions must also report large exposures exceeding the threshold of 10 percent of its eligible capital as part of European common reporting; CCR delivers these reports to the ECB to enable harmonized review of concentration risk. ### EC6 — Power to request information from banks and wider groups - Supervisor has power to request and receive any relevant information from banks and entities in the wider group, including internal management information. - For SIs, supervisory reports are requested on a consolidated basis following Article 11(1) CRR; for consolidated reports of financial holding companies Art 11(3) CRR applies. - Information for wider banking group is included in the risk assessment and within scope of group solvency information under EBA ITS on Reporting. - For LSIs, section 44 (1) sentence 1 and section 44 (2) sentence 1 KWG allow supervisors to request all relevant documentation regarding the credit institution; formal requests often triggered by auditor’s reports, section 29 (3) or section 24 (1) no. 4 KWG filings, newspaper reports. - Section 24 (3b) KWG empowers BaFin and Bundesbank to impose additional notifications and reporting requirements on institutions or categories of institutions to obtain deeper insight into institutions’ situation, management, or governing bodies; provisions include information regarding the wider banking group. - Resolution planning cooperation: section 42 and 46 of the SAG define cooperation and contribution requirements; BaFin and Bundesbank together with FMSA review whether information is already available and provide it to FMSA where applicable. ### EC7 — Access to bank records and personnel - Supervisor has power to access all bank records and access to Board, management and staff when required. - Article 11 SSMR allows ECB to examine books and records, take copies/extracts, and obtain written or oral explanations from persons referred to in Article 10(1) and their representatives or staff (including credit institutions, financial/mixed holding companies, mixed-activity holding companies, persons belonging to these entities, and third parties to whom functions/activities are outsourced). - BaFin and Bundesbank powers derive from sections 44 et seq. KWG and apply to individual institutions, group members, and holders of qualified participating interests. - Section 44 (1) 3 KWG allows BaFin’s staff, Bundesbank staff and other persons used by BaFin to enter and inspect business premises of the institution, external service providers and subordinated undertakings during ordinary office and business hours. - Institutions and acting persons must show all documents and provide all information needed; BaFin can send representatives to general meetings and supervisory board meetings. - Section 24c KWG gives BaFin automated access to customer account information of individuals and institutions to perform prudential functions under the KWG or the Money Laundering Act, particularly regarding unauthorized banking business and financial services. ### EC8 — Enforcement of timely and accurate submission - Supervisor enforces timely and accurate submission; determines appropriate level of senior management responsibility, imposes sanctions for misreporting and persistent errors, and requires inaccurate information be amended. - For SIs, legal basis for enforcement is in the CRD: - Article 76 CRD assigns responsibility to bank senior management for accuracy of supervisory reporting. - Article 67 paragraphs (e) to (m) establish capacity for competent authority to enforce accurate and timely information submission. - Remittance dates to the ECB are specified with different deadlines; SIs directly supervised by ECB have earlier remittance dates than LSIs. - NCAs monitor data quality using validation rules in Annex XV of Implementing Regulation (EU) No 680/2014 and data quality checks defined by the ECB in cooperation with German supervisory authorities. - Directly applicable EU law (CRR Articles 99(1), 101, 349(1), 415(1) and (2), 430 (1)) imposes reporting obligations; ECB entitled to impose pecuniary sanctions and enforcement measures on SIs. - Article 18(1) SSMR: ECB has exclusive competence to open infringement proceedings and impose administrative pecuniary penalties on SIs for breaches of directly applicable EU law. - Article 18(5) SSMR: ECB may request NCAs to open proceedings to impose non-pecuniary penalties on SIs and sanctions against natural persons. - No examples provided to date of penalties applied for late or low-quality reporting for supervised entities. - For LSIs, enforcement basis is in KWG: - Section 25a KWG requires proper business organization to ensure compliance with legal provisions. - BaFin can impose pecuniary sanctions against the institution or acting natural persons for breach of reporting requirements. - Section 56 (6) KWG sets out maximum amounts for penalties listed in Section 56 (1) to (5) KWG. - BaFin may hold senior management responsible for persistent breaches and may demand removal of responsible senior managers (section 36 (1) KWG). - Recent example: a fine in total Euro 3,000 imposed against an institution for acting twice negligently contrary to Article 396 CRR in connection with section 56 (5) No. 19 KWG. - BaFin’s discretion in determining penalties is guided by section 17 of the Administrative Offences Act (Ordnungswidrigkeitengesetz – OWiG) considering relevance of offence, premeditation vs negligence, and economic situation of offender. ### EC9 — Policies and procedures to ensure validity and integrity of supervisory information - ITS reporting framework by EBA includes binding validation rules and the Data Point Model for consistent application. - Article 140(4) SSMFR: "the ECB shall organize the processes relating to collection and quality review of data reported by supervised entities subject to, and in compliance with, relevant Union law and EBA implementing technical standards." - ECB Supervisory Statistics Division checks completeness, data accuracy and presentation of each report to ensure common format; automated processes support follow-up and cooperation with German supervisory authorities. - Supervisory Statistics Division uploads data into a dedicated database, keeps and updates it continuously, tracks requests to rapporteurs, issues reminders per reporting schedules, maintains history data clearly indicated, and informs end users when updates are available. - Division maintains SSM Reporting Instructions and provides technical support and regular supervisory statistics for end users. - Supervisory reporting for LSIs is based on electronic processing; verification and validation follow CRR and ITS on Reporting; residual national reports undergo automated internal completeness and accuracy checks. - Validity and integrity of supervisory reports are checked by external auditors as part of audit of annual accounts under the Auditors’ Report Regulation (PrüfbV); section 19 PrüfbV includes checking reports are complete, accurate and timely and requires auditors to note infringements. - Additional material checks are performed manually by off-site supervision; assessors saw evidence of manual sample checks as part of off-site analysis. ### EC10 — Roles, responsibilities and suitability of external experts - When external experts support the ECB in prudential supervisory tasks, ECB rules apply. - ECB publishes contract notices in the Official Journal of the European Union to initiate tender processes for highly-qualified external providers; selection conducted in compliance with ECB Decisions (e.g., Decision ECB/2007/5 for the 2015 process) and Rules on Procurement. - Roles and responsibilities of external experts contracted to undertake supervisory tasks are covered in KWG (section 29). - Auditor’s Regulation includes stipulations regarding individuals’ probity and fitness to undertake such functions on behalf of the supervisor. ### EC11 — Requirement for external experts to report material shortcomings - The supervisor requires external experts to bring to its attention promptly any material shortcomings identified during their work for supervisory purposes. - (Description and findings for EC11 begin in the source but are not included further in the provided excerpt.) *Source: https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2016/_cr16196.pdf* ### Section 29 (3) KWG contains the auditor’s reporting and explanation duties in the course of ### _cr16196 - Section 29 (3) KWG contains the auditor’s reporting and explanation duties in the course of ### Auditor reporting and explanation duties (Section 29 (3) KWG) - The auditor must inform the German banking supervisors immediately of facts which might: - warrant the qualification or withholding of the certificate of audit; - jeopardize the existence of the institution; - seriously impair its development; - constitute a major infringement of the provisions relating to the institution’s approval criteria or the pursuit of business under the KWG; - indicate that the senior managers have severely infringed the law, the articles of association or the partnership agreement. - BaFin and Bundesbank have the right to: - request that the auditor explains the auditor’s report to them; - communicate any other facts which have come to his or her attention in the course of the audit and which suggest that the business of the institution has not been conducted properly. - In addition to the duties set out in section 29 (3) KWG (in particular the duty to inform BaFin and Bundesbank immediately of any significant findings), German banking supervisors can contact auditors at any time to exchange information. - Footnote note: "Maybe external auditors or other qualified external parties, commissioned with an appropriate mandate, and subject to appropriate confidentiality restrictions. External experts may conduct reviews used by the supervisor, yet it is ultimately the supervisor that must be satisfied with the results of the reviews conducted by such external experts." (appears in the source text) ### EC12 — Process for periodic review of supervisory information - SSM representation and data governance: - SSM is represented in relevant bodies responsible for establishment of reporting requirements. - SSM continuously assesses data needs of supervisors and adjusts data requirements accordingly. - ECB Regulation 2015/534 on reporting of supervisory financial information and additional ad hoc data collection exercises (e.g., for the SREP) are cited as relevant. - German supervisory authorities’ practices: - Monitor on a continuous basis the quality of supervisory data and other information against a bank’s business model and risk profile. - Can require ad hoc information pursuant to section 44 para 1 KWG when information is not adequate. - Enhanced the suite of reporting analytics in 2011 and have in place processes to periodically review data sets. - EBA ITS and national reporting reviews: - Periodical review of EBA ITS data is done by the German NCA based on reporting requirements set at EBA level. - For national reporting, the German supervisor developed FinaRisikoV as a result of a periodical review considering supervisory needs and relevance of data. - National reporting will continue to be periodically reviewed via national meetings ("fora") including supervisors and, in several cases, banks’ associations. ### Assessment re Principle 10 — Findings on supervisory reporting and data quality - Assessment: Materially Non-Compliant - Key findings: - Supervisory reporting requirements are now predominantly governed by a harmonized EU regime, but application of regulatory data requirements (FINREP/CoRep) is not uniform. - Some banks do not report a comprehensive suite of data for off-site analysis based on common definitions. - Lack of granular data inhibited the effectiveness of off-site supervision; this was a finding from the previous FSAP and has not been sufficiently remedied. - Credit institutions report using both nGAAP and IFRS; differences can be material. Supervisors generally know main differences and implement work-arounds; mapping from German GAAP to IFRS helps but differences complicate comparisons and outlier identification. - Regulatory framework notes: - ECB Regulation 2015/13 extends harmonized regular reporting to consolidated reports under national accounting frameworks and to solo reports; it does not affect accounting standards applied by supervised groups/entities in consolidated or annual accounts, nor change accounting standards applied to supervisory reporting. - The Regulation uses templates designed by the EBA and forming part of Implementing Regulation (EU) 680/2014, including dedicated national GAAP reporting templates. - ECB collaborates with NCAs to provide national GAAP banks further guidance to facilitate their reporting. ### Data gaps, verification, and analytical limitations - Specific gaps and consequences: - Lack of granular data for detailed risk information needed to support off-site supervision and in-depth analysis. Examples include: - related party exposures; - credit risk (loan loss data for portfolios, segmentation of past due loans by portfolio and time bucket, restructured loans, and forborne loans); - operational risk loss data; - market risk; - liquidity. - Supervisors supplement gaps with short-term data exercises/surveys and use requests for management information; this process is working but is a workaround that does not facilitate structured peer group analysis or standardized time-series analytics. - Greater segmentation (multiple time buckets and by portfolio) would allow more detailed portfolio-quality analysis and earlier identification of deterioration. - For operational risk, only the operational risk capital figure is routinely reported. - Need for a more systematic and structured approach to industry and peer group benchmarks to strengthen off-site supervision and system-wide monitoring. - Data accuracy and quality assurance: - Verification of accuracy needs attention. Current accuracy checks for ITS measures rely mainly on automatic triggers at submission (e.g., reconciliation of related data points, pre-defined triggers and sensitivities). - Data quality assurance is performed at NCA and ECB level (through the Supervisory Statistics Division). Supervisors report data quality issues encountered. - "Supervisory Data Issues Tracker" (a ticketing software) allows data users to register data quality issues; tickets are routed to the Supervisory Statistics Division at the ECB for investigation and follow-up with NCAs, who may request banks to resubmit data in case of reporting errors. - Example application: quarterly ID-Cards update where individual bank factsheets are updated and finalized by JSTs and provided to Supervisory Board members for information. - Greater emphasis on manual analysis of supervisory data to test and assess accuracy as input into the supervisory process is needed. - Valuation assessment: - Supervisory practices to assess whether valuations are prudent were not demonstrated as a routine task based on ITS reporting procedures. - Supervisors have tended not to focus on prudence of valuations; valuation adjustments by the supervisor could not be evidenced. ### Principle 11 — Corrective and sanctioning powers of supervisors (EC1 and EC2) - Principle statement: - The supervisor acts at an early stage to address unsafe and unsound practices or activities that could pose risks to banks or to the banking system. The supervisor has an adequate range of supervisory tools to bring about timely corrective actions, including the ability to revoke the banking license or to recommend its revocation. - EC1 — Early engagement, written actions, and follow-up - The ECB is empowered to require banks, financial holding companies or mixed financial holding companies to take necessary measures. - The annual SREP is currently the main tool from which most supervisory measures derive. - ECB supervisory decisions, as defined in Article 2(26) SSMFR, must be adopted following Article 22 SSMR and Articles 25 et seqq. SSMFR. The ECB notifies supervisory decisions in writing as a rule. - Article 35 SSMFR: ECB’s supervisory decisions can be notified to persons authorized to represent the SI. - Before exercising supervisory powers, the ECB may consider alternative measures (non-binding routine or ad hoc requests, letters, statements, meetings with management, or a letter of intervention). - Non-compliance or material problems lead to formal supervisory measures requiring decisions by the Supervisory Board and the Governing Council. - Follow-up may be based on periodical/ad hoc reports or closer interaction (including follow-up inspections); the ECB may impose enforcement measures or sanctions. Decisions on enforcement measures and sanctions are taken by the Supervisory Board and the Governing Council. - For LSIs, any material supervisory procedures or draft supervisory decisions should be notified to the ECB. - BaFin powers and practice: - If BaFin has indications of upcoming difficulties or negative developments, it has various supervisory actions depending on nature and gravity (e.g., breach of regulatory minimum requirements or non-compliance with organizational requirements). - Administrative orders are typically issued in written form and addressed to the management board; the supervisory board is informed by copy. - Under section 44 (1) KWG BaFin can request information or order on-site inspections to check compliance. - For corrective actions BaFin combines supervisory measures with duty to submit regular progress reports and deadlines to restore compliance; success can be verified by on-site inspections. - EC2 — Range of supervisory tools and exercise - The ECB’s powers are laid down in Chapter III of SSMR (Articles 9 to 18). Apart from powers listed in Article 16(2) SSMR, the ECB can directly exercise powers conferred on national authorities by national law transposing Union law directives (KWG in Germany). - The ECB can require BaFin, to the extent necessary and by way of instructions, to make use of their powers under national law where SSMR does not confer such powers on the ECB. - The ECB can act informally (operational acts, non-binding, no Supervisory Board/Governing Council decision) or formally (formal supervisory measures requiring decisions by the Supervisory Board and the Governing Council). - Formal powers include, among others: - drawing up an action program and a timetable for its implementation; - replacing one or more managers; - requesting management to convene a shareholders’ meeting; - appointing a special manager (EC4). - BaFin’s application of powers: - Most KWG supervisory powers contain specific conditions or aim at rectifying shortcomings and restoring compliance, or at averting dangers by restricting business and/or tightening regulatory requirements. - BaFin uses discretion considering circumstances of each breach and has an internal guideline ("ladder of actions") guiding escalation to revocation of license or issuing a transfer order. - Powers are executed as administrative acts. *Italic: Source — Excerpt from the PDF content provided for _cr16196 (Section 29 (3) KWG and related supervisory principles).* ### section 25a KWG, BaFin must request the institution to comply with higher capital ### _cr16196 - section 25a KWG, BaFin must request the institution to comply with higher capital requirements (section 10 (3) sentence 2 no. 10 KWG). ### BaFin supervisory powers and legal framework - BaFin can request an institution to comply with higher capital requirements (section 10 (3) sentence 2 no. 10 KWG). - In cases of organizational weaknesses BaFin may request the institution to take risk reducing measures or not to engage in certain types of business (section 25a (2) sentence 2-4, 45b (1) KWG). - If an institution is in breach of its individual combined capital buffer ratio or would be in breach if it conducted the intended distributions or dividend payments BaFin can require the institution to increase its own funds, decide on authorization of the institution’s capital conservation plan or limit on distributions and payments (section 10(6)-(8) KWG). - The general provision in section 6 (3) KWG entitles BaFin to issue orders to institutions and their managers to avoid an unsound administration of business that is not complying with laws, regulations or supervisory decisions and to counteract undesirable developments that may endanger the safety of the assets entrusted to the bank, or that could impair the proper conduct of banking business or financial services. - Violations of the provisions in sections 54-55b KWG may qualify as criminal offences. Any intentional or (gross) negligent breaches of the provisions listed in section 56 KWG can be sanctioned with fines. - Administrative acts may be contested by an objection or an appeal, but these have no postponing effect. ### Measures available when regulatory thresholds are breached or likely to be breached - The supervisor can act where a bank falls below established regulatory threshold requirements, including prescribed regulatory ratios or measurements, and may intervene at an early stage to require action to prevent breaching those thresholds. - When an institution is in breach of the minimum own funds or liquidity requirements BaFin can take the measures set out in section 45 (2) KWG, including: - Prohibit or limit withdrawals by shareholders or distribution of profits - Prohibit or restrict accounting measures that aim at balancing an existing annual deficit or show a profit - Prohibit or limit payments on profit-related own funds instruments - Prohibit or limit the granting of loans within the meaning of section 19 (1) KWG (which includes derivatives, guarantees and other off-balance sheet items) - Order measures to reduce risks arising from certain types of activities and products or through the use of certain systems - Order the limitation or cancellation of the planned annual total amount for variable remuneration - Cancel or limit payment of variable remuneration - Order to set up a restructuring plan and regularly report on the progress of its implementation - Order the implementation of one or more options set out in a recovery plan pursuant to section 13 SAG - When institutions are likely to breach minimum own funds and/or liquidity requirements in the foreseeable future BaFin may require the institution to improve the level of own funds and/or liquidity as set out in section 45 (1) KWG. - BaFin can increase regulatory requirements by requiring additional own funds above the minimum requirements set out in the CRR (section 10 (3) KWG). - To ensure lasting liquidity BaFin can increase liquidity requirements as set out in section 11 (2)-(4) KWG. - BaFin may appoint a special representative and entrust him/her with performance of activities at an institution and assign requisite powers as set out in section 45c KWG. - In cases of danger to the safety of assets BaFin may take temporary measures set out in section 46 KWG. ### Early intervention legal triggers and thresholds (KWG/SAG) - Section 45 KWG can be applied if an institution is in breach of minimum capital or liquidity requirements or an order setting higher capital or liquidity requirements, or if there is an assumption the institution will not be able to sustainably fulfill these requirements. The KWG provides precise thresholds: 1. the total capital ratio (ratio of own funds to the sum, multiplied by 12.5, of the total capital charge for credit risk, the capital charge for operational risk and the sum of the capital charges for market risk exposures including options trades pursuant to Articles 92 to 386 CRR as last amended) has decreased from one reporting date to the next by at least 10 percent, or the liquidity ratio to be calculated in accordance with the statutory order pursuant to section 11 (1) KWG has decreased from one reporting date to the next by at least 25 percent and it can be expected on the basis of this development that the minimum requirements will be undershot within the next 12 months, or 2. the total capital ratio (same definition) has decreased on at least three successive reporting dates by more than 3 percent in each case, or the liquidity ratio to be calculated in accordance with the statutory order pursuant to section 11 (1) KWG has decreased on at least three successive reporting dates by more than 10 percent in each case and it can be expected on the basis of this development that the minimum requirements will be undershot within the next 18 months and no facts are apparent which justify the assumption that it is highly likely that the minimum requirements will not be undershot. - Section 36 SAG grants early intervention powers where an institution infringes CRR requirements or institution specific capital or liquidity decisions, or is likely in the near future to do so due to rapidly deteriorating financial condition, including deteriorating liquidity, increasing leverage, non-performing loans, or concentration of exposures. Triggers may include the institution’s own funds requirement plus 1.5 percentage points. - Recovery plans should include possible measures management could take where conditions for early intervention are met (Section 12 SAG). - Section 14 SAG requires group recovery plans and empowers BaFin to request recovery plans on a solo level where appropriate; institutions must submit plans to competent authorities (ECB or BaFin) for assessment. ### Severe measures, insolvency and license revocation - Section 46 KWG is triggered by danger to the discharge of an institution's obligations to creditors, especially the safety of assets entrusted to it. Temporary measures BaFin may take include: - issue instructions on the institution's management - forbid the acceptance of deposits, funds or securities of customers and the granting of loans - prohibit proprietors and senior managers from carrying out their activities, or limit the performance of these activities - temporarily impose a ban on sales and payments by the institution - order that the institution be closed for business with customers - prohibit the acceptance of payments not intended for the payment of debt vis-à-vis the institution, unless the competent compensation scheme or other guarantee scheme warrants that the obligees will be satisfied in full - Section 46b KWG grants BaFin the power to initiate insolvency proceedings only under more stringent requirements: when an institution becomes insolvent or over-indebted. The petition for initiation of insolvency proceedings may only be filed by BaFin. In the event of imminent insolvency BaFin may file the petition only with the consent of the institution, pursuant to Section 46b KWG. - Section 35 KWG empowers the competent authority (BaFin for non CRR institutions or ECB for credit institutions) to revoke the banking license. ### Sanctions, ECB interaction, and allocation of enforcement powers - The ECB has powers under Article 16 SSMR and related provisions; these powers are available not only when the institution is breaching requirements but also when the ECB has evidence the bank is likely to breach requirements within the next 12 months or where SREP findings indicate weaknesses. - Allocation of sanctioning tasks between the ECB and NCAs vis-à-vis SIs depends on: (i) type of regulation allegedly infringed; (ii) entity to be penalized; (iii) sanction to be imposed. - In general, the ECB can only apply non-pecuniary sanctions and sanction natural persons through an NCA. For Germany, in practice there are few powers directly available to ECB as BaFin’s powers are administrative measures under the VwVfG. - Where SIs intentionally or negligently breach directly applicable Union law with administrative penalties available, the ECB may under Article 18 (1) SSMR impose administrative pecuniary penalties of twice the amount of the profits gained or losses avoided because of the breach where those can be determined or up to 10 percent of the total annual turnover in the preceding business year. - In case of breach of ECB regulations or decisions, the ECB may under Article 18 (7) SSMR impose fines against supervised entities of the same maximum amount. - The ECB has the power to impose periodic penalty payments of up to 5 percent of the average daily turnover per day of infringement to enforce ECB decisions or regulations. - The ECB can require BaFin to open proceedings if penalties for breaches of national law transposing EU Directives, penalties against natural persons or non-pecuniary penalties are to be imposed (Article 18 (5) SSMR, Article 134 SSMFR). - BaFin may impose fines on institutions or natural persons for intentional or reckless breaches of KWG provisions listed, or of orders issued by BaFin (section 56 KWG). ### Corrective actions, ring-fencing, and replacement of management - The supervisor can apply measures that include restricting activities, imposing prudential limits, withholding approval of new activities or acquisitions, restricting or suspending payments to shareholders or share repurchases, restricting asset transfers, barring individuals from the banking sector, replacing or restricting powers of managers or Board members, facilitating takeovers or mergers, providing interim management, and revoking or recommending revocation of banking licenses. - ECB may remove members from the management body of SIs who do not fulfill fit-and-proper requirements (Article 16 (2) (m) SSMR). - Based on section 36 KWG, BaFin can demand dismissal of executive board managers and supervisory board members or prohibit them from acting. Under section 45c KWG BaFin may appoint a special representative to replace management or supervisory board members. - Section 46 (1) sentence 3 and 4 KWG allows BaFin to ban or restrict disadvantageous payments to affiliated undertakings or set conditions for such payments if they adversely affect the institution’s financial situation. - Assessors saw evidence of ring-fencing action. ### Crisis management and resolution cooperation - The legal framework for crisis management and bank resolution for SIs was recently established under BRRD and SRMR and defines cooperation arrangements between the ECB and the SRB/NRAs during resolution. - If the ECB/SSM determines an institution is failing or likely to fail, it must notify relevant resolution authorities. Before the SRB makes such a determination it must first inform the ECB/SSM and allow the ECB 3 calendar days to make an assessment. - The ECB and SRB have signed a Memorandum of Understanding to ensure early and effective coordination and information sharing. - At the resolution stage the BRRD envisages tasks for the supervisor which the ECB will perform in accordance with the national transposition of the BRRD (SAG in Germany). For example, a bridge institution set up by the resolution authority may request a temporary exemption of authorization conditions; ECB/SSM would grant authorization and could become the competent authority for the bridge bank. - For LSIs, if problems cannot be solved by early intervention, the competent authority (BaFin together with Bundesbank) assesses whether the institution is failing or likely to fail and informs the resolution authority. FMSA may also make the assessment for LSIs not in SRB remit after January 1, 2016. Determination that an institution is failing or likely can be done by FMSA after hearing the supervisory authority or by the supervisory authority after hearing the FMSA. ### Additional criteria and communication - AC1: There are neither banking supervisory nor general administrative law regulations in Germany expressly stating that BaFin must take certain measures within a certain period. - AC2: There is no provision for the ECB to communicate with BaFin when taking formal corrective action against a bank that has non-bank related financial entities supervised by BaFin. However: - BaFin is an integrated supervisory authority for all regulated financial sector entities and sits at the Supervisory Board at the ECB, who approves all supervisory measures, so it will be informed. - BaFin has members in the JSTs responsible for liaison and communication of material issues. - The ECB is encouraged to develop protocols for communication with supervisors of non-bank entities to coordinate actions, since not all NCAs are integrated supervisors. ### Assessment and comments - Assessment re principle 11: Largely compliant - Comments: German law and SSMR provide a broad range of actions for supervisors in their respective responsibilities. Direct enforcement powers and sanctions of ECB are limited; however, the ECB can make use of enforcement and sanction powers available to BaFin. Assessors had evidence of such indirect actions where ECB instructed BaFin to apply local enforcement and sanctioning powers according to national legislation. - Assessors note the complex legal framework may make it operationally difficult and time consuming for the ECB to impose enforcement actions and sanctions in some countries, where some powers may not be available. *Source: IMF staff summary of Germany supervisory framework as provided in the supplied content.* ### conclusions regarding enforcement and sanctions. At the time of this mission, considering ### _cr16196 - conclusions regarding enforcement and sanctions. At the time of this mission, considering ### Enforcement and sanctions: findings - At the time of this mission, considering the recent establishment of the SSM, the ECB had not directly applied any sanction or enforcement action; therefore, assessors were not able to verify effectiveness in practice. - In Germany, actions by BaFin (on its own initiative or at the initiative of the ECB) can be appealed but such appeals do not have a suspension effect. - BaFin appears to have an adequate set of supervisory tools at its disposal, but assessors note that the actual use of these formal powers in practice is not intensive, suggesting a light touch in the enforcement area. - BaFin has traditionally, and by requirement of German Constitution, always used first the mildest of all comparable measures, so it often does not reach the stage where formal actions are taken, and few banks reach thresholds where mandatory action is warranted. - There are no laws or regulations that guard against BaFin or ECB unduly delaying appropriate corrective actions. - In response to recommendations in the last FSAP, BaFin has detailed “ladders” of action to provide clarity and consistency in progressive application of supervisory actions. ### Principle 12 — Consolidated supervision (overview and EC1) - Principle statement: Supervisor supervises the banking group on a consolidated basis, monitoring and, as appropriate, applying prudential standards to all aspects of the business conducted by the banking group worldwide. 33 - EC1 (Essential criteria 1): The supervisor understands the overall structure of the banking group and is familiar with all material activities (including non-banking activities) conducted by entities in the wider group, both domestic and cross-border; understands and assesses how group-wide risks are managed and takes action when group risks may jeopardize safety and soundness. ### Description and findings re EC1 — SREP and supervisory model - The ECB is the competent authority required to carry out a SREP and to take decisions for significant institutions. - Within a group, supervision is applied at consolidated, sub-consolidated and single-entity levels unless an entity has been waived from supervision on an individual basis in accordance with Articles 7, 8, 10 of the CRR. - In the case of a financial conglomerate, SREP decisions need to take into account the outcome of the supplementary supervision as required by FICOD. (SM Ch. 7 para 2.) - For consolidated supervision, in general: - Supervision at the consolidated level is carried out by the JST with a high degree of involvement of ECB staff. - Solo/sub-consolidated supervision of SSM parent companies, banking subsidiaries and significant branches follows the same supervisory model as consolidated supervision, but with a greater involvement of the local JST members. - For solo/sub-consolidated supervision of subsidiaries and branches established in non-participating Member States, the model based on supervisory colleges set out in CRD applies. - For solo/sub-consolidated supervision of subsidiaries and branches established in third countries (outside the EU), the model is based on MoUs, and if possible on colleges as set out in CRD. - If the parent entity is established in a non-euro Member State or third country, the JSTs conduct sub-consolidated/solo supervision on the entities established in the SSM participating Member-States. - For all significant institutions within the SSM, the JSTs conduct the SREP in accordance with the SSM methodology, and ensure compliance with the requirements of CRD IV and the CRR. - Interaction between consolidated and sub-consolidated/single-entity supervision is mainly relevant for large cross-border credit institutions; the SSM model is designed for those credit institutions but can apply to smaller cross-border groups. - Organization and coordination: - Matrix model: NCA staff remain employed in their own institutions, but for JST tasks a reporting line exists with the JST coordinator who can give instructions to all JST members for internal coordination. - Sub-coordinators can be used to manage JSTs and facilitate cooperation with NCAs. - JST coordinator refers to ECB delegated experts and NCA experts directly and can mandate sub-coordinator of the parent company for specific tasks. - Core JST reviews consolidated assessment, considers national analyses, and acts as first level mediator in conflicts between NCAs or between NCAs and ECB. - Experts on consolidated supervision include ECB supervisors, supervisors from the previously responsible authority for the parent company, and supervisors responsible for material subsidiaries; organized as one cross-border team to avoid competing teams and overlap. - For solo and sub-consolidated supervision the role of sub-coordinators is more prominent; teams prepare supervisory activities and can be supported by ECB staff working at national level. - Risks from entities included in consolidation but not supervised as credit institutions by the SSM (e.g., insurance supervisors or not supervised at all) are to be considered. - For financial conglomerates (FiCOD criteria), SREP should include potential impact of non-banking activities on the banking part of the group, including risk profile, profitability, capital and liquidity position, and assess situation at conglomerate level. - JSTs need to understand risks from non-banking activities (e.g., underwriting risk specific to insurance entities) and mechanisms through which these activities could affect the banking institution; assessment and issuance of requirements occur at end of process. - Where a mixed financial holding company is subject to equivalent provisions under CRD IV and under FICOD, there is the option to apply only the provisions of FICOD to the mixed financial holding company; decisions taken case-by-case. ### Mapping, supervisory intensity and material subsidiaries - Proper allocation of supervisory work between parent/group and local subsidiary/sub-consolidated level requires awareness of group structure, business model(s) and operational features. - Mapping the group’s perimeter includes at minimum: a) Degree of relevance of the subsidiary/sub-consolidated group: indicators include percentage of total assets, income contribution, contribution to the consolidated capital requirements, risks; qualitative factors (e.g., managing credit card business or custodian function). b) Degree of significance of the subsidiary/sub-consolidated group: importance in local market (market share of loans, deposits); qualitative factors (e.g., managing a “core” infrastructure in local payment system). c) Degree of centralization/decentralization of strategy, business, operations, risk governance and controls. d) Level of perceived risk: determines intensity of supervision; entities deemed particularly risky within cross-border groups can have potentially destabilizing effects, at least reputationally. - Mapping identifies two subsets: (i) material subsidiaries — significant and/or relevant and/or more autonomous and/or riskier, warranting supervisory intensity comparable to consolidated level; (ii) non-material subsidiaries — supervisory intensity may be lower. - Mapping is JST responsibility supported by DG MS IV and NCAs where needed; an annual review of the mapping is carried out by the JST coordinator, who requests updates from the NCAs. ### Business model viability assessment (consolidated level) - Objective: assess viability of current business model via quantitative analysis of several risk indicators at consolidated level and comparison to peers. - Inputs: consolidated annual accounts of at least the past three years, most recent monthly/quarterly management reports for the current year budget (including year-to-date realization), FINREP and COREP, data and indicators in IMAS, and SNL data. - Analyst focus: how key points develop over time and comparison to relevant peer group. - Forecast expectations: - A bank should provide detailed bottom-up forecasts of performance for the short-to-medium term (one to three years) and, at least, top-down forecasts for the longer term (two to five years). - Assumptions used by the bank to generate forecasts for key drivers should be identified and understood; usually found in the bank’s strategic assessment and planning documents and Board papers. - Distinguish between assumptions applied at the consolidated level and assumptions applied to business lines. ### Supervision of financial conglomerates and the “Five Cs” - Supplementary supervision (cross-sector) builds on sectorial supervision and addresses risks from group activities in other financial sectors; within the EU cooperation among sector supervisors is governed by the FICOD. - Supplementary supervision addresses the “Five Cs”: i. Capital adequacy at group level (i.e. avoidance of “double gearing” across the sectors); ii. Contagion (i.e. supervising intra-group transactions); iii. Concentration (i.e. supervising risk concentration across business lines); iv. Conflict of interest (i.e. the issues with respect to corporate governance); v. Complexity. ### Reporting and notification requirements (KWG and related provisions) - KWG contains reporting requirements to enable BaFin, Bundesbank and ECB to judge structure of institutions at group level; documentation must contain detailed information about significant holdings. - Section 2c KWG: persons wishing to acquire or increase a significant ownership in an institution must notify BaFin and Bundesbank. - Art. 4 (1) (1) CRR: BaFin may oppose an acquisition due to supervisory concerns. - In accordance with section 26 (3) KWG: institutions that produce consolidated annual accounts or a group management report must submit these documents to BaFin and Bundesbank without delay; applies to auditor’s reports prepared by an auditor of the group. - In accordance with section 24 KWG, German banking supervisors must be informed without delay of the following (selected items): 1. Ad-hoc notifications of changes in the structure of an institution's participating interests: - the acquisition or termination of a significant ownership in its own institution as well as the reaching, overshooting or undershooting of the thresholds for significant ownerships of 20 percent, 30 percent and 50 percent of voting rights or capital – passive participating interests (section 24 (1) no. 10 KWG); - the fact that the institution becomes or ceases to be the subsidiary of another enterprise (section 24 (1) no. 10 KWG); - the existence of, change in or termination of a close link to a natural person or an enterprise (section 24 (1) no. 12 KWG); - the acquisition and termination of significant ownerships in other enterprises, and changes in the amount of the significant ownerships (section 24 (1) no. 13 KWG); - the intention to merge with another institution (section 24 (2) KWG). - the establishment, relocation and closure of a branch in a non-EEA state and the commencement and termination of the provision of cross-border services without establishing a branch (section 24 (1) no. 6 KWG). *Source: _cr16196 - conclusions regarding enforcement and sanctions. At the time of this mission, considering* ### 2. Annual notifications according to section 24 (1a) KWG: ### _cr16196 - 2. Annual notifications according to section 24 (1a) KWG: ### Annual notifications and immediate reporting requirements (section 24 KWG) - Institutions must notify BaFin and Bundesbank annually the following items under section 24 (1a) KWG: - the institution’s close link to a natural person or an enterprise; - the institution’s significant ownerships in other enterprises; - the name and address of any holder of a significant ownership in the reporting institution and in the enterprises subordinated to it as described in section 10a KWG that are domiciled abroad, as well as the amounts of these significant ownerships; - the number of its domestic branches; - the modified balance sheet capital ratio based on the approved annual accounts; - the classification as a significant institution pursuant to section 17 of the Remuneration Ordinance for Institutions (Institutsvergütungsverordnung) of 16 December 2013 (Federal Law Gazette I page 4270) as well as a change in this classification; - if the institution is a CRR institution, the information required by the European Banking Authority to compare remuneration trends and practices within the meaning of Article 75 (1) CRD IV in conjunction with Article 450 (1) letters (g) and (h) CRR as last amended; - if the institution is a CRR institution, the information pertaining to senior managers and members of staff that earn total annual remuneration of at least €1 million within the meaning of Article 75 (1) CRD IV in conjunction with Article 450 (1) letter (i) CRR as last amended that the European Banking Authority requires for publishing aggregate information. - In addition, managers must report without delay (section 24 (3) sentence 1 no. 2 KWG): - the acquisition and termination of a direct participating interest in an enterprise, and - any changes in the amount of such a participating interest. - Financial holding companies must annually submit to BaFin and Bundesbank an aggregated report of subsidiaries, financial enterprises and ancillary services undertakings (section 24 (3a) sentence 2 KWG). BaFin shall transmit a list of these to the competent authorities in other EEA states and to the European Commission (section 24 (3a) sentence 3 KWG). Establishment of, changes to or discontinuation of such participating interests or corporate relationships must be reported without delay (section 24 (3a) sentence 4 KWG). ### Consolidated supervision and group-level regulatory requirements - Institutions face consolidated requirements covering: - solvency regulation; - large exposure regulation; - adequacy of risk management systems on a consolidated level; - outsourcing requirements; - additional consolidated reporting for systemically relevant institutions (e.g., earnings situation, solvency). - Part 1 Title II Chapter 2 section 3 CRR in conjunction with section 10a KWG defines scope of supervisory consolidation, differentiating: - groups of institutions; - financial holding groups; - mixed financial holding groups. - Parent undertakings are responsible for ascertaining necessary group-level information and ensuring KWG requirements are observed at group level. Failure can be sanctioned by deduction of the book value of the entity concerned from the parent’s own funds. - In addition to section 24 KWG general reporting, a parent company must submit an aggregated quarterly return (aggregated financial information) to Bundesbank (section 25 (2) sentence 1 KWG). ### BaFin requirements on group-wide risks, risk management and MaRisk - Section 25c (4b) no. 1 KWG: the management board of a parent undertaking shall ensure: - a group-wide business strategy geared to the group's sustainable development; and - a group-wide risk strategy consistent with that business strategy. - Minimum expectation: strategic orientation of undertakings belonging to the group must be aligned with group-wide business and risk strategies. - Section 25a (1) KWG requires appropriate risk management on solo and group level, further specified in MaRisk. - Section 4.5 MaRisk exclusively deals with group management aspects; other MaRisk sections touch the group dimension. - Basic principle: a parent undertaking must manage all its material risks regardless of where they arise or if the entity is a financial operation. ### Colleges of supervisors, supervisory process, and information sharing - BaFin, as an integrated supervisor, institutionalizes an annual conference of all relevant supervisors for a banking group/conglomerate to exchange prudential findings and plans across banking, insurance, securities market, anti-money laundering, and consumer protection. - Colleges of supervisors are used to share significant information on organizational structures, financial conditions and supervisory concerns. The process was demonstrated to the mission. - The supervisory assessment for a financial conglomerate with significant insurance, asset manager and building society components: - determines capital adequacy for the conglomerate; - estimates risk bearing capacity (RBC) and capital adequacy requirements (CAR) for each sector and overall for the conglomerate; - assigns risk ratings to each risk category for the consolidated entity and solo subsidiaries; - identified deficiencies in the reviewed conglomerate included market risk processing, internal controls and monitoring, and absence of a model to evaluate individual risk (only aggregate-level evaluation existed); - results are discussed at the college of supervisors and supervisory scope agreed-to. ### EC2 — Consolidated prudential standards, reporting and supervisory coverage - CRR/CRD prudential standards are imposed at consolidated, sub-consolidated and individual basis: - Definitions preserved from CRR: 'consolidated situation' and 'sub-consolidated basis' as stated. - CRR articles 11, 13, 14: parts 2 (Own Funds), 3 (Capital requirements), 4 (Large Exposures), 5 (Exposures to Transferred Risk), 6 (Liquidity), 7 (Leverage) and 8 (Disclosure) are to be complied with on consolidated basis. - CRR article 6: the same parts are to be complied with on individual basis, unless waivers under Article 7, 8 or 10 apply. - CRR articles and reporting requirements: - Reporting in Articles 99-100 (reporting on own funds on consolidated basis based on accounting standards), 394 (large exposures), 415-416 (liquidity), 430 (leverage) as specified by the EBA’s ITS on reporting (Commission Implementing Regulation (EU) No 680/2014) impose reporting on both solo and consolidated basis, unless a waiver under articles 7, 8 or 10 applies. - ECB Regulation (EU) 2015/534 of 17 March 2015 on reporting of supervisory financial information lays down requirements for reporting supervisory financial information to NCAs and the ECB (including balance sheet items and income/expenses such as impairment due to credit losses). - The supervisor collects and analyses consolidated information covering capital adequacy, liquidity, large exposures, exposures to related parties, lending limits and group structure. - The supervisor ‘maps’ several components using a model complemented by a centrally coordinated planning process defining supervisory priorities and involvement of JSTs, ECB staff and NCA assistance (referenced operational linkage to EC1). ### EC3 — Oversight of foreign operations and management adequacy - The supervisor reviews whether oversight of a bank’s foreign operations by parent/head office management (and holding company where relevant) is adequate given risk profile and systemic importance, and that no host-country hindrance prevents access to material information from foreign branches and subsidiaries. - Supervisor ensures banks’ policies require local management of cross-border operations to have necessary expertise and to comply with supervisory/regulatory requirements. - The home supervisor takes into account effectiveness of supervision in host countries where banks have material operations (BaFin takes this into account; see EC4). - As part of SREP, consolidated supervision and supervisory colleges, the SSM achieves an overall view of group cross-border activity management and presence of risk management deficiencies. - BaFin/Bundesbank regularly review appropriateness of institution’s and group’s risk management off-site or via on-site inspections (usually pursuant to section 44 KWG), including cross-border inspections. The BBk regularly visits London, New York. In case of inadequate risk management, BaFin has supervisory tools under section 45b KWG including measures to reduce risks, orders to reduce aggregate large exposure limit of a group or to limit business activities of an institution’s branch in a non-EEA state. ### EC4 — On-site visits to foreign offices, colleges, and cooperation frameworks - ECB legal basis for on-site inspections: Article 12 SSM Regulation and Title 5 of the SSM Framework Regulation; empowers ECB to conduct necessary on-site inspections where ECB is consolidating supervisor (Article 10(1) SSM Regulation; point (g) of Article 4(1) SSM Regulation). - Roles of ECB in supervisory colleges: - Home supervisor where ECB is consolidating supervisor and college includes supervisors from non-participating Member States or outside EU (European/international colleges). - Host supervisor where consolidating supervisor is from a non-participating Member State (or outside EU). - Where ECB is consolidating home supervisor, JST coordinator chairs the college. - Participation rules when consolidating supervisor is not in a participating Member State (article 10 SSM Framework Regulation): - a) supervised entities in participating Member States all SIs: ECB participates as member; NCAs entitled to participate as observers; - b) all less LSIs: NCAs participate as members; - c) mixed LSI and SI: ECB and NCAs participate as members; NCAs of participating Member States where the SIs are established are entitled to participate as observers; ultimate decision on NCA participation lies with competent authority chairing the college. - Bilateral cooperation between ECB/NCA and supervisory authorities outside SSM is used for cross-border group supervision, may be bank-specific, issue-specific, and can include exchange of information, on-site inspections, internal model approval, etc. - Section 8 (3) KWG: BaFin cooperates with other competent authorities within the EEA, including necessary exchange of information for supervisory purposes. Identification of group structure of major credit institutions is considered essential and shall be communicated on supervisor’s own initiative. Section 8e KWG: BaFin or the ECB (for SIs) establishes colleges of supervisors. - On-site inspections under section 44 (3) KWG focus on risk management aspects and accuracy of consolidation data pursuant to section 10a (4) to (7), section 25 (2) and (3) and Articles 11 to 17 CRR, insofar as necessary and permissible under other states’ laws. - The BBk regularly visits New York, London and Singapore and have scheduled visits for New York and London in 2016. Other jurisdictions are visited as warranted by risks analyzed during colleges. ### EC5 — Supervisory review of parent and affiliated company activities - The supervisor reviews main activities of parent companies and affiliated companies that materially impact safety and soundness of the bank and banking group and takes appropriate supervisory action. - SSM framework requires supervisors to review activities of companies affiliated with parent companies that may impact group safety and soundness only where those companies are classified as “institutions” (have investment firm or credit institution license); otherwise assessment may be done based on national law. - The ECB has authority and responsibility to understand and assess risks of cross-border entities and subsidiaries; for supervision of non-banking activities within a financial conglomerate refer to EC2. For cooperation and supervision of parent companies see CP8 EC5 and EC8. - German banking supervisors may require information or conduct audits under section 44 (1) KWG as part of ongoing supervision. *Source: _cr16196 - 2. Annual notifications according to section 24 (1a) KWG* ### section 44 (1) and (1a) KWG, section 44 (2) and (3) KWG also grants them the right to request ### section 44 (1) and (1a) KWG, section 44 (2) and (3) KWG also grants them the right to request ### Supervisory information and audit rights (solo and consolidated) - Section 44 (1) and (1a) KWG, section 44 (2) and (3) KWG grant the supervisor the right to request information from and perform audits on subsidiary enterprises within the meaning of Part 1 Title II Chapter 2 section 3 CRR in conjunction with section 10a KWG, both domestic and cross-border, as well as financial holding companies at the head of a financial holding group and mixed financial holding companies at the head of a mixed financial holding group and members of a governing body of such enterprises. - These regulations also apply to subsidiaries not included in consolidation, in particular to ascertain whether consolidation may be required. - As part of ongoing supervision, section 44 (1) sentence 1 KWG grants German banking supervisors the right to request information and conduct audits on solo level. ### Powers to limit activities, ring-fencing, and location constraints - Ring-fencing may be applied to the members of a mixed financial company and banking groups on an accounting consolidation sphere. Outward transactions may be limited also. KWG, section 46. - The supervisor may limit the range of activities the consolidated group may conduct and the locations in which activities can be conducted (including the closing of foreign offices) if it determines that: - a) the safety and soundness of the bank and banking group is compromised because the activities expose the bank or banking group to excessive risk and/or are not properly managed; - b) the supervision by other supervisors is not adequate relative to the risks the activities present; and/or - c) the exercise of effective supervision on a consolidated basis is hindered. - The ECB can restrict or limit the business, operations or network of institutions or request the divestment of activities that pose excessive risks to the soundness of an institution and require the reduction of the risk inherent in the activities, products and systems of institutions. - The ECB has the power to grant authorization to take up the business as credit institution (licensing); if the applicable national law allows, when issuing the decision the ECB can limit the range of activities that are conducted and the locations in which they can be conducted within the consolidated group and of individual institutions. - The ECB may withdraw an authorization on its own initiative (or on basis of a proposal from the NCA of the participating Member State where the credit institution is established) (SM Ch. 5 para 92). - BaFin/ECB will be informed if a German institution intends to take up business abroad and will object if this could encumber the supervision on a consolidated level. The same applies if a foreign investor intends to acquire a significant ownership in a German institution. ### Specific KWG provisions enabling remedial and restrictive measures - Section 25a (2) sentence 2 KWG gives BaFin the right to issue instructions to institutions which are suited and necessary to set up / restore a proper business organization. Such instructions could, theoretically, also refer to the termination of activities or business lines which are not properly managed. - If the supervision of representative offices and legally dependent branches by the institution itself is not adequate to the risks the respective office presents, BaFin/ECB may issue orders according to section 25a (2) sentence 2 KWG requiring the institution to implement adequate arrangements for managing, monitoring and controlling these risks or if this appears not possible to close the office. - Section 45b KWG allows BaFin to decree that the institution has to take risk reducing measures which could also include terminating or in-sourcing certain activities. - Section 45b KWG also allows implementing a prior supervisory approval requirement for the establishment of further branches or prohibiting or limiting the conduct of certain activities. - Section 12a (2) KWG authorizes BaFin/ECB to prohibit the continuation of the participating interest or of the corporate ties if the super-ordinated enterprise does not receive the information required to fulfill the obligations stipulated by sections 10a, 13 (3), 25 (1) KWG or legislative decrees according to sections 10 (1) sentence 1 KWG or 13 (1) sentence 1 KWG as well as obligations stipulated by articles 11 - 17 of CRR. - Section 45b (2) sentence 2 KWG empowers BaFin/ECB to limit the business activities of a branch domiciled in a third country or to decree its closure and resolution if the branch does not have a proper business organization, is not able to provide required information, is not properly supervised in the third country, or the competent authority of the third country is not willing to cooperate with BaFin/ECB. - If a credit institution or an investment firm domiciled in another EEA member state with a branch in Germany is not observing its obligations set out in section 53b (3) KWG, and neither the institution nor its competent home authority remedy the shortcoming or the measures are not sufficient, BaFin/ECB may take necessary measures, which can include prohibiting new business within Germany. - Where German institutions are subsidiaries of an institution in a third country without provisions for consolidated supervision equivalent to the rules applying in the EEA / set out in the KWG, BaFin/ECB can determine the German subsidiary as the parent institution for the purposes of consolidated supervision (section 53d (1) KWG). ### Supervisory approach: consolidated and individual (EC6 and EC7) - EC6: The supervisor limits activities and locations if safety, cross-border supervision adequacy, or effective consolidated supervision is compromised (see criteria a–c above). - EC7: In addition to supervising on a consolidated basis, the responsible supervisor supervises individual banks in the group on a stand-alone basis and understands their relationship with other members of the group. - Within the SREP, various assessments are performed at different frequencies, defined as a result of the SREP in the SEP (minimum engagement levels) and are scoped by the SEP for each individual institution. Supervision takes place on a bank-by-bank SEP basis. - Draft SEPs are formulated in detail by the JSTs for each significant institution. The macro-calendar of supervisory activities regarding on-going supervision, on-site inspections and internal model investigations is defined. The JST also takes into account information provided by competent authorities for other entities within the group, particularly where consolidated supervision is the responsibility of an EEA home supervisor. - All activities, except in exceptional cases, are undertaken to comply with the minimum engagement level defined in the strategic planning process by the Planning and Coordination of SEP Division. The SEP is discussed in the core JST. - According to the general principles stated in Part 1 Title II Chapter 1 of CRR institutions shall comply with the obligations laid down in Parts Two to Five and Eight of the CRR on an individual basis. The legal basis for the changes of the supervisory measures and sanctions is Art. 64 et seq. CRD IV. - CRD IV was transposed into German law by the CRD IV Transposition Act (CRD IV-Umsetzungsgesetz) which entered into force on January 1, 2014. *Source: IMF staff compilation from the referenced PDF chapter/section.* ### section 44 (1) sentence 2 to 4 KWG grants them the right to conduct on-site inspections on ### _cr16196 - section 44 (1) sentence 2 to 4 KWG grants them the right to conduct on-site inspections on ### On-site inspection and information rights - "section 44 (1) sentence 2 to 4 KWG grants them the right to conduct on-site inspections on solo level." - "The information and inspection rights according to section 44 (1) KWG also apply on group level." - "However, the powers are limited to monitoring the accuracy of the information or data transmitted that is necessary for supervision on a consolidated basis, or that is to be transmitted in the quarterly returns (please refer to the answer to Essential Criterion 5)." ### Additional criteria — AC1 (owners and senior management fit-and-proper) - For countries allowing corporate ownership of banks, the supervisor has the power to establish and enforce fit-and-proper standards for owners and senior management of parent companies. - "Significant ownership in banks by non-banks and corporates are permitted under the conditions set out by section 2c KWG." - "According to section 44b KWG, the holder of a significant ownership is subject to the same obligation to provide information and documents to the supervisor as the institution itself." - "Moreover, the KWG contains a number of indirect requirements for the owner of the institution or the holder of a significant ownership. If these persons or their statutory representatives fail to meet these requirements, BaFin/ECB can either deny the institution’s license in the first place, revoke it at a later stage or prohibit a later acquisition of a significant ownership." ### Assessment of Principle 12 - Assessment: "Compliant" - Comments: - "Supervisors have the authority to conduct consolidated supervision and this was displayed to the assessors during reviews and presentations of the supervisory process." - "All relevant issues are considered and information is available to draw conclusions on a consolidated basis and the legal framework permits collection of needed information." - "Examples of cases where ring-fencing was applied were demonstrated." ### Principle 13 — Home-host relationships (overview) - Principle summary: "Home and host supervisors of cross-border banking groups share information and cooperate for effective supervision of the group and group entities, and effective handling of crisis situations. Supervisors require the local operations of foreign banks to be conducted to the same standards as those required of domestic banks." ### Essential Criterion EC1 — Supervisory colleges and JSTs - Within the SSM, "the ECB is exclusively competent for carrying out the supervisory tasks of Article 4 Regulation 2013/1024/EU for SIs." - "Rather than establishing colleges of supervisors, the joint supervision of SIs is being exercised in JSTs." - "According to Article 3 SSM Framework Regulation, each JST is comprised of staff members from the ECB and from the NCAs including National Central Banks (NCBs) where the NCA is not a central bank but cooperates with the NCB in the supervision based on national law." - For subsidiaries of SIs located outside the SSM: "the ECB establishes colleges of supervisors ... BaFin and Bundesbank participate in the colleges as observers (Article 9(1) SSM Framework Regulation)." - "The supervisory college tasks are performed at least on an annual basis." - Membership and observer status: "based on a mapping exercise ... on the basis of Article 3 of EBA/RTS/2014/16." - College structures: "General College", "Core College", "Crisis Management Group and Cross Border Stability Groups", "Resolution Colleges (not yet in place)" and subgroups (e.g., Liquidity Subgroup). - "The establishment and the functioning of supervisory colleges are elaborated in written cooperation and coordination arrangements (WCCA)..." - "BaFin as NCA in cooperation with Bundesbank remains responsible for college-activities that concern LSIs." - "According to Article 8 (3) KWG, BaFin and Bundesbank shall cooperate with the relevant EEA authorities as well as the EBA and ESMA when supervising cross-border institutions." - "According to section 8e KWG, colleges of supervisors have been established." - Third-country provisions: "Article 53 c and d KWG, which establishes the principle of host supervision and gives BaFin the respective competencies." ### Essential Criterion EC2 — Information exchange (timeliness, scope, confidentiality) - See CP 3 and EC 1. - Commission Delegated Regulation (EU) 2016/98 and Commission Implementing Regulation (EU) 2016/99 specify required information to share, including: - "information on capital requirements for credit, market, operational and settlement risks and on additional own fund requirements (i.e. Pillar 2 add-ons) for all other risks and elements of risk;" - "information on institutions’ violations of requirements on internal control mechanism, including risk management, risk control and internal audit." - "Commission Delegated Regulation (EU) 2016/98 sets the information exchange for performing group risk assessments and reaching joint decisions, including on the assessment of inherent individual risks and risk management and controls (art. 10). It also requires that the information exchanged be adequate, accurate and timely." - "EBA Guidelines on common procedures and methodologies for SREP require competent authorities to discuss and coordinate - within the framework of supervisory colleges – the outcomes of their assessments, including SREP scores ..." - "Article 48 of CRD IV entitles the European Commission to draft proposal ... for the negotiation of agreements with one or more third (i.e. non-EU) countries regarding the means of exercising supervision on a consolidated basis, in particular to ensure adequate exchange of information." ### Essential Criterion EC3 — Coordination of supervisory activities - See CP 3 and EC 1. - "Commission Delegated Regulation (EU) 2016/98 and Commission Implementing Regulation (EU) 2019/99 contain provisions on information exchange and coordination between the consolidating supervisor and college members for a number of tasks," including: - "performing group risk assessments and reaching joint decisions;" - "ongoing review of the permission to use internal approaches and non-material extensions or changes in internal models;" - "early warning signs, potential risks and vulnerabilities;" - "non-compliance and sanctions;" - "assessment of the group recovery plan;" - "group financial support agreements." ### Essential Criterion EC4 — Communication strategy - See CP 3. - "Commission Implementing Regulation (EU) 2016/99 establishes a number of requirements in terms of communication between the college members and with the supervised entities," including: - "written coordination and cooperation arrangements include a description of the communication policy of the consolidating supervisor and the members of the college with the EU parent undertaking and with the group entities;" - "the communication with the institution and its branches shall be organized according to the supervisory responsibilities of the consolidating competent authority and the members of the college (art. 28); in general, the consolidating supervisor shall be responsible for communicating, including requesting information, to the EU parent undertaking, while the members of the college shall be responsible for communicating, including requesting information, with the EU institutions and EU branches under their supervisory remit;" - "the members of supervisory colleges ensure that any external communication is done in a coordinated way and covers elements which are agreed ex ante." - "Commission Delegated Regulation (EU) 2016/98 also regulates the coordination of external communication in an emergency situation (art. 22, 37)." - "BaFin and Bundesbank have agreed with many other foreign supervising authorities on information sharing and exchange in bilateral and multilateral memoranda of understanding according to the Core Principles of Effective Banking Supervision of the Basel Committee." ### Essential Criterion EC5 — Cross-border crisis cooperation and coordination - "KWG) and SAG provide a comprehensive framework for cross-border crisis cooperation and coordination, as required by the relevant European directives, CRD IV and the Bank Recovery and Resolution Directive (Directive 2014/59/EU, BRRD." - "Pursuant to sections 6, 7 and 9 KWG and 138 SAG, BaFin is both empowered and required to share information on crisis preparation and to effectively cooperate with other relevant authorities including the European Banking Authority (EBA)." - "According to section 138 (2) SAG BaFin has to inform the resolution authority in case of imposing crisis preparation or early intervention measures immediately." - "If the supervisory authority or resolution authority concludes that an institution or an entity of a group is failing or likely to fail, they have to inform BaFin, Bundesbank and FMSA, the relevant deposit guarantee scheme, the group-level supervisory authority (including the consolidating supervisor), the group-level resolution authorities (including the resolution authority of Member States where the consolidating supervisory authority is located), the Financial Stability Committee and the European Systemic Risk Board immediately." - "The SAG provides for colleges, in which the home and host supervisors of cross-border banking groups share information of crisis preparation, especially effective handling of crisis situations. For this the SAG envisages the establishment of resolution colleges (section 156 SAG)." - "The specific procedures for the planning and coordination of supervisory activities in preparation for and during emergency situations ... are laid out in written coordination and cooperation arrangements (WCCA) for each supervisory college." ### Essential Criterion EC6 — Group resolution planning and cooperation - "The KWG and SAG provide a comprehensive framework for cross-border crisis cooperation and coordination, as required by the relevant European directives, CRD IV and the BRRD." - "Pursuant to sections 6, 7 and 9 KWG and 138 SAG, BaFin is both empowered and required to share information on crisis preparation and to effectively cooperate with other relevant authorities including the EBA." - "According to section 138 (2) SAG BaFin has to inform the resolution authority in case of imposing crisis preparation or early intervention measures immediately." - "If the supervisory authority concludes that an institution or an entity of a group is failing or likely to fail, they have to inform BaFin, Bundesbank and FMSA, the relevant deposit guarantee scheme, the group-level supervisory authority (including the consolidating supervisor), the group-level resolution authorities (including the resolution authority of Member States where the consolidating supervisory authority is located), the FSC and the European Systemic Risk Board immediately. In all cases confidentiality must be ensured." - "The SAG provides for colleges, in which the home and host supervisors of cross-border banking groups share information of crisis preparation, especially effective handling of crisis situations. For this the SAG envisages the establishment of supervisory colleges (section 8e KWG combined with section 2 paragraph 3 No. 8 SAG) and of resolution colleges (section 156 SAG)." - Members "shall endeavor to reach a joint decision on e.g., the review and assessment of the group recovery plan, the application of measures referred to in section 16 SAG (Section 17 and 18 SAG) or coordinate early intervention measures and the appointment of a temporary administrator in relation to groups (section 39 SAG)." - Group-level resolution authorities tasks include: - "exchanging information relevant for the development of group resolution plans, for the application to groups preparatory and preventive powers and for group resolution;" - "developing group resolution plans pursuant to section 46 and 47 SAG;" - "assessing the resolvability of groups pursuant to section 58 SAG;" - "exercising powers to address or remove impediments to the resolvability of groups pursuant to section 60 SAG;" - "deciding on the need to establish a group resolution scheme as referred to in section 161 to 165 or 166 SAG; reaching the agreement on a group resolution scheme proposed in accordance with" *Source: https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2016/_cr16196.pdf* ### section 161 to 165 or 166 SAG; coordinating public communication of group resolution ### section 161 to 165 or 166 SAG; coordinating public communication of group resolution ### Resolution Colleges and Cross-Border Group Resolution - Resolution colleges may be used for coordinating public communication of group resolution strategies and schemes; coordinating the use of financing arrangements; setting the minimum requirements for groups at consolidated level under section 49 to 54 SAG. - Resolution colleges may be used as a forum to discuss any issues relating to cross-border group resolution. - Members of the resolution college (according to section 157 SAG) include: - the resolution authority; - the group-level resolution authority; - the resolution authorities of each Member State in which a subsidiary covered by consolidated supervision is established; - the resolution authorities of Member States where a parent undertaking of one or more institutions of the group is established; - the resolution authorities of Member States in which significant branches are located; - the Bundesbank; - the ECB (if it is the competent consolidating supervisor); - the competent authority; - the competent authorities of the Member States where the resolution authority is a member of the resolution college (where the competent authority of a Member State is not the Member State ́s central bank, the competent authority may decide to be accompanied by a representative from the Member State ́s central bank); - the MoF; - the competent ministries (where the resolution authorities which are members of the resolution college are not the competent ministries); - the authority that is responsible for the deposit guarantee scheme and the authority that is responsible for the deposit guarantee scheme of a Member State, where the resolution authority of that Member State is a member of a resolution college. ### Transposition of BRRD, SSM and SRM Implementation - The transposition of the EU Bank Recovery and Resolution Directive (BRRD) into German law has significantly strengthened the existing resolution regime in Germany. - Institutional arrangements have undergone fundamental change with the implementation of the SSM and Single Resolution Mechanism (SRM). - The SRB has assumed responsibility to ensure effective resolution of ECB-supervised banks along with several other German banks with cross-border operations in other EU jurisdictions effective January 1, 2016. - The SRB is supported by Internal Resolution Teams in which FMSA, the national resolution authority, will play an important role. - While the SSM is establishing a track record, the SRM is still in a start-up phase. ### Recovery and Resolution Planning Progress - German authorities are making significant progress in recovery and resolution planning. - Requirement timeline and coverage: - Requirement for large domestic banks to have recovery plans adopted in 2013. - Recovery plans implementation is expanding to additional banks, including potentially systemic institutions (PSI) supervised by the domestic authorities, and to small banks by 2017. - Resolution planning and resolvability assessments are being implemented in all PSIs. ### Cooperation with Non-EU Countries and Scope of Resolution Framework - The resolution framework constrains the participation of third country authorities in Resolution Colleges, as well as their access to confidential information. - In practice, German authorities have developed a good track record of coordination with countries outside of the EU. - Recommendation: the authorities should continue efforts to foster cooperation with non-EU countries, despite gaps in the European framework. - The resolution framework currently requires the resolution authority to take into account the effects of a resolution decision in other EU Member States, but not the effects in third countries. - It is understood that cooperation in Resolution Colleges and Crisis Management Groups (CMGs) will also address effects in third countries. ### EC7 — Host Supervisor Requirements for Cross-Border Operations - EC7 statement: The host supervisor’s national laws or regulations require that the cross-border operations of foreign banks are subject to prudential, inspection and regulatory reporting requirements similar to those for domestic banks. - Description and findings re EC7: - Licensing and supervision of branches is accomplished by the SSM if the branch is significant. - Applications to establish branches are filed with BaFin. - Section 53b KWG (implementing article 40 (1) of CRD IV) applies the principle of home state supervision to branches in Germany of institutions based in member states of the EEA. - Even as host competent authorities, BaFin and Bundesbank have competencies in compliance with CRD IV, including liquidity provisions, reporting requirements, rights of access to data, suitable arrangements for managing, monitoring and controlling risks. - Section 53 (1) sentence 1 KWG determines that branches of foreign credit institutions with domicile in states outside the EEA are subject to the supervision of the host country (Germany). ### EC8 — Home Supervisor On-Site Access - EC8 statement: The home supervisor is given on-site access to local offices and subsidiaries of a banking group in order to facilitate their assessment of the group’s safety and soundness and compliance with customer due diligence requirements. The home supervisor informs host supervisors of intended visits to local offices and subsidiaries of banking groups. - Description and findings re EC8: - Home supervisory authorities are regularly granted access to inspect branches and subsidiaries of foreign institutions in Germany on the basis of KWG Section 44a (2) to the extent that the requesting jurisdiction grants reciprocal inspection possibilities and the inspection is discussed with BaFin/ the ECB SSM in advance. - Section 53b (6) KWG expressly grants foreign supervisory authorities in the EEA states an audit opportunity after prior notification of BaFin/ the ECB SSM. - Section 44a (2) KWG allows BaFin/ the ECB SSM to permit banking supervisory authorities from other EEA-states – and if reciprocity is granted also non-EEA states – to check the accuracy of data transmitted by a German enterprise to certain enterprises abroad, when necessary to comply with prudential provisions on the enterprise domiciled abroad, as provided in the Banking Directive. ### EC9 — Supervision of Booking Offices and Shell Banks - EC9 statement: The host supervisor supervises booking offices in a manner consistent with internationally agreed standards. The supervisor does not permit shell banks or the continued operation of shell banks. - Description and findings re EC9: - Art. 13 of CRD IV requires competent authorities grant a banking license only where at least two persons effectively direct the business of the applicant; and every bank has its head office in the same Member State as its registered office or in the Member State where it is licensed and it actually carries out its business. - Branches of third countries are supervised by BaFin and are required to maintain capital. - There are no shell banks or booking offices in Germany. ### EC10 — Consultation before Consequential Action - EC10 statement: A supervisor that takes consequential action on the basis of information received from another supervisor consults with that supervisor, to the extent possible, before taking such action. - Description and findings re EC10: - BaFin notifies the respective competent authorities of any measures it intends to take against breaches of an institution based on information provided by the competent authorities, to the extent possible (section 8 (8) KWG). - Examples were provided of action taken based on information from the home country supervisor. ### Assessment of Principle 13 - Assessment: Compliant - Comment: Member states are fully incorporated in the supervisory process. Third countries are provided the same arrangements through the MOU process if they meet the equivalency test for EU protection of confidential information. ### Principle 14 — Corporate Governance (Overview) - Principle 14 requires supervisors to determine that banks and banking groups have robust corporate governance policies and processes commensurate with the risk profile and systemic importance of the bank. - Key governance elements include strategic direction, group and organizational structure, control environment, responsibilities of Boards and senior management, and compensation. ### EC1 — Responsibilities of Board and Senior Management; Guidance - EC1 statement: Laws, regulations or the supervisor establish the responsibilities of a bank’s Board and senior management with respect to corporate governance to ensure there is effective control over the bank’s entire business. The supervisor provides guidance to banks and banking groups on expectations for sound corporate governance. - Description and findings re EC1: - Germany has a two-tier Board structure: Supervisory Board (oversight) and Management Board (executive). For assessment, “Board” refers to the Supervisory Board and “senior management” to the Management Board. - Legal framework: HGB and the Stock Corporation Act govern structure of enterprises and credit institutions. - Corporate governance summary: - Incorporated enterprises have a dual board structure with a management board and a supervisory board (two tier system). - The management board is the executive organ, responsible for day-to-day business. - The supervisory board supervises the management board and is appointed by a shareholder decision-making body. - KWG requirements: - An institution shall have a proper business organization ensuring compliance with legal provisions and business requirements. - The management board is responsible for ensuring the institution’s proper business organization and formulating internal guidelines except where such decisions are taken by the supervisory board. - Proper business organization comprises, in particular: 1. the definition of strategies, including a business strategy geared to sustainable development and a risk strategy consistent therewith, and establishment of processes for planning, implementing, assessing and adjusting strategies; 2. processes for determining and safeguarding internal capital adequacy, based on a conservative determination of risks and available financial resources to cover them; 3. the establishment of internal control mechanisms consisting of an internal control system and an internal audit function, where the internal control system shall comprise, in particular: (a) rules on organizational and operational structure including clear delineation of competencies, (b) processes for identifying, assessing, managing as well as monitoring and reporting risks in accordance with the criteria laid down in Title VII, Chapter 2 Section II Sub-Section 2 of CRD IV, and (c) a risk control function and a compliance function. - MaRisk (issued by BaFin) provides guidance on supervisory expectations for sound corporate governance; it is a proportionate framework expanding on section 25a KWG. - Responsibilities arising from section 25a KWG lie with the management board (AT 3 MaRisk). - Section 25c and AT 1 MaRisk: risk management creates a basis for the supervisory board’s monitoring function and shall include adequate supervisory board involvement. - Section 25c: management board responsibility for business strategy, internal control system, governance and business strategy on a solo and group-wide basis. - Management board required to inform the supervisory board of the risk situation at least quarterly. - Internal audit function reports to management board and supervisory board at appropriate intervals and at least once per quarter; MaRisk AT 4.4.3: internal audit is an instrument of the management board, directly subordinated and reporting to it or to a single member of the management board. - Section 25d (6) KWG: the supervisory board shall oversee the management board, including adherence to applicable prudential supervisory requirements (sections 25a and 25c KWG). - BCP standards emphasize a proactive supervisory board oversight role given lessons from bank failures. - Observed shortcomings: - While Germany has well-developed corporate governance requirements, the supervisory board’s oversight role is passive and its operational oversight role is limited. - The fit-and-proper process is streamlined for supervisory board members and technical knowledge requirements are limited. - Operationally, oversight focuses more on the management board with less frequent substantive interaction with the supervisory board. ### EC2 — Supervisor Assessment of Corporate Governance Policies - EC2 statement: The supervisor regularly assesses a bank’s corporate governance policies and practices, and their implementation, and determines that the bank has robust corporate governance policies and processes commensurate with its risk profile and systemic importance. The supervisor requires banks and banking groups to correct deficiencies in a timely manner. - Description and findings re EC2: - For SIs, governance is assessed continuously as part of SREP. - Corporate Governance and risk management is one of four SSM SREP modules, including: 1. internal governance; 2. risk framework and risk culture; 3. risk infrastructure, data and reporting. - Governance is one of four priorities of the SSM strategy and is subject to a thematic review of all SIs, focusing on boards’ functioning and effectiveness and the risk appetite framework. - JSTs have been building a database of corporate governance practices via surveys. - For LSIs, BaFin and Bundesbank regularly monitor compliance with MaRisk; Bundesbank conducts off-site monitoring through institution-specific information requests and on-site inspections reviewing MaRisk compliance. - BaFin may send representatives to supervisory board meetings (Section 44 (4), (5) KWG) typically in observer status. - BaFin may request all relevant information and conduct local inspections according to section 44 (1) KWG and assesses compliance with section 25a KWG and MaRisk. - External auditors must determine whether institutions fulfilled section 25a KWG and MaRisk in their annual report (section 29 (1) sentence 2 No. 2.a) KWG). - Supervisory documentation shows communications with banks requiring corrective action and the use of capital add-ons based on SREP reviews. ### EC3 — Board Nomination, Composition and Committees - EC3 statement: The supervisor determines that governance structures and processes for nominating and appointing Board members are appropriate for the bank and across the banking group. Board membership includes experienced non-executive members, where appropriate. Board structures include audit, risk oversight and remuneration committees with experienced non-executive members, commensurate with risk profile and systemic importance. - Description and findings re EC3: - (The source content ends at the beginning of the EC3 description and findings; no further text on EC3 is available in the provided content.) *Excerpt from: _cr16196 - section 161 to 165 or 166 SAG; coordinating public communication of group resolution* ### Section 25d (11) KWG specifies in detail the tasks which shall be performed by the ### _cr16196 - Section 25d (11) KWG specifies in detail the tasks which shall be performed by the ### Nomination committee duties and fit-and-proper framework (EC6 / related) - Section 25d (11) KWG specifies in detail the tasks to be performed by the nomination committee of an institution’s supervisory board (or the supervisory board as a whole if no nomination committee has been established). - Key nomination committee responsibilities (Section 25d (11) sentence 2 No. 1 KWG): - Support the supervisory board in identifying candidates to fill management board vacancies. - Prepare proposals for the selection of members of the supervisory board. - Take into account the balance and diversity of the knowledge, skills and experience of all members of the board in question. - Prepare a job description with a candidate profile. - State the time commitment associated with the task. - Committees and staffing requirements: - Significant CRR-institutions shall, depending on size, internal organization and the nature, scope, complexity and riskiness of their activities, establish committees which advise and support the supervisory board (Section 25d (7) sentence 1 KWG). - Committees should include: risk, audit, remuneration and nomination (proportional to bank complexity). - Members of committees shall have the necessary knowledge, skills and experience to perform the respective committee functions (Section 25d (7) sentence 3 KWG). - Risk committee required (Section 25d (8) KWG) and audit committee required (Section 25d (9) KWG); these may be combined if appropriate (Section 25d (10) KWG). - Nomination committee (Section 25d (11) KWG) and remuneration committee (Section 25d (12) KWG) required when institution is considered significant; if not CRDIV significant, supervisory board as a whole should fulfil the function. ### Suitability / fit-and-proper assessments (EC4) - ECB responsibility: - The ECB carries out the assessment of the suitability (‘fit-and-proper’) of members of management bodies of significant credit institutions, having regard to Articles 4(1)(e) and 16(2)(m) of the SSM Regulation and Article 93 of the SSM Framework Regulation. - In SSM internal procedures, suitability is addressed every time there is an appointment of a new board member and in the assessment of Internal Governance in the SREP (Organizational structure and governance). - Suitability definition and elements: - Concept of suitability is defined in Section 25c KWG for management board members and Section 25d KWG for supervisory board members. - Covers professional qualification, reliability, availability of sufficient time, and limitations of mandates. - Members of the supervisory board (Section 25d (1) KWG) must possess an adequate degree of expertise to exercise control and assess/monitor transactions; required expertise depends on scope and complexity of business activities. - Observations and harmonization: - Process for determining suitability for supervisory board members is streamlined compared with management board members (expertise standard may be met by attending a banking seminar). - With establishment of the SSM the assessment procedure of fitness and propriety of Supervisory Board members of SIs has been harmonized. - BaFin issued the Guidance Notice for Assessing the Professional Qualifications and Reliability of Managers in Accordance with the Banking Supervision Act. - External auditors must review compliance with MaRisk requirements on corporate governance; results may lead to further follow-up by regulators. ### Board responsibilities for strategy, risk appetite, culture and oversight (EC5) - Allocation of responsibilities: - In Germany, most responsibilities in EC5 are assigned to the management board rather than the supervisory board. - Section 25c (3) no. 1 KWG: management board inter alia responsible for bank’s strategic direction, risk appetite and strategy, and related policies to ensure a proper business organization. - Section 25a KWG defines proper business organization; MaRisk specifies details. - Section 25c (4a) KWG: management board shall ensure institution has a business strategy geared to sustainable development and a risk strategy consistent therewith, and processes for planning, implementing, assessing and adjusting strategies (pursuant to section 25a (1) sentence 3 number 1 KWG). - Supervisory and audit activity: - Role of supervisory board is general oversight of the management board. - External auditors required by BaFin to review and certify bank compliance with MaRisk and the law. - Bundesbank conducts on-site inspections and off-site reviews for compliance. - Thematic review focus and findings: - SSM thematic reviews of Risk Governance and Risk Appetite addressed: risk appetite when discussing strategic decisions; detailed policies on conflicts of interest; internal processes for communicating conflict of interest policies to staff; discussion between supervisors and board on relationship between risk appetite statement and business strategy; review frequency of board risk appetite compliance; whether board/senior management have clear views on higher-risk business lines; whether board/management determine employee morale. - Reviews highlighted deficiencies in corporate governance concerning qualifications and involvement of the supervisory board in oversight of management and made recommendations to strengthen internal audit reporting to supervisory board. - Bundesbank on-site inspections place significant emphasis on risk management and governance concerning the management board. ### Compensation governance and limits (EC7) - Board oversight expectations: - ECB seeks to determine that the bank’s Board actively oversees the design and operation of the remuneration system. - Compensation system and incentive structure should promote good performance, convey acceptable risk-taking behavior and reinforce the bank’s operating and risk culture. - Board responsible for overall oversight of compensation system for entire bank and must regularly monitor and review (at least annually) outcomes. - Significant banks should have a supervisory board level remuneration committee that can exercise competent and independent judgment on compensation policies/practices. - Quantitative limits and supervisory powers: - Section 25a (5) KWG: institutions shall set appropriate ratios between variable and fixed annual remuneration components for (all) employees and management board members. - The variable remuneration component shall not exceed 100 percent of the fixed remuneration component for each individual employee or management board member. - Shareholders/proprietors/members may approve a higher variable remuneration component; this higher component shall not exceed 200 percent of the fixed remuneration component for each individual employee or management board member. - In case of violation of capital requirements, BaFin can, according to section 45 (1) sentence 1 no. 5a KWG, order an institution to limit the total annual amount designated for variable remuneration to a certain proportion of the profit for the year or to completely cancel it; this does not apply to variable components established in a collective wage agreement or within its scope of application. ### Organizational structure, transparency and records (EC8) - Supervisory review of structure and risks: - SSM and Bundesbank/BaFin ensure that banks maintain detailed records on organizational structure; these are discussed with the management board. - Information shared with assessors included data systems and the ability to massage the data and drill down to determine affiliates. - Assessment scope: - SSM internal procedures include “Organizational structure” within the Internal Governance and Risk Management Assessment. - Nomination and appointment processes analysis includes criteria for selecting members and existence of succession plan. - Assessment focuses on composition and functionality of Board and management body and evaluation of Board Committees, particularly Audit, Risk and Remuneration Committees, and other committees if established (e.g., Nomination/human resources/governance/Ethics/Compliance). - Analysis aims to understand how each Committee operates, develops its charter to perform its mandate and reports to the Board; contained in scope of the thematic review of 2015. ### Supervisor powers to require board composition changes (EC9) - Legal powers: - If facts indicate members of management board or supervisory board no longer meet applicable suitability requirements, BaFin can demand their dismissal and prohibit them from further carrying out their positions (Section 36 (1) in conjunction with section 35 (2) No. 3 and section 33 (1) No. 2, 4 et seqq. KWG). ### Staffing qualifications and MaRisk expectations - Staffing standards: - Credit institutions required to have a sound business organization, including suitable staffing levels (Section 25a (1), sentences 1 and 3 No. 4 KWG; Section 25c (4a) No. 4 KWG). - MaRisk AT 7.1, (2): "Staff members and their deputies shall possess the expertise and experience needed for their tasks, competencies and responsibilities. Appropriate measures shall be taken to ensure that staff is suitably qualified." - Oversight and review: - BaFin/Bundesbank conduct on-site reviews as appropriate. - External auditors must review compliance with MaRisk requirements on corporate governance; results may lead to further supervisory follow-up. *Source: _cr16196 (PDF excerpt).* ### section 36 (3) No. 1-3 and 6-10 KWG, section 2d (2) No. 1 KWG). ### _cr16196 - section 36 (3) No. 1-3 and 6-10 KWG, section 2d (2) No. 1 KWG). ### Removal and supervisory enforcement powers - BaFin may demand dismissal or prohibit further duties of management board members who have intentionally or recklessly contravened supervisory law or BaFin orders and persist despite due warning (section 36 (2) KWG, section 2d (2) No. 2 KWG). - BaFin may demand dismissal or prohibit further duties of supervisory board members where they were unaware of serious violations due to careless oversight or failed to counter detected infringements and persist despite due warning (Section 36 (3) No. 4 KWG). - In most cases BaFin sends an informal letter of disapproval to the credit institution before formal measures to work toward corrective measures; an example was provided where BaFin required supervisory board changes. - The ECB has power to remove members of the management boards of SIs who do not fulfill legislative requirements. ### AC1 — Notification requirements (management/supervisory board fitness and propriety) - Laws, regulations or the supervisor require banks to notify the supervisor as soon as they become aware of any material and bona fide information that may negatively affect the fitness and propriety of a bank’s Board member or a member of the senior management. - Specific reportable information includes: - (qualifying) participating interests: section 24 (1) No. 10, 13, (1a) No. 2, 3, (3) sentence 1 No. 2 KWG - close links with natural persons or other undertakings: section 24 (1) No. 12, (1a) No. 1 KWG - loans to shareholders owning more than 25 percent of capital or voting rights not on market terms or not adequately secured: section 24 (1) No. 17a, (1b) No. 1 KWG - activities of members of management board: section 24 (3) sentence 1 No. 1 KWG - members of the supervisory board as members of another undertaking: section 24 (2a) KWG ### Assessment of Principle 14 — Corporate governance, Boards and fit-and-proper - Assessment: Largely Compliant - Key findings: - Germany has a two-tier Board structure: Supervisory Board (oversight) and Management Board (executive); for assessment, “Board” = Supervisory Board; “senior management” = Management Board. - KWG, Commercial Code and Stock Corporation Act provide framework for corporate governance. - Post-2007 crisis lessons: supervisory boards had been passive and too reliant on management; core principles revised with increased emphasis on corporate governance. - Currently supervisory boards are generally weak and passive; most policy and risk management duties rest with the management board. - Evolution: supervisors have increased focus on supervisory boards; a thematic review on corporate governance was conducted; MaRisk is being amended to include code of conduct requirements. - Internal audit reports operationally to the management board; not required to report directly to the supervisory board. - Supervisory interactions are mainly with the management board; reporting to supervisory boards is limited in practice. - Fit-and-proper and technical knowledge requirements for supervisory board members are light. - Recommended actions to strengthen supervisory board role: - Supervisory guidance should state that ultimate responsibility for establishing risk culture, developing business plans and risk appetite statement rests with the supervisory board. - Supervisory enforcement and sanctioning programs should explicitly address supervisory board member liability. - Knowledge/experience requirements for supervisory board members should be commensurate with bank complexity. - Reporting to the board should be frequent and sufficiently detailed to enable board challenge of management. - Banking supervisors should increase dialogue and discussions with the supervisory board on supervisory results and concerns. ### Principle 15 — Risk management process (overview) - Principle summary: Supervisor determines banks have comprehensive risk management processes (including effective Board and senior management oversight) to identify, measure, evaluate, monitor, report and control or mitigate all material risks timely, and to assess adequacy of capital and liquidity relative to risk profile and macro conditions; includes contingency arrangements and recovery plans; proportionate to risk profile and systemic importance. ### EC1 — Risk management strategies and Board involvement - KWG section 25a (1) sentence 3 requires banks to establish appropriate and effective risk management to continuously safeguard internal capital adequacy; risk management shall comprise: - definition of strategies (business strategy geared to sustainable development and consistent risk strategy) and processes for planning, implementing, assessing and adjusting strategies; - processes for determining and safeguarding internal capital adequacy based on conservative risk determination and available financial resources; - establishment of internal control mechanisms: internal control system, risk control function, compliance function, and internal audit; - adequate staffing and technical and organizational resources; - definition of an adequate contingency plan, especially for IT systems; - suitable and transparent remuneration systems for management board members and employees geared to sustainable development. - MaRisk (current version dated 2012; revision out for comment) specifies holistic approach and modular structure (AT module; BTO, BTR modules; BT 2 for internal audit). - Philosophy of proportionality emphasized: risk management proportional to nature, scale, complexity. - SREP and EBA guidelines provide supervisory review instructions; SREP emphasizes involvement of the managing body (Board) and senior management but in German application directs primary responsibility to the Management Board rather than the Supervisory Board (see CP14). - JST practice: - Assess appropriateness of Management Board-approved risk management strategies and Management Board-set risk appetite. - Supervisory Board able to obtain reporting, but accepted practice places primary responsibility with Management Board; Supervisory Board role more passive contrary to EC spirit. ### EC2 — Bank-wide comprehensive risk management policies and processes - MaRisk adopts holistic approach; AT 2.2 no. 1 MaRisk requires regular/ad-hoc risk inventory (overall risk profile). - Material risks required at minimum: counterparty and credit risk (including country risk), market risk (including interest rate risk), operational risk, liquidity risk. - Risk concentrations (intra-risk and inter-risk) must be assessed (annotations to AT 2.2 no. 1 MaRisk). - SIs required to have comprehensive risk management framework; JSTs assess internal governance, risk committee involvement, RAF adequacy and implementation, and whether RAF provides bank-wide view across material risks. ### EC3 — Documentation, review, communication, and exception handling - Supervisors assess documentation via risk appetite statement and evidence of ongoing monitoring and changes. - Effective RAF should be allocated to business lines/divisions/subsidiaries with quantitative metrics. - JSTs assess mechanisms ensuring RAF, risk strategy and business strategy alignment and regular review per risk. - Exceptions to policies must be identifiable, well recorded and resolved; substantial limit exceeds subject to risk reporting (BTR 1 no. 7; BTR 2.1 no. 5 MaRisk). - For LSIs: organizational guidelines, manuals, work instructions required in writing and communicated (AT 5 MaRisk); management board to review appropriateness/effectiveness regularly per section 25a (1) sentence 5 KWG. ### EC4 — Board and senior management information and understanding - Relevant CRD articles: 74, 76, 97, 98, 99; Article 97 requires NCAs to review arrangements, strategies, processes and mechanisms and determine if own funds and liquidity ensure sound management and coverage of risks. - EBA guidelines (SREP and GL44) describe expectations for managing body and senior management reporting; guidelines do not explicitly require Board or senior management to regularly review implications and limitations of risk management information. - Supervisory expectation: Board and senior management obtain sufficient information on nature and level of risk, relation to capital and liquidity, and understand measurement uncertainties. ### EC5 — Internal processes for capital and liquidity adequacy (ICAAP/ILAAP) - SREP guidelines provide structured ICAAP assessment; economic capital models used by many banks. - Historically ICAAP assessment used as input into risk assessment; process completed in 2015 for SIs; for LSIs alignment with new EBA guidelines starting in 2016. - ICAAP established in Germany since 2008/09; included in on-site exams and annual Management Board meetings. - Typical ICAAP review components: risk strategy, risk appetite, risk organization, measurement methodologies, Pillar 1 and Pillar 2 risk assessment; stress testing integral; LSIs obliged to run scenarios including reverse stress tests. - ILAAP assesses liquidity/funding under normal and stressed conditions; ECB is competent authority to carry out SREP per CRD. - MaRisk AT 4.1 requires ICAAP; ICAAP to be conservative and ensure going-concern continuation and protection of creditors; institutions choose methods, supervisors assess assumptions and robustness (model validation). - Supervisors published guidelines on assessing bank-internal capital adequacy concepts (January 2013). ICAAP supplemented by capital planning over several years; at least quarterly overall risk reports to management board. - Liquidity: MaRisk requires liquidity risk appetite, stress tests, liquidity overview, sustainable liquidity reserves, contingency plan, and frequent reporting (BTR 3.1; BTR 3.2 for capital market oriented institutions). ### EC6 — Models: supervisory standards, Board understanding, validation - CRD Article 78 requires institutions using internal approaches to report calculation results and methodologies to NCAs at least annually. - EBA RTS on assessment criteria sets expectations for model development, analysis, validation, and independent validation by independent bodies within the bank; managing body must be aware of assumptions and inputs. - EBA RTS on materiality of extensions/changes to internal approaches aims to harmonize assessments across NCAs. ### EC7 — Information systems and risk data aggregation - SSM internal procedures based on EBA guidelines (GL44); GL44 expectations for effective and reliable information and communication systems (paragraph 30). - SREP guideline paragraphs 106 & 107 require supervisors to assess institutions’ ability to generate accurate, aggregate, timely risk data and meet on-demand requests by management body or NCA. ### EC8 — New products and major initiatives - MaRisk AT8.1 requires institutions to understand business activities and decide strategic plan before new products. - LSIs: supervisors discuss new products frequently and at least annually in annual meeting with Management Board. - SIs: JSTs meet management and heads of business to understand strategies and new products; business model analysis in SREP assesses risks from new products. Assessors saw evidence of prudent approval processes. ### EC9 — Risk management function independence, resources, reporting and audit - SSM internal procedures based on EBA GL44; SREP guideline paragraph 88 and 104 assess effective interaction between management and supervisory functions and independent risk control function with capacity to report directly to management body. - Risk management function expected to be resourced, independent, with authority and access to Board; subject to regular internal audit review. ### EC10 — CRO role and removal notification - Not met: MaRisk 4.4.1 paragraph 5 requires only ex-post notification to the supervisory Board if the CRO is removed. The EC expects prior approval by the Board, disclosure and discussion with supervisor on removal; current MaRisk minimum is ex-post notification only. ### EC11 — Standards for major risk types - MaRisk sets comprehensive standards for credit risk (BTO 1), market risk (BTR2.2), operational risk (BTR4), IRRBB (BTR 2.3), liquidity (LiqV); anchored in KWG section 25(a). ### EC12 — Contingency arrangements and recovery planning - MaRisk AT7.3 requires contingency plans for time critical activities and processes and back-up solutions. - On-site examinations by BBk and BaFin routinely assess contingency plans, including dedicated IT risk on-site examinations. - Recovery planning: - German legislation expanded recovery plan obligations to include all banks and elaborated powers and procedures; requirements align with EBA standards. - Recovery plans must be submitted to BaFin and Bundesbank and, where appropriate, the ECB; FMSA reviews in resolution context. - All potentially SIs must prepare full scope plans (22 banks/groups supervised by the ECB and 12 supervised by BaFin/Bundesbank); by early 2016 most had submitted revised or initial plans; plans submitted early each year, feedback by mid-year, banks have 6 months to revise and resubmit. - Private banks with assets < € 30 billion may submit simplified plans; supervisors can require more rigorous requirements; savings and cooperative banks generally covered by IPS plans. - JST reviews recovery plans using ECB standard template; BaFin/Bundesbank staff actively involved; feedback letters prepared by BaFin staff and finalized by ECB JST coordinator; JST transmits assessments to supervisory college where applicable; SRB and FMSA also review for resolvability implications. ### EC13 — Stress testing programmes - MaRisk AT 4.3.3 requires regular and ad-hoc stress tests covering all material risks, reflecting nature, scale, complexity; cover risk concentrations, diversification effects, off-balance-sheet entities, hypothetical and historical scenarios, exceptional but plausible events, reverse stress tests, and capital adequacy impacts. - JST uses stress-tests for macro perspective; SIs develop own stress-testing programs per EBA guidelines 2014/13 and 2010/32 and demonstrate use in risk management and ILAAP/ICAAP. - SREP methodology: ICAAP reliability assessed in Element 3 block 2; supervisor challenges internal capital stressed estimates in block 3; similar approach for liquidity. JST assesses governance, documentation, regularity, board reporting, integration of results into risk management and assumptions review. Assessors reviewed examples. - LSIs: stress test results reviewed and actions derived (e.g., capital backing, closer monitoring); stress test results considered in ICAAP and annual Management Board meeting. Larger banks have invested resources into IRRBB stress testing. ### EC14 — Internal pricing, performance measurement and new product approval - EBA SREP guideline paragraph 72 requires supervisors to include qualitative and quantitative factors in business model analysis, including risks associated with internal pricing, performance measurement and new product approval. JSTs assess these elements during business model reviews. ### Additional Criteria (AC1) — Other material risks - MaRisk AT 4.2 requires due regard to all material risks; ICAAP typically includes Pillar 1 and Pillar 2 risks such as strategic, reputation, conduct risk. - SREP guidelines include assessing sustainability of strategy and key vulnerabilities: poor expected financial performance; reliance on unrealistic strategy; excessive concentrations or volatility; excessive risk-taking; funding structure concerns; significant external structures. ### Assessment of Principle 15 - Assessment: Largely compliant - Summary comments: - Risk management standards anchored in MaRisk require banks to regard all material risks calibrated against risk-bearing capacity. MaRisk revised repeatedly, most recently January 2016 to incorporate risk culture and risk data aggregation. - Largest and more complex banks often use enterprise-wide risk management and economic capital models commensurate with risk profile. - Supervisory practice well developed: on-site examinations by BBk and BaFin; MaRisk Inspection Guide for LSIs; external auditors and annual EA long form report required. - ICAAP integral to supervisory framework; banks submit ICAAP at least annually; ICAAP and ILAAP guidelines recently released by ECB (no published minimum standards to date). - SREP implementation evolving toward quantitative approaches and Pillar 2 capital add-ons; new SREP methodology used for SIs in 2015. - Key shortcomings: - Supervisory Board involvement insufficient; supervisory board role largely passive contrary to CP requirements (see CP14). - CRO reporting and independence weaknesses: risk reporting flows through Management Board/CEO; risk function lacks separate direct reporting line to Supervisory Board; MaRisk prescribes only ex-post notification of CRO removal, weakening CRO independence and ability to raise issues despite whistle-blowing processes. ### Principle 16 — Capital adequacy (introduction) - Principle summary: Supervisor sets prudent and appropriate capital adequacy requirements reflecting bank risks and macro/market context; defines capital components emphasizing loss-absorbing capacity; at least Basel standards for internationally active banks. - EC1 (start): - CRR establishes requirements to calculate prescribed capital requirements (Part Three, Art. 92-386 CRR), including thresholds by reference to which a bank might be subject to supervisory action and which banks must satisfy at all times (Article 92(1) CRR). *Source: IMF staff report text as provided in the content unit.* ### Part II of CRR defines the components of capital following Basel capital tier structure, which ### Part II of CRR defines the components of capital following Basel capital tier structure, which ### Scope, legal framework, and supervisory responsibilities - Part II of CRR defines the components of capital following Basel capital tier structure and the deduction requirements. - Supplementary delegated regulations: Delegated Regulations (EU) No. 241/2014, 2015/850 and 2015/923 (including RTS on own funds Parts 1 to 4), and delegated acts of the EU Commission. - Art. 54 CRR provides for write down or conversion of Additional Tier1 instruments when the CET1 ratio of a bank falls below 5.125 percent; these are directly applicable by ECB, BaFin and Bundesbank to supervised banks. - CRD IV gives Member States discretion on macroprudential buffers and measures; each Member State designates a designated authority (may be the competent banking supervisor — in Germany BaFin is both). - For SSM members, the ECB is empowered to apply higher requirements for capital buffers or more stringent macroprudential measures (Art. 5(2) SSMR). - Transposition in Germany: - CRD IV transposed via amendments to the KWG and through the Solvency Regulation (Solvabilitätsverordnung; SolvV). - KWG introduced a ‘capital conservation buffer’ (section 10c)) and related capital conservation measures (section 10i) restricting distribution of dividends, payments of variable remuneration, payments on Additional Tier 1 instruments whenever such payments would result in breach of the combined buffer requirement. - BRRD (EU Directive 2014/59/EU) requirements on write-down or conversion at point of non-viability (PONV) transposed into national law by Section 89 SAG. - Competent authority powers: - Powers of the ECB as competent authority for SIs are laid down in Chapter III of SSMR (Articles 9 to 18). - BaFin exercises supervisory powers with regard to LSIs and institutions within the meaning of the KWG, using the full “toolbox” provided by KWG (e.g., Section 45 KWG addresses actual and impending breaches of capital and liquidity requirements). - Ongoing monitoring: compliance with adequacy of own funds is monitored via institutions' quarterly returns submitted to BaFin and Bundesbank; annual account auditors must assess appropriateness of institutions’ calculations regarding adequacy of own funds (sections 18 to 21 PrüfbV). ### Definition, transitional provisions, and national discretions - Eligible components of own funds and deductions defined in Articles 26 et seq. CRR. - Basel Committee RCAP (2014) assessed EU implementation of Basel III as Materially Non-Compliant overall; specifically Largely Compliant for definition of capital. - National discretions under Art. 467 para 2 CRR: - BaFin allows institutions not to include unrealized gains or losses on exposures to central governments in any element of own funds until the Commission has adopted a regulation endorsing the IFRS replacing IAS 39. - Deferred tax assets (DTAs) that rely on future profitability and existed prior to 1 January 2014: - BaFin chose the extended transitional period until the end of 2023 as provided for in Art. 468 para 2 CRR. - Transitional provisions implemented in sections 23 to 31 SolvV. - Germany opted to phase out deduction of goodwill in the transition period. - Art. 89 para 3 CRR and transitional provisions Art. 481 pp. CRR provide other national discretions; example: - BaFin applies a 1250 percent risk weight in accordance with Art. 89 para 3 point a) CRR for qualifying holdings. ### Minimum capital requirements and buffers (explicit thresholds) - CRR-established minimum capital requirements thresholds: - Common Equity Tier 1 (CET1) capital: 4.5 percent - Tier 1 capital (including additional Tier 1): 6 percent - Total capital (including Tier 2 capital): 8 percent - Capital conservation buffer by CET1 capital: 2.5 percent - Other buffers (such as the G-SIB buffer and capital conservation buffer) are required to be covered by CET1 capital. ### Alignment with Basel standards and specific deviations - RCAP 2014 conclusions for EU implementation (summarized findings relevant to EC2 and EC1): - Materially Non-Compliant overall. - Compliant: scope of application, transitional arrangements, capital buffers, internal models approach for market risk, operational risk, supervisory review process, disclosure requirements. - Largely Compliant: definition of capital, standardized approach for credit risk, securitization framework, standardized approach for market risk. - Materially Non-Compliant: IRB approach for credit risk. - Non-Compliant: counterparty credit risk framework. - For Germany: - Sovereign exposures under permanent and temporary partial use under CRR represent a relevant part of on- and off-balance sheet exposures and may overstate CET1 ratios. - EU counterparty credit risk framework deviations could lead to materially higher reported capital ratios for some banks. - Some deviations are being addressed via banks’ internal capital adequacy assessments and supervisory action (SREP), but assessors could not determine full practical remediation. ### Supervisory powers to set capital add-ons and address uncovered risks (EC3) - Articles 97-98 CRD: where risks are not covered by CRR or buffer requirements, ECB and BaFin must consider institution’s individual risk profile (via SREP or internal model reviews) and can establish capital requirements in excess of CRR and buffer requirements. - Article 104 (1)(a) and (2) CRD IV empowers competent authorities to require institutions to hold own funds in excess of Chapter 4 Title VII (Capital Buffers) requirements and for risks not covered by Article 1 CRR; transposed by Section 10 para 3 KWG. - Section 10 para 3 KWG: - Sentence 1: general discretionary power. - Sentence 2: non-discretionary list of cases obligating a capital add-on (e.g., risks not covered by minimum capital requirements of CRR; insufficient risk bearing capacity; likely underestimation of risks despite compliance; lack of sound business organization). - Sentence 1 is subsidiary to sentence 2. - Securitization transactions: - ECB and BaFin decide case-by-case when possible reduction in risk-weighted exposure amounts is not justified by commensurate transfer of credit risk. - German law permits a capital add-on per section 10 para 3 sentence 2, 7 KWG; assessors noted access to cases where banks were required to demonstrate at least 50 percent risk transfer had occurred. ### Risk sensitivity, systemic importance, leverage, and macroprudential tools (EC4) - CRR sets maximum requirements at the Basel minima, generally leaving no room for diverging national requirements except at individual bank level via Pillar 2 (EC3). - BaFin may increase requirements only under strict conditions of Article 458 CRR in conjunction with Section 48t KWG for macroprudential or systemic risks identified nationally. - CRD IV foresees five capital buffers (national transposition in Sections 10c et seq. KWG): - capital conservation buffer - counter-cyclical buffer - systemic risk buffer - G-SRI-buffer - O-SRI-buffer - Buffer characteristics: - Targets systemic relevance, point in economic cycle, or overall systemic risks rather than particular institution risk. - Not fixed minimums; meant to be used in downturns and rebuilt later. - Breaches of combined buffer requirements restrict distributions on CET1-capital instruments rather than trigger severe supervisory measures. - Article 124 (2) CRR: competent authority may set higher risk weights for exposures secured by immovable properties if loss experience or forward-looking market developments justify. - Article 164 (5) CRR: competent authority may set higher minimum values of exposure-weighted average LGD for immovable property exposures. - Leverage: - Article 98(6) CRD requires supervisors to consider risk of excessive leverage in SREP. - Art. 4(1)94 CRR defines excessive leverage; leverage consideration based on indicators such as leverage ratio per Article 429. - Leverage is considered in SSM SREP methodology for overall SREP score and resulting supervisory measures. - For LSIs, section 6b paragraph 2 number 13 KWG requires BaFin to consider excessive leverage; section 25a (1) (3) (b) KWG expects institutions to manage leverage. - Assessment of leverage had not been routinely incorporated into supervision; the new SREP process in development will consider excessive leverage more systematically. - Preferential treatments in European framework (e.g., covered bonds and mortgages) create importance of close leverage monitoring. ### Internal models approval and controls (EC5) - EU framework approves internal assessments (IRB, IMA, AMA, IMM) subject to qualifying standards analogous to Basel, with exceptions identified in RCAP. - For ECB-supervised entities, ECB approves internal models under Article 9(1) SSMR, basing decisions on EBA and other Guidelines (examples listed in source). - For LSIs, SolvV contains additional provisions on IRB application, approval examination (section 7 SolvV), implementation planning, monitoring, and suitability examinations of rating systems prior to regulatory capital use. - IRB roll-out timeline under SolvV: - Roll-out period set to 5 years (section 8 (1) SolvV). - Supervisory reference point: institution must achieve supervisory reference point pursuant to section 10 (2) SolvV within two and a half years of reaching the entry threshold (at least 50 percent coverage). - Full implementation of IRB pursuant to section 10 (3) SolvV within five years. - Permanent fulfillment of all relevant thresholds pursuant to section 9 (3) SolvV once achieved. - Coverage thresholds referenced: - supervisory reference point: At least 80 percent of exposures (before and after risk weighting) must be covered by internal ratings. - entry threshold: At least 50 percent of exposures (before and after risk weighting) must be covered by internal ratings. - full implementation target: At least 92 percent of exposures (before and after risk weighting) must be covered by internal ratings. - Approval and assessment process: - BaFin reviews implementation plans, monitors roll-out, and assesses rating systems during on-site examinations per section 44 (1) sentence 2 KWG. - For institutions supervised by ECB, internal model investigations typically performed on-site with four phases: preparatory pre-application, assessment phase (on-site), draft decision, final decision. - Draft assessment reports reviewed at BaFin/Bundesbank level and at ECB Internal Model division level; ECB has a practical guide to internal model investigations. - Cessation or revocation: - Cessation of use of individual internal models for regulatory capital determination requires prior approval by ECB or BaFin (Articles 149, 225(1), 259(5), 283(5), 313 CRR). - Revocation of general approval to use internal models is subject to Article 101 (4) CRD IV requirements as implemented by national law. *Source: IMF staff report excerpt on Germany’s implementation of CRR/CRD IV and related supervisory practices.* ### section 4 (5) SolvV. Any material change to an approved internal model needs prior ### _cr16196 - section 4 (5) SolvV. Any material change to an approved internal model needs prior ### Model changes, reversion, and permissions - Any material change to an approved internal model requires prior permission by the competent authority, according to: - CRR Article 143(3) (IRB) - CRR Article 312 for AMA for operational risk - CRR Article 363(3) for IMA for market risk. - Conditions for assessing a model modification as a material change are laid out in Commission Delegated Regulation (EU) No 529/2014 of 12 March 2014 (IRB and AMA) as amended by Commission Delegated Regulation (EU) 2015/942 of 4 March 2015 (IMA). - Ceasing use of an internal model and reverting to a standardized approach (reversion to a less sophisticated approach) requires permission by the ECB or BaFin according to: - CRR Article 149 (IRB approaches) - CRR Article 283(5) (IMM method) - CRR Article 313 (AMA). - For IMA, a reversion to a standardized approach is considered a material change according to Commission Delegated Regulation (EU) 2015/942, Annex III, Part I, Section 1. - Permission to use an Advanced-CVA model is linked to the permission for using an IMA for specific interest rate risk and the IMM approach according to CRR Article 383(1). - For the IMM method and Advanced-CVA models there are no provisions in CRR concerning material changes; SSM guidelines for assessing the materiality of model changes are in preparation. - Both BaFin and ECB have included follow-up examinations and ongoing monitoring of the models' compliance with the requirements after approval. ### Non-compliance, notification, and supervisory powers - For cases of non-compliance with the requirements for using internal models for calculating regulatory capital requirements, ECBs can apply its powers under Article 16 SSMR. - When an institution ceases to comply with the requirements, it has to notify BaFin. - According to section 4 SolvV (which transposes Article 101 (4) CRD IV into national law) BaFin requires a plan for the timely return to compliance with relevant requirements unless the institution can demonstrate that the effects of non-compliance are immaterial. - If BaFin considers it unlikely that a presented plan will result in full compliance or if the proposed time period for correction is inappropriate, the permission to use the IRB Approach is to be revoked or to be limited to compliant areas or those areas where compliance can be achieved within an appropriate time period. - With regard to significant institutions the ECB can apply section 4 SolvV directly in conjunction with Article 4 (3) SSMR. ### Use of advanced approaches at time of assessment - All German banks using advanced approaches at the time of this assessment had been authorized before SSM came into force: - 11 banks for market risk - 50 for the IRB Approach (8 only for their retail exposures, 23 for F-IRB, and 19 A-IRB) - 14 banks for AMA - 3 for IMM. ### Supervisor powers on forward-looking capital management and stress testing (EC6) - The supervisor has the power to require banks to adopt a forward-looking approach to capital management (including the conduct of appropriate stress testing). The supervisor can require banks: - (a) to set capital levels and manage available capital in anticipation of possible events or changes in market conditions that could have an adverse effect; and - (b) to have in place feasible contingency arrangements to maintain or strengthen capital positions in times of stress, as appropriate in the light of the risk profile and systemic importance of the bank. - Relevant CRR provisions require approved-model banks to have stress testing processes: - Art. 177 CRR: IRB banks must have sound stress testing processes for assessment of capital adequacy; identify possible events or future changes in economic conditions that could have unfavorable effects on a bank’s credit exposures. - Art. 290 CRR: Banks with approved IMM for counterparty credit risk must have a comprehensive stress testing program, including for assessment of capital requirements for counterparty credit risk. - Art. 368 CRR: Banks with approved IMA for market risk must frequently conduct a rigorous program of stress testing, addressing a number of possible shocks. - Under Article 16(2)(a) SSMR, the ECB can require institutions to hold own funds in excess of Pillar 1 requirements as set out in CRR; these requirements are defined at least once a year in the context of the SREP. - The SSM SREP methodology adopts a forward-looking view by anticipating adverse effects of possible events and changes in market conditions; Element 3-Block 3 of the SSM SREP methodology assesses the adequacy of institutions’ capital under stressed assumptions and is key in determining capital imposed in excess of Pillar 1 requirements. - National requirements under MaRisk and KWG: - AT 4.3.3 MaRisk: German banks must conduct stress tests regarding their main (material) risk factors on a regular and ad-hoc basis, reflecting the nature, scale, complexity and riskiness of the institution’s business activities; must cover assumed risk concentrations and diversification effects within and between risk types; include off-balance-sheet entities and securitization transactions; represent historical and hypothetical scenarios; account for changes in strategic orientation and economic environment. - Shortcomings in organizational set-up may lead to application of a capital add-on (section 10 (3) sentence 2 no. 10 KWG). - Results of stress tests are taken into account when assessing internal capital adequacy; banks are required to implement a process for future capital planning (AT 4.3.3 No. 5 MaRisk, and AT 4.1 MaRisk). - Section 10 (3) sentence 2 number 1 KWG: BaFin may set higher minimum capital requirements to consider risks not completely covered by Pillar I. - Section 6b KWG: BaFin can require institutions to carry out supervisory stress tests; results are to be taken into account in the SREP. ### Scope of CRD IV/CRR application and capital distribution (AC1, AC2) - CRD IV and CRR apply to all credit institutions and investment firms in the European Union, irrespective of size or intensity of international activity. - In Germany, section 1a KWG applies CRR requirements mutatis mutandis to other institutions that are not CRR-credit institutions (such as leasing companies); exceptions (Section 2 para 8a, para 9, para 9a, para 9b and para 9c KWG) reflect proportionality and adjust regulatory requirements to business models and risk situations of these entities. - CRD IV and CRR are applied both on a stand-alone and consolidated basis, with few exceptions (Art. 6 and 7 CRR) subject to conditions aimed at ensuring adequate distribution of capital between parent and subsidiaries. - The competent authority may waive capital adequacy requirements on an individual basis for the parent institution and/or for the subsidiaries in the country (Articles 7(1) and 7(3) CRR) provided there is no material practical or legal impediment to the prompt transfer of own funds or repayment of liabilities. In the case of Germany, Article 7 CRR is complemented by national provisions. *Source: _cr16196 - section 4 (5) SolvV. Any material change to an approved internal model needs prior* ### Section 2a KWG which sets out further details regarding the application process if an ### _cr16196 - Section 2a KWG which sets out further details regarding the application process if an ### Capital waivers, Section 2a KWG and supervisory framework - Section 2a KWG sets out further details regarding the application process if an institution wants to use a capital waiver. - Section 2a paragraph 5 KWG contains a grandfathering clause for capital waivers used by institutions prior to the entering into force of CRR. - Section 2a paragraph 6 KWG establishes that the conditions for the waiver must be met continuously and competent authority may revoke waiver authorization when not met. - The ECB supervision is developing criteria for waiver authorization to be applicable to all SSM institutions. ### Assessment of Principle 16 — Largely compliant - The whole of Part II and III (Art. 25-386) of CRR and Title VI, Chapter 4 (Art. 128-142) of CRD IV implement the Basel capital standards in the EU. - The CRR and CRD are complemented by EBA Regulatory Technical Standards (RTS) on Own Funds. - The Basel Committee RCAP assessment (Regulatory Consistency Assessment Programme) - Assessment of Basel III regulations – European Union, December 2014 found the implementation in the EU: - Materially Non-Compliant overall. - Compliant: scope of application, transitional arrangements, capital buffers, internal models approach for market risk, operational risk, supervisory review process and disclosure requirements. - Largely Compliant: definition of capital, standardized approach for credit risk, securitization framework, standardized approach for market risk. - Materially Non-Compliant: IRB approach for credit risk. - Non-Compliant: counterparty credit risk framework. - Specific German context: - Deviations regarding the definition of capital do not seem to be material for German banks in general, although some may be for specific banks (deduction of participation in insurance, for instance). - BaFin allows institutions not to include in any element of own funds unrealized gains or losses on exposures to central governments, a national discretion that will be used until a European regulation endorsing IAS 39 is issued. - For DTAs that rely on future profitability and that existed prior to 1 January 2014, BaFin chose the extended transitional period until the end of 2023. - A few elements for which the RCAP found deviations may be significant for Germany: sovereign exposures under the permanent and temporary partial use, lower risk weights for covered bonds, and in particular the counterparty credit risk framework. - Assessors observed some cases where deficiencies were being addressed by banks’ internal capital adequacy assessments and supervisory action, but assessors do not feel comfortable that existing framework is not in general resulting in overstated CET1 ratios. - National authorities and supervisory practice: - National authorities can impose overall capital requirements above the Basel minima by resorting to the systemic risk buffer or, in the case of the macroprudential authority, to macroprudential measures subject to notification obligation plus strict conditions. Germany has not availed itself of these instruments. - Both ECB and BaFin can require banks to hold capital in excess of the minima under Pillar 2; the practice is not commonly used by German authorities, which in general prefer to address these through direct discussion with the banks on the adequacy of ICAAP. - ECB as a supervisor has only concluded one SREP cycle, in which some banks were required to implement Pillar 2 add-ons. - Leverage: - Leverage is specifically taken into account in the SSM SREP methodology. - For BaFin’s supervised institutions, leverage can be considered (assessors reviewed a file where leverage was discussed with the bank in the context of ongoing supervision) but it is not yet a routine part of the supervisory assessment. - Given preferential treatments in risk weights (e.g., for covered bonds and mortgages) not compatible with the Basel framework, close monitoring of bank leverage is crucial. - Capital adequacy monitoring must be closely monitored at individual level given the waivers granted under article 7 of CRR. ### Principle 17 — Credit risk: overarching finding and scope - Principle 17: The supervisor determines that banks have an adequate credit risk management process that takes into account their risk appetite, risk profile and market and macroeconomic conditions. This includes prudent policies and processes to identify, measure, evaluate, monitor, report and control or mitigate credit risk (including counterparty credit risk) on a timely basis. The full credit lifecycle is covered including credit underwriting, credit evaluation, and the ongoing management of the bank’s loan and investment portfolios. - Note: Principle 17 covers evaluation of assets; Principle 18 covers management of problem assets. - Credit risk scope: on-balance sheet and off-balance sheet exposures, including loans and advances, investments, inter-bank lending, derivative transactions, securities financing transactions and trading activities. - Counterparty credit risk includes credit risk exposures arising from OTC derivative and other financial instruments. ### Essential Criterion 1 (EC1) — legal basis and supervisory verification - Legal basis: section 25a (1) KWG regulates risk management (including credit risk). - BaFin issued MaRisk (Minimum Requirements on Risk Management) outlining expectations on credit risk management. - MaRisk AT 2.2 item 1: management board shall, regularly and on an ad hoc basis, review the risks faced by the institution. - MaRisk AT 4.2: institution must establish an appropriate and effective risk management function and a sustainable business strategy addressing objectives and measures for each material business activity; define a risk strategy consistent with business plans; consider external factors (market developments, competition, regulation) and internal factors (risk bearing capacity, liquidity, profitability, resources). - Supervisory verification: - Verify clarity and mutual consistency of credit risk strategy and appetite as expressed by the management body. - Verify senior management implements and monitors consistency of bank activities with established strategy. - Verify the credit risk strategy is appropriate with respect to the bank’s role in the financial system and the adequacy of its own funds and takes into account cyclical aspects of the economy. - Methods of determination: on-site reviews, off-site analysis, external audit reports and thematic reviews. - Evidence of supervisory practice: - Review of Bundesbank (BBk) inspection reports and external audit reports show detailed review of policies, procedures and internal controls concerning credit risk. - External auditors must certify compliance with MaRisk and address it in annual reports. - For SIs, the SSM has identified credit risk as a key objective and initiated a thematic review of NPL treatment and a questionnaire process to determine best practices; outcomes may form basis for issuing guidelines on NPL provisioning. - BBk on-site inspections review bank risk bearing capacity and use stress testing and ICAAP results. ### Essential Criterion 2 (EC2) — Board approval and senior management implementation - EBA guidelines on SREP require supervisors to verify that the management body approves policies for managing, measuring and controlling credit risk and discusses and reviews them regularly, in line with risk strategies. - KWG requirements: - All transactions containing credit or counterparty risk must be addressed. - Management Board required to conduct regular and ad hoc reviews of the risk inventory (AT 2.2 MaRisk). - BTR 2 MaRisk: policies and processes used for risk measurement must be regularly reviewed. - AT 4.3.3 MaRisk: stress test assumptions and methods should be assessed at least on an annual basis. - Supervisory verification methods: review of board minutes, on-site inspections and reports from external audits to gauge the role of the management board in oversight. ### Essential Criterion 3 (EC3) — operational arrangements and supervisory coverage - MaRisk and SREP form the supervisory framework for SI and LSIs. - MaRisk provisions: - Structural and operational arrangements for the lending business in AT 4.3.2 item 1 and 2, BTO 1 and BTR 1 MaRisk. - BTO 1 MaRisk: requirements can be applied proportionally depending on size, business focus and risk situation. - Supervisory review on a regular—at least annual—basis of segregation of duties, lending business processes, compliance with regulatory requirements and credit risk profile/strategies. - Aggregate supervisory approach: - Laws, MaRisk and SREP provide broad and comprehensive framework on credit risk management; confirmed and reviewed via on-site and off-site supervision and supplemented by external audit reports. - SSM focuses on SREP for SIs; LSIs reviewed by BBk and external auditors based on MaRisk and increasingly SREP. - External auditors must follow MaRisk and verify compliance in annual report. - Specific supervisory review objectives: - Verify policies and procedures are sound and consistent with credit risk strategy, covering credit granting processes and criteria for borrower creditworthiness review; clear lines of responsibility for taking on, measuring, monitoring, managing and reporting credit risk. - Note: there is no recommendation for supervisors to verify the existence of well-defined criteria and policies and processes to identify the appropriate approval authority for the size and complexity of the exposures. - Verify policies and procedures cover criteria for assessing borrowers’ creditworthiness and collateral evaluation and for loan classification; assess detection, measurement and regular monitoring of credit risk for all on- and off-balance-sheet activities (collateral coverage, contractual terms, covenants); assess level and quality of credit risk mitigation; assess whether institution has appropriate skills, systems and methodologies to measure risk at borrower/transaction and portfolio level and to differentiate borrower/transaction risk levels. - Art. 82 of CRD IV requires supervisors to ensure risks arising from securitization are evaluated and addressed through appropriate policies and procedures. - Verify data, information systems and analytical techniques enable institutions to fulfill supervisory reporting requirements and detect, measure and monitor credit risk; confirm regular reporting of credit risk exposures including stress testing outcomes to management body, senior management and relevant credit risk managers. - Verify policies and procedures cover credit limits appropriate to the nature and complexity of the institution and are formalized, communicated and applied consistently. - Verify internal controls and practices ensure breaches and exceptions to policies, procedures and limits are reported in a timely manner to appropriate management for action. ### Essential Criterion 4 (EC4) — monitoring total indebtedness and unhedged FX risk - Banks are required to aggregate borrower credits to determine compliance with regulatory limits and thus must monitor total indebtedness within the institution. - Private credit reporting companies help banks determine whether borrowers have other credit outstanding and performance problems. - MaRisk: transactions be aggregated towards borrower-related limits immediately; compliance with limits must be monitored (BTR 1 item 5 MaRisk). - Regulatory rules: - Rules for large exposures and for granting loans exceeding EUR 750,000 (or more than 10 percent of the own funds (section 18 KWG)) imply that an institution has to monitor total indebtedness to comply at any time. - Use of the credit registry enables banks to monitor level of debt of major clients (total debt exceeding € 1,000,000) across the German banking sector as a whole. - MaRisk and SREP address unhedged borrowing in foreign currency and require credit analysis to determine borrowers’ ability to repay if the currency position moves against the borrower. - These requirements are monitored by supervisor and external auditor. ### Essential Criterion 5 (EC5) — conflicts of interest and arm’s length credit decisions - EBA guidelines on SREP require supervisors to assess whether the bank demonstrates policies to identify and avoid conflicts of interest. - KWG provisions: - Section 15 KWG in conjunction with section 19 KWG regulate the arm’s length principle for credit decisions, including loans to management, parties related to management, members of the Board and firms closely related to management. - In these cases, credit conditions need unanimous approval of all Executive Board members and can be approved only at market conditions, requiring also approval by the Supervisory Board. - Compliance verification: compliance thoroughly checked by external auditors according to section 33 of audit standards. *Source: _cr16196 - Section 2a KWG which sets out further details regarding the application process if an* ### 33.4 PrüfbV specifically instructs external auditors to verify if “there are any indications, that ### _cr16196 - 33.4 PrüfbV specifically instructs external auditors to verify if “there are any indications, that ### EC6 — Board/senior management decision authority for major credit risk exposures - Legal/regulatory requirements: - Article 392 CRR in conjunction with section 13 (2) KWG: loans to single borrowers or counterparties which exceed 10 percent of the institution’s own funds (large exposures) have to be granted unanimously by all members of the management board. - The unanimous decision shall be made prior to the granting of the loan. - Such loans have to be reported to BaFin. - Those loans must not exceed 25 percent of the own funds without previous acceptance by BaFin (article 395 CRR or section 13 (3) sentences 5 KWG). - Institutions are required to have well-defined credit-granting decision authority (BTO 1.1 item 6 MaRisk). - Internal decision rules: - For “risk-relevant lending decisions” (loans with risk characteristics not specifically addressed in the normal loan approval process), two consenting votes by both front office and back office are required. - Front office is defined as the loan officer. ### EC7 — Supervisor access to credit and investment portfolio information - Legal basis and practice: - KWG, Article 44 (1) requires supervised entities to provide all information required to facilitate supervision. - Supervisor has full access to information in the credit and investment portfolios and to the bank officers involved in assuming, managing, controlling and reporting on credit risk. ### EC8 — Inclusion of credit risk in stress testing programs - Requirements and guidance: - EBA guidelines on SREP require supervisors to assess whether the institution has undertaken stress testing to understand the impact of adverse events on its credit risk exposures and on the adequacy of its credit risk provisioning. - For IRB banks art. 177 of CRR applies. - AT 4.3.3 MaRisk: institutions shall carry out, on a regular and ad hoc basis, stress tests in respect to all material risks (including credit risk), dependent on the nature, scale, complexity and riskiness of the business activities. - Stress tests may be executed at portfolio level, firm level or business unit level. - Credit risk exposures shall be included in the institution’s stress tests alongside market and liquidity risks. ### Assessment of Principle 17 - Overall assessment: Compliant - Commentary: - MaRisk provides guidance on risk management for banks. - Guidance could be enhanced by broad guidelines on general characteristics of various loan risk buckets; definitions of non-performing, restructured, forborne and cured loans. - These deficiencies are reflected in the CP 18 rating. ### Principle 18 — Problem assets, provisions and reserves (EC1–EC3) - EC1 — Requirement to formulate policies/processes for problem assets and regular review - SREP addresses assessment of overall credit quality at portfolio level and grades within “performing,” “nonperforming,” and “forborne”. - MaRisk: no specific definitions of nonperforming or forbearance. - SREP expectations: - Institution has a sound, clearly formulated and documented credit risk strategy, approved by the management body. - Appropriate organizational framework to enable effective credit risk management, measurement and control. - Appropriate policies for identification, management, measurement and control of credit risk, explicitly referring to non-performing assets and loan impairment. - MaRisk requirements: - Institutions must set up risk-classification procedures for initial, regular or ad hoc assessment of credit risk and, as appropriate, property/project risk. - Criteria to determine when an exposure requires special monitoring (intensified loan management) and regular review intervals (BTO 1.2.4 MaRisk). - Criteria for transfer of an exposure to staff/units specialized in restructuring and winding up (BTO 1.2.5 MaRisk). - HGB (commercial code) requirements: - Section 252 HGB in conjunction with section 253 HGB: all loans valued annually on an individual basis (group valuation possible for homogeneous loans). - Section 340e HGB: principle adopted by credit institutions. - When full repayment appears doubtful, provisions must be made (at a minimum for that part not secured by collateral). - In the event of total default, loans must be written off immediately. - EC2 — Supervisor determines adequacy of grading/classification and provisioning processes - Supervisory practice: - BBk performs on-site reviews of LSIs’ policies for compliance with MaRisk requirements for loan-portfolio risk management. - BBk does not conduct valuation review of individual loans nor challenge bank assumptions on impairment, loan classification or provisions. - LSI supervisors rely on external auditors’ work but do not have access to external auditors’ work papers and therefore do not test the depth of loan valuation analysis. - If supervisors have concerns, they can ask for additional information from the auditor or ask a different auditor to review the loan portfolio. - For SIs: - Horizontal reviews of credit risk management and loan valuation conducted through on-site reviews using SSM procedures. - An AQR exercise was conducted in 2014 that reviewed loan valuations and produced recommendations to institutions on reclassifying loans and increasing provisions. - Routine inspections: - SI/LSI on-site inspections by BBk focus on MaRisk compliance concerning credit risk. - SREP focuses on reviewers assessing adequacy of classification of credit exposures and the impact of potential misclassification; competent authorities may use peer analysis, benchmark portfolios, and loan sampling. - Audit and remedial powers: - Classification and provisioning policies and processes subject to special audits: generally performed by BBk (section 44 KWG) for LSI and under operational responsibility of the ECB for SIs. - For LSIs, BBk on-site inspections focus on process, documentation and compliance; supervisors review external audit reports and bank reports on problem loans but will not re-classify loans or require increased provisioning—an own funds requirement may be imposed. - Capacity building: - BBk is initiating training and developing procedures for inspectors to be able to challenge bank management assumptions on impairment and valuations. - SSM staff reported that in inspections of credit quality they hold discussions with banks to challenge adequacy of provisioning and loan valuation assumptions. - EC3 — Classification and provisioning consider off-balance-sheet exposures - SREP procedures address whether data, information systems and analytical techniques enable institutions to fulfill supervisory reporting requirements and to detect, measure and regularly monitor credit risk inherent in all on- and off-balance-sheet activities (where relevant at group level). - The term “credit” in MaRisk and PrüfbV refers to all credits pursuant to the applicable provisions. *Source: IMF staff summary of supervisory framework and findings contained in the provided chapter excerpt.* ### section 19 para. 1 KWG. This encompasses all positions and transactions containing credit risk ### _cr16196 - section 19 para. 1 KWG. This encompasses all positions and transactions containing credit risk ### Scope and coverage - Section 19 para. 1 KWG encompasses all positions and transactions containing credit risk (including counterparty risk) regardless if on-balance or off-balance. - Assessment of auditors concerning the risk classification and provisioning includes off-balance sheet positions as well. - Two types of off-balance sheet exposures are recognized: those that can be unilaterally cancelled by the bank (based on contractual arrangements and therefore may not be subject to provisioning), and those that cannot be unilaterally cancelled. ### Loan classification, provisioning and oversight (EC4–EC12) - EC4: Supervisory expectation - The supervisor determines that banks have appropriate policies and processes to ensure that provisions and write-offs are timely and reflect realistic repayment and recovery expectations, taking into account market and macroeconomic conditions. - SREP procedures address whether loan loss provisions and credit valuation adjustments are appropriate for the quality of exposures and, where relevant, for the level of collateral. - MaRisk requirements cited: BTO 1.2, BTO 1.2.4, BTO 1.2.5, BTO 1.2.6, BTO 1.3, BTO 1.4 MaRisk. - On-site inspections: assess exposure quality, robustness of provisioning and collateral policies, and implementation within loan loss accounting; BBk reviews process and compliance while external auditors certify impairment and provisions. - EC5: Early identification and treatment of problem assets - Supervisor expectation: banks have policies/processes and organizational resources for early identification of deteriorating assets, oversight of problem assets, and collecting on past due obligations. - For homogeneous portfolios, classification when payments are contractually in arrears for a minimum number of days (e.g., 30, 60, 90 days). - German findings: Ongoing oversight and collection not covered by EBA Guidelines on the SREP. MaRisk (BTO 1.2.4, 1.2.5, BTO 1.3) requires intensified loan management, treatment of problem loans, early identification of risks, and staff qualifications (AT 7.1 MaRisk). Practice shows German banks use groupings as per EBA/ITS/2013/03 (30, 60, 90 days). - Supervisors rely on external auditors to test treatment of assets for circumvention (e.g., rescheduling, refinancing, reclassification). - EC6: Access to information and documentation - Supervisor expectation: regular, detailed access to classification and provisioning information; banks must have adequate documentation. - Findings: EBA ITS on Supervisory Reporting (Forbearance and non-performing exposures) collects data; SREP sets minimum elements for NCAs. NCAs’ requirements for documentation are implementation prerogative. - FinaRisikoV: institutions file quarterly information with BBk on loan quality and provisioning (including amount of hidden reserves and losses, amount of loans with increased PD or in default, provisions). - External auditors annually assess appropriateness of processes and quantitative provisioning; LSI supervisor assesses auditor’s report. Supervisors can mandate auditor focus on specific topics. ECB does not rely on external auditors to review asset classification and provisioning. - Additional access via internal risk reports and special audits under section 44 KWG. - Gap: Loan quality information collected regularly lacks granularity on loan portfolio risk buckets, delinquencies, NPLs, restructured loans. - EC7: Prudential adequacy and supervisory powers - Supervisor expectation: assess adequacy of classifications and provisioning and require adjustments, increased provisioning or capital, and remedial measures if inadequate. - Findings: MaRisk and KWG do not define nonperforming loans; guidelines for loan classification not issued. Banks set classifications based on individual characteristics. - SREP asks NCAs to assess portfolio credit quality across “performing,” “nonperforming,” and “forborne” categories; Guidelines do not expressly refer to EBA definitions. - Supervisory powers in Germany when risk management is inadequate: - Capital add-on: BaFin must require additional own funds (section 10 (3) sentence 2 no. 10 KWG). - Order to (re)establish adequate business organization (section 25a (2) sentence 2 KWG). - Business restrictions: order measures to reduce risks (section 45b (1) no. 1 KWG); prior approval for opening branches (section 45b (1) no. 2 KWG); prohibit or restrict certain business activities (section 45b (1) no. 3 KWG). - External audits cover risk classification and provisioning (section 23 and 26 PrüfbV); assess recoverability and adequacy (section 26 (1) PrüfbV). - BaFin can impose an offsetting item on own funds (section 10 (7) KWG) if in doubt about asset valuation. - Practical note: differing views exist on supervisor power to require banks to adjust individual asset classifications and provisioning; historically loan valuation and provisioning viewed as accounting issues and reliant on external audit. Under the SSM, some re-classification and provisioning actions were requested but challenged as not in accordance with IFRS 39. - EC8: Valuation of risk mitigants and collateral - Supervisor expectation: banks regularly assess value of guarantees, credit derivatives and collateral; valuation reflects net realizable value and prevailing market conditions. - Findings: CRR Part II, Chapter 4 (Arts. 192 – 217) on credit risk mitigation; SREP guidelines assess collateral valuations. - MaRisk (BTO 1.2.1 items 2 and 3; BTO 1.2.2 item 3) requires assessment of value and legal validity prior to granting loans and at suitable intervals thereafter. Counterparty risk of guarantors to be reviewed. - External audit: Art. 35.2 PrüfbV in connection with Art. 34.2 PrüfbV assesses collateral viability for exceptional exposures (“bemerkenswerte Kredite”) limited to categories (1) significant provisions, (2) high risk of impairment, (3) extraordinary collateral, (4) large or conflict-risk “Organkredite”. - EC9: Definitions for problem assets and reclassification - Supervisor expectation: criteria for identifying problem assets and reclassifying as performing. - Findings: CRR Art. 178 provides definition of default. EBA ITS (Forbearance and non-performing exposures) technical standards: default when obligor is unlikely to pay or past due more than 90 days; NCAs may replace 90 days with 180 days for certain retail or SME residential/commercial real estate exposures and public sector entities. - ITS Para. 156: exposures cease being non-performing when (a) meets institution’s exit criteria, (b) debtor situation improved so full repayment likely under original or modified conditions, (c) debtor has no amount past-due more than 90 days. Exposure remains non-performing while conditions unmet even if accounting discontinuation criteria are met. - CRR is unspecific on discontinuation of default status (Art. 178.5). Institutions must apply discontinuation criteria for supervisory reporting on top of accounting/Article 178 CRR criteria. - KWG/HGB: no special provisions; internal commentary to section 25 PrüfbV references non-performing: either unlikely full payment without institution actions or more than 90 days overdue. - Gap: broader supervisory guidance to identify a problem asset (deteriorating repayment capacity but not an NPL/default) is absent; no issued guidance to define cured, restructured or extended loans. - EC10: Board reporting on asset portfolio condition - Supervisor expectation: Board obtains timely and appropriate information on asset portfolio, classifications, provisions, major problem assets, summary asset review results, trends, measurements of deterioration and expected losses. - Findings: MaRisk AT 4.3.2 item 7 requires comprehensive risk reports submitted to management board, addressing all material risks and stress test results. BTR 1 MaRisk details credit risk reporting at least quarterly and must include: - performance of lending portfolio by sector, country, risk class and size or collateral category, taking special account of risk concentrations; - extent of limits granted and external lines; large exposures and noteworthy exposures (e.g., material problem loans) listed and commented; - separate analysis of country risks where appropriate; - development of new business; - limit overdrafts; - any exceptional business; - development of institution’s risk provisioning. - Management board provides quarterly risk report to supervisory board (AT 4.3.2). - EC11: Individual assessment of significant exposures - Supervisor expectation: valuation, classification and provisioning for significant exposures conducted on an individual item basis; banks set thresholds for significance and review them regularly. - Findings: No mandated regulatory threshold for individual review under IFRS banks. - HGB (section 340e in conjunction with sections 252 and 253 HGB) requires individual item valuation and provisioning generally; exceptions allowed for standardized retail loans. - Annual external auditor reports must cover notable loans on an individual basis; notable exposures include: - loans to members of the board (executive and supervisory board, including connected persons); - loans for which provisions are or will be necessary in a significant amount; - non-performing loans (if material related to total loan volume); - loans with exceptional collateral. - EC12: System-wide trends and concentrations - Supervisor expectation: regularly assess trends and concentrations across banking sector and adequacy of provisions/reserves bank- and system-wide. - Findings: BaFin regularly collects institution-level and ad hoc financial data (e.g., large exposures, country loans) since 2008; BaFin and Bundesbank analyze datasets and develop recommendations to banks or market. ECB also monitors system trends. - Gap: aggregated system-wide data based on bank-specific reporting is limited; most info collected on ad hoc basis. Problem asset (watch list) collected for FINREP reporting banks but without breakdowns by gravity. ### Assessment and recommendations (Principle 18) - Assessment: Largely Compliant. - Comments and supervisory strengthening priorities: - Three significant players: bank management (broad, flexible authority), accountants (review impairment assumptions for accounting), and banking supervisor (introduce prudential considerations). - Prudential input should provide bank management with guidance on loan classification parameters and provisioning: residential mortgages, commercial real estate triggers, and conservative collateral valuation (net realizable values). - Recent thematic reviews at SIs recommended increases in provisioning and reclassification of loans; supervisors consider collecting real estate data to challenge banks’ collateral valuations. - Recommended supervisory enhancements: - Consultation with banks and accounting firms on proposed prudential guidelines. - Training for supervisors on valuing loans and challenging collateral assumptions. - Develop market data to gauge reasonableness of collateral valuations, enabling questioning of significant variances from market values or trends. - Further recommended actions from prior BCP assessment: improve consistency across audit firms in review of asset classifications and provisioning; evaluate and continue improving supervisor capabilities in credit risk supervision and increase depth and frequency of credit risk inspections. ### Concentration risk and large exposures (Principle 19; EC1–EC4) - Principle 19 summary: - Supervisor determines banks have adequate policies/processes to identify, measure, evaluate, monitor, report and control or mitigate concentrations of risk; supervisors set prudential limits to restrict exposures to single counterparties or groups of connected counterparties. - Footnote definition expands concentration to single counterparties, groups, industry/sector/geography, exposures dependent on same activity/commodity, off-balance sheet exposures, and market/other risk concentrations. - EC1: Bank-wide policies and processes - EU-wide requirements do not fully cover broader concentration definition in footnote (e.g., market and other risk concentrations). - CRDIV Article 81: NCAs shall ensure concentration risk to each counterparty, groups, sectors, regions, activities, and large indirect credit exposures are addressed and controlled via written policies/procedures. - CRR provides framework for large exposures (see EC2). - ECB requires SIs to have concise practical definition of credit concentration covering counterparties, groups, sectors, geography, commodity/currency, and large indirect exposures; recommends indicators such as breakdowns by country, counterparty type, NPLs and forborne exposures. - EC2: IT systems and aggregation - CRR Article 393: institutions need adequate procedures/internal control mechanisms to identify, manage, monitor, report and record large exposures (exposures equal or in excess of 10 percent of the institution’s eligible capital per Art. 392 CRR). - CRR Article 389: “exposure” includes any asset or off-balance sheet item recognized under standardized approach for credit risk. CCR Article 390 (4)&(5): calculate exposures by adding trading and non-trading books; group exposures aggregate individual client exposures. - ECB expects SIs to have data architecture and IT infrastructure supporting risk data aggregation/reporting in normal and stressed times; data granularity to identify business lines, legal entities, asset types, industries, regions; thematic review on risk data aggregation planned over 2016-2017. - MaRisk (AT 4.3.2, BTR 1-BTR 4) requires suitable measures to limit/monitor risk concentrations; counterparty-related limits mandatory before credit transactions (BTR 1 items 2–7 MaRisk). - Audit: section 31 (1) PrüfbV requires external auditors to cover compliance with large exposure rules; section 34 (2) PrüfbV requires reporting on remarkable contingents of credit lines (remarkable when they reach or exceed large exposure limits in Article 392 CRR). BaFin may order special audits under section 44 KWG. - EC3: Thresholds, limits, board reporting - Article 392 CRR: exposures equal or in excess of 10 percent of eligible capital included in mechanisms to identify/manage/monitor/report risks. - ECB expectation: oversight function defines risk management policies and acceptable risk levels; check existence and periodic review of credit risk limits. - German MaRisk (AT 2.2) requires identification of material risks and concentrations; risk strategy must consider limitation of risk concentrations (AT 4.2 item 2). Risk concentrations to be managed using limits, traffic light systems or other measures. - BTR 1 item 7 MaRisk: risk report to management board at least quarterly including lending portfolio performance, limits, large exposures and noteworthy exposures, country risk analysis, and significant limit breaches. - Gap: no specific requirement that all material concentrations be regularly reviewed and reported to the bank’s supervisory board. - EC4: Supervisory information on concentrations - Art. 394 CRR: reporting requirements for large exposures and certain largest exposures (identification of client/group, value before CRM, type of credit protection, expected run-off). Institutions report exposures reaching or exceeding threshold of 10 percent of eligible capital to supervisor. Regulation (EU) No 680/2014 Annex VIII and IX develop common reporting templates quarterly including counterparty sector and statistical sectoral codes; geographical location uses place of residence of counterparty. - ECB STE concentration risk template requests 100 largest loans overall and 100 largest loans to non-financial corporations including FINREP counterparty breakdown; more detailed sector classification may be requested later. - For LSIs: section 14 KWG requires loans to an individual counterparty or group of connected counterparties of EUR 1 million or more be reported to Bundesbank with geographical and sectoral client information. Central credit register (CCR) at BBk collates reports and computes total indebtedness; CCR analyzes reports to identify potential risks to financial system stability or firm insolvency. *Source: _cr16196 - section 19 para. 1 KWG. This encompasses all positions and transactions containing credit risk* ### section 25a KWG and the MaRisk, a regular exchange takes place, especially with complex ### _cr16196 - section 25a KWG and the MaRisk, a regular exchange takes place, especially with complex ### EC5 — Definition and treatment of “group of connected counterparties” - Articles 387 to 403 CRR set out the large exposures regime. - Article 390 (4, 5): overall exposures to individual clients or groups of connected clients are calculated by adding trading and non-trading book exposures; exposure to a group of connected clients is calculated by adding exposures to individual clients in the group. - Article 4 (1) (39) CRR: two or more natural or legal persons are a group of connected clients if (i) one has directly or indirectly control over the other(s); or (ii) without such control they are so interconnected that financial problems of one would likely cause funding or repayment difficulties for the others. - For the control criterion CRR refers to the accounting framework and Directive 2013/34/EU (Arts. 21 and 22) and to a “similar relationship” (see Art. 4 (1) (37) CRR). - Economic interdependence guidance: EBA-Guidelines from 2009 on connected clients; applicable in Germany via circular “Rundschreiben 8/2011”. - Section 31 (2) PrüfbV: external auditors must assess institution-specific procedures for formation of groups of connected clients in compliance with Article 4 (1) no. 39 CRR. - Commission Delegated Regulation (EU) No 1187/2014: defines conditions and methodologies to determine overall exposure resulting from transactions with underlying assets (securitized and shares in collective investment entities). - Supervisory discretion: where supervisors and institutions diverge on applying the connected-counterparty definition, supervisors may exercise discretion and enforce their view; institutions can challenge before court. - Evidence: assessors had access to files where German supervision challenged banks on economic interdependence and applied supervisory measures. ### EC6 — Large exposure definition, limits, and governance - Article 389 CRR: definition of exposure for large exposures includes on- and off-balance-sheet items. - Article 392 CRR: an institution's exposure is considered a large exposure where its value is equal to or exceeds 10 percent of its eligible capital. - Article 395 (1) CRR: an institution shall not incur an exposure to a client or group of connected clients the value of which exceeds 25 percent of its eligible capital. - For credit institutions or investment firms as clients: the limit is 25 percent of its eligible capital or EUR 150 million, whichever is higher. - Articles 11 (1) and (2) CRR: large exposure limits apply at consolidation/group level (parent institution and parent financial holding). - Competent authorities may allow limited time to comply where exposures exceed Article 395 (1) CRR in exceptional cases. - LSIs: correspondent German rules found in circular “MaRisk” and section 13 KWG. - Section 56 KWG: competent authority can impose a fine for violations of Article 395 (1) CRR. - MaRisk BTR 1 items 3–5: counterparty limits for trading activities; excesses above risk-determined levels must be reported to responsible manager daily. - Section 13 (2) KWG: an institution may incur a large exposure only by unanimous decision of all senior managers; decision should be taken before the exposure is incurred or promptly thereafter and placed on record. - Section 31 (1) PrüfbV: annual account auditors must verify and assess compliance with large exposure limits. ### EC7 — Concentration risk in stress testing - SSM SREP Methodology: inclusion of concentration impact in banks’ stress-testing is part of assessment of ICAAP, particularly Block3 (assessment of capital quantification under stress); concentration assessed via supervisory proxies dedicated to concentration risk; concentration factored into SREP only at consolidated level. - EBA’s GL 31 and 32 implemented in Germany by BaFin circular “MaRisk”. - MaRisk AT 4.3.3 item 1: institutions must carry out appropriate regular and ad hoc stress tests reflecting nature, scale, complexity and riskiness of business activities; stress tests must: - identify material risk factors; - cover assumed risk concentrations and diversification effects within and between risk types; - take account of risks from off-balance-sheet entities and securitization transactions. ### AC1 — Numeric criteria for large exposures (additional criteria) - (a) 10 percent or more of a bank’s capital is defined as a large exposure. - (b) 25 percent of a bank’s capital is the limit for an individual large exposure to a private sector non-bank counterparty or a group of connected counterparties. - Minor deviations may be acceptable if explicitly temporary or related to very small or specialized banks. - Article 396 CRR: excesses of large exposure limits generally not accepted; if exceptional excess, institution must report value to supervisory authority which may allow limited time to comply. - Section 56 (5) no. 17 KWG: excesses over large exposure limits constitute, in the event of negligence or deliberate intent, a breach of administrative regulations and may entail a fine. - Section 10 (3) no. 1 KWG in connection with Art. 393 CRR: BaFin can require a bank to hold additional own funds if it lacks adequate procedures and internal control mechanisms for large exposures. ### Assessment of Principle 19 — Concentration risk and large exposures - Assessment: Largely compliant - Comments (findings and gaps): - EU-wide requirements do not cover concentration risk in the broader sense of this CP; ECB and BaFin focus on concentration as part of credit risk and discuss other concentration types less systematically. - For LSIs, MaRisk provides a general framework for supervision of concentration risk. - ECB internal procedures for credit concentration aligned with the CP, but supervisor expectations regarding concentration risk management are not clearly communicated to banks. - More work needed for both LSIs and SIs on management of concentration risk from markets, currencies, funding (i.e., beyond credit risk). - No requirement that all material concentrations be regularly reviewed and reported to the bank’s supervisory board (see CPs 14 and 15). - CRR broadly aligns with the Basel 2014 Large Exposures framework (to take effect from 1 January 2019), but some CRR exceptions weaken the limit relative to Basel LE: - CRR 400(1) exceptions: some off-balance-sheet contingent facilities appear to be beyond the Basel LE framework (which applies a 10 percent CCF floor). - CRR national discretions under 400(2): e.g., some jurisdictions (including Germany) have exercised the option of completely exempting covered bonds from the LE framework, whereas Basel LE requires a covered bond exposure value of no less than 20 percent of nominal value under certain conditions. - Eligible covered bonds under CRR article 129 appear broader than eligible covered bonds under paragraph 70 of the LE framework. - No stricter LE limit for G-SIBs as per Basel LE framework. - Basel LE regime not yet in force; these gaps have not weighted on the grade, but supervisors are urged to address them as soon as possible in their risk assessments. ### Principle 20 — Transactions with related parties (overview and key findings) - Principle objective: prevent abuses and conflicts of interest in related-party transactions by requiring arm’s length terms, monitoring, controls, and write-off policies. - EC1 — Definition of related parties: - No EU-wide framework on related parties. - Sections 15 and 17 KWG govern loans to related parties (Organkredite). - Section 15 (1) sentence 1 KWG: related parties include managers, shareholders/partners who are not managers, members of supervisory body, proxy holders (Prokuristen), other persons authorized to represent the institution in all aspects (Handlungsbevollmächtigte), spouses and underage children, and silent partners (see section 15 (1) sentence 1 numbers 4 to 6 KWG). - “Organs” include enterprises where interlocking representation, supervisory membership, or participating interests exceed thresholds listed (including participating interests of more than 10 percent). - Section 15 (1) sentence 4 KWG: permission of withdrawals in excess of remuneration and advances on remuneration deemed equivalent to granting a loan. - Concept of loans per section 21 KWG applies to loans to related parties and is broad (includes on- and off-balance-sheet exposures and leasing agreements). - Unclear legal text whether supervisors have explicit case-by-case decision power when definitions in section 15 KWG are in doubt; authorities believe supervisors would decide case by case, but no case evidence provided. - EC2 — Arm’s length terms requirement: - Section 15 (1) sentence 1 KWG: except for staff loan schemes, loans to related parties are only granted on prevailing market terms. - Section 15 (1) sentence 5 KWG: loans to related parties not on prevailing market terms shall, at BaFin’s decree, be backed by Common Equity Tier 1 items in terms of Article 26 CRR. - EC3 — Board approval and conflict-of-interest safeguards: - Section 15 (1) sentence 1 KWG: loans to related parties may only be granted by unanimous decision of all managers and only with explicit consent of the supervisory body. - No legal requirement that members with conflicts of interest be excluded from approval and management of such transactions. - Exemptions/waivers: - Intra-group exposures may waive the two unanimous/consent decisions if the enterprise receiving the loan qualifies for 0 percent risk weight under standardized approach (Article 113 CRR). - Section 15 (3) KWG exemptions: - a) loans to proxy holders or other authorized persons or their spouses/life partners/underage children if loan ≤ one year's salary; - b) loans to persons/enterprises specified in section 15 (1) sentence 1 nos. 6 to 11 KWG if loan amount < 1 percent of institution's eligible capital in terms of Article 4 (1) no. 71 CRR or < 50,000 Euros; - c) loans increased by not more than 10 percent of the amount approved under section 15 (1) sentence 1 KWG. - These exemptions account for proportionality and practicality. *Source: _cr16196 - section 25a KWG and the MaRisk, a regular exchange takes place, especially with complex (PDF chapter/section).* ### Section 15 (4) KWG sets out more detailed decision-making requirements. It stipulates that ### _cr16196 - Section 15 (4) KWG sets out more detailed decision-making requirements. It stipulates that ### Decision timing and documentation - Decisions of the managers and the supervisory body to give their consent must be taken before the loan is granted. - The decisions must include provisions on the interest rate payable and the repayment of the loan. - These provisions must be documented. - Reference: section 15 (1) sentence 1 nos. 6 to 11 KWG is cited as the category of loans mentioned. ### Urgent loans — exception to prior decision requirement - If a loan covered by section 15 (1) sentence 1 nos. 6 to 11 KWG has to be granted urgently, it is sufficient if all managers and the supervisory body subsequently approve the granting of the loan without undue delay. - Time limits for retroactive approval: - If the managers' decision has not been taken retroactively within two months of the date on which the loan was granted, the institution must report this fact to BaFin/ECB without undue delay. - If the supervisory body's decision has not been taken retroactively within four months of the date on which the loan was granted, the institution must report this fact to BaFin/ECB without undue delay. ### Reporting requirements - Failure to obtain retroactive approval within the specified timeframes triggers an obligation: the institution must report the fact to BaFin/ECB without undue delay. - Specified timeframes to preserve exactly: - two months - four months ### Incomplete continuation in source - The source continues: "For certain lending operations and types of lending operations, the decisions of the managers and the supervisory body to give their consent to loans to the persons specified in" — (text ends here in the supplied content). *Source: _cr16196 - Section 15 (4) KWG sets out more detailed decision-making requirements. It stipulates that* ### section 15 (1) sentence 1 nos. 1 to 5 and 12 KWG may be taken up to a year in advance. ### _cr16196 - section 15 (1) sentence 1 nos. 1 to 5 and 12 KWG may be taken up to a year in advance. ### Related party lending (EC4–EC7; Assessment of Principle 20) - Legal and decision requirements: - "If a related party loan is granted contrary to the rules, it must be repaid immediately, unless all managers and the supervisory body approve the granting of the loan retroactively." - "According to section 17 KWG, breaches of these decision-making requirements may possibly give rise to claims for damages against the senior managers and the members of the supervisory body." - "Loans to related parties may be granted only on the basis of a unanimous decision by all general managers of the institution and with the explicit approval of the supervisory board." - Organizational controls and exclusions: - MaRisk requires a general segregation of functions and voting for all credit risk exposures (BTO 1.1; see CP 17). - "The explanations of BTO 1.1 item 1 MaRisk state that these organizational requirements often cannot be implemented one-to-one in the case of loans to management board since there is no front office involvement." - Supervisors have usually required that "members of the management board or supervisory board benefiting from the loan do not vote in the meetings which approve the loans." - "There is no requirement that individuals with conflict of interest are excluded from the whole process of granting and managing such exposures." - Supervisory powers and practice on limits and remedial action: - "According to section 15 (2) sentence 1 KWG, BaFin may impose upper limits for the granting of loans to related parties on a case by case basis; BaFin is also entitled to do so even after the loan has been granted." - "According to section 15 (2) sentence 2 KWG, loans to related parties which exceed limits must be reduced; in the interim period they must be backed by CET1 1." - "According to article 9(1) 3rd subparagraph of the SSMR, the ECB may instruct BaFin to use these powers." - Practice to date: "However, to date there has been no imposition of upper limits on the granting of loans to related parties. BaFin considers such measure extreme, and understands as long as related party exposures are part of the risk appetite and are adequately covered no action by supervisors should be warranted." - Monitoring, reporting and audit: - "There is a corresponding obligation under section 33 (1) sentence 4 PrüfbV, which stipulates that the auditor must report about the institution’s compliance with the rules governing loans to related parties." - "Beyond the annual auditor’s report, there is no specific requirement that exposures and transactions with related parties are regularly monitored and reported." - "In the files reviewed by assessors the comment of the auditors regarding related party lending is very limited and only states no serious issues have been identified." - For LE reporting, see CP 19; "There is no regular reporting of exposures to related parties other than the notification that a missing decision / approval of managing and supervisory board was made good, or the exposure is granted to a significant stakeholder (holding more than 25 percent of the voting rights or the of the bank’s capital) but not at arm’s length conditions." - "The long form report of the annual audit has to contain information on loans to related parties" (see EC 6). - Section 44 (1) KWG provides BaFin, Bundesbank or ECB the right to ask an institution for more information about its business including loans to related parties; supervisors "could not recall an instance when these measures have been applied regarding related party exposures." - Assessment outcome and key shortcomings: - Assessment of Principle 20: "Materially non-compliant" - Key deficiencies noted: - "The framework covers loans in a broad definition that includes off-balance sheet exposures and leasing operations, albeit not all exposures which are required by this CP ('dealings such as service contracts, asset purchases and sales, construction contracts, lease agreements, derivative transactions, borrowings, and write-offs')." - "Related party loans must be granted on market terms." - "There is no requirement that related party exposures are monitored and controlled separately and in aggregate." - "There is no regular reporting of exposures to related parties." - "Supervision of related party risk is mostly carried out by external auditors, whose analysis of related party risk seems to be very limited and compliance based." - "No limits on related party are imposed by laws, regulation, or the supervisor. The supervisor has the power to do so but to the date of this assessment has not used this power." ### Country and transfer risk (Principle 21; EC1–EC6; Assessment) - Legal and reporting framework: - SSM SREP methodology: "Country Risk is detailed as a Credit Risk Subcategory which forms part of the SREP Process." - BaFin issued the Länderrisikoverordnung (LrV) on the basis of section 25 (3) KWG. - LrV reporting thresholds and timing: - "Credit institutions whose lending to borrowers domiciled outside the EU, the EEA, Switzerland, USA, Canada, Japan, Australia, and New Zealand, exceed a total of EUR 10 million on March 31, June 30, September 30, or December 31 in any year must provide BaFin and Bundesbank with details of these transactions, guarantees given and risk provisioning for country risk." - "If this reporting requirement applies, details must be provided of the transactions with those countries, in which the loans amount to at least EUR 1 million (section 1 (4) LrV)." - "The report provides information on the end-borrower. These rules also apply to groups of institutions and financial holding groups." - Risk management, governance and auditor role: - MaRisk includes country and transfer risk as part of credit risk (AT 4.2 item 2; AT 4.3.2 item 3). - "Risk reports on the risk situation have to be submitted to the management board at appropriate intervals. This risk report has to contain, where applicable, a separate analysis of country risks." - "Pursuant to section 32 PrüfbV, the auditor must assess the scale of country risk incurred by the institution and the way in which they are managed and monitored. In particular, the auditor has to comment on the appropriateness of the analysis for estimating country risk." - Aggregation, MIS and stress testing: - For LSIs, "risk concentrations have to be identified and assessed by using qualitative and, if possible, quantitative methods" (BTR 1 item 6 MaRisk). - "A risk report ... has to be drawn up and provided to the management board at least on a quarterly basis (BTR 1 item 7 MaRisk)." - "There is no specific requirement to include country risk in bank’s stress testing; only general requirements that stress testing should cover material risks." For LSIs, however, AT 4.3.3 item 1 MaRisk requires stress tests to cover material risks including country and transfer risks. - Assessors "had access to files where country risk was a separate part of the risk report" and "reviewed some annual presentations by banks to BaFin where stress testing regarding country and transfer risk was shown." - Supervisory information access and actions: - CCR reports and other sources provide breakdowns by country, credit type, sector, borrower category, "internal risk classification, probability of default, provisions and collateral." - "Pursuant to section 44 (1) sentence 2 KWG, special audits can be ordered by BaFin, with or without a special reason." - "BaFin and BBk require more information and conduct more in depth analysis when significant international developments occur." - Assessors noted supervisors used CCR and ad-hoc reports and peer reviews; as a result "banks reduced exposures or increase provisions." - Assessment outcome and comments: - Assessment of Principle 21: "Largely compliant" - Comments and remaining gaps: - "Banks have little guidance from supervisors on their expectations regarding country risk." - "Standard regular reporting on the basis of LrV excludes several countries, in particular all EU." - "There is no specific requirement that banks MIS themselves are able to identify, aggregate, monitor and mitigate country risk." - "There is no specific requirement to include country risk in bank’s stress testing; only general requirements that stress testing should cover material risks. Assessors saw no evidence that country risk is indeed a regular part of stress testing." - "While an increase in Pillar 2 or imposition of provisions would be possible if country risk concentrations are detected, there is no specific guidance for banks on measures to provision and mitigate country risk." - "The verification on whether internal limits and controls are adequate is mostly delegated to external auditors’ annual report." ### Market risk (Principle 22; EC1–EC4) - Legal and supervisory framework and proportionality: - MaRisk (AT 2.2; AT 4.3.2; AT 4.1; BTR 2; BTR 2.1) and KWG section 25 provide the legal basis and set expectations for market risk management, ICAAP, and reviews of market risk procedures. - "An important dimension of MaRisk is the concept of proportionality where institutions with more complex and sophisticated traded market risk strategies and positions are expected to make more extensive risk management arrangements than smaller institutions." - Governance, supervisory inputs and intensity: - Supervisory inputs include external audit reports, off-site analysis, ad hoc reporting, on-site market risk examinations, and enhanced reporting for higher-risk banks. - "At least annually, the German supervisory authorities will meet with the bank’s Management Board to discuss, inter alia, market risk." - Frequency of on-site examinations for LSIs ranges "from 12 years for the very smallest institutions with essentially no traded market risk to every three years for the largest LSIs." - For SIs, "the on-site schedule ... is still under construction and a MEL is based upon the SREP score and the strategic priorities set for all SIs." - Policies, MIS, limits, and reporting: - MaRisk requires "effective information systems for accurate and timely identification, aggregation, monitoring and reporting of market risk exposure." - "BTR 2 and BTR 2.1 no. 1 MaRisk demand that a threshold system has to be set up on the basis of the institution’s risk bearing capacity in order to limit market price risks." - "BTR 2.1 no. 2 MaRisk requires that no transaction, which entails market price risks, may be concluded in the absence of a market price risk limit." - "A risk report on the market price risks incurred by the institution shall be drawn up and made available to the members of the management board periodically, at least quarterly." - MaRisk is being revised "to integrate the requirements of the Paper of the Basel committee concerning risk data aggregation" and a "new module concerning risk data aggregation (AT 4.3.4) will be part of the MaRisk in the near future." - Controls around models, trading book allocation and valuation: - CRR Articles 102–105 and Articles 362–377 set standards for trading book allocation and internal models; Article 368 no. 1 CRR requires close integration of internal models into daily risk management and an independent risk control unit. - JSTs verify policies, procedures and controls around the use of models, allocation to the trading book, and the existence of MIS enabling accurate, timely aggregation and reporting. - Prudent valuation and independent verification: - CRR Article 105 and related EBA Guidelines require daily revaluation, independent price verification, model validation by independent function, and procedures for valuation adjustments. - "The SSM manual includes the controls and checks referred to in the EC4. Daily revaluation and reporting of risk measures (including VaR, Sensitivities, MtM, Stressed Exposure) of the trading book are minimum requirements." - "Effective middle and back office functions are crucial" and on-site examinations verify front/middle/back office segregation and independent sourcing and verification of rates. - For LSIs, MaRisk provisions require reviews of procedures for severe market disruptions and alternative valuation methods for material positions when market prices are unavailable, out of date or distorted. - Supervisory assessment practices: - JSTs use desk-based reviews, meetings with management, internal audit and compliance, and on-site examinations to assess market risk frameworks. - JSTs verify that "the bank ‘s risk appetite framework reflected the bank’s market risk strategies and policies defined by the management body translated into a set of binding limits, the breach of which is promptly reported and triggers adequate actions." - Standards for internal models and market risk capital: - "Standards on internal market risk models to calculate capital requirements (Pillar 1) are anchored in Articles 362 – 377 CRR." - The supervisor assesses model integration into daily risk management and reporting lines to the management board. *Source: _cr16196 - section 15 (1) sentence 1 nos. 1 to 5 and 12 KWG may be taken up to a year in advance.* ### conclusion of the trade together with all the relevant transaction data, included in the ### _cr16196 - conclusion of the trade together with all the relevant transaction data, included in the ### EC5 — Capital adequacy and valuation adjustments for market risk - Supervisor determines that banks hold appropriate levels of capital against unexpected losses and make appropriate valuation adjustments for uncertainties in determining the fair value of assets and liabilities. - CRD IV Article 83 requires supervisors to ensure that internal capital is adequate for material market risks not subject to an own funds requirement. - The JST verifies that the bank has a sound self-assessment process of adequacy of capital held against market risks as part of ICAAP. - The SSM methodology includes “in-house” capital quantification tools based on reporting and managerial data for market risk; JST supervisors can use these tools to dialogue with and, if necessary, challenge bank internal capital estimations. - CRR Article 105 standards for prudent valuation of trading book positions: - All trading book positions subject to the standards in Article 105. - Prudent valuation must achieve an appropriate degree of certainty given the dynamic nature of trading book positions and prudential soundness demands. - When marking to market, use the more prudent side of bid and offer unless the institution can close out at mid-market. ### EC6 — Market risk stress testing requirements - Supervisor requires banks to include market risk exposure in their stress testing programs for risk management purposes. - SSM supervisors must assess whether institutions have implemented adequate stress tests regarding market risk, observing: - Stress test frequency. - Identification of relevant risk drivers (e.g., illiquidity/gapping of prices, concentrated positions, one-way markets). - Assumptions underlying stress scenarios. - Internal use of stress-testing outcomes for capital planning and market risk strategies. - CRR Article 105 provides detailed requirements on valuation adjustments (see EC4). - Adequate stress testing is a specific requirement for institutions using approved internal models; JST should expect that standardized-approach banks most engaged in market activities have developed some stress tests for risk management. - MaRisk requirements on stress testing (AT 4.3.3): - AT 4.3.3 no. 1: Appropriate regular and ad hoc stress tests for material risks reflecting nature, scale, complexity and riskiness; identify material risk factors; cover assumed risk concentrations and diversification effects and off-balance-sheet and securitization risks; carried out at firm-wide level. - AT 4.3.3 no. 2: Stress tests must show exceptional but plausible events; define appropriate historical and hypothetical scenarios; analyze impact of a severe economic downturn at firm-wide level; consider strategic orientation and economic environment. - AT 4.3.3 no. 4: Appropriateness of stress tests and underlying assumptions reviewed periodically, but at least once a year. ### Assessment of Principle 22 — Market risk (overall conclusion) - Assessment: Compliant - Key observations: - MaRisk obligations are generally sound and establish requirements for effective market risk management. - Greater supervisory intensiveness and intrusiveness observed for larger, systemic, trading-biased banks. - Market risk was a supervisory focus during 2014 and 2015. - A targeted review of banks’ internal models will be carried out over several years. - Supervisors periodically review banks to ensure market risk management is consistent with risk-bearing capacity and management framework. - Banks with the largest trading books are subject to enhanced focus (mostly SIs); remaining banks follow a normal SREP-based cycle by SREP score and risk profile. - Supervisory practice observed for both SIs and LSIs; compliance with the principle verified. - Engagement with Supervisory Boards is not uniform: - JSTs have implemented meetings with Supervisory Board members (e.g., Chair, Chair of BAC/BRC). - For LSIs, meetings with Supervisory Boards are exceptional; no recent examples of meetings to discuss market risk issues at LSIs. ### Principle 23 — Interest rate risk in the banking book (IRRBB) and EC1 description - Principle 23 mandate: Supervisor determines that banks have adequate systems to identify, measure, evaluate, monitor, report and control or mitigate interest rate risk in the banking book on a timely basis, taking into account risk appetite, risk profile, market and macroeconomic conditions. - EC1 — legal and supervisory framework: - CRD IV Article 84: framework for SIs to have appropriate IRRBB strategy and management to identify, evaluate and manage risks from potential interest rate changes affecting non-trading activities. - CRD IV Article 98.5: supervisory authorities must include IRRBB exposure in SREP. - EBA IRRBB guidelines of May 2015 specify calculation of the standard supervisory shock required by CRD IV: - Standard shock measured as an economic value decline by more than 20 percent of own funds as a result of a sudden and unexpected change in interest rates of 200 basis points. - EBA “Guidelines on SREP methodologies and processes” set out elements supervisors should cover when assessing management of interest rate risk from non-trading activities (strategies and appetites; organizational frameworks; policies and procedures; risk identification, measurement, monitoring and reporting; internal control frameworks). - Implementation and supervisory practice: - At mission time, IRRBB framework was being integrated with SREP. - Phases 2 and 3 of Risk Control assessment for IRRBB specifically assess Governance arrangements and Risk Appetite Framework related to IRRBB. - Example assessment items: documented IRRBB strategy approved by management body; appropriateness of strategy and appetite given business model, overall risk strategy and appetite, market environment, role in financial system, and capital adequacy; strategy coverage of all activities where IRRBB is significant. - Off-site SREP IRRBB review organized around assessment of a) Risk Levels and b) Risk Controls, with three phases: 1) collect available information (including quantitative estimates); 2) screen information against pre-determined outcomes; 3) in-depth review. - Risk levels assessment based on quantitative information mostly from COREP submissions, complemented by management reporting and other sources. - Controls assessment based on internal/external audit reports, meetings with management and risk control functions, and on-site examination results. - On-site examinations complement off-site surveillance and provide direct input on risk management, control environment adequacy, risk levels, and policy/process implementation; on-site inspectors assess whether external and internal changes are reflected in IRRBB management framework. - Framework provides a good foundation to assess quantitative and qualitative aspects, but due to early implementation stage the assessment was relatively high level and not demonstrated to be based on first-hand knowledge. - KWG implements legal requirements for IRRBB management for all banks in Germany and establishes overall risk management obligations for LSIs. *Source: _cr16196 - conclusion of the trade together with all the relevant transaction data, included in the* ### section 25a (1) sentence 3, also AT 2.2 item 1 MaRisk). The specific requirements in relation to ### _cr16196 - section 25a (1) sentence 3, also AT 2.2 item 1 MaRisk). The specific requirements in relation to ### Governance and supervisory approval of IRRBB (EC2) - Laws and guidance: MaRisk (BTR 2.3 item 5; AT 2.2 item 1) and BaFin Circular 11/2011 (BA) establish requirements for banks to have an effective interest rate risk management framework. - Supervisor determinations: - The supervisor determines that a bank’s strategy, policies and processes for the management of interest rate risk have been approved, and are regularly reviewed, by the bank’s Board. - The supervisor determines that senior management ensures that the strategy, policies and processes are developed and implemented effectively. - SREP and evidence: - During the SREP of SIs, the supervisor must confirm Board approval of IRRBB policies and processes using board minutes, board reporting, and confirmation from IA and EA reporting. - The assessment is to be carried out at least annually, and more frequently where necessary (e.g., ad-hoc analyses or results of on-site inspections). - On-site inspections provide verification of management body involvement; however, on-site coverage of IRRBB examinations was infrequent in early implementation, limiting confirmation via on-site activities to a small sample of banks. - LSIs: - MaRisk sets expectations for the management body to establish, implement and regularly review/approve IRRBB policies and processes. - The Bundesbank performs a comprehensive assessment of LSIs’ risk profile at least annually, including IRRBB and oversight of the Management Board, using internal and external audit reports, quarterly reporting, meetings with risk control functions, on-site examinations and annual meetings with the Management Board. - Frequency: at least annually; updates when changes occur; LSIs expected to advise the supervisor if material changes occur. - Higher risk profile LSIs receive greater attention in on-site schedules and reviews. ### Measurement systems, limits, validation, and reporting (EC3) - EC3 expectations require banks’ policies and processes to establish: - (a) comprehensive and appropriate interest rate risk measurement systems; - (b) regular review, and independent (internal or external) validation, of any models used, including review of key model assumptions; - (c) appropriate limits, approved by the banks’ Boards and senior management, reflecting risk appetite, risk profile and capital strength, understood by and regularly communicated to staff; - (d) effective exception tracking and reporting processes to ensure prompt action at appropriate senior levels; - (e) effective information systems for accurate and timely identification, aggregation, monitoring and reporting of interest rate risk exposure to Boards and senior management. - Findings: - See EC1 for related evidence. - For SIs, coverage of requirements had not yet been fulfilled. - LSIs faced heightened supervisory intensity in 2015 and 2016 due to the low rate environment. - All 1690 LSIs were required to conduct a standard 200 bsp shock scenario to identify outliers; LSIs with more complex portfolios were required to conduct more complex measurement approaches. - Supervisor conducted analysis of outliers across LSI sector; IRRBB was a special focus of LSI supervision. ### Stress testing requirements and practices (EC4) - Requirement: Supervisor requires banks to include appropriate scenarios into stress testing programs to measure vulnerability to adverse interest rate movements. - Legal and guidance basis: - CRD IV Article 97.1.c: risks revealed by stress testing should be taken into consideration in the SREP, reflecting nature, scale and complexity of activities. - EBA guidelines referenced in EC1. - MaRisk AT 4.3.3 items 1 and 2: obligation to carry out appropriate regular and ad hoc stress tests for material risks reflecting nature, scale, complexity and riskiness of business activities. - Stress test features to be assessed by supervisors: - Multiple scenarios; breakdown of key assumptions (e.g., behavior of assets/liabilities, correlations); changes to market and macro conditions; possible developments related to business model. - Coverage should include all sources of risk and all relevant group entities; reflect exceptional but plausible events; use appropriate historical and hypothetical scenarios; analyze impact of severe economic downturn at firm-wide level; take strategic orientation and economic environment into account. - Findings: - Under the SSM framework for SIs, stress tests are assessed during on-site inspections; implementation was a work in progress. - Stress testing and scenario analysis have been a particular focus of on-site examinations and Management Board meetings given the low interest rate environment and pressure on NIM. ### Supervisory use of standardized shocks and reporting (AC1) - Supervisor obtains banks’ internal IRR measurement results expressed as threat to economic value, including standardized shocks on the banking book. - SIs: - As part of SREP, JST reviews and evaluates SIs’ exposure to IRR from non-trading activities. - Measures required at least for institutions whose economic value declines by more than 20 percent of their own funds as a result of a sudden and unexpected change in interest rates of 200 basis points or such change as defined in the EBA guidelines (legal basis: CRD IV Article 98 (5)). - To ensure consistency, SIs expected to apply a standard shock broadly equivalent to the 1st and 99th percentile of observed interest rate changes (five years of observed one day movements scaled up to 240 days a year) as set out in the EBA technical guidelines. - ECB receives on a quarterly basis banks’ estimates over the impact of a +/- 200bps shock on both the economic value of its equity and its one-year Net Interest Margin projections based on internal measurement systems (IMS). Both metrics contribute in the Pillar 2 assessment performed by bank supervisors at least on a yearly basis. - Evolution of banks’ IMS risk figures is monitored by SSM horizontal functions regularly. - Supervisors use the standard scenario as a starting point but consider general level of interest rates, shape of yield curve and national characteristics; supervisors may review shock size with institutions and use bespoke shock scenarios for certain SIs. - LSIs: - AC1 implemented by Circular 11/2011 (BA), the KWG and FinaRisikoV. - Institutions must calculate impact of a sudden and unexpected parallel interest rate shock (±200 basis point) at least quarterly and report results to the Bundesbank (section 25 (1) and (2) KWG and FinaRisikoV). - If economic value declines by more than 20 percent of own funds (“outliers”), institution must report to BaFin and Bundesbank. - Data included in SREP capital assessment; supervisors acted to increase capital buffer based on IRRBB assessment. ### Assessment of internal capital measurement for IRRBB (AC2) - SIs: - SI SREP framework assesses whether own funds adequately cover risks. - Supervisors evaluate whether internal capital is commensurate with risk, calculating potential changes in economic value and impact on earnings. - Horizontal cross-checks by SSM divisions ensure consistency across ICAAP assumptions and outcomes. - JSTs assess ICAAP reliability: scope, validation and control, endorsement by management, embedding into operational decisions, quantification outcomes, etc. - JST sums capital requirements and calculates the TSCR (Totals SREP Capital requirement) ratio. - Process demonstrated for a sample of SIs and shown to be adequate. - LSIs: - Savings and cooperatives sector has been a focus due to low rates and pressure on earnings. - Supervisors engage with banks on IRRBB as part of annual Management Board meetings and on-site examinations. - Risk profile process identifies most exposed banks, leading to increased frequency and intensity of supervision for those institutions. - Ongoing risk for German LSIs; supervisor responding and engaging highest risk profile banks. ### Assessment of Principle 23 (IRRBB) - Overall assessment: Compliant - Comments summarizing findings: - IRRBB has been a supervisory priority in recent years. - Banks required to measure, calculate and report IRRBB exposure quarterly. - Banks required to conduct regular stress testing using standardized and bespoke scenarios, particularly complex banks with optionality in portfolios. - Supervisors assess IRRBB through the SREP process; evidence shows IRRBB featured in SREP and in discussions with bank senior management. - German authorities conducted short term data collection exercises to deepen understanding of system risks and exposure. - IRRBB assessment is included in Pillar 2 assessment and capital add-ons where risk is material and risk management needs attention. ### Liquidity risk framework and LCR implementation (Principle 24, EC1) - Principle 24: Supervisor sets prudent and appropriate liquidity requirements reflecting bank liquidity needs and ensures strategies enable prudent liquidity management; for internationally active banks, requirements not lower than applicable Basel standards. - LCR implementation for SIs: - A modified-LCR effective for all SIs from October 2015. - CRR Article 412 (1) describes liquidity coverage requirement for 30-day stressed conditions. - Commission delegated regulation (EU) 2015/61 (“DA”) supplements CRR regarding liquidity coverage requirement with several divergences from BCBS, often less conservative, improving ratios. Examples in DA include: - inclusion of covered bonds meeting requirements to Level 1 HQLA with a 7 percent haircut and a cap of 70 percent (DA Article 10); - inclusion of non-externally rated covered bonds into Level 2BV HQLA (DA Article 12); - inclusion of assets representing claims to or guaranteed by central/regional/local governments or PSEs to Level 1 HQLA even if not marketable securities (DA Article 10); - securitization of auto, SME and consumer loans to Level 2B HQLA (DA Article 13). - More conservative treatments than Basel include application of 15-20 percent run off rates for certain retail deposits (DA Article 25 (2) (3)), and the 3 percent outflow rate for stable retail deposits cannot be applied during the phase-in period. - EBA calculation (EBA 2014 LCR IA Report, December 2014): changes lead to increase in LCR of 13.9 percentage points for all European sample banks (322) and decline in number of banks failing to meet 100 percent LCR from 74 to 17 (one bank compliant under Basel III LCR fails under DA). Recent German analysis suggested the impact was less. - Phase-in schedule: - Entered into force October 1, 2015 with 60 percent minimum ratio. - Minimum increased to 70 percent from January 1, 2016. - Minimum will increase to 80 percent from January 1, 2017. - Minimum will increase to 100 percent from January 1, 2018 (one year ahead of internationally agreed schedule) (DA Article 38). - NSFR: - EU had not taken a formal decision on NSFR yet; EU commission to present legislative proposal by end 2016. - While not binding, SIs expected to calculate and monitor NSFR; JSTs included NSFR in liquidity assessments and followed up with institutions. - Supervisory practices: - LCR used as an indicator in Risk Assessment (RAS); additional liquidity monitoring metrics complement assessment. - Binding and non-binding thresholds plus supervisory judgment applied to set risk score (1–4) using all available information. - Output of liquidity adequacy assessment considered in overall SREP. - Qualitative requirements considered via Phase 2 questionnaire; results filed within IMAS and reflect minimum regulatory standards set by CRD. - Implementing Technical Standards on additional liquidity monitoring metrics adopted by EBA and submitted to European Commission. - Review of institution’s Internal Liquidity Adequacy Assessment Process (ILAAP) is a key JST assessment component (CRR Article 86). - LSIs liquidity regulation sources: - German Banking Act in wording of announcement of 9 September 1998, as last amended by Article 2 Abs. 5 G as of 12.06.2015; - Liquidity Ordinance (LiqV) of 14.12.2006; - MaRisk; revised version published on 14.12.2012, circular 10/2012 (BA). *International Monetary Fund — Germany: Report findings on IRRBB and liquidity risk (excerpts).* ### Section 25a (1) sentence 3 no. 3 lit. b) KWG in connection with Art. 86 of CRD IV imposes a ### _cr16196 - Section 25a (1) sentence 3 no. 3 lit. b) KWG in connection with Art. 86 of CRD IV imposes a ### Legal and regulatory framework for liquidity risk - Section 25a (1) sentence 3 no. 3 lit. b) KWG in connection with Art. 86 of CRD IV imposes a general obligation on institutions to have suitable arrangements for managing, monitoring and controlling risks and to have adequate internal controlling procedures. - MaRisk contains explicit requirements for liquidity risk management and controls (see BTR 3 MaRisk). - Quantitative requirements are laid down in the Regulation on the liquidity of institutions (Liquiditätsverordnung - LiqV) as of December 2006, based on section 11 KWG. - Section 11 KWG: institutions must invest their funds so that adequate liquidity for payment purposes is guaranteed at all times. - Section 2 LiqV: liquidity is adequate if the liquidity ratio to be calculated does not fall below the value of one. - Liquidity ratio = ratio between inflows including the liquid assets available in the first maturity band (1-month time horizon) and the liabilities likely to be called during this period. - Liabilities comprise all relevant on-balance sheet items and off-balance sheet items such as liquidity facilities or lending commitments. ### LCR, NSFR, and internal approaches - Since October 2015, the EU-Implementation of the LCR as a binding minimum standard applies directly to all deposit taking and credit granting institutions in Germany; application is extended to all credit institutions (except guarantee banks and housing undertakings with a saving facility). - All institutions which include LSIs that carry material liquidity risks are captured by the LCR requirement. - The phase-in of the thresholds aligns with that of SIs. - The LiqV applies to all credit institutions including branches of foreign non-EU institutions in Germany additionally to the LCR until the LCR is fully implemented (100 percent requirement). - LSIs are expected to calculate and monitor their NSFR. - Supervisors conducted routine analysis on LSIs NSFR and deviations away from the 100 percent threshold, while not enforceable, will be followed up with bank senior management. - In addition to the standardized approach of the LiqV, banks can apply for an internal liquidity risk and measurement approach subject to supervisory approval; currently two LSIs have been granted approval of their internal liquidity model. ### Supervisory framework and SREP methodology (SIs) - The full liquidity risk profile of the bank is covered by Element 4 of the SREP methodology and includes: - i) assessment of an institution’s capacity to meet its short-term financial obligations (short-term liquidity risk); - ii) longer-term assessment of the sustainability of its funding profile (funding sustainability risk). - Inter-linkage between short-term and longer-term dimensions is taken into account. - The SREP assessment uses a three-block approach: - Block 1: apply a full suite of risk metrics to determine risk level. - Block 2: challenge the internal perspective via the ILAAP (assessment of the institution’s process for identification, measurement, management and monitoring of liquidity). - Block 3: supervisory stress tests to challenge institution’s assessment of liquidity needs in stressed conditions. - JST supervisory stress test scenario: - Considers a weekly outflow of 3 percent and no-roll over of wholesale. - Scenario inspired from recent real-life liquidity runs. - SREP processes for SIs are performed at least annually and complemented with ongoing analysis of liquidity risk indicators reported monthly. - Other information used: internal and external audit reports, meetings with management, management reports and board reporting. - For SIs, the JST uses a standardized stress scenario applied across all SIs supervised by the SSM to allow benchmarking; scenario incorporates retail and wholesale stresses. ### Supervisory practices and expectations for LSIs - For LSIs, quantitative Pillar 1 liquidity requirements (LiqV and LCR) are standardized; approved internal liquidity models are tailor-made. - Art. 11 KWG allows the supervisor to impose specific liquidity requirements considering business model, risk management, SREP outcome, and systemic liquidity risk. - MaRisk BTR 3 addresses individual liquidity risk profiles; BTR 3.1 general requirements: adequate liquidity risk management and monitoring tools. - Instruments applied depending on size, scale and complexity of the LSI: - Maturity ladder - Liquidity shortfall contingency plan - Liquidity stress testing - Liquidity buffers - Internal allocation system for liquidity costs, benefits and risks - BTR 3.2 (capital market-oriented institutions / internationally active banks) prescribes a four-week liquidity stress test relying only on high quality liquid assets with scenarios: - institution specific scenario - market stress scenario - combined scenario - Prescribed supervisory features for scenarios include: - no rollover of unsecured funding by institutional investors at least during the first week of the institution-specific stress scenario; - withdrawal of part of the retail deposits for the institution-specific scenario; - general decline in the prices of marketable assets, particularly securities in the market stress scenario; - general deterioration in funding conditions in the market stress scenario. - Conservative liabilities treatment: no concept of operational deposits; broad definition of institutional investor leading to higher outflows. ### Governance, reporting, and internal controls (EC3 and EC4) - Legal basis: CRD Article 86 requires SIs to maintain sufficient liquidity to withstand a range of stresses and to have robust liquidity management frameworks ensuring strategies, policies, processes and systems for identification, measurement, management and monitoring of liquidity risk over appropriate time horizons, including intra-day. - Assessment activities for SIs include: - Review of internal risk controls and policies; - On-site inspections focusing on governance and implementation by the Board; - Meetings with senior management; - Review of contingency funding plans, internal and external audit reports, management information such as CRO reports to board, and results of stress tests. - MaRisk: executive board must define and annually review liquidity risk strategy, policies and procedures; external auditor provides annual confirmation of MaRisk compliance. - JST must ensure: - liquidity risk strategy and liquidity risk tolerance established and approved by management body and appropriate given business model and systemic role; - adequate limit and control framework, including intraday liquidity monitoring and stress testing for intraday operations; - appropriate IT systems and reporting to identify, aggregate, monitor and control liquidity and funding risk across legal entities, branches and subsidiaries; consideration of encumbrance and legal/operational restrictions on asset use. - JST governance and oversight expectations: - management body discusses and reviews governance and policies for managing liquidity and funding risk at least annually; - senior management monitors implementation of management body decisions; - specific reports and documentation on liquidity risk regularly submitted to appropriate recipients (management body, senior management or asset-liability committee). ### Funding strategy and funding risk management (EC5) - Supervisor requires banks to establish and regularly review funding strategies and processes for ongoing measurement and monitoring of funding requirements and effective management of funding risk, including consideration of interactions with credit, market, operational and reputation risk. - Funding policy and process elements include: - (a) analysis of funding requirements under alternative scenarios; - (b) maintenance of a cushion of high quality, unencumbered, liquid assets usable without impediment in times of stress; - (c) diversification in sources (including counterparties, instruments, currencies and markets) and tenor of funding, with regular review of concentration limits; - (d) regular efforts to establish and maintain relationships with liability holders; - (e) regular assessment of capacity to sell assets. - JST assessment of funding plans: - Determine feasibility and appropriateness relative to nature, scale and complexity of institution and its liquidity/funding profile. - Assess whether funding plan is robust under adverse scenarios. - Review controls regarding liquidity asset buffer, timely monitoring and availability to group entity using assets to cover liquidity risk. - Evaluate whether limit and control framework supports diversified funding and whether the institution actively maintains market presence (testing market access). - Limitations noted: - SSM internal procedures do not recommend supervisors to assess whether the institution’s policies and processes include maintenance of the liquidity buffer. - Procedures do not provide detailed recommendations on funding diversification, including regular review of concentration limits. - Supervisory practice for SIs: funding plan assessed qualitatively and quantitatively, primarily via risk control questions in Block 1. ### Key supervisory findings and practices (EC2—EC5 synthesis) - Prescribed liquidity requirements reflect banks’ liquidity risk profiles, covering on- and off-balance sheet risks within market and macroeconomic contexts. - A modified-LCR became effective from October 2015 to calculate liquidity risk under stressed assumptions, including additional outflows for collateral outflows for derivatives under market stress and additional outflow where contractual conditions lead within 30 calendar days following material deterioration of the credit quality to additional liquidity outflows or collateral needs. - Final draft ITS by the EBA includes reporting on rollover of funding and pricing of funding to allow supervisors to monitor market refinancing ability. - JSTs combine short-term liquidity risk and funding sustainability risk level ratings using the average approach into a single liquidity risk level rating (EBA GL alignment). - Risk control assessment is performed combined for short-term liquidity risk and funding sustainability risk; one combined risk control rating is assigned. - Block 2 assesses reliability of internal determination of liquidity via the ILAAP; Block 3 challenges institution’s stressed liquidity needs using supervisory stress tests. - LSIs: supervisory assurance via annual comprehensive assessments, monthly liquidity reporting, meetings with senior management, controls assessments, and annual stress testing results submission. - On-site examination frequency for LSIs varies by size/complexity: - cycle of three years for larger and higher risk LSIs; - once every five years for medium risk LSIs; - every ten years for the lowest risk and smallest LSIs. - Ongoing monitoring of LSIs includes monthly liquidity reporting and liquidity calls with treasury staff; regular stress testing at least annually with results submitted to the supervisor. *Source: _cr16196 - Section 25a (1) sentence 3 no. 3 lit. b) KWG in connection with Art. 86 of CRD IV imposes a — IMF PDF chapter* ### 1. As part of the assessment, the JST reviews the policies and processes to ensure that they ### _cr16196 - 1. As part of the assessment, the JST reviews the policies and processes to ensure that they ### Funding and liquidity assessment framework - Block 1: comprehensive framework for assessing the funding plan; LST assesses board approval and regular updating of funding plan and that plan reflects SI profile. - Liquidity cushion maintenance assessed via: - LCR analysis and specific data on liquidity buffer (STE) and Asset encumbrance (ITS) collected on at least quarterly basis. - Supervisory stress tests performed by JST in Block 3 at least annual basis and via banks’ internal reporting in Block 2 on internal determination of liquidity needs (stressed and unstressed) on at least annual basis. - Diversification of funding (counterparties, instruments, currencies, markets) and tenor assessed via STE templates (future AMM) on concentration of funding and indicators on quality of liquidity buffer. - Regular assessment of capacity to sell assets ensured via CRR operational requirements for liquidity buffer and a specific question on market liquidity test in phase 2 risk assessment. ### Supervisory metrics and reporting (LSIs) - LiqV: quantitative liquidity standard interpreted as combined stock and maturity mismatch approach with maturity buckets: up to 1 month, 1 up to 3 months, 3 up to 6 months and 6 months up to 1 year. Banks must ensure cash outflows/liabilities with maturities up to one month are covered by respective inflows and liquid assets. - Additional Monitoring Metrics (ITS under Art. 415 (3) (b) CRR) to be introduced by EU Commission ITS; EBA’s proposed metrics include: - A maturity ladder (contractual maturity mismatch template) with time buckets from overnight to up to 10 years. - Concentration monitoring templates/instruments to collect: - Concentration of funding by counterparty: report top 10 largest counterparties where funding received exceeds threshold of 1 percent of total liabilities; include counterparty name, type, location, product type, currency, amount, weighted average and residual maturity. - Concentration of funding by product type: report total amount of funding from each product category when it exceeds threshold of 1 percent of total liabilities. - Concentration of counterbalancing capacity by issuer/counterparty: report 10 largest holdings of assets or liquidity lines granted. - Prices for various lengths of funding: average transaction volume and prices for maturities from overnight to 10 years. - EBA Guidelines on Funding Plans introduced harmonized spreadsheet templates and definitions; BaFin notified full compliance. - First standardized delivery of funding plans as of 30.06.2015: BaFin and BBk collected data from 30 institutions. Beginning with reporting date 31.12.2015 the data will be collected annually. ### MaRisk funding-specific requirements (BTR 3) - Institutions shall ensure they can meet payment obligations at all times; ensure sufficient diversification (asset and capital structure); implement appropriate procedures and regularly review suitability; take impact of other risks into account. - Institutions shall draw up an informative liquidity overview listing anticipated inflows and outflows, account for usual volatility in payment flows, and specify assumptions on which inflows/outflows are based. - Continuous review of ability to cover liquidity requirements including in tense market environment; focus on asset liquidity and permanent access to relevant funding sources; maintain relationships with liquidity providers as necessary. - Maintain sufficient sustainable liquidity reserves (e.g., highly liquid, unencumbered assets); monetize a sufficiently representative sample of liquid assets at least yearly to test market access (Delegated Regulation Article 8 paragraph 4). - Deterioration of funding situation is a stress assumption in institutions’ stress tests; mandatory to analyze impact of alternative stress scenarios. ### Contingency funding plans — EC6 (description and findings) - Supervisor determines banks must have robust, formally articulated, documented LCPs addressing liquidity shortfalls across stress environments without reliance on lender of last resort; clear responsibilities, communication plans, regular testing and updating. - JST assesses whether SI’s LCP: - Specifies policies, procedures and action plans for severe funding disruptions. - Contains feasible actions relative to stress scenarios, appropriate escalation and prioritization procedures, and adequate internal/external communication procedures. - Appropriateness of assumption regarding central bank funding considered. - JST assesses adequacy and appropriateness of SI’s LCP on at least an annual basis. - For LSIs, MaRisk BTR 3 item 9 requires detailed contingency plans with specified sources of liquidity, communication channels, regular feasibility reviews, and mandatory regular testing; contingency funding plans are part of annual external auditor review and on-site inspections. ### Stress testing — EC7 (description and findings) - Supervisor requires banks to include variety of short-term and protracted bank-specific and market-wide stress scenarios (individually and in combination) with conservative and regularly reviewed assumptions; results to be used to adjust liquidity risk management and develop contingency funding plans. - JST assesses for SIs: - Adequacy of stress testing and scenario analysis including liquidity-specific testing. - Inclusion of short-term and prolonged, institution-specific and market-wide scenarios. - Conservative assumptions and sufficiently frequent review/update. - Integration of stress testing outcomes into strategic planning, liquidity management, and liquidity recovery plans. - LCR applied to SIs predicated on stressed assumptions; SSM “Book 7” highlights stress tests’ key role in quantitative assessment of liquidity needs. - For LSIs: - LCR applies as standardized stress scenario; LSIs report LCR monthly; supervisors assess individual results and sector/peer benchmarks. - LSIs required to conduct regular liquidity stress tests per BTR 3.1 item 8 and use results in contingency funding plans. - Supervisor assesses stress test results at least annually and reviews assumptions. - LSIs run a standard stress test over a four-week survival horizon using conservative run-off assumptions (e.g., 100 percent for all institutional such as banks, cooperatives). ### Foreign currency liquidity — EC8 (description and findings) - CRR Article 415 (2): institutions must report LCR separately in currencies where >5 percent of total liability or where significant branch uses different currency. DA Article 4 (5) also requires observation of LCR in these currencies. FX LCR calculated and reported but not binding ratio. - JST supervisory assessment considers: - Institution’s liquidity needs by currency, separate impacts of shocks in different currencies to reflect currency convertibility risk. - Ability to monetize liquid assets consistent with currency distribution of needs. - Whether limits and control framework reflect drivers such as currency mismatches. - COREP data collection on LCR and NSFR collects information on a significant currency basis ->at least 10 percent to receive specifications by currency. - Additional liquidity monitoring metrics (ALMM) to provide further specification per significant currency when in force in 2016. - For LSIs, MaRisk BTR 3.1 item 12 requires procedures for managing foreign currency liquidity risk in major currencies; LSIs must have separate liquidity overview, separate foreign currency stress tests and explicit inclusion in liquidity shortfall contingency plan when material FX liquidity risk exists. - BaFin did not set formal limits for foreign currency liquidity risk (e.g., special thresholds for foreign currency LCR); review of currency mismatches part of ongoing supervision; supervisors discuss mismatches and test mitigating instruments (swaps, hedges) under stress; supervisors act when excessive FX liquidity risks identified. ### Asset encumbrance and disclosure — AC1 (description and findings) - Supervisors assess extent to which asset encumbrance may adversely affect market appetite for unsecured debt and evaluate banks’ risk control framework for encumbrance. - SIs required to calculate and report: - Asset encumbrance ratio = encumbered assets / total assets. - Unencumbered eligible assets ratio = unencumbered ECB eligible assets / total assets. - Secured funding (covered bonds, ABS, REPO) increases encumbrance and reduces free unencumbered assets available in emergencies. - EBA Guidelines on disclosure of encumbered and unencumbered assets (published June 2014, reviewed in 2015) form basis for binding technical standards expected to be implemented in 2016; disclosure as part of “Pillar 3”. - IFRS 7 requires institutions to disclose information related to collateral and pledged assets in financial statements. - For LSIs MaRisk requires consideration of material risks including asset encumbrance (MaRisk AT 2.2 item 1); two encumbrance risk types addressed: risk to debtors from encumbrance and risk to bank’s own access to encumberable assets. - MaRisk BTR 3.1 item 4 requires continuous review of ability to cover liquidity requirements, focus on asset liquidity and maintaining sufficient sustainable liquidity reserves (highly liquid, unencumbered assets). - MaRisk AT 2.2 item 2 requires institutions to set up a risk inventory (overall risk profile) covering risks from asset encumbrance; MaRisk AT 5 item 2 requires written guidelines for internal organization and risk management; MaRisk AT 3 ensures management board responsibility; BTR 3.1 item 11 requires reporting liquidity position, stress test results and material modifications of contingency plan regularly to management board. - Monthly reporting to Bundesbank by LSIs shows asset encumbrance levels; supervisors monitor and follow up changes as part of routine liquidity calls. - Upcoming MaRisk version will contain explicit requirements for identification and reporting of asset encumbrance, including assessment in stress tests and contingency plans. ### Assessment of Principle 24 - Overall assessment: Largely compliant. - Key points: - Since 2007/08 supervisory engagement on liquidity risk intensified; frequency moderated as markets stabilized. - LCR and LiqV apply as Pillar 1 minimum standard; banks required to run regular stress tests and incorporate results into contingency plans. - EU LCR contains elements less stringent than Basel standard (notably wider HQLA definition); EBA analysis shows relatively large impact concentrated on non-internationally active banks; EU regulatory framework’s compliance with EC is problematic for internationally active banks. - Improvements ongoing in SREP liquidity risk assessment (benchmarks for liquidity risk indicators and guidance for assessing ILAAP to be developed/implemented in 2016); analysis of ILAAP not fully implemented at mission time and qualitative ILAAP assessment not fully featured in SREP for SIs. - SSM issued letter on supervisory expectations on ILAAP and harmonized information collection to enhance analysis and integration in SREP. ### Operational risk — Principle 25 (overview and findings) - Principle: supervisor determines banks have adequate operational risk management framework covering identification, assessment, evaluation, monitoring, reporting, control/mitigation. - Legal and regulatory basis: - Section 25(a) KWG and MaRisk (BTR4, AT 4.3.2) require operational risk processes for identification, assessment, control, monitoring and reporting. - CRR Articles 312, 320, 321 set requirements for standardized approach and AMA qualitative criteria (documentation, independence, reporting, review, validation, data flows transparency). - Supervisory activities and potential tools include: - Analysis of supervisory reporting (CoRep Templates 16 and 17), financial statements, internal documentation, internal controls assessment, external audit reports, meetings with external audit, meetings with bank staff, ongoing monitoring of risk indicators, thematic reviews (IT risk and cyber security), model approvals and validation, benchmarking and peer analysis, deep-dives, on-site inspections, ICAAP and SREP assessment, cooperation with local supervisory authorities. - Data collection and benchmarking: - ITS data submitted to JST depends on SI’s approach (AMA, standardized, BIA). Additional operational risk loss data collection underway. DGIV developing benchmarks for peer comparisons; process manual and work in progress. - On-site examinations: - Obtain assurance that operational risk policy and procedures cover relevant areas, documented, updated and available to staff. - Frequency for on-site examinations approximately three years for LSIs; Bundesbank conducts on-site inspections for LSIs. - LSI population: majority BIA, 28 standardized, one AMA bank. - Supervisory inputs for LSIs: annual external audit, management reporting, meetings with management body, internal audit reports, on-site examinations. - Identified weaknesses and areas for strengthening: - Need to enhance collection, classification and use of internal loss data and benchmarking against peers. - No dedicated operational risk specialist team at Bundesbank except for IT risk; operational risk examined as general competency across inspections. - Frequency and depth of on-site examinations for operational risk could be strengthened. - MaRisk contains general requirements but lacks specificity for loss data collection and integration into operational risk management. ### Operational risk essential criteria (EC1–EC8) — key observations - EC1: Legal framework and MaRisk set expectations; CRR Articles 320–321 detail qualitative AMA/standardized approach requirements; EBA SREP Guidelines form JST basis; supervisory activities enumerated above. - EC2: JSTs require management body to express operational risk strategy and tolerance; MaRisk AT 4.2 items require senior management define business and risk strategies; supervisory board to be notified; compliance confirmed via external and internal audit. - EC3: Integration of operational risk frameworks into day-to-day processes expected (CRR Art. 320(b), Art. 321(a)); JSTs verify management approval, review frequency, evidence of updates, and coverage of legal/compliance/ICT/reputational risks; need for further detail in SREP on quality of risk management and controls, especially for AMA banks. - EC4: Disaster recovery and business continuity (DR/BCP) assessment uses EBA Internal Governance (GL44) guidelines; MaRisk AT 7.3 requires contingency plans, regular testing and coordinated outsourcing plans; no prescribed minimum testing frequency in MaRisk — reliance on industry standards; scope for JST to pay greater attention to DR/BCP testing results. - EC5: IT policies and infrastructure requirements set in MaRisk AT 7.2; IT/Cybercrime identified as SSM supervisory priority in 2015; SSM conducts IT on-site inspections; LSIs obliged to ensure integrity, availability, authenticity and confidentiality of data and review IT suitability regularly. - EC6: Information systems for monitoring operational risk required under CRR for standardized/AMA approaches; BIA has no CRR requirements; JST assesses MIS reliability and accuracy via internal audit and on-site exams; need to enhance collection/classification/analysis of loss data and verify usage by senior management/board. - EC7: RTS on supervisory reporting (EU Regulation 680/2014) requires regular reporting of operational risk capital requirements (quarterly) and operational risk losses by business lines/event types (semi-annually) but does not fully capture forward-looking expectation to inform JST in a timely manner of developments affecting operational risk; EBA SREP guidance interpreted narrowly—broader forward-looking reporting desirable. - EC8: Outsourcing legal framework in CRD Article 85(1) and MaRisk AT 9 provides outsourcing requirements; JSTs use EBA outsourcing and internal governance guidelines; MaRisk AT 9 specifies material outsourcing identification, contract terms, continuity measures, audit rights, data protection, termination rights and monitoring. ### Additional criteria and supervisory practices on operational risk - AC1: JST/ECB horizontal functions may conduct specific scenario analyses with common assumptions, typically annual; horizontal analyses initiated in response to Key Risk Assessment; SSM initiated reviews on IT risk and conduct risk with other operational reviews planned in 2016; system-wide view of vulnerabilities a work in progress. - LSIs: MaRisk AT 8.2 item 1 requires impact analysis before material modifications to organization or IT systems; supervisors evaluate risk management systems of common service providers serving multiple banks; thematic analyses on common vulnerabilities not supervisory priority at time of assessment. - Assessment of Principle 25: Materially Non-Compliant. - Improvements since prior FSAP (dedicated IT risk team, targeted on-site IT exams) but weaknesses remain in data reporting, loss data collection/use, verification of effective implementation, DR/BCP testing. - Need increased supervisory focus on effective implementation verification, systematic assessment of loss data integration, enhanced on-site examinations for AMA banks, peer benchmarking development (DGIV work in progress), and system-wide analysis of operational risk common exposures (outsourcing providers). ### Internal control and audit — Principle 26 (EC1–EC4 summary of framework and practices) - EC1: CRD Art. 74.1 and Art. 76 establish expectations for robust governance, clear organizational structure, effective processes for risk identification/management/reporting, adequate internal control mechanisms, and risk management function independence and authority. - MaRisk implements section 25a KWG requirements; management board responsible for proper business organization and risk management; BBk and BaFin monitor compliance (BaFin off-site via reports and external auditors; BBk via on-site inspections). - Supervisors assess internal control across business model, internal governance, capital and liquidity risks, using risk-level and risk-control ratings with constrained judgement and documentation of rating changes. - Supervisors evaluate internal governance including role of board committees and internal audit independence. - Regular meetings with group and subsidiary management, at least annually with CEO, CRO, CFO and other key figures; JST dialogue integral to supervision. - EC2: Supervisors expect appropriate balance of skills/resources between back office, control functions and business origination units. - MaRisk AT 7.1 items 1 and 2 require staffing based on operational needs and risk situation; heads of risk control, internal audit and compliance require special qualifications; segregation of duties required (BTO item 3 MaRisk). - On-site BBk inspections review internal controls and audit; external auditors certify adequacy of internal controls. - EC3: Compliance function independence and adequacy: - MaRisk AT 4.4.2 requires compliance to support management board, report at least annually and ad hoc to management board and supervisory board; internal audit assesses compliance effectiveness. - External auditors and Bundesbank staff review these areas. - EC4: Internal audit function expected to be independent, permanent and effective to assess policies/processes/internal controls and ensure compliance — description and findings continue beyond provided excerpt. *Source: IMF staff assessment text (provided content unit).* ### Section 25a KWG and the MaRisk (AT 4.4.3) stipulate that all institutions must have an ### _cr16196 - Section 25a KWG and the MaRisk (AT 4.4.3) stipulate that all institutions must have an ### Internal audit function: legal requirements and responsibilities - Section 25a KWG and the MaRisk (AT 4.4.3) require all institutions to have an independent and a functioning internal audit function (exceptions allowed only for very small institutions). - Internal auditors are responsible for examining and assessing: - the effectiveness and appropriateness of risk management including the strategies and the internal control system; - the orderliness of all activities and processes of the credit institution regardless of whether outsourced or not; - adherence to regulatory provisions. - According to section 25c KWG the internal audit function reports to the management board and the supervisory board at appropriate intervals and at least once a quarter. ### Supervisor’s determinations for the internal audit function (EC5) - The supervisor determines that the internal audit function: - (a) has sufficient resources, and staff that are suitably trained and have relevant experience to understand and evaluate the business they are auditing; - (b) has appropriate independence with reporting lines to the bank’s Board or to an audit committee of the Board, and has status within the bank to ensure that senior management reacts to and acts upon its recommendations; - (c) is kept informed in a timely manner of any material changes made to the bank’s risk management strategy, policies or processes; - (d) has full access to and communication with any member of staff as well as full access to records, files or data of the bank and its affiliates, whenever relevant to the performance of its duties; - (e) employs a methodology that identifies the material risks run by the bank; - (f) prepares an audit plan, which is reviewed regularly, based on its own risk assessment and allocates its resources accordingly; - (g) has the authority to assess any outsourced functions. ### Description and findings regarding EC5 (MaRisk implementation) - Staffing and qualifications: - AT 7.1 items 1 and 2 MaRisk: institution staffing must be based in both quantitative and qualitative terms on the institution’s internal operational needs, business activities and risk situation. - Employees and their deputies must have the knowledge and experience required by their duties, competencies and responsibilities; suitable measures (e.g., on-the-job-training) must be taken to ensure appropriate qualifications. - This requirement applies to the internal audit function. - Reporting lines and independence: - The internal audit function is an instrument of the management board and is under its direct control; it must report to management board members (AT 4.4.3 items 2 MaRisk). - It can be subject to the direct control of one management board member, preferably the chairperson. - Chairperson of the supervisory body, in consultation with the management board, may obtain information directly from the head of internal audit. - BT 2.2 items 1 MaRisk: internal audit must perform duties autonomously and independently, not subject to instructions regarding reporting and evaluation activities. - Right to information and access: - AT 4.4.3 item 4 MaRisk: internal audit must have a full and unlimited right to information at all times. - Internal audit must be immediately provided necessary information, required documents and opportunity to review activities, processes and IT systems. - Internal audit must be informed of any management board instructions and resolutions relevant to its activities and of any material changes to risk management in a timely manner. - Audit planning and scope: - Activities must be based on a comprehensive audit plan updated yearly (BT 2.3 MaRisk). - Audit planning must be risk-oriented. - Activities and processes of the institution, even if outsourced, must be audited at appropriate intervals, as a general rule within three years. - Auditing must be performed annually if particular risks exist. - Activities and processes deemed immaterial from a risk point of view may be exempted from the three-year audit cycle. - Audit planning, audit methods and quality are to be reviewed and further developed regularly and event-driven. - Special audits required at short notice must be possible at any time. - Audit planning and any major adjustments must be approved by the management board. ### Assessment of Principle 26 (Internal controls and audit) - Assessment: Materially Noncompliant - Findings: - Internal controls and audit are reviewed during on-site inspections by BBk and are also reviewed annually for compliance with regulatory requirements by the external audit. - Independence concerns: - Independence of the internal audit and compliance officer is compromised because they direct-report to the management board and do not have an independent alternate reporting line to the supervisory board to discuss audit results without the management board present. - The supervisory board is only informed of a replacement of the internal auditor, compliance officer and risk officer ex-post. - Governance concerns: - The issue is aggravated by the generally passive role played by most supervisory boards; management oversight role is not robust (CP14). - Internal audit interaction with the supervisory board is through management board reports; management board members may join audit committee meetings. - SSM approach (SREP) and thematic review on Risk Governance and Risk Appetite highlight the need for direct and independent reporting to the Supervisory Board. ### Principle 27 and external financial reporting / audit (EC1–EC5) - Principle 27 summary: - Supervisor determines banks and banking groups maintain adequate and reliable records, prepare financial statements in accordance with accounting policies and practices widely accepted internationally, publish annual information that fairly reflects financial condition and performance and bears an independent external auditor’s opinion. - Supervisor also determines banks and parent companies have adequate governance and oversight of the external audit function. - EC1 – Responsibility and statutory framework: - Management board is responsible for drawing up the annual accounts as set out in section 242 HGB; annual accounts must be signed by all managers. - Section 340k HGB: annual accounts, management report and group accounts must be audited and certified (section 322 HGB) by an external auditor or accounting firm, irrespective of size. - Audit must include a comprehensive auditor’s report (section 321 HGB) in compliance with the Audit Report Regulation. - Annual accounts must be approved without delay by the supervisory board or general meeting (section 340k (1) HGB). - Documents must be disclosed in accordance with section 340l HGB in conjunction with section 325 HGB and filed with the electronic federal gazette (Elektronischer Bundesanzeiger); operator verifies timeliness and completeness and informs the Federal Office of Justice of deficiencies, which may consider administrative fines per section 335 HGB. - Section 28 (1) KWG: institution must notify BaFin and Bundesbank of the appointed auditor without delay; BaFin may request a different auditor within one month. - Failure to submit required annual account documents or submitting incorrectly can be punished by BaFin with fines under section 56 (2) no. 11 KWG or section 340n (1) HGB. - Financial statements are subject to audit by a German public auditor (Wirtschaftsprüfer) applying IDW Auditing Standards; content of ISA is consistent with IDW Standards where no conflict with German law. - Auditor required to prepare a “long form audit report” (PrüfbV) to be filed with supervisors. - EC2 – External auditor’s opinion and supervisory powers: - Section 25a (1) sentence 1 KWG and section 25a (1) sentence 6 no. 1 and no. 2 KWG: institutions must have proper business organization enabling accurate gauging of financial situation and complete documentation to permit BaFin monitoring. - HGB contains comprehensive recognition and valuation principles and presentation requirements for annual accounts; RechKredV (drafted by BaFin) contains further regulations; HGB updated according to EU Accounting Directive (RL 2013/34/EU) on 18 July 2015. - Regulation (EC) No 1606/2002 and section 315a (2) HGB: parent institutions may be required to prepare consolidated accounts in accordance with IFRS; option available under section 315a (3) HGB if not required. - Articles 32 to 35 CRR contain prudential filters for calculation of own funds. - Non-compliance allows BaFin to issue orders under section 25a (2) sentence 2 KWG; breaches can be fined under section 56 (2) no. 3 or 11 (b) KWG; BaFin can impose administrative fines under section 340n (1) HGB against responsible managers and take measures against responsible managers (formal warning or dismissal per section 36 (2) KWG). - EC3 – Valuation practices, independent verification and documentation: - Regulation 2002/1606 (Articles 4 and 5) requires IFRS for consolidated financial statements of EU companies with securities on a regulated market; Member States may extend application. - Art. 24 CRR: valuation of assets and off-balance sheet items must be effected in accordance with applicable accounting framework. - Art. 105 CRR: credit institutions must establish and maintain systems and controls sufficient to provide prudent and reliable valuation estimates; requires independent verification and validation and procedures for valuation adjustments between financial reporting and regulatory purposes. - Art. 34 CRR: applies Article 105 requirements to all assets measured at fair value for own funds calculation and requires deduction from Common Equity Tier 1 capital of additional value adjustments necessary. - Prudent valuation standard requirements include documented policies and procedures, independent reporting lines for valuation department, conservative marking to model rules, use of accepted market practice valuation methodologies, formal change control, periodic review, independent development/approval/testing of institution models, and appropriate documentation to recognize significant differences between financial reporting and regulatory valuations. - EBA published draft RTSs to specify conditions of Article 105 CRR on 23 January 2015. - EC4 – Scope and standards of external audits: - Audit Directive (2006/43/EU) Art 26: Member states shall require auditors and audit firms to carry out statutory audits in compliance with international auditing standards and may apply a national auditing standard if no corresponding international standard is adopted by the Commission. - Section 317 HGB and Section 29 KWG set provisions about scope of audit and auditor’s reporting/explanation duties for supervisory purposes. - PrüfbV (issued under section 29 (4) KWG) provides detailed provisions on supervisory object of the audit, timing and contents of the long-form auditor’s report and ensures items relevant to German banking supervisors are audited. - Section 2 PrüfbV: external audit should follow risk-oriented audit and consider materiality with regard to size, scope, complexity and level of risk. - Section 30 KWG: BaFin can instruct the auditor to focus on certain aspects during the audit. - EC5 – Audit coverage of key risk areas: - International auditing standards are generally expected to cover loan portfolio, loan loss provisions, non-performing assets, asset valuations, trading and other securities activities, derivatives, asset securitizations, off-balance sheet vehicles and adequacy of internal controls over financial reporting. - PrüfbV covers all areas mentioned, specifically: - a. risk management and organization (section 10 PrüfbV); - b. risk structure and risk provisioning (section 31 PrüfbV); - c. lending business, including derivatives and securitized assets (section 23 et seq. PrüfbV; exposures as defined by section 19 (1) KWG); - d. discussion of financial situation (section 29 PrüfbV); - e. discussion of profit and loss (section 30 PrüfbV); - f. discussion of consolidated companies (section 35 PrüfbV); - g. data synopsis required by section 60 PrüfbV. *Source: _cr16196 - Section 25a KWG and the MaRisk (AT 4.4.3) stipulate that all institutions must have an* ### Section 290 (2) No. 4 HGB contains provisions on the consolidation of special purpose ### _cr16196 - Section 290 (2) No. 4 HGB contains provisions on the consolidation of special purpose ### Consolidation of special purpose vehicles and audit obligations - Section 290 (2) No. 4 HGB contains provisions on the consolidation of special purpose vehicles. - According to section 35 PrüfbV the auditor has to examine if the consolidated statement is compliant with these provisions and has to discuss the regulatory basis of consolidation including differences to the accounting basis of consolidation. - Risks from off-balance sheet vehicles have to be incorporated appropriately according to annotation to AT 2.2 No. 2 MaRisk and will be encompassed by audit according to section 29 PrüfbV. ### EC6 — Supervisor power to reject or rescind auditor appointment - The supervisor has the power to reject and rescind the appointment of an external auditor who is deemed to have inadequate expertise or independence, or is not subject to or does not adhere to established professional standards. - Description and findings re EC6: - In accordance with section 28 (1) KWG, the institutions shall notify BaFin and Bundesbank of the auditor they have appointed without delay after making the appointment. - This duty of notification is intended to provide BaFin with a period of one month during which it may reject the auditor and request the appointment of a different auditor. - Rejection is only permitted where it is necessary to achieve the object of the audit. The object of the audit includes confirming that bookkeeping procedures and the annual accounts conform to the appropriate regulations, and assessing in detail the economic situation of the institution and its compliance with its reporting duties as set out in the KWG. - BaFin must have concrete, transparent findings supporting its request. Decisions are made on an individual basis and take into account experiences with previous audits. ### EC7 — Auditor rotation requirements - The supervisor determines that banks rotate their external auditors (either the firm or individuals within the firm) from time to time. - Description and findings re EC7: - The Audit Directive (2006/43/EU) sets out the rotation requirements for the key audit partner or partners on public interest entity engagements within a maximum of seven years from the date of appointment and is/are allowed to participate in the audit of the audited entity again after a period of at least two years. ### EC8 — Periodic meetings between supervisor and external audit firms - The supervisor meets periodically with external audit firms to discuss issues of common interest relating to bank operations. - Description and findings re EC8: - A standardized meeting is held once a year with the Banking Committee of the German Institute of Certified Public Accountants (IDW) which represents German individual auditors and audit firms. - Supervision of savings banks and cooperative banks involves annual meetings with the representatives of the regional associations, which also act as the statutory auditors of their affiliated institutions. - For significant institutions, supervisors meet regularly with auditors on the level of the individual institution. - Further meetings with auditors on a collective or individual basis are arranged if and when required on a case-by-case basis. ### EC9 — Auditor duty to report matters of material significance - The supervisor requires the external auditor, directly or through the bank, to report to the supervisor matters of material significance, for example failure to comply with the licensing criteria or breaches of banking or other laws, significant deficiencies and control weaknesses in the bank’s financial reporting process or other matters that they believe are likely to be of material significance to the functions of the supervisor. - Laws or regulations provide that auditors who make any such reports in good faith cannot be held liable for breach of a duty of confidentiality. - Description and findings re EC9: - The requirement of the “duty to report” is established in the CRD IV (Art 63(1)). - It is related to material breaches of laws, regulations or administrative provisions; issues which affect the ongoing functioning of the institution; and issues which may lead the auditor to refuse to certify the accounts or to the expression of reservations. *Source: _cr16196 - Section 290 (2) No. 4 HGB contains provisions on the consolidation of special purpose* ### Section 29 (3) KWG stipulates that if, in the course of his audit, the auditor learns of facts, which ### _cr16196 - Section 29 (3) KWG stipulates that if, in the course of his audit, the auditor learns of facts, which ### Auditor reporting, access to external auditors’ working papers (AC1) - Legal basis: Section 29 (3) KWG requires that "if, in the course of his audit, the auditor learns of facts, which might warrant the qualification or withholding of the certificate of audit, jeopardize the existence of the institution or fundamentally impair its development, which constitute a material infringement of the provisions on the institution’s approval requirements or the pursuit of business under this Act, or which indicate that the senior managers have severely infringed the law (including the banking supervision law), the articles of association or the partnership agreement, he shall report this without delay to BaFin and Bundesbank." - Additional criterion (AC1): "The supervisor has the power to access external auditors’ working papers, where necessary." - Description and findings re AC1: - "No EU-wide requirement as such. CRD IV (article 56) allows for the exchange of information, subject to professional secrecy between the supervisor and the auditor in the discharge of their supervisory functions." - "The German banking supervisors have no direct access to the external auditors’ working papers." - Under section 29 (3) KWG, "BaFin and Bundesbank have the right to request that the auditor explains his report to them." - If explanations "require great detail, the auditor will have to make use of his internal working papers, thus effectively granting the supervisors access to the information contained therein." ### Assessment of Principle 27 - Overall assessment: Largely Compliant - Comments: - "German HGB section 322 requires all credit institutions to produce annual accounts audited by an external auditor. CRD also requires audited statements of all credit institutions. BaFin can hold management responsible and impose fines for noncompliance with accounting standards." - "Overall, all essential criteria are met." - Identified deficiency relative to best practice: "Given the heavy reliance on the work of external auditors to determine banks’ compliance with supervisory requirements and determining asset quality and provisioning, the lack of power to review the external auditors’ work papers should be addressed in order to meet best international practices." ### Principle 28 — Disclosure and transparency (overview) - Principle statement: "The supervisor determines that banks and banking groups regularly publish information on a consolidated and, where appropriate, solo basis that is easily accessible and fairly reflects their financial condition, performance, risk exposures, risk management strategies and corporate governance policies and processes." - Coverage: Essential Criteria EC1, EC2, EC3 examined. ### EC1 — Periodic public disclosures (Description and findings) - Legal and regulatory framework: - Part Eight of the CRR requires disclosures on capital and capital requirements, risk management, credit risk, market risk, counterparty credit risk, securitization risk, equities risk, interest rate risk, asset encumbrance, leverage, operational risk, remuneration. - "Article 6 and 13 of the CRR require the disclosure of information in Part Eight CRR by all banks and investment firms on an individual, and where relevant consolidated basis for institutions (banks and investment firms)." - Regulation 1606/2002 (Article 4 and Article 5) governs mandatory application of IFRS to consolidated accounts of publicly traded companies and options for solo statements. - Specifics: - EBA technical standards and guidelines used for comparability: Article 437 CRR with Regulation (EU) 1423/2013; Article 451 CRR; Article 440 CRR; Article 441 CRR and Regulation 1030/2014; Article 443 CRR. - Pillar 3 information "is not required to be audited by the EU legislation." Practice: German SIs require "assurance by the external auditor at least annually that the Pillar 3 data is prepared in accordance with the national audit framework." - "Article 433 CRR requires disclosure of Pillar 3 information at least on an annual basis, in conjunction with the date of publication of the financial statements." - EBA Guidelines and BaFin circular 05/2015 implement materiality/confidentiality/frequency rules (EBA/GL/2014/14 transposed). - "Article 104 of CRD IV empowers supervisors to require additional disclosures for the purpose of the application of the regulatory requirements in the CRR." - LSIs and group-level requirements: - Commercial law requires LSIs to disclose annual accounts and management reports (Section 325 HGB). - Section 26a KWG requires disclosure of the group's legal and organizational structure and principles of proper management. - CRR institutions must include country-by-country reporting (transposition of Article 89 CRD) and "disclose in their annual report their return on assets, calculated as net profit divided by their total balance sheet (transposition of Article 90 of the CRD)." - "Pursuant to section 26a (2) KWG, BaFin can issue specific orders to remedy deficiencies in disclosure practice." ### EC2 — Scope and content of required disclosures (Description and findings) - Required content: - Disclosures include "financial performance, financial position, risk management strategies and practices, risk exposures, aggregate exposures to related parties, transactions with related parties, accounting policies, and basic business, management, governance and remuneration." - Title II and III of Part 8 CRR require disclosure of risk management objectives and policies, governance arrangements, risk exposures and remuneration policy. - Notable gaps/peculiarities: - Some disclosures (related party exposures and transactions, accounting policies) are required only in financial statements (IAS 24, IAS 1.117 to .124, IFRS 7.21) and not as part of Pillar 3; "German SIs are not required to disclose related party exposures or transactions with related parties as part of the Pillar 3 disclosures." - Materiality framework: Article 431(3) CRR, Article 432(1) CRR and EBA Guidelines on materiality/proprietary/confidentiality/frequency guide institutions' assessments and disclosure aggregation. - Verification and supervisory review: - Supervisor "paid attention to the content of Pillar 3 disclosures and for LSIs a sample of Pillar 3 disclosers was selected to verify compliance with the disclosure requirements." - For non-CRR institutions, "Section 16 of German Remuneration Ordinance for Institutions of 16 December 2013 (hereinafter referred to as “ROI”) contains provisions on disclosure" of remuneration design and amounts; disclosures are spot checked and double-checked against "an annual query on quantitative remuneration figures (remuneration benchmarking exercise)." ### EC3 — Disclosure of group structure (Description and findings) - Consolidation basis and disclosures: - "For supervisory purposes, the scope of consolidation is the CRD regulatory scope of consolidation rather than IAS/IFRS consolidation." - "Article 436(b) CRR requires the disclosure of an outline of the differences in the basis of consolidation for accounting and prudential purposes, with a brief description of the entities therein, explaining whether they are: (i) fully consolidated; (ii) proportionally consolidated; (iii) deducted from own funds; or (iv) neither consolidated nor deducted." - Financial statements disclosures (accounting scope) require names and registered offices of subsidiaries, associates, proportionally consolidated entities, indirect subsidiaries, immaterial entities excluded from consolidation and entities for which consolidation would be too onerous, proportions of capital and voting rights, and rationale for consolidation (Article 43(2)h) Directive 86/635). - IFRS references: IFRS 10, IFRS 11 and IAS 28; IFRS 12 requirements noted. *Source: IMF staff excerpt from the Germany country report section on Principles 27–28 and associated Essential and Additional Criteria.* ### Section 313 (II) HGB the Notes must contain contents with respect to all companies that have ### _cr16196 - Section 313 (II) HGB the Notes must contain contents with respect to all companies that have ### EC4 — Disclosure scope and enforcement - Notes under Section 313 (II) HGB must cover all companies consolidated in the annual accounts regardless of whether they are subsidiaries (fully owned), partially owned or associated companies. - For banks obliged to report according to IFRS, IFRS 12 defines additional disclosure requirements with respect to material associates, material joint ventures, material joint operations, subsidiaries and NCI as well as unconsolidated structured entities. - The supervisor or another government agency effectively reviews and enforces compliance with disclosure standards. - German SIs: JST verifies disclosure statements as part of the annual supervisory cycle. - EBA activities: - Reviewed disclosures on crisis-related exposures (2008 to 2010). - Assessed compliance of Pillar 3 disclosures with CRR disclosure requirements (from 2010 onwards); identified good practices and published reports. - MEL activity (2015) mandatory for all German SIs under ECB direct supervision resulted in recommendations to enhance reporting and Pillar 3 disclosures. - Compliance with IFRS disclosure requirements is ensured by BaFin and the Financial Reporting Enforcement Panel (FREP). - CRD assigns responsibility for administrative penalties for breaches in disclosure practice to the Member State; where German law provides sanctions, the ECB may impose sanctions on that basis. No examples of ECB sanctions for failure to meet IFRS standards were identified. - Cooperation: section 7 (1) sentence 2 KWG ties BaFin and Bundesbank to ongoing monitoring of institutions; Bundesbank monitors compliance with disclosure requirements from Part 8 of the CRR and informs BaFin of non-compliance. - Remedy and sanctions framework: - BaFin may demand appropriate disclosures; sustained deficiencies may prompt a specific order under section 26a (2) KWG. - Violation of such an enforceable order constitutes a breach of administrative regulations punishable by a fine pursuant to section 56 (6) no. 3 KWG. - Auditors must verify processes for assessment and disclosure per Part 8 CRR and section 26a KWG (section 24 PrüfbV) and discuss in their report whether appropriate disclosures have been made. - BaFin conducted compliance reviews of a sample of LSIs in 2015 to ensure Pillar 3 disclosures met standards; reviews covered all quantitative and qualitative requirements. No administrative sanctions were exercised in 2015 or 2014. ### EC5 — Publication of aggregate banking system information - Regulation and formats: - Commission Implementing Regulation No 650/2014 lays down format, structure, contents list and annual publication date for disclosed information. - Aggregate information includes texts of laws/regulations, options and discretions used in EU law, SREP criteria and methodologies. - Aggregate statistical data comprises: - number of banks and investment firms - total banking assets and share of GDP - total Tier I, total Tier 2 capital - total capital requirements - total capital adequacy ratio - own funds requirements by type of risks (in percent of own funds requirements) - credit exposure by exposure class (in percent of own funds requirements) - own fund requirements for operational risk by type of approach (in percent of total own fund requirements) - own fund requirements for market risk by type of approach (in percent of total own fund requirements) - EBA and ECB publications: - EBA publishes aggregate statistical data on implementation of the prudential framework for each Member State (national data on banking sector, credit risk, operational risk, market risk, supervisory actions). - ECB “Consolidated banking data” provides country-by-country aggregated balance sheet, P&L and supervisory ratios. - ECB banking statistics series (from SIs) under the “Revised communication framework for supervision” (SB/X/14/06.rev-2) provides consolidated data including profit and loss, balance sheet items, non-performing loans and provisions; indicators based on ITS on Supervisory Reporting include (i) balance sheet and P&L items and (ii) capital adequacy (RWA and capital levels/ratios). Further liquidity and leverage indicators to be added when available. - Publication milestones and reporting scope: - First publication took place at 30 June 2015 with 2014 year-end data covering all German SIs; statistics updated yearly. - SIs reporting only individually and/or under national GAAP to be included after they start reporting FINREP as of fourth quarter of 2015. - LSIs required to report FINREP as of second quarter of 2017 for inclusion in subsequent updates. - BaFin annual report contains banking industry economic environment, sector development and aggregated risk profile information. - Bundesbank monthly reports provide analyses and comprehensive statistical material (balance sheet totals and relevant asset/liability items). - BaFin and Bundesbank joint website contains statistical data on national banking sectors including credit risk, operational risk, market risk and aggregated BaFin actions; part of EU supervisory disclosure requirements under Article 143 of CRD IV. ### AC1 — Disclosure of over-the-period metrics and assessment - Disclosure requirements promote information useful for understanding a bank’s risk exposures over a reporting period, but disclosures are more often provided using end-of-period values. - CRR references some average or over-the-period values, but there was no evidence these inputs are used in the risk assessment to date. - Specific CRR/IFRS requirements cited: - Article 442 c) CRR: disclosure of total amount of exposures after accounting offsets and without credit risk mitigation, and the average amount of the exposures over the period broken down by exposure classes. - Article 449 n) iv) CRR: disclosure of a summary of securitization activity of the current period including amount of exposures securitized and recognized gain or loss on sale. - Article 443 CRR: asset encumbrance disclosures made using median values. - IFRS 7.42 G c): where transfer activity qualifying for de-recognition was not evenly distributed, requires disclosure of timing and amounts recognized in that part of the reporting period. - IFRS 12.27: sponsored entities without sponsor interest require disclosure of income from those structured entities during the reporting period and carrying amount at time of transfer of assets transferred during the reporting period. - For LSIs, supervisors have adjusted disclosure frequency in some cases, but to date no systematic requirement for non-end-of-period data; such data has not influenced supervisory analysis outcomes. - Assessment of Principle 28: Largely compliant. - Comments: Disclosure standards align with Basel II Pillar 3; supervisors confirm compliance via sample testing and thematic reviews. Related party exposures are disclosed under HGB in annual reports, not in Pillar 3 disclosures. ### Principle 29 — AML/CFT framework (EC1 and EC2) - EC1 — Legal framework and supervisory duties: - AML-CFT legal framework includes the AML-Act (Geldwäschegesetz – GwG), KWG, Regulation (EC) No. 1781/2006, and PrüfBV obligations for auditors. - Directive 2005/60/EC (3AMLD) is minimum harmonization; Member States may adopt stricter measures. Art 37 and Art 5, 3AMLD referenced. - GWG and KWG require BaFin to monitor and take necessary action; framework satisfies 3AMLD and this EC. - EC2 — Bank policies/processes and supervisory verification: - Section 25a para 1 KWG requires proper business organization including internal control system and IA function. - Section 9 (2) no. 2 GwG and section 25h para 1 KWG require banks to develop/update internal principles, business and customer-related safeguards and controls to prevent ML/TF; section 25h para 1 KWG extends to other criminal activities; section 25h para 9 KWG requires a central unit or person (MLRO). - Guidance on central unit: “DK-Hinweise”, nr. 89. - Section 11 para 1 GwG requires reporting of suspicious transactions to the FIU and competent law enforcement authorities; amendments clarified a low threshold of suspicion. MoF guidance adopted by BaFin (Circular Letter 1/2014 (GW)). - BaFin AML/CFT supervision: - Dedicated BaFin department GW responsible for AML/CFT across entities under BaFin mandate with estimated entity counts: - credit institutions: 1800 - securities investment firms: 98 - payment services organizations: 32 - e-money agents: 100,000 - financial services firms: 750 - insurance entities: 130 - GW consists of six divisions with approximately 110 staff. - Department GW2: total staff 18, of which 12 are supervising credit institutions. - Each supervisor has approximately 200 credit institutions in their portfolio, ranging from large complex cross-border institutions to small monoline regional institutions. - Audit and supervisory inputs: - Annual EA report: all credit institutions required to have this audit annually; report provided and testified by external auditor and submitted to Bundesbank (BBk) and BaFin. - PrüfBV (section 6) prescribes scope of the audit for AML/CFT compliance and requires the auditor to opine on compliance with KWG and GWG. - BBk assesses bank risk profile including ML/TF risk using the EA report. - BaFin uses the ML/TF part of the EA report and other information to assess compliance and classify a bank’s ML/TF risk as part of general risk classification. - On-site examinations and enforcement: - BaFin is empowered to carry out on-site inspections alone or by commissioned auditors. - Two typical types: targeted on-site examinations (partially accompanied by BaFin staff) and auditor-accompanied examinations. - Targeted on-site examinations in banks and branches: - 2015: 26 in banks and 6 in branches of foreign banks - 2013: 26/6 - 2014: 28/8 - 2012: 2012 noted as special due to extraordinary campaign - Targeted on-site examinations focused on the account data retrieval system (section 24c KWG): - 2011: 8 - 2012: 10 - 2013: 10 - 2014: 1 - 2015: 10 - Number of auditor-accompanied examinations increased during 2015. - Where BaFin detects AML/CFT shortcomings it can issue orders/instructions and sanction responsible persons or institutions (dismissal, withdrawal of license, administrative fines) under GwG (sec. 17) and KWG (e.g., sec. 35 para. 2 No. 6). - Risk-based supervision and review cycles: - BaFin developed a 12 cell risk matrix combining inherent risk and quality of safeguards; matrix accounts for size, complexity, inherent risk profile and risk mitigants; larger, more complex banks typically receive greater supervisory intensity and frequency. - Review cycles: - Low risk credit institutions: EA report reviewed on at least a four-year cycle. - Highest rated credit institutions: EA report reviewed and assessed approximately every year. - Streamlining: external auditors requested to prepare a checklist of findings in the context of AML/CFT and prevention of other criminal activities to help identify deficiencies in EA reports. *Source: _cr16196 - Section 313 (II) HGB the Notes must contain contents with respect to all companies that have* ### Annex 6 to the PrüfBV, which was implemented in 2010. ### Annex 6 to the PrüfBV, which was implemented in 2010. ### Annex 6: purpose and rating system - Annex 6 obliges the EA to rate the outcome from the audit regarding ML/TF and other criminal activities by using a rating system of F0 – no deficiencies to F4 – severe deficiencies (resp. F5 – non applicable). - A copy of Annex 6 is submitted and checked for each bank annually (for banks with a balance sheet of not more than 400 Mio. Euro every two years) by BaFin staff to determine whether there are evidences of higher risk issues (e.g., F4 and F3) and if so will single out the credit institutions for follow up. ### Off-site and on-site supervision practices - Additional off-site information sources: results from previous on-site examinations; interviews with institutions; meetings with association bodies; meetings with law enforcement officials; STR reports from FIU. - On-site examination cycle: - Lower risk credit institutions: approximately every ten years. - Largest credit institutions: typically more frequently. - BaFin accompaniment and assessment of EA: - BaFin will accompany the external auditor when conducting its annual audit of a credit institution which typically lasts for between 2-3 days. - BaFin will also assess the work of the EA. - Targeted AML/CFT examinations typically last for between 2-3 weeks and consist of meetings with compliance officers, management, sample testing and an in-depth review of risk management and controls. - Scope and scale: - The number of on-site examinations and EA accompany exams equates to approximately 5 percent of the population of credit institutions supervised by the BaFin. - Recent operational shift: - Reduction in targeted on-site examinations is largely a result of adjusting the emphasis of how the on-site process is applied, preferring to increase the number of EA accompanied on-site examinations. ### ECB role and BaFin-ECB coordination - ECB direct prudential supervision role: responsible to supervise the general risk management and controls at an enterprise wide level which is linked to AML/CFT compliance issues; AML/CFT will be captured as part of the overall ECB’s supervision. - Two-way communication flow via BaFin staff participating in the SI JSTs: - BaFin staff help to identify AML/CFT priorities for ECB supervision. - BaFin makes the ECB aware of AML/CFT issues as input into ECB’s supervision of risk management. ### Reliance on External Auditors and limitations - BaFin’s risk-based framework is mainly based on information received from the EA, supplemented by other information on quality of risk management and controls and AML/CFT implementation. - To enhance the quality of EA reports: - BaFin together with the Banking industry produced detailed interpretation and implementation guidelines (“Auslegungs- und Anwendungshinweise”) regarding the AML/CFT provisions in the GwG and the Banking Act. - BaFin meets annually with the auditors association (“IDW”) to discuss issues from recent assessments. - Capacity constraint: - BaFin’s capacity to make an own first-hand verification of the accuracy of the work of the EA as well as its own verification of the implementation of controls by banks to prevent AML/CFT abuse is limited due to the existing personal resources. ### Reporting to supervisor and information flows (EC3) - Legal and procedural framework: - STRs are not required to be reported to BaFin; banks report STRs to the FIU and law enforcement agencies (LEAs). - If the FIU or LEAs identify an STR relevant for BaFin’s mandate, they are required to notify BaFin of material STRs. - BaFin notifications received: - In 2015, BaFin received between 5-10 notifications by LEAs in relation to individual institutions. - BaFin actions and engagement: - BaFin holds meetings with law enforcement agencies to obtain insight into the type, volume and nature of STRs across the German banking system. - Periodic meetings are held with a range of institutions throughout the year including: law enforcement, AML compliance officers and industry associations. - Regulatory obligations on banks related to suspicious activity and preventative controls: - Section 25h para 1 KWG: banks and financial services institutions must develop and update internal principles, appropriate business and customer-related safeguards and controls and perform inspections to prevent fraudulent activity to their detriment. - Banks are required to implement policies and procedures for the prevention of AML and CFT, including appropriate data management systems and electronic monitoring of business relations and transactions. - Banks must provide sufficient AML/CFT training to staff. - Suspicious cases must be internally recorded and presented directly to the AML compliance officer for assessment and decision; reasons for abstaining from filing an STR must be documented. - All reports (including internal reports that have not resulted in an STR) need to be recorded and retained for at least five years. - Supervisor awareness concerns: - Banks are not required to report to the banking supervisor suspicious activities including STRs and other incidents of fraud when such activities/incidents are material to the safety, soundness or reputation of the bank; nevertheless there are circumstances where banks will make the supervisor aware if there is a material incident/STR. - BaFin becomes aware of STRs and other incidents regarding ML and TF through regular interaction with the FIU and law enforcement officials. - Given the size of the German bank sector, its connectedness within Europe (rated as high risk by the FATF MER in 2010), the number of STRs reported by banks as well as the low volume of STRs reported to BaFin does not provide a sound basis for BaFin to be fully aware of whether banks’ implementation of STR reporting requirements is effective. - A more systematic mechanism is needed for BaFin to be kept aware of the type, volume and trends in STR reporting by banks as an input to its ongoing surveillance of the banking system and of individual banks. ### Supervisor reporting to FIU and LEAs (EC4) - Legal duties to report: - Cases covered by criminal law are exceptions to professional secrecy of supervisors as provided for in Art 53 CRD IV. - Art 25 of 2005/60/EC3AMLD establishes the obligation of supervisors to inform the FIU promptly if they discover facts that could be related to money laundering or terrorist financing in the course of their supervisory work. - Section 16 para 2 GwG: where factual circumstances indicate assets or property connected with a transaction are the product of an offence under section 261 of the Criminal Code or related to terrorist financing, competent supervisory authorities shall promptly report such circumstances to the FIU of the Federal Criminal Police Office and the competent LEAs, section 14 para 1 GwG. - BaFin reporting volumes (reported to FIU and LEAs, per Annual Reports of the FIU): - 2013: 65 - 2014: 157 - 2015: 118 - Reports regarding agents account for most of these STRs. - Ongoing coordination: - Periodic meetings are held with law enforcement, AML compliance officers and industry associations throughout the year. ### Customer Due Diligence requirements and supervisory assessment (EC5) - CDD program essential elements expected on a group-wide basis: - (a) a customer acceptance policy that identifies business relationships the bank will not accept based on identified risks; - (b) a customer identification, verification and due diligence program on an ongoing basis, including verification of beneficial ownership, understanding the purpose and nature of the business relationship, and risk-based reviews to ensure records are updated and relevant; - (c) policies and processes to monitor and recognize unusual or potentially suspicious transactions; - (d) enhanced due diligence on high-risk accounts, including escalation to senior management for decisions on entering or maintaining such relationships; - (e) enhanced due diligence on politically exposed persons (escalation to senior management for decisions on entering or maintaining relationships with PEPs); - (f) clear rules on records to be kept on CDD and individual transactions and their retention period of at least five years. - German and EU legal framework highlights: - Chapter II of the 3AMLD sets out CDD requirements including simplified and enhanced due diligence. - Section 3 (1) no. 1 GwG: banks must identify the contracting party. - Section 6 (2) no. 1 GwG: banks must take appropriate risk-based measures to determine whether the contracting party is a natural person based outside the country who is or has been entrusted with prominent public functions (PEPs). - Section 3 (1) no. 3 GwG: banks must clarify whether the contracting party is acting on behalf of a beneficial owner and, if so, identify the beneficial owner. - Section 3 (1) no. 2 GwG: institutions must seek and obtain information on the purpose and the intended nature of the business relationship. - Section 3 (6) GwG: if a bank cannot fulfill CDD requirements, it may not establish or continue a business relationship or carry out any transactions. - Section 3 (1) no. 4 GwG: continuous monitoring of the business relationship, including transaction consistency with customer profile; update documents, data or information at appropriate intervals. - Section 3 (2) no. 4 GwG: update CDD information where there is doubt as to veracity of previously collected information. - Section 4 (3) GwG: prescribes which type of ID information must be obtained from natural persons (para 3 no. 1) or legal persons (para 3 no. 2) during CDD. - Section 8 para 3 GwG: all information obtained during CDD must be retained for a period of at least five years. - Art 8, Art 9(5), Art 9(6), Art 13 and Art 20 of the Directive further set out obligations for identification, verification, monitoring, enhanced due diligence and attention to high-risk or unusual transactions. - Art 13.4 and Commission Directive 2006/70/EC set out detailed rules for PEPs including senior management approval, establishing source of wealth and source of funds, and enhanced monitoring. - Chapter IV mandates record-keeping of evidence obtained when applying CDD measures and supporting evidence of all transactions and business relationships for at least five years after termination of the business relationship or carrying out the transaction. - Supervisory assessment inputs: - The main input to determine whether banks have effectively implemented adequate CDD policies and processes is the EA report, conducted for all credit institutions and submitted to the BBk and BaFin. - According to individual risk classification and using a supervisory risk-based framework, BaFin will select a sample of banks to conduct on-site examinations during the supervisory cycle. *Annex 6 to the PrüfBV, implemented in 2010 (content unit)._ ### Annex 6 report which is a high level summary of banks’ compliance with the AML/CFT ### Annex 6 — High-level summary of banks’ compliance with the AML/CFT ### Correspondent banking (EC6) - Legal requirements cited: - Art 13(3), 3AMLD applies to correspondent banking and requires that a bank "must gather sufficient information about the respondent institution in order to fully understand the nature of its business, to determine the quality of its supervision and the reputation of the correspondent bank." - Art 13(5) prohibits credit institutions from entering into or continuing a correspondent banking relationship with a shell bank and requires that credit institutions take appropriate measures to ensure that they do not engage in or continue previous correspondent relationships with a shell bank. - Findings: - Review of a sample of EA reports showed correspondent banking was considered in EA reports to varying degrees depending on materiality for the business model. - The information in EA reports was "not sufficiently detailed" to detect changes in business model, number of new correspondent relationships, or shifts toward higher risk locations. - Correspondent banking is considered a high risk activity and is referenced as such in the German banking law. - Risk monitoring for correspondent banking "is complex and requires a transaction-level monitoring." - Implication: - "A more in-depth knowledge of the bank’s business model is required to fully assess the inherent risk of correspondent relationships of AML/CFT." ### Supervisory monitoring and powers (EC7–EC8) - EC7 (controls and systems to prevent, identify and report abuses): - Legal basis: Art 37, 3AMLD requires supervisors to monitor banks’ compliance with the Directive’s requirements, including measures to prevent and detect money laundering and terrorist financing and to report suspicious transactions. - Cross-reference: (See EC 1-4). - EC8 (adequate powers to take action): - Legal basis: Art 39, 3AMLD requires MS to ensure natural and legal persons can be held liable and that penalties are "effective, proportionate and dissuasive"; administrative measures/sanctions must be available in conformity with national law. - National development: In June 2013, section 30 OWiG (“Regulatory fine imposed on legal persons and on associations of persons”) was amended, increasing the maximum amount of the fine in the case of a criminal offence by the factor ten: - "ten million Euros in cases of intent, five million Euros in cases of negligence." ### Governance, controls, staffing and reporting (EC9–EC11) - EC9 (internal audit/external experts, compliance officers, screening, training): - 3AMLD provisions: - Art 34: obliged entities establish "adequate and appropriate policies and procedures", including internal control, risk and compliance management and communication. - Art 22 (2): obliged entities must designate a person in accordance with Art 34 (including the person who will normally report suspicious transactions to the FIU). - Art 35(2): obliged entities must ensure staff are aware and receive training to recognize money laundering and terrorist financing and to know how to proceed. - Findings: - Internal auditing departments must examine compliance with GwG duties; examination reports must be drawn up and submitted at least once a year to the management board and include: - description of internal reporting system for suspicious transactions; - detailed information on the type, number and local occurrence of suspicious transactions reports filed with competent law enforcement authorities in accordance with section 11 GwG; - information on termination of business relationships; - assessment of adequacy and sufficiency of measures adopted by the bank to prevent ML/TF and whether the compliance officers (AML) fulfilled assigned tasks. - Compliance officer (AML) is obliged to annual reporting to the board of management. - EC10 (staff reporting procedures and management information systems): - 3AMLD Art 27 provides protection of staff who report suspicions internationally or to the FIU. - Credit institutions must draw up service and organizational instructions to ensure written reports on all internal cases of suspicion are submitted to the compliance officer (AML) and documented; internal audit must examine compliance; ad-hoc information to management board required for single cases with deep reputational impact. - EC11 (legal protection for reporters): - Article 26, 3AMLD: a disclosure in good faith by an institution or an employee shall not constitute a breach of restriction on disclosure and shall not involve the institution, person, directors or employees in liability of any kind. - Article 27: Member States shall take appropriate measures to protect employees who report suspicions either internally or to the FIU from threats or hostile action. ### Cooperation and specialist resources (EC12–EC13) - EC12 (cooperation with domestic and foreign supervisors): - CRDIV provisions apply (see Principles 3 and 13). - Audit regulation requires the EA to provide assurance regarding offshore activities; however, EA places reliance on internal and external sources to confirm compliance. - BaFin extended its on-site program to include offshore operations; in 2013 it conducted an off-site program to several jurisdictions to assess compliance with AML/CFT obligations. - EC13 (in-house specialist expertise and risk communications): - Art 37 (2), 3AMLD: adequate resources must be at disposal of competent authorities to perform functions, including ensuring banks’ compliance. - Art 35 (2) and (3): obliged entities must have access to up-to-date information on ML/TF practices and feedback on suspicious transaction reports where practicable. - Finding: BaFin "has no legal responsibility and no specific expertise for addressing criminal activities." BaFin "cooperates closely with the Federal Criminal Police Office – Financial Intelligence Unit and LEAs" and shares expertise to strengthen supervisory quality. ### Assessment of Principle 29 — Findings and overall conclusion - Assessment: Largely Compliant - Key findings: - Germany has introduced reforms to enhance AML/CFT (criminalized self-laundering; immobilized bearer shares; enhanced domestic cooperation; improved supervisory framework for DNFBPs; improved risk analysis model applied by BaFin). - On-site visits to financial institutions and DNFBPs have increased. - A national assessment of ML/TF risks is currently being conducted in light of the revised AML/CFT standard. - While legislation is generally comprehensive, supervisory practices need strengthening to ensure high standard compliance is maintained. - Specific supervisory framework observations: - BaFin has a risk-based framework based on a matrix of inherent risk and quality of safeguards that recognizes size, complexity and inherent risk profile and risk mitigants. - The framework is calibrated so larger, more complex banks typically receive greater supervisory intensity and frequency; low risk credit institutions receive less frequent attention. - The framework "should help focus supervisory attention on the highest risk institutions," but inputs need refinement to be fully risk-based. - The framework is "mainly reliant on the EA report" to identify deficiencies, despite BaFin steps to enhance EA report quality. - Ongoing monitoring "needs to be more systematic" through off-site surveillance that includes first-hand analysis and verification of banks’ AML/CFT risk management and controls. - Coverage through on-site examinations should be expanded by increasing the number of targeted examinations and auditor-accompanied examinations and the personal resources necessary given the size of the German bank sector and its connectedness within Europe (rated as high risk by the FATF MER in 2010). - A more systematic mechanism for information flow from the FIU and LEAs to BaFin regarding identified non-compliance (including STRs not being reported immediately) "would be desirable" to keep BaFin aware of type, volume and trends in STR reporting (EC3). - Supervisory assurance that CDD policies and processes are integrated into a bank’s risk management "rely mainly on the EA report" (EC5). ### Policy recommendations and supervisory priorities - Strengthen supervisory practices to reduce undue reliance on the EA report by: - refining inputs into the risk-based framework to be fully risk-based; - increasing off-site surveillance using first-hand analysis and verification of AML/CFT controls; - expanding the number and scope of on-site examinations (targeted and auditor-accompanied); - increasing personal resources for AML/CFT supervision commensurate with the size and interconnectedness of the banking sector. - Improve monitoring of correspondent banking by: - obtaining deeper, transaction-level information and ongoing intelligence on changes in correspondent business models, new correspondent relationships, and shifts toward higher risk locations; - ensuring EA reports contain sufficient detail or supplementing EA reports with in-depth supervisory assessments where needed. - Enhance information sharing arrangements by: - establishing a more systematic mechanism for the FIU and LEAs to inform BaFin of identified non-compliance, including delayed or absent STR reporting, to inform off-site surveillance and supervisory prioritization. - Build specialist AML/CFT expertise within supervision by: - strengthening cooperation channels with Federal Criminal Police Office – Financial Intelligence Unit and LEAs and formalizing regular knowledge transfers to BaFin; - ensuring adequate in-house resources are available to perform AML/CFT supervisory functions as required by Art 37 (2), 3AMLD. - Ensure governance and reporting by banks: - require consistent, comprehensive annual internal audit reports to management boards covering internal reporting systems, STR statistics, termination of relationships, and assessments of AML/CFT measures and compliance officer performance. ### Selected Basel Core Principles — grades and salient comments (excerpt) - Core Principle 1. Responsibilities, objectives and powers — Grade: C - Comment: Division of responsibilities between BaFin and Bundesbank regarding LSIs supervision seems clear; SSM framework evolving with uncertainties regarding operational roles. - Core Principle 2. Independence, accountability, resourcing and legal protection for supervisors — Grade: LC - Comment: Operational independence exists; MoF approval of BaFin organizational matters and budget committee composition may indirectly affect supervisory priorities/timeliness. - Core Principle 3. Cooperation and collaboration — Grade: C - Comment: Cooperation channels are highly developed and effective. - Core Principle 4. Permissible activities — Grade: C - Comment: Permissible activities are well defined in German legislation. - Core Principle 5. Licensing criteria — Grade: LC - Comment: ECB and BaFin have clear criteria; financial suitability of shareholders often limited to availability of initial capital; supervisory board assessment not customarily assessed historically. - Core Principle 6. Transfer of significant ownership — Grade: C - Comment: Process identifies ultimate beneficial owners but fit-and-proper requirements should be strengthened. - Core Principle 7. Major acquisitions — Grade: MNC - Comment: Investments not exceeding 15 percent of capital do not require ex-ante consultation or approval; acquisition of holdings in an EU regulated financial entity assessed from perspective of target; acquisition by a bank of a non-EU bank not covered by CRR or CRDIV. - Core Principle 8. Supervisory approach — Grade: LC - Comment: SSM introduction brought positive externalities; SREP/RAS processes and methodology still evolving; greater emphasis needed to verify reliability, accuracy, and integrity of information used for risk assessments. *Source: Annex 6 — report summarizing banks’ compliance with AML/CFT (excerpt).* ### 9. Supervisory techniques and tools LC ### 9. Supervisory techniques and tools LC ### Overview - Overall supervisors of German banks take an active approach to using supervisory tools. - The supervisory manual and associated frameworks provide a sound basis to perform comprehensive risk assessments using a mix of on-site and off-site supervision activities. - Annual risk assessments and the SREP process allow integration of off-site and on-site supervision into a single overall view of all material risks and necessary measures. - Supervision manuals are detailed and guide the risk assessment process systematically. - On-site examinations are an effective tool to focus on deficiencies in risk management. ### Key findings and deficiencies in supervisory approach - Gaps exist in the approach to on-site and off-site supervision that need to be addressed: - For LSI off-site supervision there is an undue reliance on the work of the external auditor. - The annual EA report contains significant detail, but off-site supervision needs greater use of other inputs into the risk assessment process. - Results of on-site examinations for SIs are not ranked by degree of severity: - While communication of findings at the conclusion of the examination process is clear, communications to banks do not prioritize findings from high priority to low. - Lack of prioritized findings makes it unclear for banks how to prioritize remedial actions. - A ladder of severity is recommended to ensure management and supervisory boards prioritize remedial action according to severity. ### Data, reporting, and supervisory reporting issues (CP10 and related) - Supervisory reporting is predominantly governed by a harmonized EU regime. - Application of regulatory data requirements (FINREP/CoRep) is not uniform; some banks do not report a comprehensive suite of data for off-site analysis based on common definitions. - Analysis of regulatory data is hampered by a lack of granular data. - Supervisors need to perform manual calculations to map exposure values from nGAAP to IFRS, inhibiting systematic and consistent comparisons between different accounting treatments. - Processes to map supervisory data reported using different accounting treatments were in progress and not consistently applied at the time of the mission. ### Use of supervisory powers and enforcement (CP11) - German law and SSMR provide a broad range of supervisory actions. - Direct enforcement powers and sanctions of ECB are limited; ECB can make use of enforcement and sanction powers available to BaFin. - At the time of the mission, ECB had not directly applied any sanction or enforcement action. - BaFin has an adequate set of supervisory tools, but actual use of formal powers in practice is not intensive. - No laws or regulations guard against BaFin or ECB unduly delaying appropriate corrective actions. ### Selected Core Principle assessments and supervisory practice highlights - Consolidated supervision (CP12): A consolidated supervisory approach exists at SI and LSI levels; supervisory colleges and MOUs support detailed planning and comprehensive group review; ring-fencing powers are available. - Home-host relationships (CP13): Collaboration and coordination with domestic and cross-border supervisors is highly developed; EU supervisory coordination is based on joint supervision through the SSM, colleges led by home country coordinators, and MOUs with third-country supervisors. - Corporate governance (CP14): Germany has well-developed corporate governance requirements; oversight role of the supervisory board is passive and operational oversight limited; fit-and-proper process streamlined for supervisory board members and technical knowledge requirements streamlined. - Risk management process (CP15): Anchored in MaRisk; MaRisk revised most recently in January 2016 to incorporate risk culture and risk aggregation; ICAAP integrated into risk assessment framework; ICAAP and ILAAP guidelines recently released by the ECB, but no published minimum standards to date. - Risk function reports to Management Board and the CEO, not directly to the Supervisory Board, which may weaken the independence of the CRO and risk function. - Capital adequacy (CP16): Deviations from Basel standards regarding capital definition do not seem material in general, though may be for specific banks (deduction of participation in insurance, for instance). - RCAP found deviations potentially significant for Germany: sovereign exposures under permanent and temporary partial, lower risk weights for covered bonds, and counterparty credit risk framework. - Some deficiencies being addressed by banks’ internal capital adequacy assessments and supervisory action. - Both ECB and BaFin can require capital in excess of minima under Pillar 2, but practice is not commonly used; ECB had concluded one SREP cycle where some banks were required to implement Pillar 2 add-ons. - Leverage is taken into account in the SSM SREP methodology, not yet systematically so by BaFin. - Credit risk (CP17): General guidance exists and is monitored; granularity of credit portfolio data is limited (see CP18). - Problem assets, provisions, and reserves (CP18): Loan valuation performed by external auditors with limited supervisory involvement; loan classification guidelines not issued; neither MaRisk nor the KWG define nonperforming, cured, restructured and renewed loans. - Supervisors do not re-classify loans or request increased provisions and rely on capital add-ons. - Supervisor expectations on loan valuation and guidelines should be communicated and discussed with bankers and auditors. - Concentration risk and large exposure limits (CP19): ECB internal procedures aligned with the CP, MaRisk provides general framework, but supervisor expectations on concentration risk management are not clearly communicated. - No requirement that all material concentrations be regularly reviewed and reported to the supervisory board. - Transactions with related parties (CP20): Definition of related parties is wide; framework covers loans broadly but excludes some dealings such as service contracts, asset purchases and sales, construction contracts. - Related party loans must be on market terms, but no requirement to exclude conflicted individuals from the granting/managing process. - No requirement that related party exposures be monitored and controlled separately and in aggregate; no regular reporting of related party exposures; supervision mostly by external auditors. - No limits on related party exposures imposed by laws, regulation, or supervisor. - Country and transfer risks (CP21): Little guidance from supervisors on expectations regarding country risk; standard reporting based on LrV excludes several countries. - No specific requirement that bank MIS identify, aggregate, monitor and mitigate country risk; no specific requirement to include country risk in stress testing. - No evidence country risk is a regular part of stress testing. - Market risk (CP22): MaRisk obligations are generally sound; market risk was a supervisory focus during 2014 and 2015; supervisors periodically review banks’ market risk management. - Interest rate risk in the banking book (CP23): IRRBB is a key supervisory priority; banks required to measure, calculate and report IRRBB quarterly and to conduct regular stress testing using standardized and bespoke scenarios. - Liquidity risk (CP24): Supervisors increased interaction on liquidity risk since 2007/08; LCR and LiqV apply as Pillar 1 minimum standards. - EU LCR adopted contains elements less stringent than Basel (notably wider HQLA definition); EC 1 states internationally active banks should not have requirements lower than applicable Basel Standard. - EBA analysis shows relatively large impact from these changes, with concentrated impact on non-internationally active banks. - Aspects of ILAAP assessment in SREP were under development; benchmarks for liquidity risk indicators developed during 2016; guidance for assessing ILAAP to be implemented for 2016. - SSM issued a letter on Supervisory expectations on ILAAP and harmonized information collection to enhance ILAAP analysis and SREP integration. - Operational risk (CP25): Enhancements since last FSAP, notably strengthening of dedicated IT risk specialists; areas needing strengthening include data reporting, collection and use of loss data, verification that risk management is implemented, and DR/business continuity. - Internal control and audit (CP26): Independence of internal audit and compliance is compromised as they report to the management board. - Financial reporting and external audit (CP27): Banking supervisors do not have legal power to access external auditors’ work papers; given heavy reliance on external auditors, this gap should be addressed. - Disclosure and transparency (CP28): Disclosure standards are generally sound and reflect Basel II Pillar 3; supervisors confirm compliance via sample testing and thematic reviews. - German banks do not disclose related party exposures as part of Pillar 3 disclosures (EC2); related party disclosures are covered by the Commercial Code (HGB) in annual reports. - Data which is not end-of-period has not been made use of in supervisory process with impact on outcomes of analysis (AC1). - Abuse of financial services (AML/CFT) (CP29): BaFin has a risk-based framework to discriminate banks’ AML/CFT risk profiles using a matrix of inherent risk and quality of safeguards. - Framework needs refinement to be fully risk-based and is heavily reliant on the EA report. - Ongoing monitoring of banks’ compliance needs to be more systematic with a range of off-site surveillance inputs from first-hand analysis and verification. - Coverage of the banking sector through on-site examinations needs to be expanded. ### Recommended Actions (selected, by Core Principle reference) - Principle 1: Ensure new consumer protection responsibilities do not affect BaFin’s ultimate responsibility for safety and soundness. - Principle 2: Reduce scope for potential influence of industry and government in execution of supervisory priorities and allocation of resources at BaFin through budget and organizational structure; streamline SSM decision making processes for supervisory measures. - Principle 5: Include systematic analysis of availability of additional resources in the licensing process; include systematic analysis of the collective knowledge of the management and of the supervisory board; enhance qualification criteria for Supervisory Board members. - Principle 7: Review significant bank investments ex-ante. - Principle 8: Greater focus on first hand verification of compliance with regulations. - Principle 9: Complete implementation of the supervisory framework. - Principle 10: Collect more granular data as part of routine supervisory reporting; implement a data mapping solution to compare IFRS and nGAAP supervisory data. - Principle 14: Strengthen supervisory board qualifications and responsibilities. - Principle 15: Strengthen reporting lines of the CRO and risk control function to the Supervisory Board; implement a prior notification requirement to the Supervisory Board in the event a CRO is removed. - Principle 18: Issue guidance on loan classification and provisioning. - Principle 19: Issue guidance on management of concentration risk in a broader sense; introduce requirement that all material concentrations be regularly reviewed and reported to the supervisory board; monitor large exposures beyond compliance with LE limits. - Principle 20: Introduce a regime for management, monitoring, and supervision of related party risk. - Principle 21: Issue guidance on management of country and transfer risk, including MIS requirements and stress-testing inclusion; enhance reporting of country and transfer risk; issue guidance on provisioning and mitigation for country risk. - Principle 24: Develop a greater suite of industry benchmarks for liquidity risk analysis. - Principle 25: Collect more granular data for operational risk; place more emphasis on confirming operational risk management systems are effectively implemented. - Principle 26: Provide opportunity for independent reporting to the supervisory board without management board participation. - Principle 27: Find workaround to gain access to external audit work papers. - Principle 29: Place more emphasis on ongoing surveillance to confirm banks’ AML/CFT risk management and controls, especially via first-hand analysis and verification. ### Authorities’ response (summary) - German authorities expressed appreciation for the IMF assessment and generally appreciated the assessment. - Some recommendations were considered encouragements to reflect and adjust supervisory practices. - German authorities noted areas where they believe the current regime effectively fulfils IMF requirements, and provided clarifications (example cited: Principle 5 — supervisory board member assessment and BaFin powers under section 25d (1) and section 36 (3) sentence 1 KWG). *Source: _cr16196 - 9. Supervisory techniques and tools LC (IMF).* ### section 25d (2) KWG the supervisory board as a whole shall have the necessary knowledge, skills and ### _cr16196 - section 25d (2) KWG the supervisory board as a whole shall have the necessary knowledge, skills and ### Supervisory board qualifications and BaFin guidance - Section 25d (2) KWG: "the supervisory board as a whole shall have the necessary knowledge, skills and experience to fulfil its control function as well as to assess and monitor the management board of the institution, group of institutions or financial holding group, financial holding company or mixed financial holding company." - BaFin guidance: - Guidelines regarding the licensing procedures were published in 2007. - Guidelines regarding the assessment of managing directors and members of the supervisory board were published for the first time in 2012 and 2013 and contain passages regarding the term "trustworthiness" and provide an overview of the standards applied by BaFin. - The Guidelines regarding the assessment of managing directors and members of the supervisory board were revised in 2016 and "will be published in English shortly as well." ### Authority view on participations and Principle 7 - Authorities' position on Principle 7: - Germany rejects classification as "materially non-compliant" regarding the absence of ex ante review/(dis)approval of participations. - Rationale: - Article 89 Capital Requirements Regulation [CRR] is directly applicable in Germany; Germany "does not see the possibility to apply a stricter approach than the one set out in directly applicable Union law." - Acquisition of participating interests outside the financial sector is viewed as a business decision in which the supervisor should not intervene. - Potential risks from acquisitions and investment policies are limited by quantitative limits and by managers' responsibility and accountability for handling and monitoring institutions' risks; managers' performance is subject to auditor review and supervisory interventions if requirements are breached. - Qualifying holding procedures also apply for significant participations in insurance companies under section 17 of the German Act on the Supervision of Insurance companies [Versicherungsaufsichtsgesetz - VAG] and other financial services institutions according to section 1 (1a), (2) KWG. - "The requirement of a pre-approval by the competent supervisor for any significant participation in one of these regulated entities also applies if the proposed acquirer is a bank." ### Supervisory reporting (CP 10) — authorities' response - Authorities disagree with the IMF's overall assessment on Principle 10. - Key points: - Considering the supervisory environment, experience with available information, and capacity to react promptly, the isolated assessment of Principle 10 "is too harsh and should be upgraded." - The IMF assessment "does not take future developments into account." - Regulation references: "According to the ECB regulation 534/2015 which further elaborates Regulation (EU) 680/2014 the required information will be available next year." ### Corporate Governance (CP 14) — IMF findings and recommended actions - IMF concludes actions needed to strengthen the role of the supervisory board and recommends: - "Supervisory guidance should clearly state that ultimate responsibility for establishing the risk culture, developing business plans and risk appetite statement rests with the supervisory board." - "Supervisory enforcement and sanctioning programs should explicitly address supervisory board member liability." - "The knowledge/experience requirements for supervisory board members should be commensurate with the complexity of the bank." - "Reporting to the board should be frequent and with sufficient detail to enable the board members to challenge management." - "Banking supervisors should continue to increase dialogue and discussions with the supervisory board on results of supervisory activities and concerns." ### Basel Committee context and applicability to two-tier system - References to Basel guidance: - Basel Principles for enhancing corporate governance, October 2010: paragraph 6, page 2 — insufficient board oversight, inadequate risk management, and unduly complex or opaque structures were reasons for the financial crisis beginning in mid-2007. - Principle 1 (October 2010): "The board has overall responsibility for the bank, including approving and overseeing the implementation of the bank’s strategic objectives, risk strategy, corporate governance and corporate values. The board is also responsible for providing oversight of senior management". - Basel Corporate Governance Principles for banks, July 2015: Principle 1 requires "the board has overall responsibility for the bank, including approving and overseeing management’s implementation of the bank’s strategic objectives, governance framework and corporate culture". - Footnote 27, page 25 of BCP: acknowledges differences across jurisdictions (two-tier vs one-tier structures) and states the document "does not advocate a specific board structure" and that "the terms 'board' and 'senior management' are only used as a way to refer to the oversight function and the management function in general." - Paragraph 7 (October 2010): corporate governance standards should be applied consistent with national laws, regulations and codes. - Paragraph 15 (July 2015): Principles are intended to guide a diverse range of banks and authorities; "Each jurisdiction should apply the provisions as the national authorities see fit. In some cases, this may involve legal change. In other cases, a principle may require slight modification in order to be implemented." - Authorities' position: - The German two-tier structure differs from the one-tier structure; however, the "abovementioned Basel principles in general and especially the BCP 14 requirements have been fulfilled." - Requiring the supervisory board to have "ultimate responsibility for establishing the risk culture, developing business plans and risk appetite statement" would contravene the separation of management and supervisory responsibilities inherent in the two-tier system. ### Two-tier system functions and allocation of responsibilities - Structural description: - Management board: direct responsibility for management of the company, exercise of management control over lower hierarchical levels. - Supervisory board: supervises the management activities of the management board; institutionally independent, staffed and functionally separate to prevent involvement in management decision-making and self-monitoring conflicts. - Advantages: clear separation of management and supervisory responsibilities; independence of supervisory board members. - Interaction and legal framework: - Role of both boards governed by supervisory law (KWG) and substantially by company law (example: public limited company, Aktiengesellschaft). - Management board duties (corporate law): - Sec. 76 German Stock Corporation Act [Aktiengesetz – AktG]: management board "has to manage the company on its own responsibility." - Management board responsibilities include performing management/leadership tasks, developing corporate strategy, determining corporate policy, ensuring implementation (cf. sec. 4.1 German Corporate Governance Code (GCGC); cf. also sec. 25c KWG). - Management board exercises management control (ongoing and subsequent monitoring of delegated management tasks). - Supervisory board main responsibility: normally to assess whether delegation is appropriately organized and whether responsible individuals are properly selected and sufficiently monitored by the management board. - Qualifications consideration: - When assessing supervisory board member expertise, "the scope and complexity of the business conducted by the institution, group of institutions or financial holding group, financial holding company or mixed financial holding company has to be taken into account (sec. 25d para. 1 sentence 2 KWG)." - Reference to BCP 14, EC 9, German specific part for corrective measures against supervisory board members. ### Specific supervisory board responsibilities for credit institutions (sec. 25d KWG and related provisions) - Sec. 25d para. 6 KWG: supervisory board "shall oversee the management board, also with regard to its adherence to the applicable prudential supervisory requirements, and shall devote sufficient time to the discussion of strategies, risks and remuneration systems for management board members and employees." - Sec. 25d para. 7-12 KWG: set out tasks of the supervisory board's committees. - Powers and duties of the supervisory board (legal citations preserved): - Appointment and dismissal of management board members (sec. 84 AktG), including service agreements, termination, and compensation (cf. sec. 25d (12) KWG in accordance with sec. 3 (2) Remuneration Ordinance for Institutions [Institutsvergütungsverordnung – InstitutsvergVO]); representation vis-à-vis management board (sec. 112 AktG). Where necessary, pursue claims for damages against management board members (cf. sec. 116, 93 AktG). Supervisory board members can be held personally liable for damages for infringements of their duty of care (sec. 116 AktG). - Management board reporting obligations: comprehensive regular and case-specific reporting (sec. 90 AktG). Supervisory board may require further reports at any time (sec. 90 para. 3 AktG). Supervisory board may inspect books and records and company assets (sec. 111 para. 2 AktG). - Credit institution specific rights: chairs of the risk committee and the audit committee, or if such committees are not established the chair of the supervisory board, have direct enquiry rights to the head of internal audit and the head of the risk control unit (sec. 25d para. 8 and 9 KWG). Chair of the remuneration committee (or chair of the supervisory board) may make direct enquiries to the head of internal audit and heads of units responsible for remuneration systems (sec. 25d para. 12 KWG). - Advisory role: supervisory board advises management board regularly and "must be involved in decisions of fundamental importance to the enterprise" (cf. sec. 5.1.1 GCGC). - Auditor instruction and examination of financials: supervisory board instructs auditor as to annual and consolidated financial statements per sec. 290 Commercial Code (sec. 111 para. 2 sentence 3 AktG); examines annual financial statements, annual report, and appropriation proposal and reports in writing to shareholders’ meeting (sec. 171 AktG). Annual financial statements deemed approved upon supervisory board approval unless management and supervisory boards resolve for shareholder approval (sec. 172 AktG). - Consent for specific transactions: articles of association or supervisory board must determine specific transaction types requiring supervisory board consent (sec. 111 para. 4 AktG). - Right to call shareholders’ meeting: supervisory board shall call a shareholders’ meeting whenever company interests require (sec. 111 para. 3 AktG), e.g., to seek a vote of no confidence to revoke management board appointment. - Strategy communication: "The strategies and, where applicable, adjustments to the strategies shall be brought to the attention of and discussed with the institution’s supervisory board (guidance provided by AT..." *Italic: Content derived from the IMF PDF chapter/section _cr16196 - section 25d (2) KWG the supervisory board as a whole shall have the necessary knowledge, skills and* ### 4.2 para. 5 Minimum Requirement for Risk Management [MaRisk], an administrative ### _cr16196 - 4.2 para. 5 Minimum Requirement for Risk Management [MaRisk], an administrative ### Reporting lines and independence of control functions - Management board is the right body regarding the reporting lines of the control functions; all control functions are instruments of the management board due to its responsibility to manage the company on its own responsibility. - Control functions report directly to the management board; the management board is obliged to report to supervisory board. - Two safeguards against undue influence on supervisory board reporting: - Control functions are clearly (up to and including management board level) segregated from the operational functions (front office) to enable independent monitoring and reporting. - It is not up to management board members to decide about form and extent of information provided by the control functions. - German supervisors expect reports to the supervisory function to be identical or at least coextensive to those provided to the management board to ensure the same level of information for the supervisory board and the management board. ### Direct supervisory board access and statutory provisions - Supervisory board access to heads of control functions: - Chair of the risk committee, and if no risk committee has been established, the chair of the supervisory board, may make direct inquiries to the head of internal audit function and the head of risk control unit (sec, 25d (8) KWG). - Chair of the audit committee and the head of supervisory board if an audit committee has not been established, may make direct inquiries (sec. 25d (9) KWG). - Remuneration-related inquiries: - Chair of remuneration committee or, if a remuneration committee has not been established, the chair of the supervisory board may make direct inquiries to the head of the internal audit function and the heads of the organizational units responsible for the structure of the remuneration systems; the management board shall be informed (sec. 25d (12) KWG). - All members of the respective committees are only supervisory board members; no management board member is included. ### MaRisk guidance on reporting requirements - AT 1 para. 1 MaRisk: risk management creates a basis for the proper performance of the supervisory board’s monitoring functions and shall include adequate involvement of the supervisory board. - AT 4.4.2 para. 6 MaRisk: reports of the compliance function shall (next to the primary reporting line to the management board) additionally be passed to the supervisory board. - BT 2.4 para. 4 (MaRisk amended version): Internal Audit function has to write an overall report on its performed audits on a quarterly basis and provide them to both the management board and the supervisory board. - Guidance provided by BTR 1 para 7a MaRisk: the risk report on credit risk has to contain information regarding the development of the credit portfolio; risk concentrations as well as large exposures (Para 7b) have to be considered. - AT 4.3.2., para 4 and AT 4.3.3 para 1 MaRisk: special reporting about risk concentrations and extension of stress tests to risk concentrations; results of stress tests have to be reported and cover assumed risk concentrations. - AT 4.4.1, AT 4.4.2, AT 4.4.3 MaRisk: notification requirements for removals of heads of risk management, compliance, and internal audit. ### Independence and practical safeguards for risk management - Risk management function is organizationally subordinated to the management board but: - Segregation from front office ensures independent monitoring and reporting. - Supervisors expect risk reports to supervisory board to be identical or coextensive to those presented to management board; compliance reviewed during ongoing supervision and on-site inspections. - Chair of the supervisory board (or chair of the audit committee) has direct access to the head of the risk management function and can call for further information; management board shall be previously informed but discussion in confidence is possible. - Large institutions: head of risk management function implemented exclusively on management board level (“CRO”); in those cases CRO has access to supervisory board (and vice versa) at all times. ### Notification and removal procedures - Notification of supervisory board in cases where head of the risk management function is removed is required not only ex-post but a sufficient time before the removal to enable the supervisory board to discuss issues with the management board. - Draft of revised MaRisk (consultation process opened in February 18th 2016) will amend respective sections to make clear that the notification has to be given due in advance and under specification of the reasons of the removal. ### Valuation, accounting, and supervisory capacity building - Based on AQR 2014 experience, BaFin established a new division, BA 53, Financial Accounting and Valuation Practices, to get a better understanding of institutions’ valuation practices, underlying assumptions and calculation of provisions. - BA 53 aims for deeper insight into institutions’ processes and valuation methods to discuss appraisals from a prudential perspective; guidance for the supervisor might be helpful, but conflict with existing accounting legislation should be avoided. - BaFin and BBK implemented PAAR – Prudential Assessment of Adequate Risk-Provisioning – for LSIs in 2015 and set up a supervisory training program enrolled in 2015; internal guidelines for inspectors are available though no publicly issued guidelines yet. - On SSM-level there is an on-site methodology for credit risk available; detailed information for loan valuation and provisioning are yet to be finished. ### Concentration risk and related reporting - CEBS Guidelines on management of concentration risk under SREP (GL 31) applicable and relate to Art. 81 Capital Requirements Directive [CRD]; definition congruent with MaRisk (AT 2.2, para Annotations). - MaRisk definition of intra-risk concentrations includes market-risks aspects (market, currencies) as well as funding risk concentrations; requirement to analyse access to relevant refinancing even in tight markets (BTR 3.1. Tz. 4). - MaRisk require special reporting about risk concentrations and their potential consequences (AT 4.3.2., para 4); stress tests extended on risk concentrations (AT 4.3.3 para 1). - Risk reports generally sent via management board in identical or at least coextensive form to the supervisory board to ensure timely and equal information. ### Related-party exposures and limits - No separate regular reporting of exposures to related parties is in place, but supervisors can obtain information: - Section 34 (2) No. 4 of the Audit Report Regulation [Prüfungsberichtsverordnung – PrüfbV]: stricter (single-loan-based) reporting requirements where loans to related parties are noteworthy because of size, structure, or indications of conflicts of interest. - Reaching or exceeding certain thresholds (large loans according to section 14 KWG and large exposures according to Article 394 CRR) requires reporting of exposures to related parties to the supervisor. - Granting exposures to related parties is part of credit granting and surveillance process; section 15 KWG defines transactions with related parties and regulates unanimous decision by all general managers in advance of credit granting; other provisions such as section 18 KWG and guidance by MaRisk apply. - No separate legal limit for exposures with related parties, but large exposure limit according to Article 395 of the CRR is applicable; section 15 (2) KWG allows BaFin to impose limits on exposures to related parties on a case by case basis. - Supervisor can decide on a case by case basis if there are doubts regarding definition of related party transactions or relevant provision. ### Comments on IMF assessments and Principle compliance - German authorities disagree with IMF assessment that the German dual system weakens independence of control functions; they argue supervisory board responsibility to observe and monitor business management is clear and does not imply management tasks. - Authorities consider German system compliant with the requirements of Principle 14. - Authorities express that dialogue between German banking supervisors and institution bodies is commensurate with the role of each board and that IMF findings are not sufficiently justified. *Source: _cr16196 - 4.2 para. 5 Minimum Requirement for Risk Management [MaRisk], an administrative* ### 1.2 para 3 MaRisk all important aspects of a credit engagement have to be fleshed out (not only at ### _cr16196 - 1.2 para 3 MaRisk all important aspects of a credit engagement have to be fleshed out (not only at ### Country risk, credit engagement and reporting - MaRisk: "all important aspects of a credit engagement have to be fleshed out (not only at the time of the granting of the loan but also during the ongoing monitoring), whereby country risks are to be considered in an appropriate way." - Operational context for German banks: - "The bulk of German banks operate regionally and are usually not engaged in foreign exposures (with the exception of some EU sovereign bonds) so that country risk is rather in exceptional cases an essential risk in the LSI-context." - National guidance: - "According to the national Guidelines on the supervisory assessment of bank-internal capital adequacy concepts (published in December 2011) unrealised losses in relation to hidden burdens which have occurred with European sovereign bonds in the near past must be considered." - Reporting requirements (BTR 1, para 7 MaRisk): - "according to lit. a information must be given on the development of the credit portfolio, inter alia broken down by countries." - "If significant positions with country risk exist, a special presentation of these risks is necessary (see para 7c)." - Supervisory audits: - "auditors of Bundesbank also examine the limit system in the context of their audits and whether country risks are appropriately taken into account and limited" - Assessment position: - "Regarding Principle 25: We disagree with the classification because it is not clear where Germany does not comply with the Basel framework." - "We agree that there might be room for improvements... But the benchmark has to be the BCP requirement and not what seems to be desirable." - "However, we do not agree that the findings justify a verdict of material non-compliance. The Basel text is fully covered by the CRR and the guidance provided by the MaRisk." ### Operational risk supervision: resources, examinations, and AMA oversight - Bundesbank capacity and practices: - "Bundesbank has both supervisors dedicated exclusively to operational risk as well as quantitative and qualitative experts with a lot of experience on operational risk examinations." - "Bundesbank furthermore offers in-house trainings for supervisors on operational risk that covers both regulation and presentations from bank practitioners." - AMA examinations and use test (EC3): - "AMA banks are thoroughly examined before given accreditation and the monitoring of KRIs and other risk management instruments is part of our ongoing supervision." - "The four elements of an AMA and their use are also an explicit part of AMA first-time inspections and a common part of follow-up inspections." - Historical findings from AMA examinations: - "12 findings with respect to the integration of the AMA into day-to-day management" - "an additional 36 findings with respect to the four data elements." - Loss data benchmarking and cross-sector analysis: - "While a benchmarking of losses is currently not performed by Bundesbank, such an exercise is in progress by ECB (DG IV)." - "the (desirable) supervisory collection of loss data for BIA-banks would exceed BCBS requirements." - "We agree that a cross-sector analysis of operational risks is not performed; however this is not envisaged by the Basel text either." - "We also see no basis for such an analysis as the Basel text does not require small banks to systematically collect loss data and we consider the BIA capital requirement to be not risk sensitive enough to allow for comparisons." - Frequency, scope and depth of operational risk examinations: - "In the past we have had dedicated operational risk exams for large banks, which have each lasted several weeks with teams of more than 6 people." - "our largest bank is examined on at least a yearly basis." - "All other banks that do not have an approved AMA are regularly examined for compliance with BTR 4 MaRisk." - "In total, MaRisk examinations have yielded more than 90 operational risk findings since 2013." - Request to assessors: "We are hoping for a statement from the assessors what is considered an adequate frequency, scope and depth for operational risk examinations." ### Disaster recovery (DR) and business continuity planning (BCP) - Legal and regulatory references: - Banking Act sec. 25a: "risk management shall comprise, in particular, (...) the definition of an adequate contingency plan, especially for IT systems". - Banking Act sec. 25c: management board responsibilities include: - "adequate contingency plans pursuant to section 25a (1) sentence 3 number 5 for contingencies affecting time-critical activities and processes; as a minimum, the management board shall ensure that regular contingency tests are carried out in order to verify the suitability and effectiveness of the contingency plan and the results are communicated to the respective responsible staff;" - Audit activity and findings: - "Between 2012 and 2014, Bundesbank has conducted more than 50 audits with a focus on DR and BCP (MaRisk AT 7.3) that have resulted in 71 findings." - MaRisk granularity and supervisory guidance: - Assessors' critique: "no provisions within the regulations to establish minimum expectations with respect to testing, review and approval by board of DR and BCP plans." - Response: MaRisk is principle-based; supervisors have internal guidelines, roadshows and in-house training on DR and BCP. - Industry standards referenced: "federal office for information security (BSI) which sets ISO norms among others." - Upcoming revisions: "The upcoming revisions of the MaRisk guidance will also include the requirement to use loss databases." - JST (Joint Supervisory Team) attention: - Assessors suggested greater JST attention to DR and BCP testing results; Bundesbank notes existing supervisory guidance and examiner resources and requests clarification of Basel violations cited by assessors. ### Operational risk data collection and classification (EC6) - Assessors' critique: "loss data from AMA SI banks should be collected and compared." - Bundesbank position: - References "on-going SSM exercise." - "large loss events are discussed with JSTs on a regular basis and that management awareness is created through the regular reporting of operational risk losses and scenarios." - "we still see no legal basis to ask this from the supervisors." - MaRisk specificity claim: "MaRisk specifically states in its BTR 4 that 'It shall be ensured that any material operational risk is identified and assessed at least once a year.'" - Planned change: "The upcoming revisions of the MaRisk guidance will also include the requirement to use loss databases." ### Internal audit, compliance reporting lines, and supervisory board notifications - Reporting lines and legal provisions: - "internal audit function and the compliance function have alternative reporting lines to the supervisory board." - Sec. 25d (8) and (9) KWG: chairs of risk committee and internal audit committee (or chair of supervisory board if committees absent) "may make direct inquiries to the heads of the both control functions." - BT 2.4 para. 4 MaRisk (amended): "Internal Audit function has to write an overall report on its performed audits on a quarterly basis and provide them to both, the management board and the supervisory board." - BT 2.4 MaRisk: internal audit "is an instrument of the management board" and reports to management board in the first instance. - BT 2.4 para. 5 MaRisk: if audit reveals serious findings concerning management board members, "the internal audit function shall inform the chair of the supervisory board if the management board fails to meet its reporting obligation or if it fails to adopt appropriate remedial measures." - AT 4.4.2 para. 6 MaRisk: compliance reports "shall additionally be passed to the supervisory board (and the internal audit function)." - Notification of replacements: - Assessors' view: supervisory board informed only "ex-post" of replacements of internal auditor, compliance officer and risk officer. - Bundesbank/MaRisk response: - Guidance requires supervisory board notification when head of risk control function (AT 4.4.1 para. 5), compliance officer (AT 4.4.2 para. 7) and head of internal audit function (AT 4.4.3 para. 6) is replaced. - Not required "ex-post" but "in a sufficient time before the removal so that the supervisory board is able to discuss these issues with the management board." - Draft revised MaRisk (consultation process opened in February 18th 2016) will require notification "in advance in a timely manner, stating the reasons for the replacement." - Conclusion: "we are convinced that Germany is compliant with the BCP 26 guidelines." ### ECB response summary - General view: - "The ECB welcomes the assessment prepared by the IMF" and "concurs with the views expressed in the report, as they generally reflect in a very balanced and thoughtful manner the reality of the SSM." - ECB highlights "excellent cooperation with the IMF mission team and the German authorities." - SSM supervisory approach and harmonisation: - SSM objective: "ensuring that banks across the euro area are supervised according to the same high standards." - SSM advantages: "take a European perspective, allowing the ECB to compare and benchmark banks across institutions and identify problems at an early stage" and "combines the experience and expertise of 19 national supervisors." - SREP 2015: - "in 2015 the European banking supervision took a great step towards harmonised and unbiased supervision by conducting a euro area-wide Supervisory Review and Evaluation Process (SREP) according to a common methodology." - For the first time, "all significant institutions in the euro area were assessed against a common yardstick." - Operational risk assessment view: - ECB considers the assessment of BCP 25 "does not fully take into consideration the initiatives undertaken by the SSM" and that "progress made so far and the initiatives that are still ongoing to improve the supervision of operational risk were not fully recognised in the assessment." - SSM supervisory assessment guidance provides "guidance on this matter" applicable also "in practise" for BIA banks. - JSTs address operational risk in specific risk control assessments as part of regular supervisory activity, including when analysing "credit, liquidity or market risk, as well as in governance risk control assessments." - Data quality and verification: - JSTs "undertake quantitative and qualitative assessments to determine respectively the actual level of exposure to this risk and the internal risk controls established by the banks." - These assessments are included in "the RAS assessment and in the monitoring reports that are produced at least once per year" and complemented with "additional supervisory assessments for AMA banks." - JSTs perform "deep dives" and on-site inspections covering these issues. - Additional SSM work: - "SSM undertook a number of reviews – notably on CyberCrime, BCBS 239 and cybercrime incident reports – and is currently in close contact with key service providers to assess preparedness to risks related to systemic threats." - Closing position: - "The ECB will duly consider the observations and recommendations included in the report to further improve the quality of the SSM banking supervision." *Source: _cr16196 - 1.2 para 3 MaRisk all important aspects of a credit engagement have to be fleshed out (not only at — IMF PDF content provided above* --- _Source: https://www.imf.org/-/media/websites/imf/imported-full-text-pdf/external/pubs/ft/scr/2016/_cr16196.pdf_