ECB guide to internal models : July 2025.
Date: 2025-07-29
Institutions: European Central Bank
Subjects: European Central Bank, banking policy, credit institution, financial control, financial legislation, financial risk, investment company, user guide

ECB guide to internal 
models 

July 2025 

 
 
 
 
 
Document releases 

Release 

Date of 
issue 

Release 
number 

Sections/Chapters 
modified 

Rationale underlying the release 

Guide for the Targeted 
Review of Internal Models 
(TRIM) – First version 

Public Consultation – ECB 
guide to internal models – 
general topics chapter 

17/02/2017 

1.0 

- 

28/03/2018 

2.0a 

General topics 

Incorporation of institutions’ feedback on 
version 1.0, outcomes of the supervisory 
review on general topics, and related 
horizontal analyses   

Public Consultation – ECB 
guide to internal models – 
risk-type-specific chapters 

07/09/2018 

2.0b 

Credit risk, market risk 
and counterparty credit 
risk 

Incorporation of institutions’ feedback on 
version 1.0 and experience gained with 
TRIM investigations; addition of dedicated 
principles for low-default portfolios 

Revised ECB guide to 
internal models – general 
topics chapter 

Revised ECB guide to 
internal models – risk-type-
specific chapters 

15/11/2018 

2.1a 

General topics 

Inclusion of industry’s feedback received 
during the public consultation   

08/07/2019 

2.1b 

Credit risk, market risk 
and counterparty credit 
risk 

Inclusion of industry’s feedback received 
during the public consultation   

Consolidated version 

01/10/2019 

2.2 

Consolidated document 

Public Consultation – 
Revised ECB guide to 
internal models 

ECB Guide to internal 
models 

ECB Guide to internal 
models 

22/06/2023 

3.0 

Consolidated document 

19/02/2024 

3.1 

Consolidated document 

28/07/2025 

4.0 

Consolidated document 

Compilation of the general topics and risk-
type-specific chapters in one consolidated 
document 

Inclusion of reviews to reflect changes in 
regulatory requirements and to address 
experiences in using the guide 

Inclusion of industry’s feedback received 
during the public consultation 

Inclusion of reviews to reflect changes in 
regulatory requirements and to address 
experiences in using the guide 

ECB guide to internal models 

1 

 
 
 
 
 
Contents 

Foreword 

Overarching principles for internal models 

1 

2 

3 

4 

5 

6 

7 

8 

9 

Guidelines at consolidated and subsidiary levels 

Documentation of internal models 

Data governance 

Implementation of a model risk management framework 

Identification of management body and senior management 

General principles for internal validation 

General principles for internal audit 

General principles on climate-related and environmental risks 

The use of machine learning techniques in internal models 

10  General principles for the implementation of a changed or 

extended model 

Third-party involvement 

Internal models in the context of consolidations 

11 

12 

Credit risk 

A 

1 

2 

3 

4 

5 

6 

7 

8 

B 

General topics for credit risk 

Scope of the credit risk chapter 

Roll-out and permanent partial use 

Internal governance 

Internal validation 

Internal audit 

Model use 

Management of changes to the IRB approach 

Data maintenance for the IRB approach 

Definition of default 

ECB guide to internal models – Contents 

5 

7 

8 

9 

10 

10 

12 

12 

14 

15 

15 

27 

27 

34 

35 

35 

35 

35 

42 

48 

57 

60 

71 

76 

86 

2 

 
 
9 

10 

11 

12 

13 

14 

C 

15 

16 

17 

18 

Consistency of the application 

Days past due criterion 

Unlikeliness to pay criterion 

Return to non-defaulted status 

Consistency of external data 

Adjustments to risk estimates in the case of changes to the 
definition of default 

Estimation of credit risk parameters 

Use of data 

Probability of default 

Loss given default 

Conversion factors 

19  Model-related MoC 

20 

21 

Review of estimates 

Calculation of maturity for non-retail exposures 

Market risk – CRR2 

1 

2 

3 

4 

5 

6 

7 

Scope of the market risk chapter 

Scope of the internal model approach 

Regulatory back-testing of VaR models 

Aspects of internal validation of market risk models 

Methodology for VaR and stressed VaR 

Methodology for IRC models focusing on default risk 

Risks-not-in-the-model engines 

Market risk – CRR3 

1 

2 

3 

4 

Scope of the chapter on market risk 

Scope of the internal model approach 

Regulatory back-testing and profit and loss attribution 

Internal validation of market risk models 

ECB guide to internal models – Contents 

87 

89 

92 

94 

96 

96 

99 

99 

105 

127 

149 

157 

158 

161 

162 

162 

163 

179 

189 

194 

206 

219 

231 

231 

232 

246 

256 

3 

 
 
5 

6 

7 

8 

Methodology for ES and SSRM 

Methodology for DRC 

Risks not in the model engines 

Risk management, governance and audit 

Counterparty credit risk 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

Scope of the counterparty credit risk chapter 

Trade coverage 

Margin period of risk and cash flows 

Collateral modelling 

Modelling of initial margin 

Maturity 

Granularity, number of time steps and scenarios 

Calibration frequency and stress calibration 

Use test 

Validation 

Effective expected positive exposure 

Alpha parameter 

Risks not in effective expected positive exposure 

Annex 

A.1  Method 1 

A.2  Method 2 

A.3  Aggregation across netting sets 

Abbreviations 

262 

278 

288 

299 

303 

303 

304 

309 

317 

322 

323 

327 

328 

330 

334 

340 

341 

342 

358 

358 

360 

363 

364 

ECB guide to internal models – Contents 

4 

 
 
 
Foreword 

1. 

2. 

3. 

4. 

5. 

Articles 143, 283 and 325 of Regulation (EU) No 575/2013 (CRR)1, as amended by 
Regulation (EU) 2019/876 (CRR2)2  and Regulation (EU) 2024/1623 (CRR3)3, 
require the European Central Bank (ECB) to grant permission to use internal models 
for credit risk, counterparty credit risk and market risk where the requirements set out 
in the corresponding chapters of the CRR are met by the institution(s) concerned. 
Based on the current applicable European Union (EU) and national law, the ECB 
guide to internal models provides transparency on how the ECB understands those 
rules and how it intends to apply them when assessing whether institutions meet 
these requirements. 

The guide is also intended as a document for the internal use of the different 
supervisory teams, with the aim of ensuring a common and consistent approach to 
matters related to internal models. When applying the relevant regulatory framework 
in specific cases, the ECB will take into due consideration the particular 
circumstances of the institution concerned. 

This guide should not be construed as going beyond the current existing applicable 
EU law including, among others, adopted regulatory and implementing technical 
standards (RTS and ITS), and national law and therefore is not intended to replace 
or overrule applicable EU and national law. 

This guide should also be considered without prejudice to any policy stances that the 
European Banking Authority (EBA) may take when fulfilling its mandate under the 
CRR3. 

In accordance with the requirements set out in the CRR, the EBA has drafted RTS 
and ITS, some of which have already been adopted by the European Commission by 
means of a Delegated Regulation. The regulatory references tables in the individual 
sections of this Guide provide details on the status of the RTS and ITS used as a 
basis for this guide. Some parts of this guide may require further revision once the 
new RTS or ITS have been finalised by the EBA or adopted by the European 
Commission. The ECB will endeavour to update this guide accordingly if needed. 

6. 

In this guide, the ECB provides its understanding of the CRR provisions which 
currently apply. On 24 July 2024, the European Commission adopted a Delegated 
Act postponing by one year (i.e. until 1 January 2026) the date of application of the 

1    Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on 

prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 
648/2012 (OJ L 176, 27.6.2013, p. 1), referred to in this guide as the “CRR”. 

2    Regulation (EU) No 2019/876 of the European Parliament and of the Council of 20 May 2019 

amending Regulation (EU) No 575/2013 as regards the leverage ratio, the net stable funding ratio, 
requirements for own funds and eligible liabilities, counterparty credit risk, market risk, exposures to 
central counterparties, exposures to collective investment undertakings, large exposures, reporting and 
disclosure requirements, and Regulation (EU) No 648/2012, referred to in this guide as “CRR2”. 
3    Regulation (EU) No 2024/1623 of the European Parliament and of the Council of 31 May amending 

Regulation (EU) No 575/2013 as regards requirements for credit risk, credit valuation adjustment risk, 
operational risk, market risk and the output floor, referred to in this guide as “CRR3”. 

ECB guide to internal models – Foreword 

5 

 
 
Basel III fundamental review of the trading book (FRTB) standards in the European 
Union (EU).4  Further, on 12 August 2024, the European Banking Authority (EBA) 
published a no-action letter on the boundary between the banking book and the 
trading book. This implies that while some banks keep their current market risk 
models for calculating own fund requirements, others have already applied for the 
new FRTB models to be used under CRR3. To clarify supervisory expectations for 
both kinds of market risk models, this version of the Guide to Internal Models (EGIM) 
includes two market risk chapters: one chapter for CRR2 market risk models, which 
is unchanged with respect to the previous version of the guide (February 2024), and 
a second chapter explaining the ECB’s understanding of the CRR3 provisions on 
market risk models; this chapter reflects the draft FRTB supervisory expectations, 
which were already shared with institutions to collect feedback. The chapter on 
CRR2 market risk models will lose relevance once it becomes necessary to calculate 
the COREP own funds requirement with CRR3 market risk models. 

The concept of “best practice” as used in this guide can be described as actions or 
measures which – in the view of the ECB – ensure compliance with certain 
prudential requirements in a prudentially sound manner. In this context, it should be 
noted that (i) there can also be other actions or measures that ensure compliance, 
and (ii) institutions are not required to apply that practice where compliance is 
ensured in another way. 

The ECB carries out internal model investigations to ensure that the internal models 
for credit risk, counterparty credit risk and market risk and the corresponding material 
model changes applied for by institutions are compliant with the relevant prudential 
rules as provided for in the CRR and CRD. Within the scope of its remit, the ECB 
may also consider prudential risks resulting from non-compliance with regulatory 
requirements stemming from legal sources other than the CRR or CRD.5 

7. 

8. 

4    Commission Delegated Regulation (EU) 2024/2795 of 24 July 2024 amending Regulation (EU) No 

575/2013 of the European Parliament and of the Council with regard to the date of application of the 
own funds requirements for market risk. 

5    One example of such a framework that is of relevance and for which institutions need to ensure 

compliance in the context of the usage of data- and analytics-based approaches (as in the case of 
internal models) is the General Data Protection Regulation (GDPR), also through the Directive on 
Consumer Credit (Directive 2008/48/EC on credit agreements for consumers). Moreover, the AI Act 
could potentially affect Pillar 1 models and hence prudential supervision; this impact would be 
channelled through the use test that links creditworthiness assessments and internal ratings-based 
(IRB) models. 

ECB guide to internal models – Foreword 

6 

 
 
 
Overarching principles for internal 
models 

Relevant regulatory references 

Table 1 

Legal background 

Date of 
issue 

Article 

Paragraph/ 
Point 

Commission Delegated Regulation (EU) No 2022/4391 

20/10/2021  3, 4, 9, 10, 12, 13, 14, 16, 17, 30, 31, 

Commission Delegated Regulation (EU) No 529/20142 

12/03/2014 

Commission Delegated Regulation (EU) No 2015/9423 

04/03/2015 

32 

3 

CRD;4  as implemented in the relevant national law 

26/06/2013 

1, 3, 76, 85 

CRR 

26/06/2013 

105, 144, 171, 172, 174, 175, 177, 
179, 180, 185, 190, 191, 286, 287, 
288, 290, 292, 293, 294, 325bi, 
325bh, 325bj, 367, 368, 369, 370, 
376 

Digital Operational Resilience Act5 

14/12/2022 

Other references 

Final draft RTS on assessment methodology for IMA and 
significant share6 

22/11/2016 

7-34 

235 

Section 22 

EBA Guidelines on SREP7 

EBA Guidelines on internal governance8 

EBA Guidelines on outsourcing9 

EBA Supervisory handbook on validation10 

18/03/2022 

21/03/2018 

25/02/2019 

10/08/2023 

Basel Committee on Banking Supervision (BCBS) 23911 

09/01/2013 

ECB Guide on effective risk data aggregation and risk 
reporting 

03/05/2024 

ECB Guide on the supervisory approach to consolidation 
in the banking sector 

12/01/2021 

ECB Guide on climate-related and environmental risks 

27/11/2020 

ECB Guide on materiality assessment (EGMA) 

25/09/2017 

1    Commission Delegated Regulation (EU) No 2022/439 of 20 October 2022 supplementing Regulation 
(EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical 
standards for the specification of the assessment methodology competent authorities are to follow 
when assessing the compliance of credit institutions and investment firms with the requirements to use 
the Internal Ratings Based Approach (OJ L 90, 18.3.2022, p. 1), referred to in this guide as 
“Commission Delegated Regulation (EU) No 2022/439”. 

2    Commission Delegated Regulation (EU) No 529/2014 of 12 March 2014 supplementing Regulation 
(EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical 
standards for assessing the materiality of extensions and changes of the Internal Ratings Based 
Approach and the Advanced Measurement Approach (OJ L 148, 20.5.2014, p. 36), referred to in this 
guide as “Commission Delegated Regulation (EU) No 529/2014”. 

3    Commission Delegated Regulation (EU) 2015/942 of 4 March 2015 amending Delegated Regulation 

(EU) No 529/2014 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the 
Council as regards regulatory technical standards for assessing the materiality of extensions and 
changes of internal approaches when calculating own funds requirements for market risk (OJ L 154, 
19.6.2015, p. 1), referred to in this guide as “Commission Delegated Regulation (EU) 2015/942”. 

ECB guide to internal models – Overarching principles for internal models 

7 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1. 

The principles listed in this section relate to internal models that are subject to 
supervisory approval for the calculation of own funds requirements for credit, market 
and counterparty credit risk (Pillar 1 models), unless stated otherwise. 

1 

Guidelines at consolidated and subsidiary levels 

2. 

3. 

An inconsistent implementation of internal model-related tasks within a banking 
group bears the risk of an inappropriate coverage of the risks measured by internal 
models at group level. Therefore, institutions should either develop binding group-
wide (i.e. consolidated) principles and guidelines relating to the life cycle12  of internal 
models13, or ensure that each relevant entity has appropriate and independently 
audited principles and guidelines in place with a high degree of consistency between 
one another. 

A consistent and integrated level of application of the group principles and guidelines 
in the relevant entities is expected. This could be ensured by applying controls that 
verify that these principles are implemented correctly in all relevant entities. 
Examples of such controls include periodic monitoring procedures by the parent 
entity on implementation at local level or a gap analysis between group-wide 
principles and local application, including local guidelines. These controls can be 
used to identify those gaps and to mitigate any associated risk. The group-level 
policies should clearly define under which circumstances deviations from the group-
wide principles would be accepted. The parent entity should be informed about such 

4    Directive 2013/36/EU of the European Parliament and the Council of 26 June 2013 on access to the 
activity of credit institutions and the prudential supervision of credit institutions and investment firms, 
amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 
27.6.2013, p. 338), referred to in this guide as the “CRD”. 

5    Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on 
digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, 
(EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011, referred to in this guide 
as “Digital Operational Resilience Act”. 

6    Final draft Regulatory Technical Standards on the specification of the assessment methodology for 

competent authorities regarding compliance of an institution with the requirements to use internal 
models for market risk and assessment of significant share under points (b) and (c) of Article 363(4) of 
Regulation (EU) No 575/2013 (EBA/RTS/2016/07), referred to in this guide as the “Final draft RTS on 
assessment methodology for IMA and significant share”. 

7    EBA Guidelines on common procedures and methodologies for the supervisory review and evaluation 

process (SREP) and supervisory stress testing under Directive 2013/36/EU (EBA/GL/2022/03), 
referred to in this guide as the “EBA Guidelines on SREP”. 

8    EBA Guidelines on internal governance (EBA/GL/2017/11), referred to in this guide as the “EBA 

Guidelines on internal governance”. 

9    EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02), referred to in this guide as the “EBA 

Guidelines on outsourcing”. 

10    EBA Supervisory handbook on the validation of rating systems under the internal rating based 
approach (EBA/REP/2023/29), referred to in this guide as the “EBA Supervisory handbook on 
validation”. 

11    Basel Committee on Banking Supervision, “Principles for effective risk data aggregation and risk 

reporting”, referred to in this guide as “Basel Committee on Banking Supervision (BCBS) 239”. 

12    The model life cycle generally includes the following steps: development (including data preparation), 

calibration (including data preparation), validation, supervisory approval (if necessary), implementation 
in internal processes, application and review of estimates. 

13    In the case of credit risk, “internal models” should be read hereinafter as “IRB rating systems”. 

ECB guide to internal models – Overarching principles for internal models 

8 

 
 
deviations. The effective implementation of the policies should be periodically 
monitored and assessed. 

2 

Documentation of internal models 

4. 

5. 

6. 

7. 

All internal models should be documented to allow a qualified third party to 
independently understand the methodology, assumptions, limitations and use of the 
model and to replicate its development and implementation. 

The institution should therefore define principles and guidelines for model 
documentation. These should encompass guidance for the governance of the model 
documentation itself. The scope of the model documentation should be defined by 
type of model. In-scope areas should include at least the technical aspects of the 
model (methodology and assumptions), data (processes), instructions for model 
users and performance/validation (including the results of implementation testing). 

The institution should be able to demonstrate how its documentation and the register 
of its internal models facilitate the internal and external understanding of the models. 
The institution can choose to have one or more registers for models in use, 
according to the different risk types (credit, market or counterparty credit risk). The 
register(s) should contain at least the following information for each model:14  the 
model owner(s), range of application, materiality, approval date, potential restrictions 
on the model’s use (e.g. conditions), as well as the key model weaknesses, main 
changes applied and change versioning. The register should also include models 
purchased from third-party vendors. 

Adequate controls of the register of the institution’s internal models, together with an 
inventory of the documentation, including an annual review, should be in place. This 
includes a policy for document management that clearly states the roles and 
responsibilities involved in approving documents, as well as how changes in 
documentation are applied and communicated internally. In addition, the institution 
should have a policy regarding the adequate archiving and maintenance of 
information, access permissions and the assessment of the completeness and 
consistency of the information held. 

8. 

Documentation should be kept up to date and the institution should keep documents 
for an appropriate period of time, taking into account legal or regulatory retention 
periods. 

14    Regarding credit risk, Article 32 of Commission Delegated Regulation (EU) No 2022/439 specifies the 

contents of a register of rating systems. 

ECB guide to internal models – Overarching principles for internal models 

9 

 
 
3 

Data governance 

9. 

10. 

The ECB expects sound data governance practices, as set out in chapter 3.2 of the 
ECB Guide on effective risk data aggregation and risk reporting, to be in place for all 
data used as inputs for internal models. 

Institutions should have adequate organisational measures in place for data 
management and data security throughout the data lifecycle. For that purpose, 
institutions should consider common standards, such as the Digital Operational 
Resilience Act (DORA) or the Basel Committee on Banking Supervision (BCBS) 239. 
In particular, there should be organisational measures in place to ensure that the 
management body can monitor data security and enable a timely reaction to 
breaches. For example, this could be implemented as part of the overall information 
security management strategy, or via a data security framework dedicated to data 
used for internal models. 

11.  When institutions use approaches where the value of the target variable is 

determined by human judgement (e.g. unlikeliness to pay flags), there should be a 
data governance process in place to ensure consistency in the labelling performed, 
including clear guidelines on how to apply human judgement and regular analyses to 
ensure that there is no systematic difference in the labelling performed by different 
individuals. 

4 

Implementation of a model risk management framework 

12.  Effective model risk management allows institutions to reduce the risk of potential 
losses and underestimation of own funds requirements as a result of flaws in the 
development, implementation or use of the models. To mitigate these risks, 
institutions should have a model risk management framework15  in place that allows 
them to identify, understand and manage their model risk for internal models across 
the group. This framework should comprise, at least, the following: 

(a)  A written model risk management policy. This policy should, as a minimum, 

include a concept or a definition of what constitutes a model, provide the 
institution’s interpretation of model risk16  and describe the model risk framework 
with reference to its different components (e.g. model governance, risk control 
function, validation function, internal audit) and their related documented 
policies. 

(b)  A register of the institution’s internal models, as described in paragraph 6 of this 
chapter. This register should facilitate a holistic understanding of the application 

15    Institutions are expected to implement an effective model risk management framework for all models in 
use. However, Section 4 of this chapter focuses only on internal models approved for use for the 
calculation of own funds requirements for credit, market and counterparty credit risk and the respective 
requirements for a model risk management framework for these models. 

16    “Model risk” as defined in Article 3(1) sub-paragraph (11) of the CRD. 

ECB guide to internal models – Overarching principles for internal models 

10 

 
 
and use of the models and provide the institution’s management body and 
senior management with a comprehensive overview of the models in place. 

(c)  Guidelines on identifying and mitigating any areas where measurement 
uncertainty and model deficiencies are known to exist, according to their 
materiality. In particular, those elements that relate to qualitative aspects of 
model risk (such as data deficiencies, model misuse or implementation errors) 
should be considered. This methodology should be applied consistently across 
the group (e.g. in subsidiaries or regions). 

(d)  Guidelines and methodologies for the qualitative and/or quantitative 
assessment and measurement17  of the institution’s model risk. 

(e)  Guidelines with respect to the model life cycle as set out in paragraph 2 of this 

chapter. 

(f)  Procedures for model risk communication and reporting (internal and external). 

(g)  Definition of roles and responsibilities within the model risk management 
framework (e.g. define which unit(s) is/are in charge of or involved in 
independent reviews of risk estimates). 

(h) 

Institutions should define and document the appropriate levels of skills, 
capabilities and expertise required for each stakeholder group (including senior 
management) and that are commensurate with the institution’s model risk and 
with the duties of each stakeholder. Moreover, institutions should devise 
appropriate training programmes for all the stakeholder groups so as to ensure 
that these appropriate skill levels are reached and then maintained. Institutions 
should review the skills, capabilities and expertise levels and training 
programmes on a regular basis to help ensure that stakeholders are 
consistently able to manage model risk. 

13.  As part of an institution’s model risk framework, each internal model should undergo 

a regular complexity assessment.18  As an outcome of this assessment, institutions 
should be able to classify internal models based on their complexity. Moreover, 
institutions should clearly identify internal models to be labelled as highly complex 
(e.g. due to the use of ML techniques) or dynamic.19 

17    Article 85(1) of the CRD refers to model risk in operational risk. However, and specifically with regard to 
Pillar 1 models, the EBA Guidelines on SREP state that competent authorities should consider model 
risk as part of the assessment of specific risks to capital (e.g. IRB model deficiency is considered as 
part of the credit risk assessment) and for the capital adequacy assessment. In particular for IRB 
models, the expected range of estimation errors should be reflected in the margin of conservatism of 
the model, in accordance with Article 179(1)(f) of the CRR. The guidance for the calculation of the 
margin of conservatism for IRB models is defined in the chapter on the estimation of credit risk 
parameters. 

18    Further details of this complexity assessment can be found in paragraph 33 of this chapter. 
19    Throughout this guide, the terms “dynamic models” and “dynamic ML-based internal models” refer to 
models that are able to adapt, recalibrate or otherwise change autonomously in response to new 
inputs. 

ECB guide to internal models – Overarching principles for internal models 

11 

 
 
5 

Identification of management body and senior 
management 

14. 

15. 

16. 

17. 

Institutions should clearly define the roles and responsibilities of their management 
body and senior management as defined in Article 3(1) sub-paragraphs (7) and (9) of 
the CRD, as implemented in the relevant national law with regard to internal models 
and in relation to each risk type. The institution’s internal documentation should also 
clearly describe the composition of the management body and the senior 
management. 

The term “management body” could refer to the single board, in a one-tier system, or 
to the function of the management and supervisory boards in a two-tier corporate 
governance system. The institution should document the roles and responsibilities of 
each individual in the management body. For the purposes of this guide, the 
management body refers to the members of the management body in its 
management function (executive members). 

The institution should assess the appropriateness of designated committees of the 
management body (if applicable) in order to ensure that they provide an adequate 
support function for effective decision-making procedures. This holds, in particular, 
for decisions concerning material aspects of the institution’s internal models. The 
institution should clearly document the composition, mandate and reporting lines of 
committees responsible for internal model governance and oversight, as well as the 
decisions taken. These committees should be given a mandate by the management 
body; the mandate should clearly define their tasks and authority. In order for the 
designated committee to be set at an appropriate level, it should be chaired by a 
member of the management body. 

The institution should also be able to identify which individuals constitute its senior 
management with respect to the credit, market and counterparty credit risk Pillar I 
model frameworks. In addition to the specifications of Article 3(1) sub-paragraphs (7) 
and (9) of the CRD, senior management can be deemed to constitute the highest 
hierarchical level(s) below the management body with a clearly defined responsibility 
for internal models.20  The senior management should either report directly to the 
management body or be responsible for providing it with the necessary information 
to carry out its duties, especially with regard to its oversight role. The senior 
management’s decision-making procedures relating to all aspects of internal models 
should be clearly documented. 

6 

General principles for internal validation 

18.  All internal models and internal estimates should be subject to an initial, and 

subsequently to an annual, internal validation. For the avoidance of doubt, the term 

20    This includes clarity on the role, authority and responsibilities of the various positions within senior 

management. 

ECB guide to internal models – Overarching principles for internal models 

12 

 
 
“initial validation” in the guide refers to the validation of new models as well as the 
validation of material changes and extensions to approved models. 

19. 

To ensure the effective independence of the internal validation function from the 
model development process (i.e. model design, development, implementation and 
monitoring), institutions should have appropriate organisational arrangements in 
place. The ECB understands that the possible organisational arrangements are as 
follows21: 

(a)  separation into two different units reporting to different members of the senior 

management; 

(b)  separation into two different units reporting to the same member of the senior 

management; 

(c)  separate staff within the same unit. 

The decision on which organisational arrangement to adopt should take into account 
the nature, size and scale of the institution and the complexity of the risks inherent in 
its business model. 

20.  Consequently, the ECB understands that large and complex institutions should 

implement the most robust independence option. 

21.  With option (b) of paragraph 19 of this chapter, two different units report directly22  to 
the same member of senior management, but act separately at any level below that. 
When using option (b), the institution should fulfil the additional requirements 
specified in Article 10(3) of Commission Delegated Regulation (EU) No 2022/439. 
The ECB considers it best practice if the institution fulfils Article 22(1)(e) of the Final 
draft RTS on assessment methodology for IMA and significant share. The internal 
audit should regularly assess whether these additional requirements are being met. 

22. 

The ECB considers that option (c) of paragraph 19 of this chapter could be suitable 
for small legal entities which are not classified as global systemically important 
institutions (G-SIIs) or other systemically important institutions (O-SIIs).23  When 
using this option, the institution should fulfil the additional requirements specified in 
Article 10(4) of Commission Delegated Regulation (EU) No 2022/439. The ECB 
considers it best practice if the institution fulfils Article 22(2) of the Final draft RTS on 
assessment methodology for IMA and significant share, and in particular that the 
internal audit regularly assesses that these additional requirements are met. 

23.  A proper separation of the staff of the development function from the staff of the 

validation function enables institutions to limit the risk of conflicts of interest resulting 

21    The principles set out in paragraphs 19 to 22 do not apply to the organisational structures for the 

management of counterparty credit risk due to the specific requirements of Article 287(1) and (2) and 
Article 293(1)(c) of the CRR. Further guidance is given in Section 9 of the chapter on counterparty 
credit risk. Under Article 287(2) of the CRR, the risk control unit must be responsible for, among other 
things, the design and implementation of the institution’s counterparty credit risk management system. 
Under Article 287(2)(d), this unit must also be independent from units responsible for originating, 
renewing or trading exposures and free from undue influence. 

22    Crossing the units’ reporting lines on a lower level would impede fulfilling the requirement. 
23    SIs not considered as O-SIIs are those not included in the list available on the EBA banking website. 

ECB guide to internal models – Overarching principles for internal models 

13 

 
 
in an ineffective challenge from the validation. To mitigate this risk, the institution 
should ensure that the staff of the validation function is separate from the staff 
involved in the model development process.24 

24. 

The validation function25  should be adequately staffed following the proportionality 
principle. It should have suitable resources and experienced26, qualified personnel 
(who have appropriate quantitative and qualitative knowledge) to enable it to conduct 
an effective independent challenge of the internal models and internal estimates and 
their performance. 

7 

General principles for internal audit 

25. 

The CRR requires internal models to be subject to regular review by the internal 
audit or another comparable independent auditing unit (hereinafter internal audit).27 
In the understanding of the ECB, also taking into account the EBA Guidelines on 
internal governance28, this regular review needs to be efficient and effective to meet 
that objective. 

26. 

To enable an objective assessment, the internal audit should be granted an 
adequate level of independence from the processes and units reviewed to ensure 
that: 

(a) 

there is an effective separation of the internal audit from the staff involved in the 
operations of the internal models, e.g. the validation function, the risk control 
unit and all other relevant business areas; 

(b) 

it reports directly to the management body29; 

(c)  no undue influence is exerted on the staff responsible for the audit conclusions. 

27. 

To enable a sufficient number and adequate scope of internal model reviews the 
internal audit should: 

(a)  have adequate resources30  and experienced, qualified personnel (with the 

appropriate quantitative and qualitative knowledge) to undertake all relevant 
activities; 

(b)  be adequately equipped and managed in proportion to the nature, size and 

degree of complexity of the institution’s business and organisational structure. 

24    In particular regarding option (c) of paragraph19 of this chapter, this means different sub-teams with 

different tasks. 

25    Regardless of whether the related validation tasks are allocated internally or delegated to a third party. 
26    The use of external resources has to comply with the institution’s internal validation guidelines. See 

also Section 11.3.1 of this chapter. 

27    See also Articles 191, 288 and 368(h) of the CRR. 
28    See Section 22 “Internal audit function” of the EBA Guidelines on internal governance. 
29    Definition provided in paragraph 15 of this chapter. 
30    The use of external resources should comply with the institution’s internal audit guidelines. See also 

Section 11.3.1 of this chapter. 

ECB guide to internal models – Overarching principles for internal models 

14 

 
 
28. 

In the follow-up process to the internal audit conclusions and findings and to ensure 
that the internal audit reviews have a timely and effective impact, the following are 
considered to be best practice: 

(a)  Conclusions, findings and recommendations should be reported to the audit 

committee31  and/or the appropriate32  management level of the audited areas. 

(b)  Where weaknesses are identified, action plans and related measures should be 
approved by the audit committee and/or the appropriate33  management level of 
the audited areas. The internal audit function should monitor whether the 
audited areas implement the corrective measures in a timely manner. The 
institution should use appropriate information technology (IT) tools in order to 
ensure the effectiveness of the monitoring procedures. 

(c)  Regular (at least annual) status reports should be prepared and the results 

discussed in the appropriate committees to ensure the timely and proper 
implementation of follow-up actions. Institutions should submit a summary of 
the outcomes of the relevant audit reports, action plans and the status of 
findings to the competent authority. 

8 

General principles on climate-related and environmental 
risks 

29. 

Institutions should assess the materiality of all risks in the life cycle of their internal 
models as set out in paragraph 2 of this chapter, including climate-related and 
environmental risks.34  Where climate-related and environmental risks drivers are 
found to be relevant and material, institutions should include such risk drivers in their 
internal models approved for use for the calculation of own funds requirements for 
credit, counterparty credit, and market risk. 

9 

9.1 

The use of machine learning techniques in internal 
models 

General principles on internal models making use of machine 
learning techniques 

30. 

The principles defined in this section relate to selected topics that typically arise in 
connection with the use of highly sophisticated modelling approaches in the Pillar 1 

31    As defined in Article 76(3), sub-paragraph 4, of the CRD. 
32    The appropriate level of management (the management body or senior management) depends on the 

corporate governance model and the severity of the results. 

33    The appropriate level of management (the management body or senior management) depends on the 

corporate governance model and the severity of the results. 

34    This principle is defined in the context of the ECB Guide on climate-related and environmental risks. 

ECB guide to internal models – Overarching principles for internal models 

15 

 
 
models, which can loosely be referred to as machine learning (ML) techniques. 
While some of the topics are unique to ML techniques, others are already known 
from traditional approaches, but gain in importance in the context of ML techniques. 

31.  While there is no uniform definition of ML owing to the wide variety of approaches 
used and the blurred boundary with traditional techniques, the ECB takes a 
practitioner’s view of ML and refers to complex statistical approximation techniques. 
More specifically: 

32. 

33. 

34. 

• 

• 

For the purpose of this guide, ML techniques refer to models which rely on a 
large number of parameters, can represent highly non-linear functions and/or 
may require large amounts of data for their calibration (training). Also, some ML 
techniques are well adapted to process unstructured data, such as text. 

In parallel, ML techniques are characterised as being highly complex and 
presenting limited explainability/interpretability.35 

The ECB considers the use of ML in internal models to be an overarching topic 
generally applicable to all internal models used for Pillar 1 purposes, irrespective of 
the underlying risk type. This paradigm guided the general design of the principles 
set out in this document, even if these principles were drafted primarily from the 
standpoint of credit risk and have since been supplemented for market and 
counterparty credit risk where possible. Therefore, as a default, each principle cites 
the legal basis for credit risk, while market and counterparty risk references were 
added more selectively. Note that certain supervisory expectations in this section are 
deemed relevant only in the context of credit risk models, so it is not reasonably 
expected that they should apply to internal models for other risk types. 

The principles set forth in this section should be implemented in a proportionate 
manner, depending on, inter alia, the complexity36  of the internal models making use 
of ML techniques (hereinafter, “ML-based internal models”) and on the specific area 
where the ML techniques are used within the internal models (ML techniques used 
for data preparation, modelling, challenger tools etc.). 

The use of ML techniques in internal models should be viewed as a driver in their 
complexity assessment (as set out in paragraph 13 of this chapter). Consequently, it 
should also be viewed as a driver in their materiality assessment (as described in 
paragraph 23 of the chapter on credit risk). Accordingly, all else being equal, ML-
based internal models are more likely to be classified as material than models that 
do not rely on ML techniques, with subsequently higher expectations towards 
management reporting and internal validation, as explained in paragraph 25 of the 
chapter on credit risk. 

35    For example, generalised linear models (such as linear or logistic regressions) are not deemed to be 

ML techniques for the purposes of this guide. 

36    The complexity of an internal model can be characterised mainly in terms of the mathematical 

methodology, the data basis (i.e. the amount and types of risk drives used within the model), and the 
use of the ML technique within the model (e.g. ML technique as a supporting vs. central component of 
the internal model, and the degree of automation). More complex internal models tend to pose higher 
challenges in terms of the explainability of the output (see Section 9.7.2 on the mathematical 
methodology). 

ECB guide to internal models – Overarching principles for internal models 

16 

 
 
9.2 

Governance of machine learning-based internal models 

35. 

Institutions should reflect the risks stemming from the use of ML-based internal 
models in their governance frameworks and processes. This should include 
addressing ML-related challenges in model risk governance, including data 
governance, internal validation governance, management of extensions and 
changes to internal models, and ensuring that all the stakeholders involved possess 
the necessary skills, capabilities and expertise. Consequently, all three lines of 
defence, including compliance and the risk control unit as the second line and 
internal audit as the third line, should be aware of ML-related challenges. 

9.2.1 

Skills, capabilities and expertise 

36. 

The main stakeholders in contact with ML-based internal models within the institution 
should have sufficient skills, capabilities and expertise regarding ML techniques to 
discharge their duties in managing model risk. These stakeholders comprise staff 
attached to the development function, validation function, internal audit, model users, 
senior management and the management body, as well as the risk committee.37 

37.  Where institutions determine own funds requirements at consolidated and/or 

individual levels, sufficient internal knowledge of ML techniques should be present at 
all relevant legal entities. 

9.2.2 

Management of model changes 

38. 

Institutions should ensure that their changes policy defines what constitutes a 
change with regard to ML-based internal models, as referred to in paragraph 96 of 
the chapter on credit risk and in Annex 3, Part II, Section 2, paragraph 13(f) of 
Commission Delegated Regulation (EU) 2015/942. As such, institutions should 
clarify the potential implications of using ML techniques in internal models for the 
assessment of the qualitative criteria considered in the classification of the 
materiality of model changes. In particular, as part of the definitions, methods, 
metrics and significance levels for the impact assessment, threshold calculations and 
classification of changes, as referred to in paragraph 98(b) of the chapter on credit 
risk, the change policy should provide clear criteria on how to distinguish cases 
where changes to the ML techniques should be understood as changes to the 
internal models. In the case of market risk, the criteria should distinguish between 

37    The ECB’s understanding of this expectation concerning: 

Internal validators results from Articles 185, 294, 325bj(1) and 369(1) of the CRR, as also clarified in 
paragraph 24 of this chapter. 

•  Internal auditors results from Articles 191, 293(1)(h), 325bi(1)(d) and 368(1)(d) of the CRR, as also 

clarified in paragraph 27 of this chapter. 

•  Model users results from Articles 174(e), 287(e), 325bi(1)(d) and 368(1)(d) of the CRR, as also 

clarified in point (ii) of paragraph 74(a), point (ii) of the chapter on credit risk. 

•  Senior management and the management body results from Articles 189(1)-(2) and 293(1)(d) of the 

CRR, as also clarified in paragraph 37 of the chapter on credit risk. 

•  The risk committee results from Article 76(3) of the CRD. 

ECB guide to internal models – Overarching principles for internal models 

17 

 
 
changes to the ML techniques that should be understood as model changes and 
those that should be understood as model maintenance.38 

39. 

The ECB generally expects that the initial switch in the design of an internal model 
from a largely traditional approach to a mostly ML-based approach should be 
classified as a material change in line with Annex 1, Part 2, Section 1, paragraphs 
2(a) and (f) of Commission Delegated Regulation (EU) No 529/2014. 

40.  When ML-based internal models are used, and particularly in the case of dynamic 

models, institutions should duly consider the following two requirements in their 
assessment leading to the classification of model changes by monitoring the 
updates, as well as autonomous adaptations, recalibrations and changes: 

(a)  Part II, Section 1, paragraph (2)(d) of Annex I of Commission Delegated 

Regulation (EU) No 529/2014, since a significant change in the rank ordering or 
in the distribution of exposures should be considered a material change; 

(b)  Article 3(3) of Commission Delegated Regulation (EU) No 529/2014 as 

amended by Commission Delegated Regulation (EU) 2015/942, as no material 
change should be split into several changes or extensions of lower materiality. 

41.  Where institutions use dynamic ML-based internal models or components, they 

should justify the reason for this approach and effectively monitor the evolution of the 
component or of the internal model at an appropriate frequency. In particular, 
institutions should monitor the performance of the component or of the internal 
model, analyse how the updates affect the outputs of the internal model, and assess 
whether the updates could lead to unexpected or undesired changes in the logic of 
the internal model and how it could affect its use in the institution’s activities or 
decision-making. Institutions should also ensure that their change policy covers this 
type of model and its implications accordingly, and they should establish a suitable 
and documented monitoring process in order to identify changes, prevent the 
automatic implementation of material changes and of non-material changes requiring 
ex ante notification, and recognise model drift (i.e. changes in the model’s 
performance).39  The monitoring should also indicate if and when a series of 
automatic non-material changes leads to a material change in the model. 

9.3 

Internal validation of machine learning-based internal models 

42. 

The decision regarding the appropriate organisational arrangements ensuring the 
effective independence of the internal validation function should duly consider the 
complexity of the institutions’ internal models. Hence, the ECB considers that the 

38    According to recital (7) of Commission Delegated Regulation (EU) 2015/942, model maintenance is to 

be understood as “ongoing alignment of the models to the calculation dataset used, correction of errors 
or minor adjustments necessary for the day-to-day maintenance of the internal approaches, which 
occur in the strict limit of the already approved methods, processes, controls, data collection and IT 
systems”. For IMM models, examples illustrating the difference between model change and model 
maintenance can be found in the ECB Guide on Materiality Assessment (EGMA) (Section 3.10). 
39    Supervisory expectations regarding the monitoring of model drift are presented in paragraph 63 of this 

chapter. 

ECB guide to internal models – Overarching principles for internal models 

18 

 
 
extensive usage of ML techniques by an institution as part of its internal models may 
lead to the need for a more robust40  organisational arrangement in line with 
paragraph 19 of this chapter. 

43. 

Institutions’ internal validation policies and procedures should explicitly account for 
the use of ML techniques in internal models and/or in the validation process itself. In 
particular: 

(a) 

Internal validation should effectively challenge the modelling decisions taken 
regarding ML-based internal models, assessing whether their complexity is 
justified, and evaluating the stability and robustness of the outcomes with 
respect to other possible approaches taken, hyperparameters selected41  and 
the randomness of the training process. Internal validation should also assess 
the implications of the ML techniques used within the internal models being able 
to fit the training dataset beyond its generalisation capacities (including 
overfitting) and should pay particular attention to the performance of ML 
techniques and ML-based internal models measured using out-of-sample42  and 
out-of-time data. 

(b)  The frequency of the validation activities should be commensurate with the ML-
based internal model’s complexity and model risk, meaning that the appropriate 
frequency for performing the activities referred to in paragraphs 52(g) and 52(h) 
of the chapter on credit risk might actually be higher than the one suggested in 
these respective paragraphs for ML-based internal models, so as to ensure that 
any material deficiency is detected within a reasonable time period. 

(c)  The ECB expects institutions to rely on a set of explainability techniques and 
tools when carrying out internal checks to reliably identify circumstances 
(including instances) where an ML-based internal model is not working 
effectively pursuant to Article 175(4)(c) of the CRR, the causes for a 
deterioration in the model’s performance and stability in accordance with Article 
174(d) of the CRR, as well as the reasons for the deviation in the risk estimates 
from their realised values pursuant to Article 185(e) of the CRR. 

(d)  Besides the analyses of the ML-based internal models themselves, the internal 
validation activities should also analyse the explainability techniques and tools43 
used in conjunction with the ML-based internal models. These analyses should 
be performed at least yearly, addressing in particular the adequacy and 
appropriateness of the chosen explainability techniques and tools. 

40    Paragraph 19 of this chapter presents, under letters (a) to (c), the different possible organisational 

arrangements in order of decreasing robustness. 

41    A hyperparameter is a configuration parameter which specifies details of the learning process (e.g. 

number of branches in a decision tree, number of clusters in a clustering algorithm, the C and sigma 
hyperparameters for support vector machines, the k in k-nearest neighbours, the learning rate for 
training a neural network, or the choice of optimiser) before the model training begins. 
Hyperparameters are external to the model and their value cannot be estimated from data or changed 
during the training process, so they are often specified by the practitioner, set using heuristics or tuned 
for a given modelling problem (i.e. adjusted in a separate hyperparameter optimisation loop). 

42    This sample of data should be independent of the data used to train the parameters of the model and 

to determine the values of the hyperparameters. 

43    This concept is presented in more detail in Section 9.7 of this chapter. 

ECB guide to internal models – Overarching principles for internal models 

19 

 
 
9.4 

Internal audit of machine learning-based internal models 

44. 

To ensure that ML-based internal models can be reliably audited, it is important to 
look at the special characteristics of ML techniques when considering the adequacy 
of internal audit resources, tools and processes, as explained in paragraph 27 of this 
chapter. 

45.  When performing the general risk assessment and drawing up the work plan as 

described in paragraph 62 of the chapter on credit risk, the ECB expects the 
institution to consider whether the use of ML-based internal models might lead to 
higher model risk for the corresponding specific area, as described in paragraph 
63(a) of the chapter on credit risk. This is due to the general expectation that ML 
techniques may carry specific risks when compared with traditional approaches, and 
that general model risks may increase when using ML techniques. 

46.  Depending on the outcome of the general risk assessment, internal audit should set 

an appropriate intensity and frequency for the audit engagements for ML-based 
internal models. In the case of highly complex and/or dynamic ML-based internal 
models, the ECB expects that typically an institution should consider an increased 
risk as described in paragraph 63(a) of the chapter on credit risk, and thus, a deep 
dive should be included in the annual audit work plan. Furthermore, if special 
information needs, newly identified shortcomings, or unexpected events and 
developments occur for highly complex and/or dynamic ML-based internal models, 
the ECB recommends that additional audits outside of the annual audit work plan be 
performed. 

47. 

48. 

49. 

The ECB expects internal audit to assess whether any aspects exist that are 
particularly relevant for ML-based internal models and that are not already 
mentioned in paragraph 64 of the chapter on credit risk. If they do, internal audit 
should also include its opinion on these aspects in the general risk assessment. 

In order to properly audit ML-based internal models, internal audit should duly 
consider the relevance and meaningfulness of the audit techniques applied. 

The ECB is of the view that, pursuant to Articles 288, 293(1)(h), 325bi(1)(h), 
368(1)(h) and 376(3) of the CRR, the principles mentioned above regarding internal 
audit should also be considered relevant for market, counterparty credit risk, and 
credit valuation adjustment. 

9.5 

Data governance and maintenance for ML-based internal models 

50. 

It is best practice for institutions to define standards aligned with common practices 
and/or academic research44  for assessing the adequacy of the data types, amounts 
and sources used as inputs for ML-based internal models in relation to the specific 
ML technique they are being used for. This applies, for example, to synthetic (i.e. 

44    Academic research is understood here as papers published in high quality peer reviewed journals. 

ECB guide to internal models – Overarching principles for internal models 

20 

 
 
artificially generated) or unstructured data (e.g. text documents, social media 
interactions, or video recordings). 

51. 

In addition to the general expectations for the data quality framework related to 
internal model-based approaches, input data for ML techniques used within internal 
models should undergo an additional exploratory analysis to ensure a clear 
understanding of data formats, the treatment of missing values, and potential 
sources of bias. 

9.6 

IT and third-party involvement in the context of ML-based internal 
models 

52.  An institution should ensure that its IT infrastructure is capable of supporting its 

needs, especially if it uses ML-based internal models with potentially more complex 
data needs (e.g. unstructured data) and higher demand for computational power. 

53. 

54. 

55. 

In addition to the requirements set out in paragraph 120 of the chapter on credit risk 
and the ECB's expectations in that regard, the ECB considers it best practice for an 
institution to ensure that its IT infrastructure provides a traceable solution (including 
model versioning) to help track all steps, criteria and choices throughout the entire 
process related to the functioning of ML-based internal models. As such, the IT 
infrastructure should allow an institution to replicate and verify the decisions made by 
ML-based internal models, thus helping to ensure the auditability and traceability of 
the system.45 

The ECB is of the view that, pursuant to Articles 325bi and 368(1) and (2) of the 
CRR, the principles on IT infrastructure above should also be considered relevant for 
market risk and counterparty credit risk models. 

In addition to the requirements set out in Section 11 of this chapter and the ECB’s 
expectations in that regard, in order to be able to identify, assess and appropriately 
manage the risks stemming from delegating internal functions and tasks related to 
ML-based internal models, institutions should ensure that ML-based internal models 
are explicitly and adequately integrated into their outsourcing policies and processes 
for recognising and assessing outsourcing arrangements. 

56. 

In light of the EBA Guidelines on outsourcing arrangements, the ECB is of the view 
that the principle described above should also be considered relevant for internal 
models for market risk, counterparty credit risk and credit valuation adjustment. 

45    Best practice identified from the description included in Section 4 of the EBA report on big data and 

advanced analytics. 

ECB guide to internal models – Overarching principles for internal models 

21 

 
 
9.7 

Mathematical methodology of ML-based internal models 

9.7.1 

Model development46 

57. 

The methodology used to define the structure of an ML component and to estimate 
its parameters should be adequately justified and, where appropriate, based on 
statistical/optimality criteria. In addition, institutions should consider the potential bias 
on the estimates stemming from over- and under-fitting and choose an appropriate 
level of model complexity. To this end, institutions should identify all relevant 
hyperparameters of their ML components. Unless otherwise justified, the 
determination of their values should be based on the model’s ability to generalise. In 
this respect, the data sample used to measure the generalisation capacity of an ML 
component should be independent of the data sample used to train its parameters. 

58.  Due to the ability of ML algorithms to fit the training data sample beyond their 

generalisation capabilities, the distribution of the prediction of an ML technique on 
the training data sample will usually differ from the distribution based on the overall 
population.47  Consequently, when developing an internal model where an ML-
component is applied to observations included in its training data sample48, 
institutions should assess the potential bias arising from this approach and address 
the implications accordingly. 

59. 

The documentation of ML components should allow for their replication, including a 
determination of the parameters and hyperparameters. Where the training algorithm 
relies on simulation, the seeds used to generate the random numbers should be 
stored. The exact ordering of the observations in the training sample should also be 
stored in some cases49  in order to ensure replicability. 

46    The legal background for expectations regarding the model development for credit risk internal models 
is given by Article 144(1)(a), Article 174(a), Article 175(1), (2), (4)(a)-(c), Article 179(1)(a) and Article 
180(1)(d) of the CRR, Article 35(1)(a)-(c) and Article 40(a)-(c) of Commission Delegated Regulation 
(EU) No 2022/439 and Paragraphs 96 and 105 of the EBA Guidelines on PD and LGD. 

47    The term “generalisation” refers to the ability of a modelling technique to classify or forecast new data 

that have not been used to train the model. Even in the absence of overfitting, modelling techniques 
are well known to lead to lower estimation error on the training data than on the general population. 
This phenomenon is even more prominent in ML approaches due to the larger number of degrees of 
freedom (when compared with traditional approaches). 

48    For example, in the development of IRB models, it is common practice to use the same data 

sequentially in the following manner: (i) first, for training the parameters of a ranking method, and (ii) 
second, when assessing the homogeneity/heterogeneity of the resulting rating grades and when 
quantifying the probability of default (PD). If the ranking method is based on an ML technique, the 
scores resulting from the ranking method could be distributed differently in the sample used to train its 
parameters than in the overall population. Consequently, this sequential use of a data sample might 
affect the assessment of the homogeneity/heterogeneity of rating grades and lead to a bias in the 
quantified PDs, as the PDs could be artificially low for those obligors with a perceived low risk of default 
and artificially high for those posing a higher risk of default. 

49    The ordering is of relevance as some methods (for example stochastic gradient descent) apply an 
iterative procedure which considers only a subset of the data each time. Therefore, the outcome is 
highly dependent on the order of the observations. Random forest or boosting models are other 
examples where the outcome relies on the order of the observations. 

ECB guide to internal models – Overarching principles for internal models 

22 

 
 
9.7.2 

Complexity and explainability 

60. 

The ECB expects institutions to motivate the complexity of their internal models and 
avoid unnecessarily complex modelling approaches by taking into account any trade-
off between, on the one hand, the complexity of the modelling techniques and, on 
the other, the performance increase of the ML-based internal models as well as the 
enhanced achievement of the institution’s organisational objectives, efficiency in 
decision-making and risk steering.50 

61.  Pursuant to Article 171(1)(b) of the CRR, the documentation of the rating process 
must allow third parties to understand the assignments of exposures to grades or 
pools, to replicate grade and pool assignments and to evaluate the appropriateness 
of the assignments. Meanwhile, Article 175(2) of the CRR requires institutions to 
document the rationale for their choice of rating criteria. In accordance with Article 
179(1)(a) of the CRR, the risk parameter estimates must be based on material risk 
drivers. Furthermore, Article 174(a) of the CRR states that the input variables must 
form a reasonable and effective basis for the resulting prediction. Therefore, in the 
ECB’s view, the inclusion of a large number of risk drivers increases the 
requirements of proper justification. Moreover, the ECB expects institutions to ensure 
the economic rationale of ML-based internal models and their risk drivers, as also 
highlighted in paragraph 58 of the EBA Guidelines on PD estimation, LGD estimation 
and treatment of defaulted assets, whereby institutions are expected to consult 
relevant experts from business areas with respect to the business rationale and risk 
contribution of the considered selection of risk drivers and rating criteria. 

62.  According to Article 179(1)(a) of the CRR, the risk parameter estimates must be 

plausible and intuitive. The ECB is of the view that institutions using ML-based 
internal models may encounter situations where the functional relationship between 
model inputs and model outputs is not straightforward, thus hampering the 
plausibility and intuitiveness of the risk estimates. In this case, the ECB expects 
institutions to rely on a set of explainability techniques and tools to support the 
plausibility and intuitiveness of their estimates. The explainability techniques and 
tools should enable: 

(a)  an assessment and quantification of the contribution made by the individual risk 
drivers to the model prediction on a global level (i.e. across all predictions), and 
the relationship between the output of the model and each risk driver; 

(b) 

the contribution of the individual key risk drivers to each given prediction. 

63. 

Institutions relying on explainability techniques and tools to ensure the plausibility 
and intuitiveness of their estimates should assess the approach considered while 
being aware of the relevant state-of-the-art techniques and tools. Moreover, 
institutions should define and document their use of the explainability techniques and 

50    The legal background for expectations regarding complexity is given by: 

For credit risk internal models: Article 144(1)(a) and (e) and Article 180(1)(d) of the CRR, Article 38(a)-
(c), Article 46(4)(a) and (b), Article 48(i)(i) and (ii) and Article 54(f)(i)-(iii) of Commission Delegated 
Regulation (EU) No 2022/439, and paragraphs 96 and 105 of the EBA Guidelines on PD and LGD. 
For market risk internal models: Articles 325bh and 325bi of the CRR and Article 23 of the Final draft 
RTS on the assessment methodology for IMA and significant share. 

ECB guide to internal models – Overarching principles for internal models 

23 

 
 
64. 

65. 

tools, including the dimensions and criteria considered for their evaluation, their 
weaknesses and limits with regard to the resulting explanation, and the explainability 
requirements of the different stakeholders. 

The ECB considers that, as a minimum, the explanation resulting from the use of 
explainability techniques and tools should be robust, accurate and actionable51, so 
as to permit informed human judgement and well-founded human oversight of the 
pre-overrides model outputs. 

The ECB believes that different levels/depths of explainability should be provided to 
different stakeholders, depending on how they use the model.52  Accordingly, 
institutions should properly identify the relevant levels of explainability by relying on a 
dedicated set of explanatory techniques and tools that are appropriate and 
proportionate to each stakeholder. Stakeholders should also be made aware of the 
intrinsic level of complexity of the underlying model.53 

66.  Pursuant to Articles 175(2) and 175(4)(c) of the CRR, institutions must document the 

explainability techniques and tools used, highlighting their weaknesses when put to 
use by the institution. This applies particularly to explainability techniques and tools 
that are models themselves (i.e. so-called “explainable artificial intelligence”, or “XAI” 
models). 

67.  While the above principles on mathematical methodology are formulated mainly in 
the context of internal models for credit risk, the ECB is of the view that, in 
accordance with Articles 105(2)(a) and (7), 286(1), 290(2), 292 and 294 of the CRR, 
and Articles 325bh, 325bi, 325bj, 367(1)(a) and (b), 368, 369 and 370 of the CRR, 
they should also be considered relevant for market risk, counterparty credit risk, and 
credit valuation adjustment. 

9.8 

Use of ML-based internal models 

9.8.1 

Use for decision-making 

68.  Pursuant to Article 144(1)(b) of the CRR and the explanation of that article provided 
in paragraphs 74 to 77 of the chapter on credit risk, the ECB is of the view that 
institutions should explicitly define, in their internal policies, the scope and purpose of 
the use of ML-based internal models in their risk management and decision-making 
processes and in their credit approval, internal capital allocation and corporate 

51    “Actionable” in the sense that based on the explanation, the stakeholder could take an action in the 

context required from him/her (e.g. perform an override). 

52    This understanding is derived from Articles 185(a), 189(2) and 190(2)(f), (g) and (h) of the CRR. 
53    The level of complexity is introduced in paragraph 13 of this chapter. 

ECB guide to internal models – Overarching principles for internal models 

24 

 
 
governance functions. This should include a precise delineation of the intended 
applications54, functionalities55  and limitations56  of these models. 

69. 

70. 

In line with the supervisory expectations documented in paragraph 60 of this chapter, 
the integration of ML-based internal models should align seamlessly with the broader 
business strategy. 

In accordance with paragraph 74 of the chapter on credit risk, where institutions use 
internal ratings or risk estimates resulting from ML-based internal models without 
leveraging on (part of) the ML-based internal models for the purposes of internal risk 
management, credit approval and other internal decision-making processes, their 
documentation showing the contribution made by these models to the overall 
decision-making processes should provide adequate reasons for not leveraging on 
(part of) the ML-based internal model in specific areas, thus ensuring that any 
discrepancies are explained in a sound and understandable manner. 

71.  Moreover, institutions leveraging on ML-based internal models for risk management, 
credit approval and other internal decision-making processes should exercise 
sufficient vigilance regarding the added risks stemming from the use of these 
approaches (when compared with the use of more traditional approaches), for 
example due to the potential introduction of bias when modifying or adjusting these 
Pillar 1 models to make them fit for the other usages.57 

72.  Pursuant to Articles 144(1)(b) and 177(2) of the CRR, when an institution uses ML-

based internal models to assess, calculate and allocate its internal capital within the 
framework of the internal capital adequacy assessment process, it should ensure 
that model outcomes in stress tests and scenario analyses are explainable, plausible 
and not overly optimistic. 

73. 

The ECB understands that pursuant to Article 368(1)(a), (c), (d) and (g) of the CRR, 
the principles set out above on the use of ML for decision-making should also be 
considered relevant for market risk and counterparty credit risk models. 

54    Intended applications: internal policies should provide a precise delineation of the intended applications 
of ML-based internal models. This means specifying the areas or processes where the models will be 
applied, e.g. credit risk assessment. 

55    Functionalities: banks need to identify and outline the functionalities of ML-based internal models within 

their internal policies. This includes describing the specific tasks or functions that the models are 
designed to perform, such as predictive analytics, pattern recognition, optimisation, etc. 

56    Limitations: the internal policies should also clarify the limitations of ML-based models. This involves 
acknowledging the boundaries and constraints of the models, including potential biases, accuracy 
levels, data dependencies, and scenarios where human intervention may be required. 

57    For instance, the institution may consider a higher frequency for updating the ML-based internal model 
when using it for purposes other than the capital requirements calculation, or it may modify the ML-
based internal model when using it for other purposes by including additional variables, which could be 
informative of discriminatory information or be based on non-traditional sources of data (including, but 
not limited to, social media activity and online behaviour). Such adjustments made to the ML-based 
internal models for the purpose of their other usages may lead to added risks for the institution in those 
respective usages. 

ECB guide to internal models – Overarching principles for internal models 

25 

 
 
9.8.2 

IRB: Human judgement in model use 

74. 

In connection with the ECB's expectations laid down in paragraph 80 of the chapter 
on credit risk and paragraphs 87 to 93 of that same chapter, the ECB expects an 
institution’s override policy to consider excessive numbers/extents of overrides 
and/or an accumulation of inappropriate justifications as a strong indicator 
questioning the design and assumptions of the ML-based internal model, especially 
with regard to its complexity. 

75.  Pursuant to Article 39(a) of Commission Delegated Regulation (EU) 2022/439, the 

monitoring of overrides should include an assessment of the impact of the overrides 
on the performance of the rating model, if possible, by means of the computation of 
the marginal contribution of human judgement to the performance of the rating 
system. By extension of paragraph 92(a) of the chapter on credit risk, the ECB 
expects institutions to implement such monitoring for ML-based internal models and 
their ML-based modules. This monitoring should distinguish between input and 
output overrides as defined in Article 39(c) of Commission Delegated Regulation 
(EU) 2022/439. 

76. 

In accordance with Article 172(3) of the CRR, institutions must document and store 
sufficient information on all the overrides they conduct. The ECB believes that these 
documentation requirements are of particular importance for overrides of ML-based 
internal models and their ML-based modules, and should thus be fulfilled in a 
comprehensive manner. Specifically, for ML-based internal models that make use of 
an extensive number of input variables/risk drivers, the documentation should 
include details of the data and information not captured by the model, but considered 
for the override, and describe the relevance of this data and information to ensure a 
reliable assessment of the obligor’s creditworthiness. 

77.  All personnel responsible for performing an override should have an in-depth 

understanding of the risk factors and criteria driving the pre-override calculation of 
the output in question. For that purpose, the ECB expects institutions to consider the 
relevant explainability techniques and tools before conducting an override. Based on 
Article 39 of Commission Delegated Regulation (EU) 2022/439, the ECB advises 
institutions to document the explainability techniques and tools considered for each 
rating override. 

78. 

In the context of ML-based internal models that make use of an extensive number of 
input data/risk drivers, and when adjusting these input data through human 
judgement (input overrides), the personnel responsible for the overrides should have 
comprehensive information on the set of input variables based on which the pre-
override output has been calculated. The ECB’s expectations as to the exceptional 
nature of output overrides in the case of ML-based internal models apply 
analogously to input overrides. 

ECB guide to internal models – Overarching principles for internal models 

26 

 
10 

General principles for the implementation of a changed or 
extended model 

79.  Under Article 3(5) of Commission Delegated Regulation (EU) No 529/2014, 

institutions must calculate the own funds requirements based on the approved 
material change or extension from the date specified in the new permission (the 
“implementation date”) which must replace the prior one. In general, it is expected 
that institutions will be capable of implementing the material change or extension in a 
timely manner upon receiving permission and in any case without undue delay. 
Therefore, when setting the implementation date, the ECB considers that the 
implementation should happen within a reasonable time frame starting from the date 
of the notification of the permission.58  59  The ECB generally expects this time frame 
to be no longer than three months from the date of the notification. Exceptions to this 
expectation should be requested by the institution in question as early as possible 
(for example, when filing the application but not later than when submitting 
comments as part of the model decision process), which should provide reasons for 
the request, and can only be granted under specific circumstances (for instance in 
the case of an implementation requiring a staggered approach, such as the 
implementation across different jurisdictions, or in the case of joint implementation or 
of technical constraints inherent to the IT framework).60  61  Note that the above 
guidance on the implementation date is given without prejudice to the expectations 
set out in Section 8.2.2 of the credit risk chapter and Section 8.4 of the chapter on 
market risk (CRR3). In addition, where there is a request to reverse the use of less 
sophisticated approaches in accordance with Article 149 of the CRR, the ECB 
equally expects that institutions will be capable of implementing the approach 
requested according to the same criteria defined above for material model changes 
and extensions. 

11 

Third-party involvement 

11.1 

Preliminary principles 

80.  Outsourcing, as defined in the EBA Guidelines on outsourcing, refers to an 

authorised entity’s use of a third party (the “service provider”) to perform activities 
that would normally be undertaken by the authorised entity itself, now or in the 
future. For the purposes of this section, outsourcing in the context of internal models 

58    If the ECB decision on the material change or extension includes a condition suspending the effect of 
(parts of) the decision, the date of the notification (for the part of the decision subject to the condition) 
should generally be understood to be the date when the ECB further notifies the institution about the 
removal of the condition. 

59    Unless specified differently in the ECB decision, ancillary provisions such as limitations are applicable 
as of the implementation date, while obligation deadlines are counted from the date of the notification. 

60    Article 3(6) of Commission Delegated Regulation (EU) No 529/2014 also applies in this context. 
61    Institutions with internal models approved for the calculation of own funds requirements for credit risk 

should still fulfil the principles on the re-rating process set out in Section 7.6 of the chapter on credit 
risk. In particular, the re-rating process for the purpose of calculating own funds requirements is 
expected to start at the implementation date. 

ECB guide to internal models – Overarching principles for internal models 

27 

 
 
refers to the involvement of third parties in any internal models-related tasks.62  The 
specific case of delegation of internal model-related tasks to different legal entities 
within the same group (internal outsourcing) is also considered as outsourcing and 
hence is subject to the expectations set out below.63 

11.2 

Contract requirements 

81.  All outsourcing arrangements for internal model-related tasks should be subject to a 
formal and comprehensive contract or similar documented agreement in accordance 
with the proportionality principle (in the case of internal outsourcing between different 
entities within the same group, provisions such as service level agreements (SLAs) 
or other written agreements may be considered as sufficient, subject to the criticality 
or importance of the tasks outsourced). Outsourcing institutions should take into 
account the aspects set out in Section 13 of the EBA Guidelines on outsourcing 
when preparing written outsourcing contracts. To avoid operational risks which could 
hinder the performance and operations of the internal models, outsourcing 
agreements should provide for the following: 

(a)  The agreed terms do not impede the institution in performing its validation 

activities. 

(b)  The agreed terms do not impede the necessary communication between the 

institution and the competent authorities in performing their supervisory duties. 
In this sense they should include: 

(i) 

full and timely access for competent authorities to all information required 
(e.g. all of the models’ development details, where an externally developed 
internal model is used); 

(ii)  a requirement for the third party to provide support to the institution in the 

event of a request for information by the competent authority. 

(c)  The agreed terms should ensure that the provider gives the institution access to 
relevant information in order to maintain sufficient in-house knowledge. The 
delivery of training and workshops is considered best practice. 

62    For IRB this includes data provisioning and the use of external data (e.g. development data, calibration 

data, external ratings as input for internal models, pooled data). 

63    For generic requirements on outsourcing, such as the existence of an outsourcing policy, contract 

requirements, monitoring of third-party performance and a contingency plan for interruption of service, 
institutions must take into consideration the generic guidelines set out in the EBA Guidelines on 
outsourcing. 

ECB guide to internal models – Overarching principles for internal models 

28 

 
 
11.3 

Third-party involvement in internal functions and tasks 

11.3.1 

Internal validation and internal audit tasks 

82.  Although institutions are allowed to delegate some of their tasks, activities and 

functions to a third party, this should be done in accordance with all existing legal 
requirements and after due consideration of this guide, in particular the principles 
relating to internal validation and the internal audit included in this guide. If an 
institution plans to delegate certain internal validation or internal audit tasks to a third 
party that would perform them outside the EU, it should discuss this plan with the 
competent authority in advance. 

83. 

84. 

The ECB considers that responsibility for delegated tasks should be retained by the 
outsourcing institution.64  This understanding is also expressed in paragraph 35 of 
the EBA Guidelines on outsourcing. 

To ensure consistency in the content, quality and governance of the activities 
performed internally and externally, the ECB understands that the following practices 
in particular should be observed: 

(a)  Reports should carry the logo and name of the institution and of the third party 

performing the tasks. 

(b)  Reports should be approved by the senior management and the members of 
the management body (or the designated committee thereof) responsible for 
the function within the institution. 

(c)  The institution should assess the quality/performance of the outsourced tasks. 

(d)  The independence requirements set out in Section 6 for internal validation and 
Section 7 for internal audit of this chapter also apply to external parties. 
Institutions must ensure that model reviews are independent and free from any 
undue influence, also when performed by third parties. In this respect 
institutions should establish independence guidelines/policies with regard to 
third parties and those participating in internal model tasks equivalent to the 
internal guidelines and rules set internally. In particular, third parties and 
individuals that have performed or are currently performing model development 
or risk control unit tasks should not perform model validation tasks within the 
same institution until a prudent cool-off period has elapsed.65  66 

64    This also applies in the case of internal outsourcing. 
65    In the case of internal outsourcing or delegation of tasks within different legal entities of the same 

group, “third party” refers to the unit/function that would perform the delegated tasks. 

66    In the light of Article 4(2)(c) of Commission Delegated Regulation (EU) No 2022/439, the third party 
may provide the institution with the information necessary to conduct the validation activities. 

ECB guide to internal models – Overarching principles for internal models 

29 

 
 
11.3.2 

Model development and maintenance 

85.  When institutions delegate the development and/or maintenance of internal models, 
this should be done in accordance with all existing regulatory requirements and the 
institutions’ internal guidelines and policies, also taking this guide into account. If an 
institution plans to delegate such tasks to a third party that would perform them 
outside the EU, it is encouraged to discuss this with the competent authority in 
advance. 

86.  As the ultimate model owners and users, institutions should do the following: 

(a)  maintain an appropriate level of in-house knowledge (see Section 11.3.3 of this 

chapter); 

(b)  have a robust contingency plan in place to ensure that they are prepared for the 
risk that could derive from insufficient maintenance of the rating systems. 

11.3.3 

In-house knowledge 

87. 

To ensure that institutions are able to identify, manage and monitor the risks 
connected with internal models, they should maintain adequate in-house knowledge 
and core competence, as they are ultimately responsible for outsourced tasks and 
functions. Institutions should have access to all relevant information; this will enable 
them to take direct control of an outsourced activity in extremis. Best practice to 
ensure that this in-house knowledge is maintained includes ad hoc training at all 
levels (not only at management level) and proper oversight of the outsourced 
activities. 

88. 

In the relationship with the third party, and for the purpose of maintaining appropriate 
in-house knowledge and responsibilities, the ECB would consider the following 
practices as being advisable in the event of third-party involvement in internal model-
related tasks: 

(a) 

the terms of the contract include transparency requirements; 

(b) 

the institution has full access to all relevant information regarding internal 
model-related topics; 

(c) 

the institution receives regular reports; 

(d)  on request, the institution is provided with specific reports; 

(e)  on request, the third party provides support and attends interviews with the 

competent authorities. 

89. 

In cases where third parties are involved in model (re-)development and/or 
parameter (re-)calibration, to ensure that the institution maintains sufficient in-house 
knowledge and an adequate understanding of the internal model or that part of the 

ECB guide to internal models – Overarching principles for internal models 

30 

 
internal model obtained from the third party67, the ECB would consider the following 
practices as being advisable with regard to both the methodology and the data used 
for (re-)development and (re-)calibration: 

(a)  The institution has access to all relevant information that enables it to 

understand the main model assumptions and risk estimation processes. 

(b)  The institution has access to all necessary information to enable it to perform 
independent validation, including the validation of the model assumptions and 
performance of its own portfolio. 

(c)  The institution has a specific change policy in place for models developed by 

third parties. 

(d)  The institution is able to assess the need for a model change. The criteria that 
trigger a model change should be reflected in both the institution’s model 
change policy and the contract with the third party, to ensure that the institution 
is able to make or request changes to the models. 

90.  Additionally for rating systems under the IRB approach, the ECB would consider the 

following practices as being advisable with regard to both the methodology and the 
data used for (re-)development and (re-)calibration: 

(a)  The institution has access to its own obligors’ information. 

(b) 

In cases where pooled or external data are used for model development or 
calibration, the institution is able to assess to what degree the portfolio on which 
the model is based/developed is representative of its own portfolio, for the 
purposes of risk differentiation and risk quantification. 

(c)  The institution has sufficient knowledge of the definition of default applied for 

the purposes of risk differentiation and risk quantification. 

11.3.4 

Independent monitoring of third-party performance 

91. 

To ensure that it is able to identify and manage the risks connected with internal 
model-related outsourced tasks, the institution should also independently monitor the 
performance of third parties and have appropriate processes in place in this regard. 
This practice reinforces the fact that the institutions are the ultimate users of the 
internal models and thus have the ultimate responsibility for their operations. 

92. 

The following are considered by the ECB as best practices with regard to monitoring 
third-party provisioning of external data: 

(a)  Similar data vetting should be performed as would be the case if the data or 

service were provided in-house. Data quality checks should be automated 

67    For IRB see Article 4(1)(b) of Commission Delegated Regulation (EU) No 2022/439 and paragraph 97 

of this chapter. 

ECB guide to internal models – Overarching principles for internal models 

31 

 
 
(IT/batch processes) when possible, and technical issues as well as 
reasonableness and consistency should be considered. 

(b)  Historical differences in the data provided should trigger inquiries if justified, or if 

there has been an error. 

(c)  Where external data are used, their representativeness, appropriateness and 

consistency with regard to the institution should be assessed. 

(d)  Cross-checks should be carried out between different databases (when 

available) or between different providers. This is a sign of consistency and 
robustness. 

(e)  SLAs/contract agreements should include the required specific key 

performance indicators (KPIs) and performance metrics; 

(f) 

It should be recognised that the data quality of the information provided cannot 
be determined by its predictive power or by the performance of the model itself. 

93. 

The following are considered by the ECB as best practices with regard to monitoring 
third-party internal model-related tasks: 

(a) 

the same standards of monitoring and audit should be applied to external tasks 
as to those performed in-house; 

(b)  SLAs/contract agreements should include the specific KPIs and performance 

metrics that the service should include; 

(c)  specific bodies should be designated, with clear responsibilities regarding the 

monitoring of external internal model activities (such as a monitoring 
committee). 

11.3.5 

IRB: Use of external credit risk parameters/ratings 

94.  Although institutions are allowed to use external credit risk parameters as a 

component of their rating systems, the following practices should be observed: 

(a) 

Internal ratings and estimates methodology should also take internal 
information into account.68  When institutions use external ratings or 
parameters, they should ensure that these are incorporated in their estimation 
process in an appropriate manner and adjusted in accordance with the 
specificities of the institution.69 

(b)  Analogously to the requirements for data pooled across institutions70, the 

institution should demonstrate good knowledge of the work performed by the 
third party in producing the estimates. In particular, the institution should 

68    See Article 171(2) of the CRR. 
69    See also Section 15.2 of the chapter on credit risk on estimation of credit risk parameters on the use of 

external data. 

70    See Article 179(2) of the CRR and in particular sub-paragraph (e). 

ECB guide to internal models – Overarching principles for internal models 

32 

 
 
demonstrate a good understanding of the data cleansing process, assumptions 
used, methodological choices and resulting limitations. The institution should 
also monitor the performance of the rating systems involved and be able to 
audit them, and have clear triggers for requesting a model review. 

11.3.6 

IRB: Use of pool models 

95. 

96. 

In accordance with Article 179(2)(d) of the CRR, an institution using pool models 
must remain responsible for the integrity of its rating systems. In particular, the 
institution is ultimately responsible for the performance of the internal validation 
activities as elaborated in Section 6 of this chapter. 

To comply with the requirement to ensure integrity of the rating system specified in 
Article 179(2)(d) of the CRR, if deficiencies are identified in the pooled rating system 
at institution level, the institution should be able to independently trigger a procedure 
designed to amend the system, if necessary, at individual or pool level. This applies 
regardless of the performance of the rating system at the pool level or at the level of 
the other participating institutions. 

97.  Where a third party is involved in the tasks of developing a rating system and risk 

estimation for an institution, the institution should verify that the validation activities 
with regard to that rating system and those risk estimates are not performed by that 
third party. Where, for the purpose of developing a rating system and risk estimation, 
the institution uses data that is pooled across institutions and a third party is 
developing the rating system, the third party may assist the institution in its validation 
activities by performing those tasks of validation which require access to the pooled 
data.71 

11.3.7 

Market risk models: Risk factor modellability assessment 

98.  Based on paragraph 28 of the EBA Guidelines on outsourcing arrangements 

providing market information services (e.g. provision of data by Bloomberg, Moody’s, 
Standard & Poor’s, Fitch) is not considered outsourcing. The ECB is of the view that 
providing real price data for the risk factor modellability assessment specified in 
Article 325(be) of the CRR would fall under paragraph 28 of the EBA Guidelines on 
outsourcing arrangements. Providing not the real price data itself but only a count of 
the real price data would therefore also fall under paragraph 28 of these EBA 
Guidelines. But as classifying risk factors as modellable/non-modellable typically 
involves some kind of mapping of risk factors to real price data the ECB is of the 
view that such an activity would not be covered under paragraph 28 of the EBA 
Guidelines on outsourcing arrangements and would therefore fall under the definition 
of outsourcing in the context of IMA models. For the risk factor modellability 
assessment, the ECB is of the view that institutions should carefully analyse which 
data and services from external providers are used and based on that determine if 

71    See Article 4(3) of Commission Delegated Regulation (EU) No 2022/439. 

ECB guide to internal models – Overarching principles for internal models 

33 

 
 
this would fall under outsourcing. Even if data and services are not classified 
outsourcing, still the institution would need to ensure that respective data and 
services are audited and validated. 

12 

Internal models in the context of consolidations 

99. 

The general treatment of internal models in the case of consolidations, i.e. mergers 
and acquisitions, is set out in Section 3.4 of the ECB Guide on the supervisory 
approach to consolidation in the banking sector. Paragraph 36 of that document 
acknowledges that compliance issues regarding the continued use of internal models 
may arise in the event of a business combination. Paragraph 37 of the same 
document envisages the use of existing internal models in such cases “subject to a 
clear model mapping and a credible internal models roll-out plan to address the 
specific internal model issues created through the merger, as well as other 
conditions where appropriate”. 

100. 

In order to implement this guidance, a separate ECB decision is needed for each 
individual case, including details of compliance issues arising at the transaction date, 
the actions the institution will take to return to compliance72, and necessary 
transitional arrangements related to the risk-weighted exposure amount (RWEA) 
calculation while the return to compliance plan (see paragraph 101 of this chapter) is 
implemented. 

101. 

Institutions are expected to submit a “return to compliance plan” explaining how they 
will return to compliance with regard to model-related compliance issues. The return 
to compliance plan should clarify the strategy that the bank will follow to restore 
compliance and should include details of the following in particular: 

• 

• 

• 

• 

the internal models landscape of the banks participating in the merger, the use 
of internal model approaches or of the Standardised Approach, and the scope 
of the models; 

the target internal model landscape of the post-merger legal entity; 

the concrete actions, with their associated timelines, that the bank plans to take 
to achieve the target internal model landscape, in particular model extensions, 
requests for initial model approvals and, in the context of IRB models, PPU 
requests; 

how the post-consolidation legal entity intends to calculate RWEAs until the 
return to full compliance, taking into account the capability of the acquiring bank 
to use the models of the target, in particular before and after any potential IT 
integration. 

72    In the context of IRB models, see Article 146 of the CRR. 

ECB guide to internal models – Overarching principles for internal models 

34 

 
 
Credit risk 

A 

1 

General topics for credit risk 

Scope of the credit risk chapter 

1. 

The purpose of this chapter is to provide transparency on how the ECB understands 
a number of topics related to internal models used for the IRB approach, including a 
sub-chapter covering general topics for this approach. It is important to note that this 
chapter does not aim to cover exhaustively all topics of the CRR for the IRB 
approach that could be subject to review during internal model investigations. On 
these selected topics, the chapter is aligned with the EBA Guidelines on PD and 
LGD.1 

2 

Roll-out and permanent partial use 

2.1 

Relevant regulatory references 

Table 2 

Legal background 

Date of 
issue 

Article 

Paragraph/ 
Point 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

1, 6, 7, 8 

CRR 

26/06/2013  143, 148, 149, 150, 189 

Commission Delegated Regulation (EU) No 529/2014 

SSM Regulation2 

Other references 

12/03/2014 

15/10/2013 

10 

ECB Guide on the supervisory approach to consolidation in the banking 
sector 

12/01/2021 

1    EBA Guidelines on PD estimation, LGD estimation and the treatment of defaulted exposures 

(EBA/GL/2017/16), referred to in this guide as the “EBA Guidelines on PD and LGD”. 

2    Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European 
Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 
29.10.2013, p. 63), referred to in this guide as the “SSM Regulation”. 

ECB guide to internal models – Credit risk 

35 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2.2 

Application of the IRB approach 

2. 

3. 

4. 

5. 

6. 

7. 

As clarified in Preambles 25 and 34 of the CRR, an institution that adopted the IRB 
approach for one exposure class is no longer required to adopt that approach for all 
of its non-trading book exposures. In accordance with Article 143(2), prior permission 
to use the IRB approach, including own estimates of loss given default (LGD) and 
conversion factors (IRB-CCF), shall be required for each exposure class and for 
each rating system and for each approach to estimating LGDs and conversion 
factors (CCFs) used. 

In accordance with the first sub-paragraph of Article 148(1) of the CRR, institutions 
must implement the internal ratings-based (IRB) approach for all exposures within an 
exposure class, provided that the IRB approach is applied for a certain type of 
exposure of that class, unless they have received the permission of the competent 
authority to permanently use the standardised approach (SA) on some types of 
exposures within such an exposure class, including exposures of foreign branches 
and different product groups, where those types of exposures are immaterial in 
terms of size and perceived risk profile in accordance with Article 150 of the CRR. 

The criteria used to define the scope of application and sequential implementation of 
the IRB approach within each exposure class for which the IRB approach is applied 
should be clearly documented and agreed with the competent authority. 

Pursuant to the second sub-paragraph of Article 148(1) of the CRR, the IRB 
approach can be implemented sequentially across the different types of exposures 
within a certain exposure class, across different business units or for the use of own 
estimates of LGDs and CCFs (roll-out). The ECB considers that the time frame for 
the initially approved roll-out plan should generally not exceed five years.3 

In the light of the ECB’s need to know the regulatory treatment of all exposures for its 
ongoing supervision, institutions are expected to provide the competent authority 
with full transparency and regular communications regarding this treatment.4  These 
communications should include information on all subsidiaries and all portfolios 
(together with clear exposure assignment criteria). Institutions should receive explicit 
permission from the competent authority to use the SA for types of exposures that 
are not in the scope of the IRB approach within a certain exposure class, following 
the requirements established under Article 150 of the CRR. 

Decisions of the institutions on the application and sequential implementation of the 
IRB approach should be triggered by internal criteria with the main purpose of 
enhancing risk management and risk sensitivity. In particular, sequential 
implementation should not be selectively used for the purpose of achieving reduced 
own funds requirements.5  Regarding the intended application of the IRB approach, 
the ECB considers it best practice for institutions to define and formalise objective 
and intuitive criteria for deciding which of the different approaches should be used to 
calculate own funds requirements across the whole portfolio. In doing so, they 

3    See Article 148(2) of the CRR. 
4    Under Article 10 of the SSM Regulation, the ECB can request all relevant information. 
5    See Article 148(3) of the CRR. 

ECB guide to internal models – Credit risk 

36 

 
 
should take the following into account as part of a group-wide internal models 
strategy: 

(a) 

the required operational capability and cost for the institution in developing a 
rating system for the respective exposure class and/or type of exposure in 
relation to the size of the institution and the strategic/non-strategic nature and 
scale of its activities; 

(b) 

the availability of minimum representative data for developing a rating system; 

Institutions already using the IRB approach are expected to ensure that their internal 
model landscape is streamlined based on the group-wide model strategy referred to 
in the previous paragraph, which should be discussed with the competent authority 
in advance. 

2.3 

Governance of the roll-out plan for the IRB approach 

8. 

9. 

“All material aspects of the rating and estimation processes shall be approved by the 
institution’s management body or a designated committee thereof and senior 
management.”6  As the roll-out plan determines the intended application of the IRB 
approach and its sequential implementation within each exposure class for which the 
IRB approach is applied, it should be approved by the institution’s senior 
management and management body (or a designated committee thereof). 

As a corollary and in accordance with Article 189(2)(a) of the CRR, the ECB 
understands that the reporting by senior management on the status and progress of 
the sequential implementation of the IRB approach within exposure classes should 
be a regular agenda item for the management body or designated committee. The 
ECB would consider the following to be best practice: 

(a) 

that the status of the roll-out plan is reported frequently (at least annually) and 
that such reports include the exact scope of application (exposure class), the 
planned dates of approval and/or use, and the “initial, current and planned”7 
exposure amounts and RWEAs; 

(b) 

that the status report also covers exposure classes for which the use of the IRB 
is intended in the future and any other relevant update to the group-wide 
internal models strategy. 

10. 

To ensure compliance with Article 189(1) of the CRR with respect to the roll-out plan, 
institutions should have a framework or policy for the governance of their roll-out 
plan that includes, as mentioned above, the following: 

6    See Article 189(1) of the CRR. 
7    Where “initial” refers to the initial application, “current” to the moment the roll-out plan is updated and 

“planned” to the target level. 

ECB guide to internal models – Credit risk 

37 

 
 
(a) 

indication of which internal bodies, including the management body or other 
committees and persons, are responsible for approving the roll-out plan and 
any changes to it; 

(b) 

the frequency of reporting on the implementation of the roll-out plan to the 
management body (or designated committee) and to the competent authority; 

(c) 

the criteria used for introducing changes to the roll-out plan (see also Section 
2.4 of this chapter); 

(d)  controls to assess compliance with the roll-out plan, for example second line of 
defence attestation or internal audit review (see also paragraph 66 of this 
chapter). 

2.4 

Changes to the roll-out plan for the IRB approach 

11.  Under Article 148(2) of the CRR, institutions are required to follow the roll-out plan 
approved by the competent authorities. In the event that a change in the approved 
roll-out plan is necessary, this change needs to be subject to a supervisory decision. 

12.  Article 7(3) of Commission Delegated Regulation (EU) No 2022/4398  sets out the 

conditions under which competent authorities may approve any changes to the 
sequence and time period of the plan. The ECB intends to assess any application for 
a change to a roll-out plan against these conditions, on the basis of the 
documentation provided by the institution regarding the rationale for the change, the 
materiality of the portfolios affected, and governance arrangements for the change 
(e.g. which body will approve it). In addition, when assessing an application for a 
change to the roll-out plan, the competent authority will determine, if necessary, 
whether the proposed amendment to the time frame for the implementation of the 
roll-out plan is acceptable. If institutions have already completed the implementation 
of their roll-out plan but would like to extend the use of the IRB approach (for 
instance following a merger or acquisition), they should also seek approval9  from the 
competent authority. 

13. 

Furthermore, institutions should pay attention to the following: 

8   

“When assessing the institution’s compliance with the plan for sequential implementation of the IRB 
Approach, which has been subject to permission of the competent authorities in accordance with Article 
148 of Regulation (EU) No 575/2013, competent authorities may consider changes to the sequence 
and time period appropriate only if one or more of the following conditions are met: 

a) 

there are significant changes in the business environment and in particular changes in strategy, 
mergers and acquisitions; 

b) 

there are significant changes in the relevant regulatory requirements; 

c)  material weaknesses in rating systems have been identified by the competent authority, or by the 

internal audit or the validation function; 

d) 

the elements referred to in paragraph 2 have changed significantly, or any of the elements referred 
to in paragraph 2 were not taken into account adequately in the plan for sequential implementation 
of the IRB Approach which was approved.” 

9   

In line with the requirements of Commission Delegated Regulation (EU) No 529/2014 for model 
changes and extensions in the scope of that regulation. 

ECB guide to internal models – Credit risk 

38 

 
 
(a)  Resource constraints and re-prioritisation may affect their operational capability 
to develop and maintain rating systems. Institutions should seek to minimise 
disruptions to the implementation of the roll-out plan as a result of such factors, 
taking appropriate mitigation or contingency actions to demonstrate compliance 
with the CRR requirements. 

(b)  General uncertainty caused by potential changes to the IRB regulatory 

requirements should not be considered a valid reason for changing the roll-out 
plan (or for delaying its implementation). If such regulatory changes take place 
and become binding, the institution can then reflect the impact on its plan by 
submitting a revised roll-out plan for approval. 

2.5 

Monitoring of compliance with permanent partial use provisions 
and less sophisticated approaches 

14.  Since permanent partial use (PPU) requires compliance with certain conditions, 

institutions need to ensure on an ongoing basis that exposures under PPU fall within 
the categories listed in Article 150(1), second sub-paragraph, and Article 150(1a) of 
the CRR.10  To avoid a risk of non-compliance with these requirements, the ECB is of 
the view that institutions should implement the following: 

(a)  Measures and triggers for a re-assessment of the suitability for PPU of PPU-
authorised types of exposures, including exposures of foreign branches and 
different product groups, within each exposure class for which the IRB 
approach is applied. Examples of measures that could be used include the 
number of obligors, exposure at default (EAD), proportion of exposure class 
EAD, and average risk weight. 

(b)  A reporting process monitoring the materiality (in terms of both EAD and 

RWEAs) of the types of exposures in PPU within an exposure class over time. 
The PPU reporting on an exposure class should identify any changes in PPU 
exposures and RWEAs over time as well as the types of exposures that are at 
risk of no longer fulfilling the PPU conditions. 

(c)  Processes and guidelines to assess whether further types of exposures may 

become eligible for PPU (e.g. business in run-off or planned to be discontinued, 
excessive maintenance costs induced by the regulatory requirements vis-à-vis 
number of obligors). 

15.  As specified in Article 176(3) of the CRR and regarding exposure classes for which 

the institution has adopted the IRB approach, for exposures for which the CRR 
allows the use of own estimates of LGD or the use of IRB-CCF but for which the 
institution does not use own estimates of LGD or IRB-CCF, the institution shall 
collect and store data on comparisons between realised LGDs and the values as set 
out in Article 161(1) of the CRR, and between realised CCFs and SA-CCFs as set 

10    See also Article 8(3) of Commission Delegated Regulation (EU) No 2022/439. 

ECB guide to internal models – Credit risk 

39 

 
 
out in Article 166(8a) of the CRR. To ensure compliance with these requirements, the 
ECB is of the view that institutions should implement the following: 

(a)  A process to collect data to allow a computation of realised LGD11  and realised 
CCF and to perform the comparison requested under Article 176(3) of the CRR. 
In particular, institutions should ensure that the comparison is not biased by 
over-representation of cure and high recovery cases. 

(b)  A reporting process within the institution of the comparison requested under 

Article 176(3) of the CRR for each rating system, including the results and 
conclusions of the comparison. 

16.  Where a new type of exposure is created the institution should verify if the new type 

of exposure (1) falls under the scope of an approved rating system, (2) falls under 
the scope of an approved permanent partial use of SA, and (3) requires any 
notification or request to the competent authority in line with Commission Delegated 
Regulation (EU) No 529/2014.12  Similarly, where a new business unit is created (e.g. 
consolidation of a new legal entity), institutions should verify the suitability for PPU 
according to the criteria established in their relevant internal policy, and take action 
accordingly. 

2.6 

Reversion to a less sophisticated approach 

17. 

18. 

Institutions that use the IRB approach for a particular exposure class or type of 
exposure may be permitted to stop using that approach and use the SA for the 
calculation of RWEAs instead if the conditions described in Article 149(1) and (3) of 
the CRR are met.13  Similarly, institutions which have obtained permission to use own 
estimates of LGDs and conversion factors under Article 151(9) of the CRR may be 
permitted to revert to the use of LGD values and conversion factors referred to in 
Article 151(8) (the foundation-IRB (F-IRB) approach) if the conditions described in 
Article 149(2) and (3) of the CRR are met. 

In order to fulfil the requirements of Article 149 of the CRR, institutions should, 
among other things14, document the rationale for reverting to a less sophisticated 
approach (the SA or the F-IRB approach). This means that an institution should 
document any reasons or impediments that arose after the original authorisation and 
led the institution to reconsider the use of an advanced approach. Depending on the 
features of the exposure class and/or type of exposure affected, institutions should in 

11    The computation of realised LGD is expected to be broadly aligned with Section 6.3.1 of the EBA 

Guidelines on PD and LGD. 

12    Where new exposure types are created by splitting existing exposure types, the ECB expects 

institutions to provide convincing evidence that the newly created exposure types fulfil the definition set 
out in Article 142(1)(2) of the CRR. 

13    In such cases, the conditions for PPU set out in Article 150 of the CRR, as well as the conditions set out 

in Article 148 of the CRR, must also be fulfilled. 

14    Other  relevant  conditions  for  reverting  to  the  use  of  a  less  sophisticated  approach  are  (i)  that  the 
institution  has  demonstrated  to  the  satisfaction  of  the  competent  authority  that  the  use  of  a  less 
sophisticated approach would not have a material adverse impact on the solvency of the institution or its 
ability  to  manage  risk  effectively,  and  (ii)  that  the  institution  has  received  the  prior  permission  of  the 
competent authority. 

ECB guide to internal models – Credit risk 

40 

 
 
particular define and formalise objective and intuitive criteria for deciding which of the 
different approaches should be used for the calculation of own funds requirements 
across all exposure classes for which the IRB approach is applied. In doing so, they 
should take the following into account as part of a group-wide internal models 
strategy: 

(a) 

(b) 

the required operational capability and cost for the institution to maintain a 
rating system for the respective exposure class and/or type of exposure in 
relation to the size of the institution and the strategic/non-strategic nature and 
scale of its activities; 

the availability of minimum representative data for redeveloping a model or for 
developing another admissible approach (for example, in the case of reversion 
to the SA, institutions should first consider whether other admissible IRB 
approaches, such as the F-IRB or, where relevant, the approach under Article 
153(5) of the CRR known as the supervisory slotting criteria approach (SSCA) 
could be developed without disproportionate effort); 

(c)  where Article 149(1) of the CRR applies, the possibility of using another 

available IRB approach; 

(d) 

the impact of the reversion on own funds requirements by comparing: 

(i) 

the capital requirements produced by the approach currently used, 
including the effects of potential supervisory measures (such as 
limitations); 

(ii) 

the capital requirements produced by the use of the less sophisticated 
approach requested (the SA or the F-IRB approach). 

Where the reversion leads to a non-negligible reduction of capital requirements, 
institutions should provide convincing evidence that there is no intention to reduce 
own funds requirements. 

19. 

Institutions should consistently apply across exposure classes and/or exposure types 
for which the IRB approach is applied with similar features in terms of modelling (in 
particular with regard to points (a) and (b) of paragraph 18 above) the criteria defined 
to assess whether the requirements set out in Article 149(1) and (2) of the CRR have 
been met. Where a request is made to revert to a different approach (the SA or the 
F-IRB approach) for similar exposures of this kind, institutions are also expected to 
provide convincing evidence that the request is not being made in order to reduce 
own funds requirements. For instance, providing information on the own funds 
requirements (or a proxy of these requirements) produced by using another 
admissible approach for the related exposures may help to inform the assessment 
as to whether the request is being made in order to reduce own funds requirements. 

20.  Where institutions envisage several applications linked to a new internal model 

strategy the ECB expects that submitting a single comprehensive and consistent 
request for all the rating systems in line with the strategy will usually ensure a more 
efficient assessment and approval process. 

ECB guide to internal models – Credit risk 

41 

 
21.  More specifically, in the case of requests to revert to the SA for specialised lending 

exposures: 

(a) 

(b) 

regarding the “necessity” condition referred to in Article 149(1)(a) of the CRR, 
namely that the reversion is necessary on the basis of nature and complexity of 
the institution’s total exposures of this type, the institution should demonstrate 
that the use of the SSCA is not feasible or proportionate given, for example, the 
immateriality of the affected exposures, and that it can no longer build a rating 
system that would provide a meaningful differentiation of risk; 

regarding the condition referred to in Article 149(1)(a) of the CRR that the use of 
the SA is not proposed in order to reduce the institution’s own funds 
requirements, the impact on own funds requirements of using the SA should 
also be compared with the own funds requirements produced by using the 
SSCA (or a proxy of it), unless the institution has already provided sufficient 
convincing evidence that the use of this approach is not feasible. 

3 

Internal governance 

3.1 

Relevant regulatory references 

Table 3 

Legal background 

Date of issue 

Article 

Paragraph/Point 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

2, 14, 15, 16, 32 

CRR 

Other references 

26/06/2013 

175, 179, 189, 190 

Basel Committee on Banking Supervision (BCBS) 32815 

08/07/2015 

Principles 1, 2, 3, 4, 5, 6 

22. 

The principles on internal governance have been organised along the following lines: 

(a) 

the materiality of rating systems (Section 3.2 of this chapter); 

(b) 

the management body and senior management: 

(i)  decision-making responsibilities (Section 3.3 of this chapter); 

(ii)  management reporting (Section 3.4 of this chapter); 

(iii)  understanding of the rating systems (Section 3.5 of this chapter); 

(c) 

responsibilities of the credit risk control unit (CRCU) (Section 3.6 of this 
chapter). 

15    Basel Committee on Banking Supervision “Guidelines: Corporate governance principles for banks”, 

referred to in this guide as “Basel Committee on Banking Supervision (BCBS) 328”. 

ECB guide to internal models – Credit risk 

42 

 
 
 
 
 
 
 
 
 
 
 
 
 
3.2 

Materiality of rating systems 

23.  Whether a rating system is material depends on quantitative criteria (such as the 
share of total EAD and RWEA covered by the material rating systems) and 
qualitative criteria (such as the type, riskiness and strategic importance of the 
exposures, the complexity of the rating systems and risk parameters, and the model 
risk – in alignment with the model risk management framework). The more material a 
rating system is, the higher are the risks resulting from any potential shortcomings in 
it. Consequently, materiality should be an essential consideration in model risk 
management and the rating systems classified as material by the institution should 
be subject to particular scrutiny. 

24. 

In line with the above, institutions should assess and determine the materiality of 
their rating systems and communicate it to the competent authority. Material rating 
systems should at least include the rating systems covering material types of 
exposure. As the classification of the rating systems according to their materiality 
may be subject to changes resulting from internal or external factors (e.g. changes in 
economic factors, changes in business strategy), institutions should review their 
classification on a regular basis. 

25.  Although the same requirements apply to all rating systems throughout the model life 
cycle, additional requirements may apply to material rating systems, in particular with 
regard to management reporting (see Section 3.4 of this chapter) and internal 
validation (see Section 4.3 of this chapter). This concept, that additional 
requirements may apply for material rating systems, is supported by the higher 
potential risk resulting from material rating systems and by Article 189 of the CRR, 
which also embeds the concept of materiality.16 

3.3 

Decision-making responsibilities 

26. 

In accordance with Article 189(1) of the CRR, material aspects of all rating and 
estimation processes must be approved by the institution’s management body or a 
committee designated by it, as well as by senior management.17  The ECB considers 
that Article 14(b) of Commission Delegated Regulation (EU) No 2022/439 provides a 
good understanding of the aspects that should at least be considered as material, 
and should therefore be approved at both levels. 

27. 

The ECB understands that the approval process envisaged by Article 189(1) of the 
CRR should include the documentation of the approvals, so that they can be made 
available for review at the request of the institution’s internal audit or the competent 
authority. 

28. 

The institution should define which policies should be approved at both levels 
(management body and senior management) and this should be clarified in their 

16    See Article 189(1) and (3) of the CRR. 
17    If the decision-making process takes place in the same forum where management body and senior 

management members meet, institutions should ensure that the information is approved beforehand by 
senior management and that senior management is responsible for presenting it to the forum. 

ECB guide to internal models – Credit risk 

43 

 
 
respective mandates. At a minimum, the following should be considered as requiring 
approval at both levels: (i) risk management policies that could have a material 
impact on the institution’s rating systems and risk estimates, and (ii) policies covering 
the risk of a third-party provider for model-related tasks ceasing to operate (in 
relation to IT infrastructure and contingency planning).18 

29.  Senior management must provide notice to the management body or a designated 

committee thereof of material changes or exceptions from established policies.19 
Consequently, institutions should be able to demonstrate which material changes or 
exceptions from established policies are communicated to the management body or 
a committee designated by it, and how this is done. To ensure compliance with this 
provision each institution should, in the ECB’s view, have a policy in place which 
defines material changes or exceptions. They may use quantitative and/or qualitative 
criteria to do so. The use of expert judgement within the classification process should 
be clearly explained and documented. 

30. 

31. 

The management body and senior management are responsible for the quality of 
applications and notifications and for the timeliness (i.e. adhering to the agreed 
timelines) of their submission and implementation of new models, model changes or 
extensions. The outcome of the independent assessment conducted by the internal 
control functions, i.e. internal validation and/or internal audit function, plays a 
significant role in this respect. It is expected that sufficient time be dedicated to the 
independent assessment for identifying and evaluating any deficiencies in the rating 
system. 

The institution should only submit applications for the approval of new models, model 
changes or extensions if all the necessary changes to remediate any deficiencies of 
the rating system have been made prior to the submission of the application.20  In the 
ECB’s view, applications are not ready for investigation if the rating system has been 
assessed by the internal control functions as being materially incompliant with the 
regulation. In line with paragraph 79 of the EBA Supervisory handbook on validation, 
the ECB considers this at least to be the case if any material deficiencies or a 
material number of non-material deficiencies (especially deficiencies requiring 
additional changes to the model) have not been fully remediated prior to the 
submission of the application or if the model has not been implemented in 
accordance with Section 8.2.2 of this chapter. 

3.4 

Management reporting 

32. 

To ensure consistent oversight of the functioning of the rating systems, the CRR 
requires management reporting on their performance.21 

18    This view of the ECB coincides with Article 14(b) of Commission Delegated Regulation (EU) No 

2022/439. 

19    See Article 189(2)(a) of the CRR. 
20    See Article 144(1)(f) of the CRR. 
21    See Article 189(2), sub-paragraph 2, and Article 189(3) of the CRR. 

ECB guide to internal models – Credit risk 

44 

 
 
33. 

To comply with this reporting requirement, institutions should determine the level of 
detail of the information and data to be presented to senior management and the 
management body (or designated committee thereof), and the frequency of the 
reporting. In view of proportionality, the level of detail of the information and data and 
the frequency of reporting may differ depending on the recipient and the materiality 
of the rating systems concerned (see Section 3.2 of this chapter on the materiality of 
rating systems). Reports regarding non-material rating systems may be provided in a 
more aggregated form. The procedures encompassing reporting for non-material 
rating systems should be clearly defined in the institution’s policies and differences 
with respect to the reporting of material rating systems should be clearly identified. 

34. 

The ECB considers that Article 15 of Commission Delegated Regulation (EU) No 
2022/439 provides a good understanding of the elements to be included as part of 
the institution’s management reporting.22  In particular, these reports should include 
information regarding the materiality of each rating system, its perceived strengths 
and limitations, and its current status in the light of validation and/or audit actions. 

35.  As regards the level of detail of content, reports to the management body are 

expected to be more concise than reports to senior management. They should, 
however, include the necessary information for sound and appropriate decision-
making. As regards frequency, institutions should provide reports to senior 
management as often as, or more frequently than, to the management body (or 
designated committee). Risk profiles and the comparison of estimated PD with 
realised default rates should be reported to senior management more frequently than 
annually (at least for material rating systems – see also paragraph 25 of this chapter) 
to enable senior management to ensure, on an ongoing basis, that the rating 
systems are operating properly in accordance with Article 189(2)(c) of the CRR and 
to avoid risks that could justify supervisory measures. 

36.  At least annually, both senior management and the management body should 

receive an aggregated overview of the validation results for each rating system (see 
also paragraph 56 of this chapter). 

22    “When assessing the adequacy of the management reporting as referred to in Article 189 of the CRR, 

competent authorities shall verify that: 

(a) the management reporting includes information about all of the following: 

(i) 

the risk profile of the obligors or exposures, by grade; 

(ii)  the migration across grades; 

(iii)  an estimation of the relevant risk parameters per grade; 

(iv)  a comparison of realised default rates, and, where own estimates are used, of realised LGDs 

and realised conversion factors against expectations; 

(v)  stress test assumptions and results; 

(vi)  the performance of the rating process, areas needing improvement and the status of efforts to 

improve previously identified deficiencies of the rating systems; 

(vii) validation reports; 

(b) the form and the frequency of management reporting are adequate having regard to the 

significance and the type of the information and to the level the recipient occupies in the hierarchy, 
taking into account the institution’s organisational structure; 

(c) the management reporting facilitates the senior management’s monitoring of the credit risk in the 

overall portfolio of exposures covered by the IRB Approach; 

(d) the management reporting is proportionate to the nature, size, and degree of complexity of the 

institution’s business and organisational structure.” 

ECB guide to internal models – Credit risk 

45 

 
 
3.5 

Understanding of the rating systems 

37. 

38. 

The management body must possess a general understanding of the rating systems 
and senior management must have a good understanding of the rating systems 
designs and operations.23  Institutions should therefore be able to provide evidence 
of the processes they use to improve and maintain the management body and senior 
management’s understanding of the rating systems, including those implemented 
after receiving permission to use the IRB approach. 

The format and content of these processes (for example workshops, seminars or 
dedicated training on IRB models) should match the roles and responsibilities of the 
management body and senior management, in particular those related to the model 
approval process. Especially for the management body, an adequate balance 
between collective and individual knowledge should be ensured. In the case of third-
party involvement (see Section 11 of the chapter on overarching principles for 
internal models), the institution should maintain adequate internal knowledge of the 
outsourced tasks. 

39.  While reporting or monitoring can be considered as part of the management body 

and senior management’s knowledge-building process, it is expected that these will 
not be the only means of ensuring that they have an adequate understanding of the 
rating systems. 

40.  One outcome of an effective internal understanding of the rating system is that the 

management body or the designated committee should be able to hold an objective 
debate on, and challenge, the rating systems. This applies in particular to the 
approval of material changes or the escalation process contemplated in paragraph 
58 of this chapter. In the ECB’s view, it is best practice if the evidence of such 
debates is visible in the minutes of management body or designated committee 
meetings in which such a challenge is raised, as the management body or the 
designated committee should be able to discuss the outcomes, use, strengths and 
limitations of the IRB models. 

3.6 

The credit risk control unit (CRCU) 

41. 

To ensure that the CRCU is independent from the personnel and management 
functions responsible for originating and renewing exposures24, institutions should 
clearly determine which individuals and/or teams make up the credit risk control 
function and which personnel and/or units are responsible for originating and 
renewing exposures25, and why they are independent from one another. In addition, 
institutions need to ensure a direct line of reporting of the CRCU to senior 
management in accordance with Article 190(1) of the CRR. 

23    See Article 189(1) and (2)(b) of the CRR. 
24    See Article 190(1) of the CRR. 
25    This refers in particular to those persons with authority or direct responsibility for decisions to originate 

or renew facility or obligor-level credit lines (for example by underwriting). 

ECB guide to internal models – Credit risk 

46 

 
 
42. 

43. 

Institutions should have a clear written mandate for their CRCU which clarifies its 
roles and responsibilities in order to ensure that they are aligned to the 
responsibilities mentioned in Article 190(2) of the CRR. Institutions should also 
determine which units are responsible for performing which subset of the tasks 
allocated to the CRCU(s)26, especially those tasks related to model design and 
development and the ongoing monitoring of the rating systems. 

The CRCU is responsible for ensuring the satisfactory performance of the rating 
systems and their ongoing maintenance. The CRCU may provide the validation 
function, when required and in line with paragraph 52 of this chapter, with the 
necessary input for the validation of internal estimates. In addition, the CRCU should 
address any deficiencies identified by the validation function and conduct the 
approved remediation activities as described in paragraph 57 of this chapter. 

3.7 

Review of estimates 

44. 

In accordance with Article 179(1)(c) of the CRR, risk estimates should be reviewed27 
when new information comes to light but at least on an annual basis. The ECB 
considers it best practice to do this on the basis of: 

(a) 

the ongoing monitoring performed by the CRCU; 

(b) 

the annual validation of internal estimates performed by the validation function 
(as described in Section 4 of this chapter). 

26    See Article 190(2) of the CRR. 
27    See Section 20 of the chapter on credit risk. 

ECB guide to internal models – Credit risk 

47 

 
 
4 

Internal validation 

4.1 

Relevant regulatory references 

Table 4 

Legal background 

Date of 
issue 

Article 

Paragraph/Point 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

10 

11 

12 

13 

14 

15, 33, 36 

(1)(a), (b) and (c), 
(2)(a) 

(1)(b), (2)(c), (4) 

(a), (c), (d), (e) 

(b) 

(b), (d) 

CRR 

26/06/2013 

144 

1(f) 

143, 170, 172, 174, 
185, 189 

Commission Delegated Regulation (EU) No 529/2014 

12/03/2014 

Annex 1 Part 2 Section 1 and 2 

Other references 

EBA Supervisory handbook on validation 

10/08/2023 

Basel Committee on Banking Supervision (BCBS) – Newsletter No. 428 

01/2005 

Basel Committee on Banking Supervision (BCBS) Regulatory 
Consistency Assessment Programme (RCAP)29 

04/2016 

45. 

In accordance with Article 8(1)(aa) of Regulation (EU) No 1093/201030, the EBA has 
published the EBA Supervisory handbook on validation to provide additional clarity 
on best supervisory practices that competent authorities are expected to give 
consideration to when performing their supervisory activities and developing their 
own expectations on the validation of IRB rating systems. Accordingly, the ECB 
intends to use the EBA Supervisory handbook on validation as a basis for 
interpretative purposes when performing its supervisory activities with respect to 
Articles 144(1)(f), 174(d) and 185 of the CRR. 

46. 

In the context of rating systems, the term “validation” encompasses a range of 
processes and activities that contribute to an assessment of whether ratings 
adequately differentiate risk, and whether estimates of risk parameters (such as PD, 
LGD and CCF) appropriately characterise the relevant aspects of risk. 

28    Basel Committee Newsletter No. 4 (January 2005), “Update on work of the Accord Implementation 
Group related to validation under the Basel II Framework”, referred to in this guide as “Basel 
Committee on Banking Supervision (BCBS) - Newsletter No. 4”. 

29    Basel Committee on Banking Supervision “Regulatory Consistency Assessment Programme (RCAP) – 

Analysis of risk-weighted assets for credit risk in the banking book”, referred to in this guide as “Basel 
Committee on Banking Supervision (BCBS) - Regulatory consistency assessment programme 
(RCAP)”. 

30    Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 
establishing a European Supervisory Authority (European Banking Authority), amending Decision No 
716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12), referred 
to in this guide as the “EBA Regulation”. 

ECB guide to internal models – Credit risk 

48 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
47. 

The main role of the validation function is to perform a consistent and meaningful 
assessment of the performance of internal rating and risk estimation systems. The 
term “validation function” encompasses the personnel responsible for performing the 
validation. 

4.2 

Validation level and responsibilities 

48. 

In general, internal validation should be performed at all relevant levels. In particular, 
institutions should pay attention to the following: 

(a) 

(b) 

If the institution has approval for a rating system on a consolidated basis only, 
the validation of that rating system should be performed at least at consolidated 
level. 

If the institution has approval for a rating system on a consolidated basis as well 
as on a sub-consolidated and/or individual basis, the validation of that rating 
system should be performed at the consolidated as well as on the sub-
consolidated and/or individual levels. The results of the validation at the sub-
consolidated and/or individual levels should be taken into account for 
consistency reasons in the validation performed at consolidated level. 

49. 

In order to ensure consistency in validation activities across the different levels, the 
group validation function can provide support to validation functions at lower levels 
(sub-consolidated and/or individual level). However, responsibility for the validation 
tasks should be retained at the level at which the rating system is approved (sub-
consolidated and/or individual level). See also Section 11.3.1 on internal and 
external outsourcing of internal validation and internal audit tasks and Section 11.3.3 
on in-house knowledge of the chapter on overarching principles for internal models. 

4.3 

Content and frequency of tasks of the validation function 

50. 

To meet the requirements of Article 185 of the CRR with regard to the assessment of 
the performance of the internal rating and risk estimates by the validation function, 
the ECB understands that institutions should implement the following: 

51.  Validation policy 

Institutions should have internal validation policies involving proven procedures and 
methods which adequately validate the accuracy, robustness and stability of their 
estimation of all relevant risk parameters.31  The procedures and methods stipulated 
in the validation policy should be in line with the institution’s classification of material 
and non-material rating systems as defined in paragraphs 23 and 25 of this chapter, 
specifically considering also the complexity of the rating systems32  in accordance 

31    Validation policies are assumed by Article 185(d) of the CRR, which stipulates that the methods and 

data used for quantitative validation must be documented and consistent through time. 

32    See paragraphs 14 and 25 of the EBA Supervisory handbook on validation. 

ECB guide to internal models – Credit risk 

49 

 
 
with paragraph 13 of the chapter on Overarching principles for internal models. 
Institutions should follow their internal validation policy when carrying out validations. 

52.  Validation process and content 

(a)  The validation process should assess the performance of the rating systems by 

means of qualitative and quantitative methods, in particular with regard to the 
ranking of borrowers by creditworthiness (ranking power) and risk parameter 
estimation (calibration appropriateness). 

(b)  To be able to meaningfully and consistently assess the performance of the 
rating systems, the content of the validation process should be consistent 
across rating systems and through time.33  The analyses and tests described in 
this paragraph should be considered as the minimum activities required to 
ensure that the assessment is meaningful and the depth of the activities should 
be commensurate to the materiality of the rating systems, as defined in 
paragraph 23 of this chapter. However, the implementation of all of these 
analyses and tests does not necessarily mean that the validation requirements 
according to CRR have been fulfilled, nor should it prevent the institution from 
developing additional tests when deemed relevant. 

(c)  The content of the validation process should include quantitative analyses, 

which in turn should include thresholds. If such thresholds are breached, further 
investigation should be initiated and, if necessary, adequate measures or 
actions should be triggered. 

(d)  All analyses and tests should be performed in such a way that the validation 
function is in a position to propose an effective and independent challenge to 
model development and use. To that end, the institution should ensure that the 
validation function has its own access to the relevant databases.34  The results 
of the validation analyses and tests should be documented (validation report) 
and verifiable by third-party experts (e.g. the internal audit and the competent 
authority). This also includes the preparation of the validation data. 

(e) 

It is not expected that institutions develop a uniform validation process, as the 
relevant tests and their frequency may differ from one rating system to another 
(e.g. corporate vs. retail rating systems or material vs. non-material rating 
systems). 

(f)  To ensure that the systems in place to validate the accuracy and consistency of 
rating systems are sufficiently robust35, institutions should ensure that any 

33    See Article 185(a) of the CRR for “consistently and meaningfully” and Article 185(d) for “consistent 

through time”. 

34    When an institution is using rating systems developed from pooled data, the validation function should 
have access to all relevant internal data of that institution. In addition, any third party involved may 
assist the institution in its validation activities by performing those validation tasks which require access 
to pooled data (see also paragraphs 97 and 90(c) of the chapter on overarching principles for internal 
models). 

35    See Article 185(a) of the CRR. 

ECB guide to internal models – Credit risk 

50 

 
 
statistical tests or confidence intervals that they use are appropriate from a 
methodological point of view and sufficiently conservative. 

(g)  A meaningful validation of the rating systems requires (as also anticipated by 
Article 185(b) of the CRR with respect to certain elements) not only an initial 
validation but also assessment on a regular basis. In line with Article 185(b) of 
the CRR, these assessments should be carried out annually.36  Therefore, the 
validation analyses listed hereinafter should be carried out annually (“annual 
validation”)37  or at least as part of a “full validation”38  as advised below. The 
appropriate frequency of full validations should be defined as part of the 
validation policy. In the ECB’s understanding, with respect to material rating 
systems, institutions should perform a full validation at least once every three 
years. As mentioned in paragraph 18 of the chapter on overarching principles 
for internal models, the term “initial validation” in the guide refers to the 
validation of new models as well as the validation of material changes and 
extensions to approved models.39  In the case of material changes and 
extensions the validation should be conducted on those aspects directly or 
indirectly affected by the change.40 

(h) 

In addition, and to ensure a robust validation, the analyses should be performed 
by the validation function without considering input from the CRCU41  unless 
otherwise specified below. 

(i)  Back-testing42 

For the annual validation of non-material rating systems, the validation 
function can also take into account the back-testing analyses performed by 
the CRCU. 

(ii)  Discriminatory power 

(ii.a)  Analyses of discriminatory power for PD models should be 

designed to ensure that the ranking of obligors/facilities resulting 
from the rating methodology appropriately separates riskier and less 
risky obligors/facilities.43  Similarly, analyses of discriminatory power 
for LGD (respective CCF) models should be designed to ensure 
that the LGD (respective CCF) model is able to discriminate 
between facilities with high values of LGD (respective CCF) and 
those with low values of LGD (respective CCF). 

36    See Article 174(d) of the CRR. 
37    See paragraph 98 of the EBA Supervisory handbook on validation. 
38    See paragraph 100 of the EBA Supervisory handbook on validation. 
39    See paragraphs 77 and 99(b) of the EBA Supervisory handbook on validation. 
40    See also Article 11(4) of Commission Delegated Regulation (EU) No 2022/439 and paragraph 77 of the 

EBA Supervisory handbook on validation. 

41    Or credit risk control function for institutions using option (c) of paragraph 19 of the chapter on 

overarching principles for internal models. 

42    Comparison of risk estimates with realised default rates, in accordance with Article 185(b) of the CRR. 
43    Further elaborated in Article 170(1), sub-paragraphs (d), (e) and (f), and 170(3)(c) of the CRR.   

ECB guide to internal models – Credit risk 

51 

 
 
(ii.b)  These analyses should be performed at least at the level of the 
overall model and, when relevant, at the level of individual risk 
factors and other possible segments including, for example, 
scorecards and modules. 

(ii.c)  For the annual validation of non-material rating systems, the 
validation function can also take into account the analyses of 
discriminatory power performed by the CRCU. 

(iii)  Analyses of representativeness 

(iii.a)  The data used to build the model must be representative of the 

actual obligors or exposures (Article 174(c) of the CRR). This should 
include the following checks: 

• 

Ensuring that the range of application of the model is in line 
with the approved one, in accordance with Article 143(3) of the 
CRR. Obligor characteristics should be compared for PD 
models, and facility types and characteristics should be 
compared for LGD and CCF models. 

•  Monitoring the changes made to the definition of default, with 
the aim of identifying any changes that would affect the 
representativeness of the dataset with respect to the obligors or 
facilities within the range of application of the model. 

• 

Analysing lending standards or workout procedures, external 
market and economic conditions, and other relevant 
characteristics surrounding the model development process. 

(iii.b)  Where an institution uses data that are pooled across institutions, 
the analyses should also cover the requirements of Article 179(2) 
paragraphs (a) and (b) of the CRR. 

(iii.c)  For the annual validation of rating systems, the validation function 

can also take into account the analyses of representativeness 
performed by the CRCU. 

(iv)  Analyses of overrides 

(iv.a)  Overrides should not only be monitored but also assessed as part of 
the validation process (Article 172(3) of the CRR). See also Section 
6.6.3 of this chapter. 

(iv.b)  Analyses of overrides should be conducted on an annual basis (and 

not at initial validation). The validation function can also take into 
account the analyses of overrides performed by the CRCU. 

ECB guide to internal models – Credit risk 

52 

 
(v)  Stability analyses of the internal ratings and risk parameters over time44 

(v.a)  Examples for analysing the stability of internal ratings and risk 

parameters over a specific observation period for PD estimates can 
be the following: 

• 

• 

• 

obligor/facility migrations; 

stability of the migration matrix; 

concentration in rating grades. 

(v.b) 

Institutions should justify excessive or unexpected variability. 

(v.c)  For the annual validation of non-material rating systems, the 

validation function can also take into account the stability analyses 
performed by the CRCU. 

(vi)  Analyses of model specifications and model design stability45 

(vi.a)  The institution should challenge the model specifications, including 
assumptions and methodology, based on the applicable regulation. 
A stepwise initial validation process involving interaction with the 
model development at each step of the development phase may not 
be sufficient to perform this challenge effectively. Regardless of the 
validation approach followed, the validation unit should provide an 
overall conclusion on the model to ensure that individual model 
strengths and weaknesses are evaluated on an overall basis. 

For model design stability, the institution should analyse: 

• 

• 

the differences between the original weights of the risk drivers 
(derived from the development sample) and the weights 
estimated from a different sample (longer or more recent 
historical sample); 

the continued homogeneity46  of rating grades or pools used as 
a basis for the estimation of risk parameters. 

Additionally, at least in a full validation, the ECB considers it best 
practice for the institution to perform the analyses outlined in 
paragraph 100 and further explained in Focus Box 9 of the EBA 
Supervisory handbook on validation. 

(vi.b)  Institutions should justify excessive or unexpected variability. 

44    This is required by Article 174(d) of the CRR. 
45    This is required by Article 174(d) of the CRR on “monitoring of model performance and stability” and 

“review of model specifications”. 

46    The term “homogeneity” is used here as defined in Article 36 of Commission Delegated Regulation 

(EU) No 2022/439. 

ECB guide to internal models – Credit risk 

53 

 
 
(vi.c)  These analyses should be performed at initial validation and at an 
adequate frequency thereafter, but at least as part of a full 
validation. The validation function can also take into account the 
analyses performed by the CRCU for non-material rating systems, 
except at initial validation. 

(vii)  Evaluation of input data47 

(vii.a)  This should ensure all of the following: 

• 

• 

• 

• 

that the data treatment process is reliable and well-founded; 

that the necessary information is available and up to date for 
the majority of the application portfolio’s48  obligors and facilities 
by tracking the age of model input data, especially in the case 
of financial statements; 

that all defaults that occurred in the institution within the scope 
of application of the model are correctly identified and fully 
documented and registered in the appropriate and intended IT 
systems; 

that the number and reasons for technical past-due situations 
are tracked. 

(vii.b)  For the annual validation of the rating systems, the validation 

function can also take into account the evaluation of the input data 
performed by the CRCU. 

(viii)  Benchmarking analyses 

(viii.a) The institution should carry out comparisons with up-to-date data 

from representative and comparable external data sources, in 
particular with regard to low-default portfolios (Article 185(c) of the 
CRR). The institution should provide sufficient evidence in the event 
that no usable external data are available. 

(viii.b) Benchmarking analyses should be performed at initial validation and 

at an adequate frequency thereafter, but at least as part of a full 
validation. For benchmarking analyses at initial validation the 
validation function can take into account the benchmarking analyses 
performed by the CRCU. 

(ix)  Data cleansing analyses49 

47    See Article 174(b) of the CRR. 
48    “Application portfolio” means the actual portfolio of exposures within the range of application of the PD 

LGD or CCF model at the time of estimation of a risk parameter. 
49    The rationale for these analyses is set out in Article 174(c) of the CRR. 

ECB guide to internal models – Credit risk 

54 

 
 
(ix.a)  These analyses refer to the exclusion of observations (and the 

reasons behind this) from the risk database for the construction of 
the reference dataset (RDS) for the modelling. 

(ix.b)  These analyses should be performed at least at initial validation. 

(x)  Quality assurance of the computer codes used 

(x.a)  This should include at least the following: 

• 

• 

that the implementation of the rating system in the relevant IT 
system is compliant with and reproduces exactly the 
documented model under review50; 

that the descriptions of the data sources, variables and risk 
drivers used for development purposes are properly 
documented. 

(x.b)  These analyses should be performed at least at initial validation. 

(xi)  Additional qualitative analyses51 

(xi.a)  These analyses should include, among other things, the following: 

• 

• 

• 

• 

qualitative assessments of assumptions and expert-based 
estimates and of the integrity of the rating assignment process; 

assessment of the use of the models and their correct 
application in practice; 

assessment of legal or macroeconomic changes that may 
impact the risk parameters; 

assessment of downturn phases and the correct application of 
margins of conservatism. 

(xi.b)  Not all of the above-mentioned qualitative analyses need to be 

performed annually, but institutions should have a clear policy in 
place defining the appropriate frequency of each assessment. 

53. 

The duration from the start (reference date of data) to the end (approval of the 
validation results) of the yearly validation should not be more than one year. 
Deviations from this requirement should be clearly justified and documented by the 
institution and also reported to senior management. 

54.  Quantitative thresholds (see paragraph 52(c) of this chapter) should be set up for at 

least the following tests: 

50    See also Article 144(1) of the CRR, which requires that the institution’s systems for the management 

and rating of credit risk exposures be sound and implemented with integrity. 

51    This is contemplated in Article 174(e) of the CRR. 

ECB guide to internal models – Credit risk 

55 

 
 
(a)  back-testing; 

(b)  discriminatory power; 

(c)  analyses of overrides; 

(d)  stability analyses of the internal ratings and risk parameters over time. 

55. 

In particular for tests where no thresholds are applied, a consistent qualitative 
assessment of the results should be performed and documented. In the event of a 
negative qualitative assessment, adequate measures or actions should be triggered. 

4.4 

Reporting and follow-up 

56. 

Institutions should ensure that senior management and the management body (or 
the committee designated by it) are informed about the conclusions and 
recommendations of the validation results as set out in the rating systems’ validation 
reports, and in particular about any exceeded thresholds and deficiencies identified, 
as this is required by Article 189(2), sub-paragraph 2, of the CRR. Such information 
should be provided, where appropriate52, in a summary document (or documents) to 
ensure that a sufficient level of information is provided to senior management and to 
the management body and to enable them to assess the performance of the rating 
systems. This summary document (or documents) should present an aggregated 
view and comparison of the results for all the rating systems. 

57. 

Institutions should be able to demonstrate that, on the basis of the validation results 
and recommendations, measures are initiated to remedy the identified deficiencies of 
the rating systems (e.g. model change, recalibration) as contemplated by Article 
189(2), sub-paragraph 2, of the CRR. 

58.  Article 189(2)(c) of the CRR requires senior management to ensure, on an ongoing 

basis, that the rating systems are operating properly. Article 189(2), sub-paragraph 2, 
of the CRR requires senior management to be informed of the status of the 
measures to remedy any previously identified deficiencies. From this, it can be 
inferred that institutions should have a process in place (e.g. through a committee or 
another comparable body) to decide on such measures, who will be responsible for 
them, and the timelines for their implementation, on the basis of the validation results 
and recommendations. To ensure sufficient senior management engagement as 
contemplated by Article 189(2) of the CRR, the ECB is of the view that at least for 
material rating systems the direct involvement of senior management should be 
envisaged (e.g. by senior management chairing the committee). The process should 
involve persons with the appropriate level of seniority and responsibility from both 
the CRCU and the validation function. If affected, business units should also be 
involved. An escalation process up to management body level should be in place in 

52    Such a summary document (or documents) is (are) expected to be appropriate, for example in the case 

of institutions with a significant number of rating systems. 

ECB guide to internal models – Credit risk 

56 

 
 
59. 

60. 

the event of conflicts between the validation function, the CRCU and/or business 
units. 

Institutions should have adequate processes in place for tracking the status of the 
measures adopted to remedy deficiencies.53 

Institutions should always apply to/notify the competent authority in the event of 
changes to their validation methodology and/or processes in accordance with Annex 
1 Part 2 Section 1 (material model change) or Section 2 (ex ante notification) of 
Commission Delegated Regulation (EU) No 529/2014. 

5 

Internal audit 

5.1 

Relevant regulatory references 

Table 5 

Legal background 

Date of 
issue 

Article 

Paragraph/ 
Point 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

17 

CRR 

26/06/2013 

145, 175, 191 

Commission Delegated Regulation (EU) No 529/2014 

8 

Other references 

Basel Committee on Banking Supervision (BCBS) 328 

08/07/2015 

43, 139, 140, 141, 142, 143 

EBA Guidelines on internal governance 

26/09/2017 

V. 22. 201, 202, 204, 205, 206, 207 

EBA Supervisory handbook on validation 

10/08/2023 

20, 21, 22, context box 1, interaction 
boxes 2 to 4 and 6 to 9 

5.2 

Scope and frequency of the review of the rating systems 

61. 

62. 

In accordance with the existing regulatory requirements under Article 191 of the 
CRR, the internal audit or another comparable independent auditing unit (hereinafter 
internal audit) must review the institution’s rating systems and its operations at least 
annually. The areas for review must include adherence to all applicable 
requirements. 

The ECB considers that an institution fulfils the above-mentioned requirements of 
Article 191 of the CRR if the internal audit carries out, annually and on the basis of 
up-to-date information, a general risk assessment of all aspects of the rating systems 
for the purpose of drawing up the appropriate internal audit work plan, as elaborated 
in paragraphs 63 to 65 of this chapter, and executes this plan. 

53    See Article 189(2), sub-paragraph 2, of the CRR. 

ECB guide to internal models – Credit risk 

57 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
63.  Depending on the outcome of the general risk assessment, the intensity and 
frequency of the audit assignments54  may differ between specific areas. 

(a)  An area showing signs of increased/high risk in the general risk assessment is 

subject to a thorough audit assignment (“deep dive”). Reasons for the increased 
risk might include, but are not limited to, new processes, new regulatory 
requirements, new types of exposures in the range of application of a rating 
system, material model changes, findings by the competent authority or by any 
other function, open issues and areas with high risk identified in previous risk 
assessments. The audit assignments should be included in the annual audit 
work plan established on the basis of the general risk assessment. 

(b)  Areas not showing any sign of an increased/high risk are subject to a deep dive 

mission at least every three years in order to provide a thorough update of the 
internal audit opinion on them.55 

64. 

For the purpose of the general risk assessment, the internal audit should develop its 
own opinion on the areas of rating systems to be reviewed but can take into 
consideration the analysis performed by the internal validation function where 
appropriate. This general risk assessment should include at least the opinion of the 
internal audit unit on the following aspects: 

(a)  The development56  and performance57  of the rating systems. 

(b)  The use of the models. The assessment of model use shows that the rating 

systems play an essential role in the most significant areas of the institution’s 
risk management, decision-making, credit approval, internal capital allocation 
and corporate governance functions. 

(c)  The process for the materiality classification58, the impact assessment and the 

compliance with regulatory requirements of all changes to the rating systems as 
well as their consequent implementation. The internal audit is informed of all 
changes to the rating systems. 

(d)  The quality of the data used for the quantification of risk parameters. 

(e)  The integrity of the rating assignment process. 

(f)  The validation function, in particular with regard to its independence from the 

CRCU as described in paragraphs 21 and 22 of the chapter on overarching 
principles for internal models, as well as the scope and suitability of the tasks 
performed and outputs obtained. 

54    An audit assignment can refer to a separate audit, a range of audits or themes of audits. 
55    These deep dives may be either thematic, covering one area for several rating systems (e.g. rating 
assignment process, data quality management, definition of default), or targeted on a specific rating 
system. 

56    The scope should include the initial validation tasks described in the internal validation principles. 
57    The scope should include the annual/regular basic tasks described in the internal validation principles. 
58    The internal audit function may be involved in the classification as an independent function confirming 

the assessment of materiality, as set out in Section 7.4 of this chapter. 

ECB guide to internal models – Credit risk 

58 

 
 
(g)  The process for calculating own funds requirements. 

65. 

66. 

67. 

68. 

The procedures and results of the general risk assessment and prioritisation, the 
annual work plan, the guidelines, and the subsequent production of the internal audit 
reports should be properly documented and approved by the management body. The 
auditing techniques used and applied by the institution should be documented to 
ensure that assessments are consistent.59 

To avoid delays in the procedures related to an initial IRB application or an 
application to extend the IRB approach to an exposure class or a type of exposure 
that is currently treated using the SA, it is beneficial if the internal audit provides the 
competent authority with an independent assessment of the compliance of the initial 
IRB application or extension package with all applicable requirements. This applies 
in particular to compliance with the experience test requirements of Article 145 of the 
CRR. The benefit of carrying out an internal review of this nature is that 
shortcomings can be addressed by the institution before submitting the application, 
and the completeness of the initial IRB application or extension package can be 
ensured. 

For extensions and changes to the IRB approach60, institutions must submit, among 
other things, and together with the application, reports of their independent review or 
validation.61  In the case of material changes in the validation methodology and/or 
validation processes62  or process-related aspects of changes in the definition of 
default, the review of those aspects should be independently assessed by the 
internal audit function. 

In line with paragraphs 20 and 22(c) of the EBA Supervisory handbook on validation, 
institutions should clearly document the responsibilities of their different internal 
control functions with respect to the independent assessment (e.g. definition of 
default, IT implementation of the rating system, assignment of exposures to 
exposure classes). 

59    See Article 175(1) and (2) of the CRR. 
60    See Section 7.3 “Notification” of this chapter on suggested templates to be used. 
61    Article 8(1)(e) of Commission Delegated Regulation (EU) No 529/2014. 
62    See paragraph 21 of the EBA Supervisory handbook on validation. 

ECB guide to internal models – Credit risk 

59 

 
 
6 

Model use 

6.1 

Relevant regulatory references 

Table 6 

Legal background 

Date of 
issue 

Article 

Paragraph/Point 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

18, 19, 20, 
21 

CRR 

26/06/2013 

22 

23 

24 

25 

39 

143 

144 

145 

148 

150 

171 

172 

173 

174 

179 

189 

(1)(a) and (b) 

(1)(a) 

2(a), (b), (c), (d) and 
(e) 

2(a), (b) and (c) 

(3) 

(1)(b) and (h) 

(1) 

(2) 

(3) 

(1)(b), 2 

(e) 

(1) 

(3) 

Other references 

Basel Committee on Banking Supervision (BCBS) -Newsletter No. 963 

18/09/2006 

Principles: 1, 2, 3, 4 

6.2 

Use test requirement 

69. 

The ECB acknowledges that the degree of use of internal ratings and default and 
loss estimates in the institution’s risk management and decision-making process, 
and in its credit approval, internal capital allocation and corporate governance 
functions, is more extensive for PD/internal ratings than for LGD/loss estimates and 
CCFs. 

70.  Moreover, the IRB risk parameters can be used in an adjusted form or indirectly 

through relevant risk measures/indicators stemming from the rating systems, 
provided that differences from the regulatory parameters are fully justified and 

63    Basel Committee Newsletter No. 9 (September 2006), “The IRB Use Test: Background and 

Implementation”, referred to in this guide as “Basel Committee on Banking Supervision (BCBS) - 
Newsletter No. 9”. 

ECB guide to internal models – Credit risk 

60 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
properly documented.64  For example, institutions may use adjusted or transformed 
IRB parameters by removing certain constraints (e.g. downturn effect, conservative 
add-on, floor) or adjusting the time horizon. 

71. 

The use of IRB risk parameters and their inclusion in internal policies and 
procedures enables institutions to continuously improve their accuracy and reliability 
by receiving feedback from model users. The conditions for an effective and 
beneficial feedback loop include a good understanding of the model, its assumptions 
and constraints and an adequate level of interaction between users, the CRCU and 
the validation function. 

72.  Where an institution requests initial permission to use the IRB approach or initial 

permission to use own estimates of LGD or CCF in the context of sequential 
implementation of the IRB approach, the institution should provide evidence that 
rating systems which are broadly in line with the IRB requirements of the CRR have 
been used for risk management, decision-making and credit approval processes for 
at least three years as part of the prior experience requirement set out in Article 
145(1) and (2) of the CRR and Article 22 of Commission Delegated Regulation (EU) 
No 2022/439. 

73.  Where an institution makes a request to extend the IRB approach to a new legal 

entity (that is not yet using the IRB approach) or to extend it to additional exposures, 
Article 145(3) of the CRR provides that if the use of the rating systems is extended to 
exposures that are significantly different from the scope of existing coverage, such 
that the existing experience cannot be reasonably assumed to be sufficient to the 
requirements of Article 145(1) and (2) of the CRR, the institution should provide 
evidence that the requirements of Article 145(1) and (2) of the CRR have been met. 
If the use of the rating systems is extended to additional exposures that are not 
significantly different from the scope of the existing coverage, it is the ECB’s 
understanding that: 

(a) 

(b) 

if the request is for calculation of own funds requirements at consolidated level 
only, the conditions of Article 145(1) and (2) of the CRR may be considered as 
having been met considering the existing experience of the institution; 

if the request is for calculation of own funds requirements at consolidated and 
individual levels, the institution should provide evidence that the conditions of 
Article 145(1) and (2) of the CRR have been met for the new legal entity. 

Where, following the consolidation and while the institution is returning to 
compliance, a single exposure is in the scope of the IRB rating systems of the 
acquirer and of the target, the institution should have appropriate processes in place 
to prevent a rating system from being used for the purpose of reducing own funds 
requirements. 

64    See Article 179(1), sub-paragraph 2, of the CRR. 

ECB guide to internal models – Credit risk 

61 

 
 
6.3 

Risk management, credit approval and decision-making process 

74.  As set out in Article 144(1)(b) of the CRR, internal ratings and default and loss 

estimates produced by the rating systems must play an essential role in the risk 
management and decision-making process and in credit approval. To ensure that 
they are able to play this essential role, institutions should use internal ratings and 
default and loss estimates in the approval, restructuring and renewal of credit 
facilities, and in lending policies and the monitoring process for obligors and 
exposures. This should be formally included in the institution’s internal policies. 

(a)  Credit approval 

The ECB considers that institutions comply with the requirement to use the 
internal ratings and default and loss estimates in the approval, restructuring and 
renewal of credit facilities if they establish the following: 

(i) 

Institutions incorporate the internal rating systems in the overall credit 
granting, restructuring and renewal process. Related policies are calibrated 
on the basis of rating classes or groups of rating classes or risk 
parameters. 

(ii)  For the incorporation of internal rating systems to be beneficial, staff 

involved in the credit granting, restructuring and renewal process need to 
have sufficient knowledge of the rating systems, including their strengths 
and limitations. This encompasses the inclusion of rating system users’ 
feedback in model development and maintenance as well as having 
appropriate training programmes in place. 

(iii)  The assignment or updating of ratings is a prerequisite for the assessment 

underlying the granting and reviewing of credit lines. 

The ECB considers that institutions comply with the requirement to use the 
internal ratings and default and loss estimates in their lending policies, 
including exposure limits and mitigation techniques, if those policies have 
the following features: 

(iv)  Lending policies include specific references to the use of internal rating 

systems and related parameters (for instance, use of a grid of parameters 
in the decision-making process). These parameters serve as an indicator 
of riskiness (e.g. in terms of expected loss (EL)). They may be 
differentiated by institutions’ portfolios (e.g. retail/non-retail) and by facility 
type. 

(b)  Risk management – monitoring process for obligors and exposures 

The ECB considers that institutions comply with the requirement to use their 
internal ratings and default and loss estimates in respect of the monitoring 
process for obligors and exposures if the following is established: 

Individuals in charge of the monitoring process are promptly provided with 
adequate information on the development of counterparties’ credit risk as 

ECB guide to internal models – Credit risk 

62 

 
expressed by ratings, so that the relevant information can be easily 
incorporated in the process and trigger appropriate actions. 

75. 

In addition, institutions should consider taking into account the internal ratings and 
default and loss estimates produced by the rating systems in the five areas shown 
below. If an institution decides to take into account the internal ratings and default 
and loss estimates in any of these five areas, this should be formally included in its 
internal policies.65  If an institution is not using internal ratings or risk parameters in 
one or several of these areas, it should properly document and justify the rationale 
for that to ensure that discrepancies are explained in a sound and understandable 
manner. 

(a)  Pricing of transactions 

(i) 

Internal ratings and risk estimates can be considered in the pricing of 
transactions, in particular for non-retail exposures. 

(ii)  The methodology underlying pricing can be documented and the use of 

risk-adjusted performance indicators (e.g. return on risk-adjusted capital – 
RORAC) or adjusted IRB parameters is considered best practice for pricing 
estimation. 

(b)  Early warning systems 

(i)  Early warning systems can be applied to all the institution’s exposures and 
can be tailored to its specific sub-portfolios (with at least a distinction 
between retail and non-retail exposures). 

(ii)  PD/ratings dynamics (i.e. downgrades) and other indicators linked to other 
risk measures (e.g. EL, loan-to-value, overdraft) can be taken into account 
in the institution’s early warning system – at least for the most relevant 
portfolios. Whenever an anomaly is detected, appropriate risk 
management decisions can be triggered. This process can be adjusted 
depending on the persistency and intensity of the warning. It can also be 
designed according to other variables such as exposure size or facility 
type. 

(c)  Collection and recovery policies and processes 

(i)  Regarding the collection process, institutions can have risk management 
procedures in place which are triggered in advance of the exposure’s 
default (e.g. early collection calls) and are based – among other indicators 
– on their internal ratings or risk drivers. 

(ii)  Regarding the recovery process, institutions can have in place rules, 
strategies or procedures that take into consideration, inter alia, their 
LGD/expected loss best estimate (ELBE) values, as well as their set-aside 
provisions. 

65    See Article 19(2) of Commission Delegated Regulation (EU) No 2022/439. 

ECB guide to internal models – Credit risk 

63 

 
 
(d)  Credit risk adjustments 

(i)  The credit risk adjustments methodology for both performing exposures 

and exposures in default (or share of exposures in default) can be aligned 
to the calculation of own funds requirements, although some adjustments 
might be needed to comply with accounting standards (for example, 
International Financial Reporting Standards 9 (IFRS 9)). The institution 
should justify and document any significant deviations to ensure that the 
rationale for discrepancies is sound and understandable. 

(e)  Allocation or delegation of competence for the approval process 

(i)  Along with the materiality of credit lines, the delegation of competences for 
credit approval can take risk estimates into account through one or several 
IRB parameters or through EL (for example, an increase of some EL-driven 
measures above a pre-defined threshold should typically trigger an 
escalation process). 

(ii)  The allocation and delegation process can include the criterion of 
proportionality, taking into account portfolio risk and facility types. 

6.4 

Internal capital assessment and allocation 

76. 

Internal ratings and the default and loss estimates produced by the rating systems 
play an important role in the assessment, calculation and allocation of institutions’ 
internal capital66  under the framework of the internal capital adequacy assessment 
process (RWEAs can also be used as an additional driver). This role should be 
reflected within the institutions’ internal policies and procedures on internal capital 
assessment and allocation. 

6.5 

Corporate governance functions 

77. 

Internal ratings and the default and loss estimates produced by the rating systems 
play an important role in the institution’s corporate governance functions.67  To 
ensure that they are able to play this essential role, institutions should use internal 
ratings and default and loss estimates, in particular in their management reporting 
and portfolio credit risk monitoring procedures. This role should be reflected within 
the institutions’ internal policies. 

78. 

The ECB considers that institutions comply with the requirement to use the internal 
ratings and default and loss estimates in their corporate governance functions if they 
establish the following: 

66    See Article 144(1)(b) of the CRR. 
67    See Article 144(1)(b) of the CRR. 

ECB guide to internal models – Credit risk 

64 

 
 
(a) 

Institutions’ management reporting68 

(i) 

Institutions have a structured reporting system on risk measured by their 
IRB risk parameters. This reporting framework contains information about 
frequency, recipients and contents (if possible, broken down by segment, 
portfolio and product). 

(ii)  The reports are accompanied by comments and explanations on the 

numbers provided as well as by qualitative assessments, to enable 
recipients to fully understand the potential underlying risks. 

(b)  Portfolio credit risk monitoring 

(i) 

In its ongoing model monitoring function, the CRCU performs descriptive 
analyses of portfolio riskiness (distribution of exposures among rating 
classes, average risk estimates and their realisations, ELs). These 
analyses are progressively refined to include the analytical insights derived 
from the information on ratings.69 

(ii)  Reporting to senior management provides a concise but complete 

overview of the relevant variables70  so that the evolution of credit risk can 
be monitored at portfolio level. 

6.6 

Assignment of exposures to grades or pools 

6.6.1 

Use of human judgement in the assignment of exposures to grades 
or pools 

79. 

In accordance with Article 171(1)(a) of the CRR, institutions must have specific 
definitions, processes and criteria for assigning exposures to grades or pools. The 
grade and pool definitions must be sufficiently detailed. To comply with this provision, 
institutions should ensure that, when human judgement is used in the assignment of 
exposures to grades or pools, there is a framework in place that establishes clear 
and detailed guidelines and procedures on the application of human judgement 
(e.g. through the use of pre-defined questionnaires). The use of human judgement 
should be documented in a way that ensures the rating assignment can be 
understood and replicated by a third party.71  To ensure the replicability and 
consistency of the rating assignment process, the principles set out below should be 
followed. 

68    See also Section 3.4 of this chapter for further details. 
69    For example: highlighting, in aggregate terms, the volume of credits whose rating has worsened by 
more than one class (“double downgrade”); rating stability; the speed and frequency of rating 
modifications; the incidence of defaults; the relationship between “upgrade” and “downgrade” at 
portfolio level in a given period of time; and changes in rating by line of business, market segment or 
type of credit line. 

70    At least those defined in Article 189(3) of the CRR. 
71    Article 171(1)(b) of the CRR. 

ECB guide to internal models – Credit risk 

65 

 
 
(a)  The basic structure of the model72  should be applied consistently and not 

modified by human judgement. It should, in particular, consist of: 

(i) 

the minimum data sources to be used for the grade/pool assignment; 

(ii) 

the complete list of pre-defined risk drivers which need to be assessed 
individually and for which the assessments need to be stored; 

(iii) 

the importance of and the evaluation criteria for the risk drivers, particularly 
the functional relationship73  between risk drivers and the assigned rating 
(before overrides); 

(iv) 

the procedures and steps to be followed during the assessment, including 
the steps where overrides can be applied. 

(b) 

Institutions should assess the consistency of the rating assignment process. To 
this end, they should define the tests and analyses in a way that is 
proportionate to the degree of human judgement applied. In cases where 
human judgement is the main component of the rating assignment process, 
these tests should at least include an analysis of consistency in a 
representative sample by having obligors re-rated independently by different 
analysts. The results of the ratings consistency assessment should be analysed 
against pre-defined thresholds as part of the framework for review of estimates. 

80. 

In accordance with Article 172(3) of the CRR, for grade and pool assignments 
institutions must document the situations in which human judgement may override 
the inputs or outputs of the assignment process and the personnel responsible for 
approving these overrides. In the context of this requirement, the ECB understands 
that an override is a judgement-based and discretionary action that contributes to the 
assessment of the obligor’s creditworthiness as obtained through pre-defined 
components of the rating system. These comprise both automatic/quantitative 
components74  and qualitative variables.75  An override constitutes a direct 
intervention to an input or to an intermediate76  or final output of the rating 
assignment process, through an adjustment or replacement of that input or 
intermediate/final output which is obtained under the regular assignment process. 
Overrides should be limited to information relevant to the obligor’s creditworthiness, 
if this is not captured well by the pre-defined components of the model.77 

72    This concept is not intended to refer to pure statistical models and can encompass other methods for 

assigning exposures to grades or pools. 

73    This refers to a relationship between different variables in order to form an output (and not necessarily 

a mathematical formula). 

74    These components also include the “forcing rules”, i.e. automatic adjustments to the rating carried out 

when certain conditions apply (e.g. more than 30 days past due). 

75    As referred to in paragraph 201(a) of the EBA Guidelines on PD and LGD. 

76    Intermediate outputs should be defined in the model specifications (e.g. results of the financial 

scorecard of a model). 

77    This also applies to climate-related and environmental risks. Where climate-related and environmental 
risk drivers are assessed to be relevant and material and institutions do not have sufficient information 
related to these risk drivers, institutions should consider whether it would be appropriate to take a more 
conservative approach in the assignment of ratings to the related facilities or obligors by applying an 
override to the final output of the rating assignment process. 

ECB guide to internal models – Credit risk 

66 

 
 
81.  Within a rating assignment process, the use of pre-defined risk drivers in the form of 

qualitative model inputs should be distinguished from overrides. These judgement-
based or qualitative variables are expected to be considered under the regular 
assignment process and as part of the pre-defined components of the rating system. 
Therefore, they are not themselves considered as overrides.78 

82.  Whenever the functional relationship between the risk drivers and the assigned 

rating as specified in paragraph 79(a)(iii) of this chapter is circumvented, for example 
in cases where the last-assigned rating deviates from the rating that would be 
assigned on the basis of this functional relationship, it is considered to be an 
override. For the purposes of Article 172(3) of the CRR, it should therefore be 
specified in the policies and criteria for the use of overrides in the rating assignment 
process. 

83. 

In accordance with Article 174(e) of the CRR, the results of the statistical model must 
be complemented by human judgement, especially by taking into account all 
information not included in the model. The higher the number of relevant 
observations, the more the institution should rely on the outcomes of the statistical 
model. 

6.6.2 

Non-rated exposures and outdated ratings 

84.  Article 144(1)(h) of the CRR requires institutions to assign and continue with 

assigning each exposure in the range of application of a rating system to a rating 
grade or pool of this rating system. Furthermore, and in accordance with Article 
173(1)(b) of the CRR, institutions must review those assignments at least annually. 
Nevertheless, the ECB observes that institutions’ portfolios occasionally show a 
certain proportion of non-rated exposures and/or outdated ratings. The ECB 
considers that this should be properly investigated, justified, documented and 
monitored. 

(a)  Root causes 

(i)  Non-rated exposures are temporary exceptions to the “ordinary” rating 
assignment process and should therefore be investigated, documented 
and justified in detail. 

(ii)  Outdated ratings include both ratings that have not been updated within 
the 12-month period following the last rating date79  and ratings based on 
outdated information.80 

(b)  Materiality 

78    However, these qualitative input variables can be subject to overrides in accordance with 

paragraph 201(b) of the EBA Guidelines on PD and LGD. 

79    See related requirements in Article 173(1)(b) and 173(2) of the CRR. 
80    For instance, when financial information is used in the rating assignment process, it should be taken 

from financial statements dating back no more than two years. 

ECB guide to internal models – Credit risk 

67 

 
 
(i)  Non-rated exposures and outdated ratings present a risk for institutions of 
not being compliant with the CRR requirements related to rating systems. 
To mitigate that risk, institutions should implement specific policies and 
procedures to identify these non-rated exposures and outdated ratings and 
monitor their materiality (in terms of number, EAD and RWEAs). A formal 
check should be carried out on these issues, at least annually, and 
reported to senior management. These items should also be reviewed 
periodically by the internal validation function. 

85.  With regard to ratings not updated within the 12-month period following the most 

recent rating date, a transition period during which the current rating is carried 
forward can be considered provided all the following conditions are met: 

(a) 

the transition period begins 12 months after the date the current rating was 
assigned or when new material information on the obligor or exposure became 
available (if earlier); 

(b) 

the transition period does not exceed three months; 

(c) 

the transition period applies: 

(i) 

to wholesale exposures whose rating assignment relies on external 
information (e.g. financial statements), which may be available/published 
not exactly 12 months apart; or 

(ii) 

in the presence of exceptional internal impediments that affect the timely 
review of the rating assignment; 

(d)  adequate monitoring and reporting policies, together with escalation 
procedures, are implemented to ensure a rapid return to compliance; 
restrictions to credit granting or to delegation of powers for credit approval are 
also envisaged for those counterparties whose rating falls within the transition 
period; 

(e)  conservative treatments apply after three months, as detailed in paragraph 86 

of this chapter. 

86.  All exposures within the range of application81  of an IRB rating system must 

eventually be rated82  and are not expected to be treated under the SA, unless they 
have received the permission of the competent authority to be permanently treated 
under that approach in accordance with Article 150 of the CRR.83  Non-rated 
exposures and outdated ratings present a risk of potential underestimation of own 
funds requirements. To mitigate that risk, institutions should adhere to the following 
guidance: 

81    The range of application refers to Article 143(3) of the CRR and thus to all exposures of the relevant 

type of exposure for which that rating system has been developed and approved. 

82    See Article 144(1)(h) of the CRR. 
83    See Article 148(1) of the CRR. 

ECB guide to internal models – Credit risk 

68 

 
 
(a) 

Institutions should have internal policies in place establishing a process to 
monitor and manage non-rated exposures and outdated ratings prudentially. In 
particular, they should be able to prove that their procedures allow for a 
conservative measure of risk, such as time-dependent downgrading for 
outdated ratings and the application of the worst-performing rating grade for 
unrated exposures.84 

(b)  The calibration of the prudential treatment should be validated at least annually 

(evidence of conservativeness). 

6.6.3 

Analysis of overrides 

87. 

88. 

For grade and pool assignments institutions must document the situations in which 
human judgement may override the inputs or outputs of the rating system and the 
personnel responsible for approving these overrides. 

For the purposes of this subsection, instances of overruling of internal policies and/or 
procedures are not considered as overrides. If institutions overrule internal policies 
and/or procedures, they should, as in the case of overrides, document these 
instances and report them to the relevant functions (e.g. CRCU, internal validation 
function). The functions concerned should assess the performance of the exposures 
affected by the overruling and its potential impact on the rating systems. 

89.  As a general principle, the rating of retail exposures is less likely to be affected by an 
override process, given the high degree of standardisation of information processing 
– including in qualitative terms – and the small margins of discretion in the 
evaluation. 

90. 

“For grade and pool assignments institutions shall document those situations in 
which human judgement may override the inputs or outputs of the assignment 
process.”85  Accordingly, institutions should have documented policies that 
incorporate the following principles: 

(a) 

(b) 

the policies include clear and exhaustive justifications for triggering the override 
process on the basis of pertinent and significant information for an accurate 
assessment of the counterparty’s creditworthiness; 

the policies define the maximum extent of overrides (in terms of, for example, 
maximum number of notches up86  and maximum share of overridden 
exposures), also considering model/portfolio specificities; institutions should aim 
to be more restrictive with positive overrides than with negative ones. 

91. 

Institutions must document each override.87  To this end, they should retain the 
quantitative and qualitative information concerning each phase of the rating process. 

84    To avoid any distortion of risk estimates, institutions should ensure that these ex-post conservative 

adjustments are not included in the calibration dataset. 

85    See Article 172(3) of the CRR. 
86    Where “up” refers to the direction of non-conservative overwrites. 
87    See Article 172(3) of the CRR. 

ECB guide to internal models – Credit risk 

69 

 
 
In particular, all decisions taken throughout the process – including interim ratings – 
should be recorded, as should the reasons for any override. The information should 
be proportionate to the severity and extent of the override. 

92. 

“Institutions shall analyse the performance of those exposures whose assignments 
have been overridden.”88  To comply with this requirement, the institutions should 
carry out the following procedures: 

(a)  Performance analysis of the rating systems, to assess whether the judgemental 
adjustments improve their discriminatory power. The analysis may be extended 
to all of the underlying components (modules) of the rating system. It is deemed 
particularly useful to measure the difference in terms of performance and 
impact of the “pre-override” and “post-override” stages. 

(b)  Other analyses, including the assessment of the distribution of overrides by 
override root cause, i.e. if there is a situation that systematically triggers an 
adjustment and that could justify an adjustment to the model (for example the 
inclusion of a specific risk driver). 

93. 

To mitigate the risks identified through the aforementioned analysis (paragraph 92 of 
this chapter), institutions should identify specific criteria for assessing whether or not 
the number of and justifications for overrides indicate significant weaknesses in the 
rating system and whether this is a reason to take ad hoc actions (e.g. a model 
change). In general, situations where there are too many overrides could be a strong 
indicator of weaknesses in the model (i.e. systematic and material adjustments can 
be the consequence of a misspecification of the model). 

94. 

If overrides fail to consistently increase the accuracy of the model, the institution 
should review its override policy and strengthen the criteria to better limit the number 
and extent of overrides. 

95. 

Input overrides should be applied consistently, being mindful of the economic relation 
(if any) between the adjusted variables. 

88    See Article 172(3) of the CRR. 

ECB guide to internal models – Credit risk 

70 

 
 
7 

Management of changes to the IRB approach 

7.1 

Relevant regulatory references 

Table 7 

Legal background 

Date of issue 

Article 

Paragraph/Point 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

CRR 

26/06/2013 

83, 84 

143 

(3) and (4) 

Commission Delegated Regulation (EU) No 529/2014 

12/03/2014 

2, 3, 4, 5, 8, Annex 1 

96.  Changes to a rating system’s range of application or to a rating system itself are 
subject to approval by the competent authorities if assessed as material, or to ex 
ante or ex post notification if non-material. 

97.  Commission Delegated Regulation (EU) No 529/2014 requires institutions to assess 
and classify the materiality of changes to rating systems. To comply with these 
requirements in a comprehensive and consistent way, institutions should establish a 
policy related to changes to the IRB approach (“change policy”). In line with the 
above, this policy should include, in particular, detailed criteria to ensure that the 
classification of changes is consistent and that any arbitrage in that regard is 
avoided. Institutions are encouraged to share their policy with the competent 
authority and to inform the latter about any implemented modifications to it, in order 
for both sides to have a common understanding of the classification process. 

7.2 

Content of the change policy 

98. 

The change policy should include provisions relating to the operationalisation of the 
requirements of Commission Delegated Regulation (EU) No 529/2014 with respect 
to the materiality assessment, classification, impact assessment, notification and 
documentation of changes and extensions.89  To that end, it should include, in 
particular, the following:90 

(a)  Responsibilities, reporting lines and procedures for the internal approval of 

changes, taking into account the institution’s organisational characteristics. This 
policy should define at least the unit(s) responsible for the assessment and 
classification of changes or extensions, as well as the function/committee 
responsible for confirming and countersigning the classification. 

(b)  Definitions, methods and, where applicable, metrics and significance levels for 
the impact assessment, threshold calculation and classification of changes; in 

89    Articles 2, 3, 4, 5 and 8 of Commission Delegated Regulation (EU) No 529/2014. 
90    Article 84 of Commission Delegated Regulation (EU) No 2022/439 provides for a comparable set of 

policy elements. 

ECB guide to internal models – Credit risk 

71 

 
 
 
 
 
 
 
 
 
particular, the quantitative/qualitative criteria referred to in Commission 
Delegated Regulation (EU) No 529/2014. In addition, as required by Annex 1, 
Part 2, Section 1 of this Regulation and to ensure consistency, the following 
should be observed: 

(i) 

the institution should specify metrics and significance levels that define the 
significance/materiality of changes in the distribution across rating grades 
produced by changes to the rating methodology (paragraph 2(d)(ii) of 
Annex 1, Part 2, Section 1); these metrics and significance levels should 
be complementary to those of Article 4(2) and (3) and Article 5(2) of the 
same Regulation; 

(ii) 

the institution should specify metrics and significance levels that define the 
significance/materiality of rating migrations produced by changes in the 
rating system’s assumptions on the impact of economic conditions 
(paragraph 2(c) of Annex 1, Part 2, Section 1); 

(iii) 

the institution should specify metrics and significance levels that define the 
significance/materiality of changes in the rank ordering of clients/exposures 
(paragraph 2(d)(i) of Annex 1, Part 2, Section 1); 

(iv) 

(v) 

in its change policy, the institution should define which changes constitute 
a change in the fundamental methodology for estimating PDs, LGDs 
(including best estimate of EL) and CCFs and are considered as material 
in the sense of paragraph 2(f) of Annex 1, Part 2, Section 1 (as opposed to 
the changes referred to in paragraph 2(h) of Annex 1, Part 2, Section 2); 

the institution’s change policy should include a definition of changes in the 
validation methodology and/or validation processes which lead to changes 
in its judgement of the accuracy and consistency of the estimation of the 
relevant risk parameters, the rating processes or the performance of the 
rating systems (paragraph 4 of Annex 1, Part 2, Section 1). 

(c)  Procedures to identify and monitor changes, and to notify and apply to the 
competent authorities for permission to make such changes. In particular, 
institutions should establish an end-to-end process from identification to 
notification/application and describe how they perform the activities at each 
step. 

(d)  Procedures for the implementation of changes, including their documentation; in 
particular, the re-rating process should be defined (if no other document is 
already in place). 

7.3 

Notification 

99. 

To facilitate the process for submitting the documentation package defined under 
Article 8 of Commission Delegated Regulation (EU) No 529/2014, on the ECB 
Banking Supervision website the ECB has made available to institutions 

ECB guide to internal models – Credit risk 

72 

 
standardised templates for notifying ex ante and ex post non-material 
changes/extensions and for submitting applications for material model 
changes/extensions. Institutions are invited to use these templates to facilitate the 
process and to ensure consistency and completeness.91 

7.4 

Classification 

100.  For the reasons mentioned in paragraph 97 of this chapter, institutions should have 

processes in place which specify, in detail, that the classification of a 
change/extension is adequate and consistent with the classification of other 
changes/extensions. The institution should ensure that the classification process is 
not subject to any arbitrage. In line with Article 3(3) of Commission Delegated 
Regulation (EU) No 529/2014, “one material extension or change shall not be split 
into several changes or extensions of lower materiality”. Similarly, an extension or 
change that requires notification before its implementation (ex ante) should not be 
split into several changes or extensions to produce one that is notified after 
implementation (ex post). Nor should several unrelated changes/extensions be 
combined to produce one change of lower materiality (e.g. two different model 
changes that affect RWEAs in opposite ways). 

101. 

In accordance with Article 3(4) of Commission Delegated Regulation (EU) No 
529/2014, “in case of doubt institutions shall assign extensions and changes to the 
category of the highest potential materiality”. 

102.  To ensure the accuracy of the impact assessment and the correctness and 

consistency of the resulting classification, the institution should establish a four-eye 
principle. This means that the assessment and classification should be confirmed by 
a unit independent of the one responsible for the assessment and classification of 
the change/extension. 

7.5 

Impact assessment 

103.  The impact assessment process must fulfil the requirements of Commission 

Delegated Regulation (EU) No 529/2014. It should consist of a quantitative and a 
qualitative assessment. 

104.  The quantitative assessment focuses on the impact of the change or extension on 

RWEAs. Before and after the change or extension the institution should calculate the 
difference in these amounts for credit and dilution risk associated with the range of 
application of the internal rating system. 

105.  This quantitative impact assessment is based on the specifications of Article 4(2) and 

(3) and Article 5(2) of Commission Delegated Regulation (EU) No 529/2014. The 
institution should use transparent definitions and internal procedures. 

91    In addition, further forms and guidelines have been made available on the Single Supervisory 

Mechanism (SSM) website to support institutions in the pre-application process. 

ECB guide to internal models – Credit risk 

73 

 
 
(a)  The institution should document the relevant reference date on which the 
calculations are based. In accordance with Article 3(2)(a) of Commission 
Delegated Regulation (EU) No 529/2014, the institution should use the most 
recent data available. In the case of material change or ex ante notification the 
time between the reference date and the date of notification should not exceed 
nine months.92 

(b)  The institution should give a precise definition of the range of application of the 
rating system applied in the calculations as referred to in Article 4(1)(c) and 
Article 5(1)(a)(iii) of Commission Delegated Regulation (EU) No 529/2014. It 
should ensure that the change to the IRB approach is directly related to 
exposures within the range of application of the rating system. 

(c)  The institution should generally perform a precise impact assessment93  (all 

exposures of the relevant range of application) when the rating system is 
automatic and does not require any human judgement of the qualitative 
variables (e.g. behavioural scoring). 

(d) 

If the institution applies Article 3(2)(b) of Commission Delegated Regulation 
(EU) No 529/2014 and performs an impact assessment based on the re-rating 
of a representative sample of the population (only possible for rating systems 
that require qualitative assessment to define the final rating/score), this sample 
and its relation to the population should be described in detail (number of 
observations/exposures, minimum/maximum exposure amount, mean/median 
exposure amount, first/third quartile). The representativeness of the sample 
should be documented. 

(e) 

If the institution applies Article 3(2)(b) of Commission Delegated Regulation 
(EU) No 529/2014 and performs an impact assessment based on other reliable 
inference methodologies, these methods should be described in detail and their 
reliability corroborated by qualitative and quantitative means. 

106.  The qualitative assessment is based on the specifications of Article 4(1)(a) and (b) 
and Article 5(1)(a) points (i) and (ii) of Commission Delegated Regulation (EU) No 
529/2014, which refer to the Annex I of that same Regulation. The institution should 
thoroughly examine each of these criteria. In addition, as reported in the change 
policy and to ensure consistency, institutions should examine the metrics and 
significance levels for the impact assessment and threshold calculation (see also 
Section 7.2 of this chapter, content of the change policy). 

107. 

If a criterion specified in Annex 1 of Commission Delegated Regulation (EU) No 
529/2014 may be applicable a priori (and within reason) to a change or an extension 
and the institution’s assessment concludes that this particular criterion is not fulfilled, 
the institution should document this conclusion in the notification. 

92    For impact assessments provided during an on-site inspection, the most recent data should be used. 
93    As derived from Article 3(2) of Commission Delegated Regulation (EU) No 529/2014. 

ECB guide to internal models – Credit risk 

74 

 
 
7.5.1 

User acceptance test 

108.  To avoid the risk of having unexpected consequences in the use of the changed 

rating system (e.g. altered role of the changed rating system in the risk management 
of credit exposures), institutions should assess and document the impact of a 
material change/extension on the use of the parameters and ensure that the related 
internal policies and procedures for the areas described in Section 6.3 of this chapter 
remain relevant. 

109. 

In the context of rating systems which contain qualitative inputs and/or any expert 
judgement component, the exposures of the representative sample referred to in 
point (d) of paragraph 105 of this chapter should be fully re-rated under the amended 
rating system (including the material change or extension); adherence to the entire 
rating assignment process should be ensured. The feedback received from users on 
the application of the amended rating system and on the rating results is expected to 
be analysed and documented. 

110.  Changes or extensions that are classified as non-material do not generally require 
the preparation of a use test sample, unless there is evidence of a potential impact 
on the use of the parameters. 

7.6 

Re-rating process 

111.  Where competent authorities have provided their permission in relation to a material 
extension or change, Article 3(5) of Commission Delegated Regulation (EU) No 
529/2014 requires institutions to calculate their own funds requirements on the basis 
of this approved extension or change from the date specified in the new permission. 
The ECB understands that this process (i.e. the re-rating process) should be covered 
in the institution’s change policy. 

112.  Re-rating refers to the computation of a rating using the changed or extended rating 
system and the assignment of this new rating to an obligor previously rated using the 
rating system as it was before the change or extension. 

113. 

In the context of changes or extensions that are classified as material, the change 
policy should ensure that the re-rating process is immediate. All former ratings and 
estimates should therefore be replaced by ratings and estimates calculated using the 
changed or extended model from the date specified in the approval decision – if the 
conceptual design allows this. This applies, for example, to rating systems that are 
exclusively based on behavioural scoring or in the case of recalibration not affecting 
the rating process. 

114. 

If an immediate re-rating is not possible (for example if the rating assignment 
requires new manual input and human judgement), and only for non-retail rating 
systems, the policy should ensure the following: 

ECB guide to internal models – Credit risk 

75 

 
(a)  The obligors/exposures/facilities are rated using the amended rating system 

within the time frame of the yearly re-rating process, i.e. within a maximum of 
12 months. 

(b)  To mitigate the risk of underestimation of own funds requirements, in the event 

that a material change would lead to a material increase in the RWEA (i.e. more 
than 10% on the range of application of the rating system subject to change), 
the institution should apply the RWEA impact, simulated on the basis of the 
representative sample. The impact thus produced is the positive difference 
between the simulated RWEA after the material change and the RWEA before 
the material change approved by the competent authority. This should be done 
at the first Common Reporting date after the date of implementation. 

For the purpose of point (b) above, the ECB would consider the following approach 
as the most appropriate: 

• 

apply the simulated RWEA impact until all exposures within the range of 
application are rated using the changed model; 

• 

remove the simulated RWEA impact linearly, i.e. 25% every quarter. 

115.  The re-rating process for changes/extensions that are classified as non-material may 

take up to one year from the date of implementation. 

8 

Data maintenance for the IRB approach 

8.1 

Relevant regulatory references 

Table 8 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

26/06/2013 

142 

144 

174 

175 

176 

189 

190 

(1)(1) 

(b) 

(1) 

(1), (2)(c) 

(4) 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

31, 32, 72, 73, 74, 75 

Other references 

Basel Committee on Banking Supervision (BCBS) 23994 

09/01/2013 

Principles 1-11 

94    Basel Committee on Banking Supervision “Principles for effective risk data aggregation and risk 
reporting”, referred to in this guide as “Basel Committee on Banking Supervision (BCBS) 239”. 

ECB guide to internal models – Credit risk 

76 

 
 
 
 
 
 
 
 
 
 
 
 
 
116. 

In accordance with Article 144(1) of the CRR, an institution’s systems for the 
management and rating of credit risk exposures must be sound and implemented 
with integrity. In particular, the institution must collect and store all relevant data to 
provide effective support to its credit risk measurement and management processes. 
The ECB understands that, in order to comply with these requirements, institutions 
should deploy robust, well-documented and adequately tested IT systems, together 
with sound data management practices. 

117.  Consequently, this section of the guide sets out the principles regarding the following 

elements for the management of IRB data:95 

(a) 

IT systems: infrastructure and implementation testing; 

(b)  policies, roles and responsibilities in data processing and data quality 

management; 

(c)  components of the data quality management framework. 

8.2 

IT systems: infrastructure and implementation testing 

8.2.1 

Infrastructure 

118.  Sound and robust IT infrastructures play an essential role in supporting the 

institution’s rating systems. In addition, and in accordance with Article 175(1) of the 
CRR, institutions must document the design and operational details of their rating 
systems. 

119.  With regard to the soundness and robustness of institutions’ IT infrastructure, the 

ECB considers that Article 75(2) and (3) of Commission Delegated Regulation (EU) 
No 2022/439 provides a good understanding of the elements that institutions should 
take into account in order to comply with the data-related requirements of the CRR.96 

120.  Furthermore, to comply with the documentation requirements for the rating systems 
as established under Article 144(1)(e) and Article 175(1) of the CRR, it is the ECB’s 
view that institutions should document and keep an updated register of all current 
and past versions of the following elements of a rating system: 

(a) 

the model’s data97  flow (from data entry98  to reporting and for both historical 
data and current exposure data), identifying the relevant workflows and 
procedures relating to data extraction, data collection, data storage and data 
transformations; 

95    The ECB acknowledges that there are other relevant elements of data management not covered in this 

guide which institutions should take into account. 

96    See Articles 144(1)(d) and 176 of the CRR. 
97    This refers to the model’s internal data, external data or pooled data. 
98    This refers to the first entry or registration of data in the institutions’ systems and applications or in the 

core systems of the institutions where the raw data first originated. 

ECB guide to internal models – Credit risk 

77 

 
 
(b) 

the relevant sources of data and the global map of IT systems and databases 
involved in the calculation systems used for the purposes of the IRB approach; 

(c) 

the relevant functional specification of IT systems and databases, including their 
size, date of construction and data dictionaries, specifying the content of the 
fields and of the different valid data values that could be inserted in them, with 
clear definitions of data items; 

(d) 

the relevant technical specification of IT systems and databases, including the 
type of database, tables, database management system, database architecture, 
and data models given in any standard data modelling notation; 

(e) 

the audit trail for critical IT systems and databases. 

To allow an independent knowledgeable third party to obtain a detailed outline of the 
different IT elements of the rating systems, the documentation produced by the 
institution should be clear and understandable. 

To comply with the requirement to document its rating system and the rationale for its 
design99, the institution should keep the register of all rating systems, including all 
current and past versions of rating systems, updated for a period of at least three 
years and, whenever necessary, an extended period beyond that. This is also 
reflected in Article 32(1) of Commission Delegated Regulation (EU) No 2022/439. In 
any case, the institution should ensure that the elements mentioned in 
paragraph 120(a) to (e) of this chapter for the current rating system are adequately 
recorded in the register and enable a clear understanding of all relevant data of the 
current rating system that must be stored by the institution.100 

8.2.2 

IT implementation of a new model or model change 

121.  When applying for an initial model approval or for roll-out of the IRB approach, the 

institution should provide evidence that it has implemented the proposed model into 
a live101  or, if duly justified, non-live production environment.102  In particular, this 
means that the institution: 

(a) 

is able to produce risk parameter estimates for exposures in the scope of 
application; 

(b)  has successfully completed IT user acceptance tests; 

(c) 

is able to calculate under the IRB approach the own funds requirements 
resulting from its risk parameters estimates; 

99    See Article 144(1)(e) of the CRR. 
100   See Articles 144(1)(d) and 176 of the CRR. 
101   In other words, a complete version of the IT environments described in paragraphs 121(a) to 121(f) of 

this chapter, where the institution will in fact implement the model and produce COREP reporting on the 
basis of the IRB approach once initial permission is granted. 

102   The non-live production environment should be understood in this context as a parallel version of a live 

production environment that is already in place, as described in paragraph 120 of this chapter. 

ECB guide to internal models – Credit risk 

78 

 
 
(d) 

is able to submit the respective COREP reporting (Article 144(1)(g) of the 
CRR); 

(e) 

is able to use the model for internal risk measurement and management 
purposes; 

(f) 

is ready to introduce a reporting system based on the risk parameters produced 
by the model.103 

122.  When applying for a material model change, the institution should provide evidence 
that it is able to provide a new version of the relevant IT systems ready to be put into 
production once the change is approved (i.e. when applying for a material model 
change, it should also be able to fully replicate the execution of the model and the 
calculation of own funds requirements according to the model change in a non-live 
production environment, fulfilling the points set out in paragraphs 121(a) to 121(f) 
above). In addition, it should be able to demonstrate that it has set up an appropriate 
process to ensure that the full IT implementation would be completed successfully 
with regard to the date of implementation of the changed model, in accordance with 
the principles set out in paragraph 79 of the chapter on overarching principles for 
internal models. 

8.2.3 

Implementation testing 

123. 

In order to ensure the integrity and robustness of IT systems104  and in particular that, 
in terms of IT, the implementation of the models is successful and error-free, 
institutions should have in place a consistent process for testing the relevant IRB 
systems and applications upon first implementation and on an ongoing basis. This 
IT-testing process should be clearly defined and documented in an organisation-wide 
policy and procedure. 

124.  To achieve its objective the policy should consider all potential events that should 

trigger a testing procedure and their impact on the tests to be conducted. The trigger 
events that should be considered include: software releases or material IT-related 
changes, regulatory changes, model methodology changes and the extension of the 
range of application of a rating system. 

125. 

IT implementation tests to be considered include the following: 

(a)  unit/component/module tests; 

(b) 

integration tests (of units and between systems); 

(c)  system tests (this includes functionality, performance – in normal and stress 

scenarios – and security and portability tests); 

103   This paragraph concerns only purely IT-related aspects. Please refer to Sections 3.4 and 6 of this 

chapter for concrete expectations on model use/reporting topics.   

104   See Article 144(1) of the CRR. 

ECB guide to internal models – Credit risk 

79 

 
 
(d)  user acceptance testing (functional testing); 

(e) 

regression testing. 

126. 

In principle, the unit(s) responsible for performing the implementation tests should be 
clearly identified and the results of the tests should be documented. It is the ECB’s 
view that as a general rule institutions should develop a standardised format for the 
documentation of test results. 

8.3 

Policies, roles and responsibilities in data processing and data 
quality management 

127.  For institutions to be able to comply with the requirement to collect and store all 

relevant data established under Article 144(1)(d) of the CRR, it is the ECB’s 
understanding that policies and rules on data management should be defined at 
group level105  for both of the following aspects: data processing (i.e. data collection, 
storage, validation, migration, actualisation and use), and data quality management 
(see Section 8.4 of this chapter). 

128.  As for data processing, and in particular with regard to manual interventions and 

data transfers, the following principles should be considered: 

(a) 

(b) 

to ensure that all data transformations are traceable and controlled, general 
guidelines and rules should be clearly formalised with regard to manual 
interventions within the data processing; 

to ensure timeliness and accountability, all data transfers should be formally 
agreed upon (for example by means of service level agreements) by data 
providers and data users (for both outsourced and in-house processes). 

129.  To ensure the integrity of the data processes, the policies and rules on data 

management should clearly set out the relevant data governance arrangements. It is 
also expected that these policies and rules will specify the different roles and 
responsibilities assigned to data management. These include data quality roles and 
responsibilities for both business owners and IT functions and data and systems 
ownership throughout the entire credit risk modelling life cycle (including all IT 
systems used). These policies should take into account the following principles. 

(a)  The responsibilities of business owners include: 

(i)  ensuring data are correctly entered, kept up to date and aligned with the 

institution’s data definitions; 

(ii)  ensuring that data aggregation capabilities and reporting practices are 

consistent with the institution’s policies. 

105   See Section 1 of the chapter on overarching principles for internal models for the definition and 

implementation of group-wide principles and guidelines. 

ECB guide to internal models – Credit risk 

80 

 
 
(b) 

IT functions are responsible for supporting the operation of the systems for data 
collection, processing, transformation, storage and availability during the entire 
life cycle of the data. 

(c)  Different business owners and IT systems owners may be appointed throughout 
the data life cycle. However, each data source, IT system and process step 
should have an assigned business owner and/or IT systems owner that can be 
formally identified. 

8.4 

Data quality management framework 

130. 

Institutions must have in place a process for vetting data inputs into the model. This 
must include an assessment of the accuracy, completeness and appropriateness of 
the data.106  To comply with this requirement and to ensure the quality of the data 
used for credit risk measurement and management processes, it is the ECB’s view 
that institutions should establish and implement an effective data quality 
management framework that is formalised in a set of policies and procedures. This 
framework should be applicable to all data used in IRB-related processes, 
i.e. internal data, external data and pooled data, if any. In addition, it should ensure 
that reliable risk information is available to enable an institution’s risk profile to be 
assessed accurately and drive sound decision-making within the institution and by 
external stakeholders, including competent authorities. 

131.  The ECB considers that the data quality management framework is effective when it 

encompasses the following components: 

(a)  sound underlying governance principles (see Section 8.4.1 of this chapter), 
particularly those relating to the allocation and fulfilment of roles and 
responsibilities for the management of data quality in a manner that ensures 
that data quality management activities are independent of data processing 
activities; 

(b)  a description of the scope in terms of risk data coverage (see Section 8.4.2 of 

this chapter); 

(c)  data quality standards covering all relevant data quality dimensions, 

i.e. completeness, accuracy, consistency, timeliness, uniqueness, validity, 
availability and traceability (see Section 8.4.3 of this chapter); 

(d)  consistent criteria and a systematic metrics approach to assess compliance 

with data quality standards; this should be supported by sufficient data quality 
controls along the entire IRB data chain (see Section 8.4.4 of this chapter); 

(e)  procedures for constantly assessing and improving the quality of data (see 

Section 8.4.5 of this chapter); 

106   See Article 174(b) of the CRR. 

ECB guide to internal models – Credit risk 

81 

 
 
(f) 

reporting procedures on data quality allowing for sufficient understanding of the 
quality of the data supporting the IRB models (see Section 8.4.6 of this 
chapter). 

The following sections further develop the above-mentioned elements. 

8.4.1 

Governance principles for the data quality management framework 

132.  The data quality management framework: 

(a)  should be approved by the institution’s management body or a designated 
committee thereof and senior management as part of their responsibilities; 

(b)  should be distributed throughout the organisation to the relevant staff; 

(c)  should be regularly assessed in order to verify its adequacy, and be updated 

and improved whenever necessary; 

(d)  should be subject to regular review by the internal audit function or another 

comparable independent auditing unit.107 

133.  The roles of the different units, internal bodies and staff involved in the data quality 

management process should be defined in such a way as to ensure that the data 
handling process is sufficiently independent of the data quality management 
process. 

134.  The ECB considers it best practice for institutions to have a dedicated independent 

unit with an overall view of and responsibility for the management of data quality. 
Where an independent unit is established, the size of this unit should be 
proportionate to the nature, size and degree of complexity of the institution’s 
business and organisational structure. 

8.4.2 

Scope of the data quality management framework 

135.  The data quality management framework: 

(a)  should cover all relevant data quality dimensions: completeness, accuracy, 

consistency, timeliness, uniqueness, validity, availability and traceability (see 
paragraph 137 of this chapter); 

(b)  should cover the whole data life cycle, from data entry to reporting, and 
encompass both historical data and current application databases. 

107   For further details on the review of the rating systems by internal audit, see Section 5 of this chapter. 

ECB guide to internal models – Credit risk 

82 

 
 
136. 

If institutions use data provided by third parties, the ECB considers it best practice 
for them to ensure that the third party has data quality processes in place to ensure 
the accuracy, completeness and appropriateness of the data provided.108 

8.4.3 

Data quality standards in the data quality management framework 

137. 

In accordance with Article 174(b) of the CRR, institutions must implement a process 
for vetting data inputs into the model which must include an assessment of the 
accuracy, completeness and appropriateness of data. The ECB understands that, in 
order to comply with this requirement, institutions should establish data quality 
standards that set the objectives and overall scope of the data quality management 
process. To this end, these standards should be defined for the following data quality 
dimensions109  for all data inputs into the model and at each stage of the data life 
cycle: 

(a)  completeness (values are present in any attributes that require them); 

(b)  accuracy (data are substantively error-free); 

(c)  consistency (a given set of data can be matched across the institution’s 

different data sources); 

(d) 

timeliness (data values are up to date); 

(e)  uniqueness (aggregate data are free from any duplication arising from filters or 

other transformations of source data); 

(f) 

validity (data are founded on an adequate and rigorous classification system 
that ensures their acceptance); 

(g)  availability/accessibility (data are made available to the relevant stakeholders); 

(h) 

traceability (the history, processing and location of the data under consideration 
can be easily traced). 

8.4.4 

Data quality controls 

138.  Data quality should be measured in an integrated and systematic way. The 

measurement system and the frequency of its application should be formalised. 

139. 

Indicators and their corresponding tolerance levels and thresholds should be set in 
order to monitor compliance with the standards established and should be combined 

108   See Article 174(b) of the CRR. 
109   It is the ECB’s view that the CRR reference to appropriateness of data inputs encompasses the 
following additional data quality dimensions: consistency, timeliness, uniqueness, validity, 
availability/accessibility and traceability. 

ECB guide to internal models – Credit risk 

83 

 
 
with visual systems (e.g. red/amber/green traffic-light system) and dashboards for 
monitoring and reporting purposes. 

140. 

Indicators should be supported by effective and sufficient data quality checks and 
controls throughout the data life cycle, from data entry to reporting, and for both 
historical data and current application data. Data quality checks and controls should 
include reconciliation across and within systems, including between accounting and 
IRB data. An effective control framework should therefore be in place to ensure that 
sound controls and related procedures are implemented, especially for manual 
processes. 

8.4.5 

Remediation of data quality issues 

141.  A process for the identification and remediation of data quality deficiencies should be 
in place in order to constantly improve data quality and promote compliance with the 
data quality standards. 

142.  Data quality assessments should be carried out independently (see paragraphs 

133 and 134 of this chapter) and recommendations should be issued with an 
indication of their priority, based on the materiality of the incidents identified. All such 
data quality incidents should be recorded and monitored. For each of the data quality 
incidents, an owner responsible for resolving the incident should be appointed and 
an action plan for dealing with the incident drawn up on the basis of the priority 
assigned. Remediation timelines should depend on the severity and impact of the 
incident and the implementation timelines required to resolve it. Data quality 
incidents should be resolved at source level110  or, if this is not possible, mitigated by 
taking a prudent approach. 

8.4.6 

Data quality reporting 

143. 

In accordance with Article 189(2)(c) of the CRR, the institution’s senior management 
must ensure, on an ongoing basis, that the ratings systems are working properly. To 
accomplish this, the ECB understands that a formal reporting process on the quality 
of risk data should be in place with the objective of improving the quality of data and 
enabling an assessment of the potential impact of data quality in own fund 
requirements calculations. In general, this reporting should be presented in a 
standardised format with clear and concise content, including the following: 

(a)  a comprehensive overview of the performance of the model in terms of data 

quality, including external data and pooled data, if any, at all stages of the IRB 
life cycle, from data entry to reporting, for both historical data and current 
exposure data; 

110   From the source system in which the incidents are present down to the IRB datasets or systems. 

ECB guide to internal models – Credit risk 

84 

 
 
(b) 

findings and, where applicable, recommendations to address detected 
weaknesses or shortfalls; 

(c)  sufficient and appropriate evidence that the recommendations have been 

adequately addressed and properly implemented (e.g. by means of a status 
report). 

144. 

In accordance with Article 189(1) of the CRR, the management body or a designated 
committee thereof and senior management must possess a general understanding 
of the rating systems of the institution and a detailed comprehension of its 
associated management reports. To comply with this requirement, the ECB 
understands that reports on the quality of risk data should be submitted to these 
parties. In addition, the ECB considers it best practice for these reports to also be 
submitted to all other relevant staff, including modellers, internal validation, internal 
audit, data quality managers, data owners and other business units involved. 

145.  Data quality reports should be produced and submitted to senior management more 

frequently than annually to enable senior management to ensure, on an ongoing 
basis, that the rating systems are operating properly in accordance with 
Article 189(2)(c) of the CRR. 

ECB guide to internal models – Credit risk 

85 

 
 
 
B 

Definition of default 

Relevant regulatory references 

Table 9 

Legal background 

CRR 

Commission Delegated Regulation (EU) No 529/2014 

12/03/2014 

Date of issue 

Article 

Paragraph/Point 

26/06/2013 

(1), (2), (3), (4), (5) 

178 

4 

Annex I, Part II, 
Section 1(3) 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

26, 27, 28, 29 

ECB Regulation on discretion on materiality 
threshold111 

26/11/2018 

3 

Corrigendum to the ECB Regulation on discretion on 
materiality threshold112   

08/07/2020 

Other references 

EBA Guidelines on DoD113 

EBA Guidelines on PD and LGD 

EBA Guidelines on SRT114 

28/09/2016 

20/11/2017 

07/07/2014 

16-114 

23, 34, 36, 37, 38   

146.  Article 178(1) of the CRR gives a definition of default to be considered for risk 

quantification under the IRB approach. 

147.  According to Article 178(1) and (2)(d) of the CRR in conjunction with Article 3 of the 
ECB Regulation on discretion on materiality threshold, a default must be considered 
to have occurred with regard to a particular obligor when either or both of the 
following have taken place: 

(a) 

the institution considers that the obligor is unlikely to pay its credit obligations to 
the institution, the parent undertaking or any of its subsidiaries in full, without 
recourse by the institution to actions such as realising security (“unlikeliness to 
pay” criterion); 

(b) 

the obligor is more than 90 consecutive days past due on any material credit 
obligation to the institution, the parent undertaking or any of its subsidiaries 

111   Regulation (EU) 2018/1845 of the European Central Bank of 21 November 2018 on the exercise of the 

discretion under Article 178(2)(d) of Regulation (EU) No 575/2013 in relation to the threshold for 
assessing the materiality of credit obligations past due (ECB/2018/26) (OJ L 299, 26.11.2018, p. 55), 
referred to in this guide as the “ECB Regulation on discretion on materiality threshold”. 

112   Corrigendum to Regulation (EU) 2018/1845 of the European Central Bank of 21 November 2018 on the 
exercise of the discretion under Article 178(2)(d) of Regulation (EU) No 575/2013 in relation to the 
threshold for assessing the materiality of credit obligations past due (ECB/2018/26) (Official Journal of 
the European Union L 299 of 26 November 2018) (OJ L 217 08.07.2020, p. 8), referred to in this guide 
as the “Corrigendum to the ECB Regulation on discretion on materiality threshold”. 

113   EBA Guidelines on the application of the definition of default under Article 178 of Regulation (EU) No 

575/2013 (EBA/GL/2016/07), referred to in this guide as the “EBA Guidelines on DoD”. 

114   EBA Guidelines on Significant Credit Risk Transfer relating to Articles 243 and Article 244 of Regulation 

575/2013 (EBA/GL/2014/05), referred to in this guide as the “EBA Guidelines on SRT”. 

ECB guide to internal models – Credit risk 

86 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
(“days past due” criterion), considering that a credit obligation past due is 
material when it: 

(i)  exceeds €100 if it is a retail exposure or €500 if it is an exposure other than 

retail exposure; and 

(ii) 

represents more than 1% of the total amount of all on-balance sheet 
exposures to that obligor for the credit institution, the parent undertaking or 
any of its subsidiaries, excluding equity exposures. 

9 

Consistency of the application 

148.  Where the definition of default is applied at obligor level, both the days past due 
criterion and the unlikeliness to pay criterion must be assessed with regard to all 
exposures of an obligor to the institution, the parent undertaking or any of its 
subsidiaries. This implies that, for a banking group, all information about the different 
exposures and the behaviour of the obligor across the banking group must be 
consolidated. This also applies in cases where the definition of default is applied at 
the level of an individual credit facility for those subsets of indications of unlikeliness 
to pay that are related to the condition of the obligor rather than the status of a 
particular exposure e.g. bankruptcy status. A certain degree of leeway is granted with 
regard to the implementation of this group-wide view in identifying defaults, as 
described in paragraphs 81 and 82 of the EBA Guidelines on DoD. 

149.  Paragraph 82 of the EBA Guidelines on DoD acknowledges that mechanisms or 

procedures for the consistent identification of the default of an obligor need not be 
applied if it is too burdensome for institutions to verify the status of a client in all legal 
entities and at all geographical locations within the group. In such a case, institutions 
may not perform the check for consistency if they can demonstrate that the effect of 
non-compliance is immaterial because there are no or a very limited number of 
common clients among the relevant entities within a group and the exposure to these 
clients is immaterial. With a view to operationalising paragraph 82 of the EBA 
Guidelines on DoD, the ECB understands that it is best practice for the institution to 
have a regular process for monitoring common obligors so as to ensure on a regular 
basis that the conditions set out in paragraph 82 (continue to) apply. As a minimum, 
it is the ECB’s understanding that the following points should be documented in the 
internal policies of the institution regarding this monitoring process: 

(a)  all assumptions made for the purpose of the regular analysis of common 

obligors should be clearly stated (in particular for the correct identification of 
common obligors across legal entities or geographies); 

(b) 

the levels of the thresholds according to which the number of common obligors 
is deemed very limited and their exposure is deemed immaterial should be 
clearly stated, justified (at least qualitatively) and reasonable; 

(c) 

the actions to be taken when the aforementioned thresholds are breached 
should be clearly described; 

ECB guide to internal models – Credit risk 

87 

 
(d) 

the frequency of the monitoring process should be commensurate with the 
share of common obligors evaluated in both numbers and exposures, and in all 
cases should be no less than annual. 

150.  The materiality thresholds for the purpose of the definition of default applied by an 

institution outside the SSM area and a parent significant institution may be different, 
even if both belong to the same banking group, because a materiality threshold 
which differs from the one set by the ECB may apply under national law outside the 
SSM area. This scenario is one of those addressed by paragraphs 83 to 85 of the 
EBA Guidelines on DoD. Without prejudice to the provisions set out in the previous 
paragraph, if an obligor has exposures under both SSM and non-SSM jurisdictions, 
institutions should check both the ECB materiality threshold and the materiality 
threshold (if any) applicable in the other jurisdiction. The default will be triggered in 
the jurisdiction where the materiality threshold, computed on the basis of 
consolidated exposures and arrears, is first exceeded for more than 90 consecutive 
days, and institutions are then expected to apply additional unlikely to pay triggers, 
making use of the provisions set out in paragraph 58 of the EBA Guidelines on DoD, 
to achieve a consistent default status across all jurisdictions. 

151.  Paragraphs 95 to 105 of the EBA Guidelines on DoD clarify the treatment of joint 
credit obligations when the definition of default is applied at obligor level for retail 
exposures. In the ECB’s understanding, it is best practice for institutions to foster 
consistency within the process related to the default identification by also applying 
these requirements to joint credit obligations115  involving non-retail exposures. 

152. 

Institutions should distinguish the concept of joint credit obligation from the concept 
of exposure secured by another individual or entity. In the latter case, if the guarantor 
has to step in to make payments not made by the obligor, then the obligor should be 
classified as defaulted because it failed to repay the credit obligation without 
recourse by the institution to the guarantor. Instead, in the case of a joint credit 
obligation, the joint obligor should be treated as a different obligor from each of the 
individual obligors, and the fact that one individual obligor pays the joint obligation in 
full does not lead to the automatic classification of the other individual obligor as 
defaulted. From a risk quantification perspective, since the joint obligors should be 
counted as separate obligors, a default on a joint credit obligation should be counted 
separately from the default of individual obligors in the default time series. Since 
defaults on joint obligors and related individual obligors will be correlated to some 
extent, institutions should ensure this does not lead to biased results or wrong 
conclusions during the development or the validation of the PD model where one-
year default rates are computed, particularly if this correlation implies a violation of 
the assumptions required by the underlying statistical methodologies (e.g. in the 
validation of model performance) under Article 180(1)(d) of the CRR. 

115   As defined in paragraph 96 of the EBA Guidelines on DoD. 

ECB guide to internal models – Credit risk 

88 

 
 
10 

Days past due criterion 

153.  The days past due criterion applies to all exposures, irrespective of their related 

repayment scheme and features. If an obligor holds products envisaging small 
interest payments compared with the outstanding exposures (e.g. bullet loans or 
interest-only mortgages) and becomes past due, then several missed payments 
would be needed to exceed the relative component of the materiality threshold and 
eventually trigger the default according to the past due criterion. Institutions that wish 
to anticipate the default recognition for this type of product should define appropriate 
additional indications of unlikeliness to pay. 

154.  When the days past due criterion is met, institutions should classify the exposures to 
defaulted status without further ado. This means that at the onset of the 91st 
consecutive day after the materiality threshold is exceeded for the first time, the 
institution should activate the default flag for all affected exposures. Moreover, it is 
the ECB’s understanding that the days past due criterion is driven by the exact 
number of days in which material past due amounts are present. Therefore, proxies 
in which defaults are triggered, for example, after three months of missed payments 
or three missed monthly payments (“months in arrears” approach) are not 
considered an appropriate implementation of this criterion. 

155.  The days past due criterion where the definition of default is applied at obligor level 
may, in some cases, lead to a default being identified despite no individual 
exposures being more than 90 consecutive days past due. This could happen, for 
instance, if an obligor repays some material past due exposures, but the number of 
days past due at obligor level keeps increasing – instead of being reset – because 
there are other material exposures that are just a few days past due at facility level. 
In that case, a default should be triggered when the counter at obligor level reaches 
90 consecutive days, even if the remaining material exposures could be less than 90 
consecutive days past due at facility level. However, in the specific case of factoring 
arrangements where the purchased receivables are recorded in the balance sheet of 
the institution, if the counter at obligor level reaches 90 but none of the receivables to 
the obligor is more than 30 consecutive days past due at facility level, then this 
should be recognised as a technical past due situation according to paragraph 23(d) 
of the EBA Guidelines on DoD and the default should not be triggered. In such a 
case, the counters at obligor and facility levels keep running (unless the obligor 
repays past due exposures) and default is triggered as soon as one receivable is 
more than 30 consecutive days past due. 

156. 

If the past due amounts cease to be material then the counting of days past due is 
reset and if the default trigger represented by the days past due criterion was active, 
it ceases to apply. Past due amounts may cease to be material as a result of 
repayments from the obligor but also in cases where the obligor has an exposure of 
up to €50,000 and switches from retail to non-retail classification.116 

116   The relative components of the materiality thresholds for retail and non-retail exposure are both 1%, 

while the absolute components are €100 and €500 respectively. This means that it is only for 
exposures up to €50,000, where the non-retail absolute component is dominant, that the shift from 
retail to non-retail may produce the reclassification of past due amounts from material to immaterial.   

ECB guide to internal models – Credit risk 

89 

 
 
157.  The absolute component of the materiality threshold set in the ECB Regulation on 

discretion on materiality threshold is expressed in euro and therefore institutions 
should convert all the relevant amounts to euro when applying the materiality 
threshold. For this purpose, significant institutions should convert exposures to euro 
using the exchange rate quoted every day in order to count the number of days that 
the threshold is exceeded and determine the exact day when default is triggered. 

158. 

Institutions should recognise as a credit obligation past due any amount of principal, 
interest or fee that has not been paid at the date it was due in line with paragraph 16 
of the EBA Guidelines on DoD. The ECB understands that principal in this context 
should also include mandatory payments related to other financial products117  of the 
same obligor which are linked to the respective credit obligation with the purpose of 
serving as a repayment surrogate (i.e. accumulating capital to repay the principal 
amount of the related credit obligation at maturity). Fees in this context include 
maintenance fees for deposit accounts that remain unpaid because the accounts are 
empty. Written-off amounts should not be considered in the calculation of the 
obligor’s total and past due exposures when assessing the materiality threshold, but 
institutions should assess, whenever a write-off occurs, whether this qualifies as an 
indication of unlikeliness to pay according to paragraphs 36 to 40 of the EBA 
Guidelines on DoD. 

159.  Paragraph 19 of the EBA Guidelines on DoD describes the situation where 

repayment is subject to a dispute between the obligor and the institution, while 
paragraph 20 describes the situation of a merger between two obligors. In particular, 
for disputes, it is up to the institution to decide whether counting is suspended and 
whether the suspension is followed by an assessment of indications of unlikeliness 
to pay. By contrast, the institution should always verify the presence of indications of 
unlikeliness to pay in cases where a payment is suspended by law or the obligor 
exercises a contractual right to suspend the payment as set out in paragraphs 17 
and 18 of the EBA Guidelines on DoD. 

160. 

In line with paragraph 21 of the EBA Guidelines on DoD, the calculation of the sum 
of all amounts past due should be performed with a frequency allowing timely 
identification of default. In any case, where the institution calculates days past due 
less often than daily, it should ensure that the date of default is identified as the date 
when the past due criterion has actually been fulfilled. In other words, the calculation 
of days past due can be performed less often than daily but it should then cover 
each day from the last calculation performed, in line with paragraph 106 of the EBA 
Guidelines on DoD. In general, institutions should ensure that the calculations of 
both days past due and default amounts are up to date whenever they are used to 
support all relevant processes, including internal and external reporting. 

161.  Paragraph 23 of the EBA Guidelines on DoD specifies the definition and treatment of 
situations where the recognition of default results from technical issues. According to 
the EBA Guidelines on DoD, technical past due situations should not be considered 
as defaults in accordance with Article 178 of the CRR. It is the ECB’s understanding 
that the technical issues referred to in point (a) of the same paragraph also include 

117   This may refer to savings accounts, investment plans and/or life insurance contracts. 

ECB guide to internal models – Credit risk 

90 

 
 
situations where the bank has approved a moratorium or restructuring for an obligor 
that is less than 90 days past due on material credit obligations but the resulting 
suspension or reset of days in the past due counter is applied in the systems with 
some delay when the counter has already reached 90 days. Moreover, it is the 
ECB’s understanding that moratoria granted on the basis of applicable laws having 
retroactive effects from a period where the obligor was less than 90 days past due 
on material credit obligations may also be treated as a technical default where the 
credit decision approving the moratorium was taken when the days past due counter 
had already reached 90 consecutive days. Any situation other than those described 
in paragraph 23 of the EBA Guidelines on DoD should not be classified as technical 
defaults. This includes, for instance, issues with payments resulting from errors in 
the data or systems of the obligor and disputes under paragraph 19 of the EBA 
Guidelines on DoD. With regard to the latter, it is the ECB’s understanding that a 
general treatment of disputes as technical past due situations, for instance because 
of the impossibility of suspending the counting of days past due in the systems, 
would lead to an unwarranted inflation of technical past due situations. An exception 
may be represented by disputes which fulfil the requirements set out in paragraph 19 
of the EBA Guidelines on DoD and that are initiated before the default classification, 
where the corresponding suspension of the counting of days past due is recorded in 
the systems after the classification in default due to delays in the formal notification 
of the dispute. In such situations, it is the ECB’s understanding that a treatment as 
technical default in accordance with paragraph 23(a) of the EBA Guidelines on DoD 
may be allowed. 

162.  The ECB has the following understanding of the application of the specific treatment 

set out in paragraphs 25 and 26 of the EBA Guidelines on DoD for exposures to 
central governments, local authorities and public sector entities. The specific 
treatment under paragraph 25 should be applied as soon as exposures have been 
materially past due for more than 90 consecutive days, and not before, but only 
where all conditions specified in paragraph 25 are met. The specific treatment 
implies that, in accordance with paragraph 26, these exposures are not treated as 
being defaulted and, from the time of the application of the specific treatment, those 
exposures have to be excluded from the calculation of the materiality threshold for all 
other exposures of the obligor. The exposures that are subject to the specific 
treatment need to be clearly documented. If, after the application of the specific 
treatment, the materiality threshold is still exceeded on account of other exposures 
past due which are not covered by the specific treatment, the obligor in question, and 
all of its exposures, are immediately regarded as having defaulted. 

163.  The days past due criterion should be applied to factoring and purchased 

receivables, taking into consideration the specific provisions set out in paragraphs 27 
to 32 of the EBA Guidelines on DoD. Institutions should clearly specify in their 
policies the types of products offered to customers which are considered as factoring 
and purchased receivables. It is the ECB’s understanding that institutions may align 
their definitions to the indications of which products are considered to be factoring in 

ECB guide to internal models – Credit risk 

91 

 
Commission Implementing Regulation (EU) No 2021/451 (with regard to supervisory 
reporting of institutions)118, where “trade receivables” are defined. 

164.  Paragraph 34 of the EBA Guidelines on DoD sets out the condition under which 

institutions may add another trigger of unlikeliness to pay in order to identify defaults 
on the basis of a lower materiality threshold than the one considered for the days 
past due criterion. It is the ECB’s understanding that, in this case, institutions should 
monitor this additional unlikeliness to pay trigger together with the days past due 
criterion in the same way as described in paragraph 150 of this chapter. 

11 

Unlikeliness to pay criterion 

165.  For the purposes of determining unlikeliness to pay in connection with the sale of 

credit obligations (Article 178(3)(c) of the CRR), according to paragraphs 42 and 43 
of the EBA Guidelines on DoD, institutions should analyse the reasons for the sale of 
credit obligations and the reasons for any losses recognised thereby. If, based on 
this analysis, the sale is recognised as credit-related, the institution should calculate 
the materiality of the loss according to the formula set out in paragraph 44 of the 
EBA Guidelines on DoD to verify whether a default is triggered. When applying the 
formula, the sale price should be used without any type of adjustment. It should be 
noted that sales of credit obligations in the context of traditional securitisations where 
there is a significant risk transfer according to Article 244 of the CRR and the EBA 
Guidelines on SRT are also considered sales of credit obligations for the purposes of 
this unlikeliness to pay criterion. 

166.  For the purposes of determining unlikeliness to pay in connection with a distressed 

restructuring (Article 178(3)(d) of the CRR), in the formula defining the diminished 
financial obligation set out in paragraph 51 of the EBA Guidelines on DoD, NPV0 and 
NPV1 are the net present value of the expected cash flows, discounted using the 
customer’s original effective interest rate based on the old and the new 
arrangements respectively. Cash flows in this context are all payments the obligor is 
legally bound to perform under the contractual terms. Therefore, NPV0 and NPV1 
should not reflect any expected loss due to default or prepayment. Any 
approximation of the original effective interest rate or treatment of variable rates that 
is used for accounting purposes should also be used in the calculation of NPV0 and 
NPV1 for the purpose of default identification. Where the obligor has accumulated 
late fees or interest rate penalties before the restructuring, the ECB’s understanding 
is as follows. 

(a) 

If late fees and interest rate penalties that originated from a violation of the 
original schedule of payments were forgiven, they should not be included in the 
NPV1 calculation since they are not part of the new contractual schedule of 
payments. 

118   Commission Implementing Regulation (EU) 2021/451 of 17 December 2020 laying down implementing 
technical standards for the application of Regulation (EU) No 575/2013 of the European Parliament and 
of the Council with regard to supervisory reporting of institutions and repealing Implementing 
Regulation (EU) No 680/2014 (OJ L 97, 19.3.2021, p. 1–1955). 

ECB guide to internal models – Credit risk 

92 

 
 
(b) 

If late fees and interest rate penalties rates that originated from a violation of the 
original schedule of payments were not forgiven, they are consequently 
included in the obligor’s new schedule of payments following the distressed 
restructuring (possibly with a postponement), and the respective amounts 
should therefore be included in the NPV1 calculation. This also holds when the 
institution applies (generic) fees and higher rates in the obligor’s new schedule 
of payments as part of the distressed restructuring. 

(c)  Late fees and interest rate penalties should not in any case be included in the 
NPV0 calculation as they were not explicitly included in the original contractual 
schedule of payments. 

(d)  The NPV1 calculation assumes that payments duly respect the new schedule. 

Therefore, fees and penalties that would be triggered in case of violations of the 
(new) schedule should not be considered in NPV1. 

In addition, it is the ECB’s understanding that the calculation of the diminished 
financial obligation should only take into consideration expected cash flows. Cash 
flows having occurred in the past, for example the financed amount and past 
payments from the obligor, are not expected and should therefore not be considered. 

167.  The calculation of the diminished financial obligation should be performed for all 

distressed restructurings in accordance with paragraph 52 of the EBA Guidelines on 
DoD when the distressed restructuring is agreed. Hence, the calculation should also 
be performed in cases where the threshold is blatantly exceeded, for example if a 
large part of the principal is forgiven. In this regard, it should be noted that – for 
institutions using own LGD estimates – the calculated diminished financial obligation 
is also relevant for deriving the economic loss caused by a default whenever 
institutions open new facilities to replace previously defaulted facilities as part of a 
restructuring or for technical reasons (see paragraph 262(b) of this chapter), and the 
amount by which the financial obligation has diminished is included among the 
information that the reference dataset for LGD estimation should contain (see 
paragraph 109(c) of the EBA Guidelines on PD and LGD). If an institution applies a 
material change to its definition of default by reviewing the threshold for assessing 
the materiality of the diminished financial obligation, for the purpose of default 
detection processes the reviewed threshold should be applied to distressed 
restructurings that occur after the modification of the threshold and does not affect 
previous restructurings. 

168.  When applying paragraph 54 of the EBA Guidelines on DoD, which requires that any 
concession extended to an obligor already in default should lead to the obligor being 
classified as a distressed restructuring, it is the ECB’s understanding that institutions 
should understand the term “concession” in the same sense as in Article 47b(1) of 
the CRR. 

169.  When specifying in their internal policies and procedures other additional indications 

of unlikeliness to pay of an obligor, institutions should, in line with paragraph 58 of 
the EBA Guidelines on DoD, define and document additional indications of 
unlikeliness to pay that are appropriate for the specific type of exposure. It is the 

ECB guide to internal models – Credit risk 

93 

 
ECB’s understanding that considering only the indications of unlikeliness to pay set 
out in points (a) to (f) of Article 178(3) of the CRR is in principle not deemed an 
appropriate and prudent approach. In order to define these additional indications, 
institutions may consider the list provided in paragraph 59 of the EBA Guidelines on 
DoD. In particular, institutions should ensure that these additional indications reflect 
the specificities of the types of exposures and adequately capture relevant factors 
that may affect the current or future repayment capacity of the obligor based on the 
source of repayment (e.g. for specific types of exposures structured as asset-based 
lending, the additional UTP indications should consider the repayment capacity 
based on the value and marketability119  of the financed asset serving as the source 
of repayment).In line with paragraph 60 of the EBA Guidelines on DoD, institutions 
are expected to take into account external information, if available, in their default 
identification process. In doing so, institutions are free to determine the frequency of 
the update and monitoring of the external information, possibly differentiating among 
individual subsets of obligors, provided that the frequency determined for each 
subset eventually guarantees the timely identification of default. 

12 

Return to non-defaulted status 

170.  Paragraphs 72 to 73 and 71 of the EBA Guidelines on DoD provide the minimum 

conditions for reclassification to non-defaulted status for exposures subject to 
distressed restructurings and for all other exposures respectively. In particular, for 
exposures subject to distressed restructurings the minimum probation period120  is 
generally longer than for exposures not subject to distressed restructuring. This 
implies the following. 

(a) 

(b) 

If the definition of default is applied at obligor level, institutions should monitor 
the conditions for reclassification to non-defaulted status that are applicable to 
each exposure of the obligor, and the obligor may return to non-defaulted status 
only when all exposures meet their respective conditions. 

If the definition of default is applied at facility level, institutions should monitor 
the conditions for reclassification to non-defaulted status that are applicable to 
the facility, and when these are met then the facility may return to non-defaulted 
status. This means that different defaulted facilities belonging to the same 
obligor may possibly return to non-defaulted status at different moments in time. 
However, institutions may make use of the possibility of setting longer probation 
periods (as set out in paragraphs 71 and 72 of the EBA Guidelines on DoD) to 
ultimately align these moments. 

171. 

In the case of exposures subject to distressed restructuring, one of the minimum 
conditions for the reclassification to non-defaulted status is that during the probation 
period a material payment has been made by the obligor. In this regard, paragraph 

119   Marketability means that there is an active market at the reference date with sufficient capacity for the 

type of asset making it likely that the value of the asset could be realised. 

120   The minimum probation period is the minimum period of time over which a defaulted exposure and 

related obligor should be monitored before the exposure may possibly return to non-defaulted status. 

ECB guide to internal models – Credit risk 

94 

 
 
73(a) of the EBA Guidelines on DoD provides examples of material payments that 
should not be construed as mandatory conditions; institutions may define material 
payments otherwise. It is the ECB’s understanding that the appropriateness of such 
a definition is one of the elements that institutions should consider when monitoring 
the effectiveness of the policy for the return to non-default status as described in 
paragraphs 76 to 78 of the EBA Guidelines on DoD. 

172.  Minimum conditions for returning to non-defaulted status with regard to past due 

amounts are different for exposures subject to distressed restructurings. These 
conditions are as follows. 

(a)  Where distressed restructuring does not apply to a defaulted exposure, if all 

other conditions described in paragraph 71 of the EBA Guidelines on DoD are 
met, a defaulted exposure can be reclassified to non-defaulted status even if 
there are still past due amounts that are either not material or material but are 
less than 90 consecutive days past due. 

(b)  Where distressed restructuring applies to a defaulted exposure, under 

paragraph 73 of the EBA Guidelines on DoD there should be no past due credit 
obligations according to the schedule applicable after the restructuring 
arrangements. Hence, it is the ECB’s understanding that institutions should 
refrain from allowing the return to non-default status as long as exposures are 
subject to outstanding past due amounts, even if these past due amounts are 
immaterial or are material and less than 90 days past due. This condition 
ensures alignment between defaulted exposures subject to distressed 
restructuring and forborne non-performing exposures (as also required by 
paragraphs 54 and 107 of the EBA Guidelines on DoD). 

173.  The activation of new default triggers for already defaulted exposures has a different 

impact on the probation period depending on whether the exposure is subject to 
distressed restructuring or not. This is explained as follows. 

(a)  Where distressed restructuring does not apply to a defaulted exposure, the 

probation period should last a minimum of three months from the moment that 
all default triggers cease to apply. According to the ECB’s understanding, this 
means that if a new default trigger becomes applicable while the probation 
period is running, then the probation period is reset to zero and will start again 
when all default triggers, including the new one, will again cease to apply. 

(b)  Where distressed restructuring applies to a defaulted exposure, the probation 

period should last a minimum of one year from the latest of the events specified 
in paragraph 72 of the EBA Guidelines on DoD and should be reset in the 
circumstances described in question ID 2022_6527 of the EBA Single Rulebook 
Q&A.121  According to the ECB’s understanding, in general, whenever a new 
default trigger becomes applicable while the probation period is running, then 
the probation period is reset to zero and immediately starts again. 

121   Question ID 2022_6527 in the EBA Single Rulebook Q&A. 

ECB guide to internal models – Credit risk 

95 

 
 
13 

Consistency of external data 

174. 

In accordance with Article 178(4) of the CRR, institutions that, for the purpose of risk 
quantification, use external data that are not themselves consistent with the definition 
of default laid down in paragraph 1 of the same article must make appropriate 
adjustments to achieve broad equivalence. To comply with this requirement, 
institutions should ensure that when they make use of external data or pooled data 
they have a complete understanding of the definition of default applied to these data 
and demonstrate representativeness of data collected under a different definition of 
default in the same way as specified for external data in Chapter 6 of the EBA 
Guidelines on DoD. In this context it is the ECB’s understanding that the following 
applies. 

(a)  Where an institution demonstrates that the difference in definitions of default is 

negligible in terms of the impact on all risk parameters and own funds 
requirements in general, data based on a definition of default different from the 
one that is used internally for default identification may continue to be used in 
the risk quantification RDS without any adjustment. 

(b)  Otherwise, institutions should perform appropriate adjustments to (i) the 

granular data used for risk quantification (as per paragraph 30 of the EBA 
Guidelines on PD and LGD in conjunction with paragraph 68(b) of the EBA 
Guidelines on DoD) and/or (ii) aggregated metrics, model components or the 
risk estimates (as per paragraphs 34, 36, 37 and 38 of the EBA Guidelines on 
PD and LGD). 

In addition, it is the ECB’s understanding that, all other things being equal, the use of 
external data for the purpose of risk quantification results in a higher level of 
estimation uncertainty than when using data collected under the definition of default 
that is used internally for default identification for the relevant type of exposure. 
Therefore, it would be in line with best practice for institutions to apply a category A 
MoC in accordance with paragraph 37(a)(viii) of the EBA Guidelines on PD and LGD 
when using external data for the purpose of risk quantification. 

175.  For the purposes of model development, an RDS based on a definition of default 
different from the internal one may be acceptable under the conditions set out in 
paragraph 23 of the EBA Guidelines on PD and LGD and as long as institutions 
provide reasonable assurance that the use of a different definition of default does not 
have a negative impact on the structure and performance of the rating model in 
terms of risk differentiation and predictive power with respect to the internal definition 
of default. 

14 

Adjustments to risk estimates in the case of changes to 
the definition of default 

176.  A change to the definition of default should be understood as any change to any 

aspect of the definition of default set out in Article 178 of the CRR, namely changes 

ECB guide to internal models – Credit risk 

96 

 
to the counting of days past due, changes to the indications of unlikeliness to pay or 
changes to the criteria for allowing the return to non-defaulted status of previously 
defaulted exposures. 

177.  Under the IRB approach, changes to the definition of default require prior approval 

from the competent authority before they can be implemented.122  As a consequence, 
to avoid temporary mismatches in the definitions of default applied under the 
different approaches, it is advisable that institutions align the implementation 
timelines of changes for exposures under IRB and under SA so that changes are 
implemented for all exposures under IRB and under SA after the supervisory 
approval is granted for exposures treated under the IRB approach. 

178.  Where a change has been made to the definition of default, institutions should 

demonstrate the model’s risk differentiation on a time series of realised default rates 
(or a time series of realised LGD or realised CCF) reflecting the new definition of 
default. Where institutions determine that their PD (or their LGD or CCF) models do 
not maintain good risk differentiation capacities with respect to the new definition of 
default, it is the ECB’s understanding that a recalibration is not sufficient to adjust the 
models to the new definition of default and, in addition to the recalibration, 
institutions should redevelop123  their models to the extent needed. 

179.  According to paragraph 11(b) of the EBA Guidelines on DoD and paragraph 30 of the 
EBA Guidelines on PD and LGD, where a change has been made to the definition of 
default, institutions should compare the new definition of default resulting from the 
change with the definitions underlying the observations included in the RDS used for 
risk quantification and assess the representativeness of such historical data in the 
same way as specified for external data in paragraph 174 of this chapter. It is the 
ECB’s understanding that one prerequisite for such a comparison is the construction 
of an appropriate dataset reflecting the new definition of default. Generally, to 
assemble a reliable dataset reflecting the new definition of default before changing 
their definition of default, institutions can adjust historical granular data collected on 
the basis of the old definition of default in order to achieve broad equivalence to the 
new definition of default by means of a parallel run (i.e. the implementation of the 
new definition of default in a parallel environment to the productive systems), a 
retrospective simulation (i.e. applying the new definition of default retrospectively to 
historical data) or a similar classification of data according to the new definition of 
default. Where the adjustments in granular data do not cover the entire historical 
observation period of the model, institutions may complement the missing periods by 
using simplifying assumptions such as applying correction factors to aggregated 
metrics, model components or risk estimates, provided that these assumptions are 
based on an RDS that covers at least two years of data adjusted at granular level by 
means of a retrospective simulation, parallel run or similar classification of data 
according to the new definition of default. 

122   As required by Article 4(1)(b) in conjunction with Annex I, Part II, Section 1(3) of Commission Delegated 

Regulation (EU) No 529/2014. 

123   For rating systems based on a slotting approach under Article 153(5) of the CRR, institutions are 
expected to review and, if necessary, adjust the assignment to slots to reflect the new definition of 
default, although the risk parameters themselves are not affected. 

ECB guide to internal models – Credit risk 

97 

 
 
180.  According to paragraphs 11(c) and 70 of the EBA Guidelines on DoD, where a 

change has been made to the definition of default, institutions should add a definition 
of default-related MoC that is appropriate and sufficient to cover the uncertainty 
caused by deficiencies in the RDS used for risk quantification owing to the 
impossibility of performing appropriate adjustments, as well as by uncertainties 
related to the quantification of appropriate adjustments (at granular or aggregate 
level) to account for the change in the definition of default in the model’s risk 
quantification. Generally, it is the ECB’s understanding that estimation uncertainty 
also increases in the infrequent cases where institutions do not apply appropriate 
adjustments to account for the change in the definition of default because they 
estimate that the impact of the new definition of default on all risk parameters and 
own funds requirements is negligible. As a consequence, in these situations too, 
institutions should apply a definition of default-related MoC.124 

124   In exceptional cases, institutions may set such a MoC to zero. For this to be permitted, the conclusion 
that the change in the definition of default will have a negligible impact must be based on an RDS that, 
for the entire historical observation period, faithfully replicates the new definition of default after the 
model change, without any use of simplifying assumptions or correction factors applied at aggregate 
level. It is the ECB’s understanding that, in such a situation, estimation uncertainty does not increase 
beyond what is already captured in the general estimation error. 

ECB guide to internal models – Credit risk 

98 

 
 
 
 
C 

Estimation of credit risk parameters 

15 

Use of data 

15.1 

Relevant regulatory references 

Table 10 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

26/06/2013 

144 

171 

172 

174 

176 

178 

179 

(1)(d) 

(1)(a), (b) 

(3) 

(b), (c), (e) 

(4) 

(1)(a), (c), (d), (2)(a), 
(b) 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

42, 45, 47, 53 

Other references 

EBA Guidelines on PD and LGD 

20/11/2017 

15-35 

181. 

In accordance with Article 144(1)(d) of the CRR, institutions must collect and store all 
relevant data to provide effective support to their credit risk measurement and 
management processes. Furthermore, good data quality is a fundamental condition 
for developing a robust rating system. The ECB considers that, to comply with these 
requirements and ensure the quality of data, institutions should have sound policies, 
processes and methods in place, under paragraphs 15 to 34 of the EBA Guidelines 
on PD and LGD for assessing and improving the quality and representativeness of 
the data used in the modelling and risk quantification process. 

182.  Since the data-related requirements of the CRR also apply in cases where an 

institution estimates CCFs, paragraph 181 of this chapter is also relevant for such 
institutions. 

15.2 

Use of external data 

183.  Data-related requirements established under the CRR apply to all data: internal, 
external or pooled. In the ECB’s understanding, therefore, paragraph 181 of this 
chapter is also relevant in the event that an institution uses external or pooled data. 
The principles on the collection and storage of data are relevant to the institutions’ 
own data and to the data received from the pool. 

ECB guide to internal models – Credit risk 

99 

 
 
 
 
 
 
 
 
 
 
 
 
184.  To ensure that credit risk management and measurement processes are built on 

appropriate data, for the purposes of risk differentiation, risk quantification and 
review of estimates institutions should assess whether external data can be used to 
complement internal data when they consider they do not have sufficient available 
internal data. 

185. 

In addition, when institutions use different data sources (including different external 
databases, whether or not combined with internal data) for the purpose of risk 
quantification, there could be a risk that the sources include common obligors among 
the data sources used for risk quantification. This could lead to bias or double-
counting effects in the calculation of one-year default rates. To avoid this risk, 
institutions should develop the necessary processes in order to identify common 
obligors within these databases and ensure that each common obligor is only taken 
into account once in the calculation of one-year default rates.125  When institutions 
are not able to identify common obligors, they should analyse potential bias or 
double-counting effects in the calculation of one-year default rates. These bias or 
double-counting effects should be reflected appropriately in the computation of one-
year default rates and long-run average (LRA) default rates. 

186. 

If an institution uses statistical models and other mechanical methods to assign 
exposures to obligors or facilities grades or pools, the data used to build the model 
must be representative of the population of the institution’s actual obligors or 
facilities.126  If external data are used, the same requirements with regard to 
representativeness127  must be applicable vis-à-vis the bank’s portfolio or portfolio 
subset for which the external data are used. 

187.  Proving representativeness in cases where an institution uses external data is 

generally more difficult, as internal data are scarce. If an institution cannot provide 
sufficient proof that the external data are representative, in the ECB’s view it may still 
use external data if it shows (by quantitative analysis and/or qualitative 
argumentation) that the information gained from the use of the external data 
outweighs any drawbacks stemming from the deficiencies identified. For this 
purpose, institutions should provide evidence that the model’s performance does not 
deteriorate when information derived from the external data is included, that the 
parameter estimates128  are not biased and that an appropriate margin of 
conservatism (MoC) is applied. To assess these issues, the institution should 
conduct quantitative and qualitative analyses specifically designed for this purpose. 

188. 

In accordance with Article 174(b) of the CRR, if an institution uses statistical models 
and other mechanical methods to assign exposures to obligors or facilities grades or 
pools, it must have in place a process for vetting data inputs to the model, which 
should include an assessment of the accuracy, completeness and appropriateness 
of the data. In addition, and in accordance with Article 179(1)(a), in quantifying the 
risk parameters to be associated with rating grades or pools institutions must 

125   If the default identification is at the level of an individual credit facility rather than at obligor level, this 

principle will not be relevant. 
126   See Article 174(c) of the CRR. 
127   As established under Articles 174(c) and 179(1)(d) of the CRR. 
128   See paragraph 234 of this chapter for the PD risk parameter. 

ECB guide to internal models – Credit risk 

100 

 
 
incorporate all relevant data, information and methods. To comply with these 
requirements, institutions should ensure that, when external data are used for risk 
differentiation, risk quantification or review of estimates, they know the data sources 
and the most relevant data processing operations of the variables acting as direct 
model inputs performed by the data provider. Institutions should be able to 
differentiate between internal and external data and to document which information 
is internal and which information is received from external data sources. To ensure 
that the data remain appropriate, institutions should provide an adequate rationale in 
the event that, for the purpose of risk differentiation, risk quantification or review of 
estimates, they modify the external data acquired, select only part of a wider external 
database or use different external providers. 

15.3 

Use of external bureau scores or external ratings as input variables 
in the rating process 

189.  Where an institution uses external credit bureau scores or external ratings as input 
variables in the rating process, and in particular when externally sourced scores are 
the main (or one of the main) input variable(s) of the overall internal rating, there is a 
risk that an internal model may not consider all relevant information. In the ECB’s 
understanding, institutions mitigate this risk when they comply with the following 
principles. 

(a)  The external scores or ratings and/or data are regularly updated or refreshed, 
especially where credit bureau information is dynamic and is used not only for 
the application rating but also for the ongoing behavioural rating. 

(b) 

Institutions understand the structure and nature of external scores or ratings 
and their key drivers. They also regularly verify that the results of the credit 
bureau score continue to be appropriate input variables in their credit rating 
process, for example by reviewing any changes in the credit bureau score 
methodology. The greater the importance of the external scores or ratings, the 
greater understanding institutions should demonstrate of their structure, nature 
and key drivers and the higher the frequency that should be considered in 
monitoring the appropriateness of these external scores or ratings. 

(c)  Validation requirements are similar to those applied to other internal and 

external input variables. 

(d)  Even when the external score or rating is the main (or one of the main) driver(s) 
of the internal rating, the institution ensures that all relevant internal information 
regarding the creditworthiness of the obligor is taken into account with sufficient 
weighting in the internal rating. In addition, the institution demonstrates that the 
additional relevant internal information considered in the model and its 
weighting are sufficient to ensure that the internal rating does not merely take 
on the results of the external bureau scores or the external ratings used. 

(e)  When institutions make use of external scores or ratings or any other 

judgement-based assessment provided by a third party as input variables in the 

ECB guide to internal models – Credit risk 

101 

 
rating process, they should ensure that any potential correlation between the 
relevant risk drivers does not lead to bias or a double-counting effect in the risk 
parameter estimates. This can be especially relevant in these cases, due to the 
potential use of duplicated information. 

(f)  The institution remains responsible for the performance of the model. 

15.4 

Use of pooled data129 

190.  The use of pooled data is treated similarly to the situation where internal data are 

combined with data derived from a different (and external) set of obligors or facilities, 
as mentioned in Section 15.2 of this chapter. 

191. 

In accordance with Article 179(2)(a) of the CRR, where an institution uses data that 
are pooled across institutions the rating systems and criteria of other institutions in 
the pool must be similar to its own. To comply with this requirement an institution 
should, among other things: 

(a)  ensure that there is a common definition of the key drivers and processes; 

(b)  ensure that policies and procedures considered for human judgement, including 
overrides130, can be applied in a comparable and similar manner across all 
participating institutions. 

15.5 

Use of purchased rating systems or models (pool models131  132) 

192. 

In accordance with the last sentence of Article 144(1) of the CRR, the requirements 
to use an IRB approach, including own estimates of LGD and CCFs, apply also 
where an institution has implemented a rating system, or model used within a rating 
system, that it has purchased from a third-party vendor. To comply with this 
provision, institutions should ensure in such cases that all relevant internal 
information for model development and parameter calibration is taken into account. 
In particular, LRAs of default rates, LGD and CCFs based only on internal data 
should always be computed and considered for calibration. The institution remains 
responsible for the performance of the rating system or model. 

129   The paragraphs below are also relevant in cases where institutions use pooled data from institutions 

belonging to the same banking group. 

130   Article 172(3) of the CRR. 
131  A “pool model” is deemed to be a model where institutions develop a shared or common rating model 

based on pooled data which is then applied by each participating institution to its portfolio(s). 
Institutions which pool their data may work together very closely, disclosing to each other more 
information than simply publicly available external data, and even sharing the same rating and 
validation processes. 

132   The paragraphs below are also relevant in cases where institutions use pooled data that are generated 

from institutions belonging to the same banking group. 

ECB guide to internal models – Credit risk 

102 

 
 
193. 

In addition, to ensure the integrity of the rating systems or internal models when 
institutions make use of pool models, and to comply with Article 144(1) of the CRR, 
the principles set out below should be followed. 

(a) 

If PD estimates are calculated using pooled data, institutions should verify that 
the data used for risk quantification meet the data requirements for default rate 
calculation as clarified in paragraph 229 of this chapter, or that the data are 
adjusted accordingly. 

(b)  Where several institutions use a common pool model, each should ensure that 
its rating process is aligned to the extent that all input risk drivers are defined in 
the same way across all participating institutions. The institutions should also 
ensure that all assessments of the qualitative components of the rating model 
are performed in a comparable manner. 

(c) 

If a pool model is used for the estimation of risk parameters and the model-
relevant parts of the process for managing distressed obligors (including the 
strategy before and after default) of the participating institutions are not aligned, 
these differences should be appropriately taken into account within the model or 
through an appropriate adjustment, in accordance with paragraph 37(a)(viii) of 
the EBA Guidelines on PD and LGD. In the case of a pool model for the 
estimation of LGD parameters, differences in the model-relevant parts of the 
workout processes should also be taken into account within the model or 
through an appropriate adjustment. 

(d) 

Institutions should ensure that all relevant internal information with respect to 
the creditworthiness of an obligor is taken into account and the rating is updated 
with new information in a timely manner. 

(e)  Each institution should remain responsible for the performance of the rating 

model on its own portfolio. 

194.  To ensure that its ratings systems are operating properly on an ongoing basis, if an 

institution introduces systematic adjustments to the outputs of the pool model, the 
institution concerned should initiate internal procedures to analyse whether 
significant weaknesses in the model exist and whether a model change needs to be 
triggered. 

15.6 

Use of human judgement in model estimation 

195.  When human judgement is used for the purpose of model development, for example 
in setting the model’s assumptions, the identification of risk drivers and determination 
of their weights, or the identification and combination of model components, there is 
a risk of the model-based assignments being inaccurate.133  To mitigate this risk, 
institutions should ensure that the incorporation of human judgement is appropriately 
managed and proportionate to the number of relevant available observations. 

133   Article 174(e) of the CRR. 

ECB guide to internal models – Credit risk 

103 

 
 
196.  For the purposes of quantifying the risk parameters to be associated with grades or 

pools, estimates must not be based purely on judgemental considerations.134  To this 
end, where human judgement is used to a greater extent because of the low number 
of relevant available observations, institutions should apply a higher MoC to their 
estimates to account for additional uncertainty. 

197. 

In addition, whenever human judgement is used in the estimation of risk parameters 
(for either risk differentiation or risk quantification purposes) institutions are expected 
to have in place a framework under paragraph 35 of the EBA Guidelines on PD and 
LGD. 

15.7 

Use of data in the case of consolidations 

198.  Consolidations, i.e. mergers and acquisitions, frequently lead to the acquirer’s IRB 

models being extended to the target’s portfolios. In such cases, the ECB 
understands that the combined default and loss histories of the acquirer and the 
target should be used to calibrate the IRB models following the extension.135 

199. 

In particular, for loss data, where the acquiring bank’s workout processes are 
different from those of the acquired bank, the acquiring bank should apply 
paragraphs 33 and 38 of the EBA Guidelines on PD and LGD. However, in line with 
paragraph 163 of the EBA Guidelines on PD and LGD, it is the ECB’s understanding 
that the defaults relating to the acquired bank’s portfolio should not be excluded. 

200.  Where the acquirer does not automatically have the legal right to access the default 

and loss histories of the acquired portfolios (e.g. in the case of a portfolio 
acquisition), the acquirer should nevertheless make reasonable efforts to acquire 
these data. 

201.  Where the acquirer has not been able to access the default and loss histories of the 

acquired portfolios or where the default and loss histories are limited in scope, length 
or quality, and where the acquirer cannot prove that the inability to access this data 
does not lead to bias, the acquirer should consider this as a data deficiency and 
apply an appropriate adjustment and MoC accordingly. 

134   Article 179(1)(a) of the CRR. 
135   Where the acquirer can show – by back-testing best estimates of risk parameters (excluding the MoC 

and downturn adjustment where applicable) in a way that includes the historical data of the target – that 
the risk parameters are still conservative, an immediate recalibration is not required. However, when 
checking whether the inclusion of recent data would have an impact on the calibration as part of the 
regular review of estimates, the historical and recent data of the target should be included in the 
analysis. Likewise, any further calibrations should be based on all data. 

ECB guide to internal models – Credit risk 

104 

 
 
16 

Probability of default 

16.1 

Structure of PD models 

16.1.1 

Relevant regulatory references 

Table 11 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

26/06/2013 

144 

161   

169 

(1)(a), (e) 

(3) 

(1), (2) 

170   

(1)(a) to (f), (2), (3)(a) to (c), (4) 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

171 

172   

173   

174 

179   

180   

201, 203, 236 

24 

30 

33 to 36, 38 

(2) 

(1)(a), (d) 

(1)(b) 

(1)(a), (c) 

(1)(a) 

(1)(a), (g), (2)(a) 

(3)(c) 

(3)(c), (e) 

Other references 

EBA Guidelines on PD and LGD 

20/11/2017 

20-27, 56-69, 96, 97, 98(b) 

202. 

In accordance with Article 179(1)(a) of the CRR, estimates must be based on the 
material drivers of the risk parameters.136  The relevant material risk drivers and 
rating criteria may be taken into consideration in several ways: 

(a)  when assigning exposures to different PD models; 

(b)  at a PD model level when assigning exposures to different ranking/scoring 

methods; 

(c)  as explanatory variables in ranking/scoring methods; 

(d)  as drivers when defining calibration segments by splitting exposures covered by 
the same PD model into subsets carrying a significantly different level of risk; 

136   Institutions should consider all potential risk drivers in accordance with paragraph 57 of the EBA 

Guidelines on PD and LGD. These include but are not limited to climate-related and environmental risk 
drivers affecting the PD, where relevant and material. 

ECB guide to internal models – Credit risk 

105 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
(e)  as drivers in the process for the assignment of facilities or obligors to grades or 

pools other than calibration segments. 

203.  When choosing the risk drivers for the models, there is a risk that those drivers that 
capture the characteristics of defaulted obligors might be inappropriately understood 
as relevant risk drivers for the portfolio, or that an inappropriate weight might be 
given to some of them. To mitigate this risk, institutions should take appropriate 
measures against model misspecification with regard to overfitting. This is 
particularly relevant where default data for the development of the model are scarce. 
Where an institution relies on one or more statistical models to define the process of 
assigning exposures to grades or pools (or parts of this process) in accordance with 
Article 175(4)(b) of the CRR, it is the ECB’s understanding that for institutions to 
comply with the requirement, set out in Article 144(1)(a) of the CRR, that rating 
systems should provide for a meaningful differentiation of risk as further explained in 
letters (c) and (e) of Article 30(3) of Commission Delegated Regulation (EU) No 
2022/439, the statistical process followed by the institution in selecting its model(s) 
should include assessing the performance of the model(s) on the basis of 
independent datasets (data points which were left out of the model fitting) in a way 
that limits the risk of overfitting. Independent datasets should correspond not only to 
random sampling (out-of-sample), but also to different time periods (out-of-time) 
unless there are no sufficient data available for the training sample. The expectations 
set out above in this paragraph are specifically related to the model development 
phase. Once the process for assigning exposures to grades or pools has been 
defined, the requirements related to the framework for the review of estimates under 
paragraphs 217 to 221 of the EBA Guidelines on PD and LGD apply together with 
the expectations set out in Section 20 of this chapter. In particular, in accordance 
with paragraph 218(b)(i) of the EBA Guidelines on PD and LGD, the institution must 
carry out an analysis to identify any potential deterioration in the model’s 
performance, including the model’s discriminatory power, by comparing its 
performance at the time of the development with its performance over each 
subsequent observation period. 

204. 

In accordance with Article 144(1)(a) of the CRR, institutions’ rating systems must 
provide for a meaningful assessment of obligor and transaction characteristics, a 
meaningful differentiation of risk and accurate and consistent quantitative estimates 
of risk. To comply with this requirement, it is the ECB’s understanding that PD 
models should perform adequately on economically significant and material sub-
ranges of application.137  The sub-ranges are identified by splitting the full range of 
application of the PD model into different parts on the basis of potential drivers for 
risk differentiation, including the following non-exhaustive list of drivers138, where 
relevant: 

137   Where an institution has approval for a PD model on a consolidated basis as well as on a sub-

consolidated and/or individual basis, it is the ECB’s understanding that this PD model should perform 
adequately at these sub-consolidated and/or individual levels, as these are considered material sub-
ranges of application. 

138   When external credit bureau scores or ratings are used as the main (or one of the main) driver(s) of the 
internal rating, the set of all exposures for which the external score or rating is not available should also 
be considered a significant sub-range of application. 

ECB guide to internal models – Credit risk 

106 

 
 
(a) 

(b) 

(c) 

for PD models covering exposures to small and medium-sized enterprises 
(SMEs): country, industry (e.g. statistical classification of economic activities in 
the European Community (abbreviated as NACE139) code section classification 
A to U), size of obligor (e.g. different buckets in terms of total assets), past 
delinquency (e.g. obligors with delinquency events, i.e. days past due, in the 
last 12 months); 

for PD models covering retail exposures: client type (e.g. high net worth/private 
banking, other individuals, self-employed, SMEs), product type (e.g. consumer 
credit, credit card, other), region (e.g. nomenclature of territorial units for 
statistics (NUTS) 1, 2 or 3 as defined by Eurostat), past delinquency 
(e.g. obligors with delinquency events, i.e. days past due, in the last 
12 months), maturity (e.g. original or remaining maturity); 

for PD models covering retail exposures secured by real estate: region 
(e.g. NUTS 1, 2 or 3 as defined by Eurostat), type of real estate 
(e.g. residential, commercial, other), past delinquency (e.g. obligors with 
delinquency events, i.e. days past due, in the last 12 months), maturity 
(e.g. original or remaining maturity); 

(d) 

for PD models covering exposures to financial institutions: business model 
(deposit-taking institutions, investment banking, insurance firms, other), 
jurisdiction (or global region as appropriate) and size (defined buckets of total 
assets); 

(e) 

for PD models covering exposures to large corporates: industry (e.g. NACE 
code section classification A to U), country (or global region as appropriate) and 
size (defined buckets of total turnover). 

205. 

In accordance with Article 169(1) of the CRR, where an institution uses multiple 
rating systems, the rationale for assigning an obligor or a transaction to a rating 
system must be documented and applied in a manner that appropriately reflects the 
level of risk. To comply with this requirement institutions should, in terms of the range 
of application of a PD model: 

(a)  clearly describe its range of application (and sub-divisions into different 
ranking/scoring methods and calibration segments) and also include an 
explanation of the risk drivers which the institution considered when designing 
the process but has decided not to use for the assignment of the obligor to the 
rating system; 

(b)  ensure that there are no overlaps in the range of application of different PD 

models and that each obligor or facility to which the IRB approach should be 
applied can be clearly assigned to one particular PD model. 

139   Nomenclature statistique des activités économiques dans la Communauté Européenne. 

ECB guide to internal models – Credit risk 

107 

 
 
16.1.2 

Risk differentiation 

Principles for all model types 

206.  Article 170 of the CRR lays down requirements related to the structure of rating 

systems. To comply with these requirements and with reference to Articles 34 to 36 
of Commission Delegated Regulation (EU) No 2022/439, institutions should, among 
other things, ensure a meaningful differentiation of risk over time which takes into 
account (i) the distribution of obligors or facilities; (ii) the homogeneity of obligors or 
facilities assigned to the same grade or pool; and (iii) the different levels of risk 
across obligors or facilities assigned to different grades or pools to which a different 
PD is applied. 

207.  To ensure that the PD model performs adequately in terms of risk differentiation, 

institutions should adopt the following approach. 

(a)  Define metrics (considering both their evolution over time and specific reference 
dates) with well-specified targets, taking into account tolerance levels that 
reflect the uncertainty of the metrics, and take action, where necessary, to 
rectify any deviations from these targets that exceed the tolerance levels. 
Separate targets and tolerances may be defined for initial development and 
ongoing performance. 

(b)  Ensure that the tools used to assess risk differentiation are sound and adequate 

considering the available data. The risk differentiation is expected to be 
demonstrated on time series of realised default rates for grades or pools under 
different economic conditions. 

Principles specific for grades and pools 

208.  A grade or pool is understood by the ECB to be the subset of obligors or facilities to 
which the same PD is applied for the calculation of regulatory capital requirements, 
irrespective of how this PD has been assigned (e.g. through the use of 
masterscales). 

Distribution of obligors or facilities across grades or pools 

209.  Articles 170(1)(c) and (d) and 170(3)(b) and (c) of the CRR require, among other 

things, that the number of grades and pools is adequate to achieve meaningful risk 
differentiation and quantification of the PD at the grade or pool level. To comply with 
this requirement, institutions should: 

(a) 

justify the criteria applied when determining the number of grades or pools and 
the proportion of obligors or facilities assigned to each; 

ECB guide to internal models – Credit risk 

108 

 
(b)  ensure that the concentration of numbers of obligors or facilities is not 

excessive in any grade or pool; any significant concentrations should be 
supported by convincing empirical evidence of the homogeneity of risk for those 
obligors or facilities; 

(c)  ensure that no grade or pool has too few obligors or facilities, unless this is 

supported by convincing empirical evidence of the adequacy of the grouping of 
the exposures in question. 

Homogeneity within grades 

210.  Articles 170(1)(b) and (d) and 170(3)(b) and (c) of the CRR require, among other 

things, that the structure of rating systems must ensure the homogeneity of obligors 
or facilities assigned to the same grade or pool. In accordance with this requirement 
and under paragraph 69 of the EBA Guidelines on PD and LGD: 

(a)  homogeneity is understood as obligors or facilities assigned to a grade having a 
reasonably similar default risk to ensure that the grade-level default rate is 
representative of all obligors or facilities in that grade; 

(b) 

in cases where it is found (through the use of additional drivers or a different 
discretisation of the existing ones) that a material subset of obligors or facilities 
within a grade/pool yields a significantly different default rate to that of the rest 
of the grade or pool, this is considered to indicate a lack of homogeneity. 

Risk differentiation across grades or pools 

211.  To comply with the requirement to ensure adequate risk differentiation across grades 

or pools140, institutions should ensure that there are no significant overlaps in the 
distribution of the default risk between grades or pools. This should be ensured 
through a meaningful differentiation of the default rates of each grade. In particular, 
the ECB expects that a very granular rating scale141  will only be used in cases where 
the institution is able to empirically confirm the risk differentiation across grades as 
described in this paragraph. 

Principles specific for direct estimates 

212.  See paragraph 250 of this chapter. 

140   As required by Articles 170(1)(b) and (d) and 170(3)(b) and (c) of the CRR. 
141   For continuous models, see paragraph 250 of this chapter. 

ECB guide to internal models – Credit risk 

109 

 
 
16.1.3 

Grade assignment dynamics 

213. 

In order to ensure a meaningful assessment of obligor characteristics142, when 
assigning obligors or facilities to a grade or pool institutions should follow 
paragraphs 66 to 68 of the EBA Guidelines on PD and LGD. Although the time 
horizon used in PD estimation is one year, it is the ECB’s understanding that the 
rating/grade/pool assignment process should also adequately anticipate and reflect 
risk over a longer time horizon and take into account plausible changes in economic 
conditions. In order to achieve this objective: 

(a)  all relevant information should be included in the rating/grade/pool assignment 
process, giving an appropriate balance between drivers that are predictive only 
over a short time horizon and drivers that are predictive over a longer time 
horizon; 

(b)  a horizon of two to three years is considered to be appropriate for most 

portfolios; 

(c) 

in accounting for plausible changes in economic conditions, the institution 
should consider at least past observed default patterns; 

(d) 

the model should perform under different economic conditions. 

As a consequence of the above, institutions’ grade assignment dynamics should also 
adequately anticipate and reflect in the assignment of grades the risk over the longer 
time horizon. For clarity, this does not mean that grades remain stable over the 
longer time horizon in the event of changes in the risks that are specific to the 
obligor. 

214.  Additionally, the following principles apply under the specific situations considered in 

(a) to (c) below: 

(a)  when using external scores or ratings (e.g. from an external bureau or external 
rating agency) as drivers for the purpose of risk differentiation within a specific 
model, institutions should identify the grade assignment dynamics embedded in 
the external rating and understand the effect on their own grade assignment 
dynamics, considering the other risk drivers used; 

(b)  when using external ratings as target variables for the purpose of risk 

differentiation within a specific model (see Section 16.1.5 of this chapter), 
institutions should preserve their own grade assignment dynamics by taking the 
appropriate measures when necessary; 

(c)  when mapping internal grades to external grades in order to use external 
default rates to estimate PD, institutions should ensure that the grade 
assignment dynamics of the external ratings are sufficiently similar to their own 
internal grade assignment dynamics, or perform the necessary adjustments 
during risk quantification to compensate for any differences. 

142   Article 144(1)(a) of the CRR. 

ECB guide to internal models – Credit risk 

110 

 
 
16.1.4 

Use of ratings of third parties 

215. 

In accordance with Article 172(1)(a) of the CRR, institutions must assign each obligor 
to a grade or pool as part of the credit approval process. To comply with this 
requirement, in accordance with paragraph 62 of the EBA Guidelines on PD and 
LGD, institutions should have clear policies specifying the conditions under which the 
rating of a third party which has a contractual or organisational relationship with an 
obligor of the institution (third-party support) may be taken into account in the risk 
assessment of that obligor. These policies should meet the following criteria. 

216. 

(a)  They should specify in which situations the rating of a parent entity could be 

taken into account in the risk assessment of other entities of the group. In 
particular, the policies should specify those situations in which obligors are 
assigned to a better grade than their parent entities. 

(b)  They should include provisions on the use of ratings of third parties that provide 
contractual support to more than one obligor. As a general rule, the policies 
should include, but not be limited to, possible prioritisation, eligibility, and the 
impact on the rating of the supporting third party. 

It is the ECB’s understanding that a “rating transfer” within the meaning of paragraph 
62(a) of the EBA Guidelines on PD and LGD constitutes a mechanism that is distinct 
from the substitution effect referred to in Article 236 of the CRR. In addition, 
according to the ECB’s interpretation, an “appropriate guarantee” within the meaning 
of paragraph 62(a) of the EBA Guidelines on PD and LGD should not be understood 
as credit risk mitigation within the meaning of Article 4(1)(57) of the CRR, but as a 
contractual agreement between the institution’s obligor and the third party, fully 
covering the obligor by providing the obligor with a claim against the third party that 
is effective (i.e. it prevents the default) and enforceable (from a legal perspective) 
before the institution has to recognise a default event of the obligor. When, under 
paragraph 62(a) of the EBA Guidelines on PD and LGD, an institution performs a 
rating transfer across different rating systems that do not share the same obligor 
rating scale, it should ensure that the mapping between rating scales is performed in 
such a way that the PD estimate (including MoC) assigned to the guaranteed 
exposure amount is not better than the PD estimate (including MoC) being 
transferred from a third party. Article 171(2) of the CRR establishes that information 
used to assign obligors and facilities to grades or pools must be current. To comply 
with this requirement, if a material proportion of exposures or obligors within a rating 
system receives a rating from an approved IRB rating system as a result of rating 
transfers, institutions should ensure that the transferred ratings are automatically 
updated when the rating of the third party changes or when the PDs of the rating 
system to which the third party belongs are re-estimated. 

217. 

In the situation described in paragraph 62(b) of the EBA Guidelines on PD and LGD, 
where a rating of a third party is being taken into account as an indication for an 
override of the assignment of the relevant obligor to a grade or pool, institutions 
should not assign a PD estimate (including MoC) to an obligor that is better than the 
PD estimate (including MoC) of the third party as a consequence of an override 
resulting solely from the existence of this third-party support. Furthermore, when 

ECB guide to internal models – Credit risk 

111 

 
third-party support is used extensively in the scope of application of a PD model as 
an indication for an override, institutions should consider its existence as a potential 
relevant driver for risk differentiation, in accordance with Section 16.1.2 of this 
chapter. 

218.  The ECB understands paragraph 62(c) of the EBA Guidelines on PD and LGD to be 
applicable not only in the presence of contractual support, but also in instances 
where there is an organisational relationship between the third party and the obligor. 
In accordance with Article 179(1)(a) of the CRR, estimates must be plausible and 
intuitive and must be based on the material drivers of the respective risk parameters. 
To comply with this requirement when the treatment specified in paragraph 62(c) of 
the EBA Guidelines on PD and LGD is used, institutions should have sufficient 
empirical evidence to justify situations where an obligor has an equal or better PD 
estimate (including MoC) than the third party providing support. 

219. 

In addition, differences between the various forms of contractual support should be 
considered in the PD models unless there is sufficient empirical evidence that these 
differences are not relevant risk drivers. This understanding should also be taken 
into account if the rating of the third party is being considered as an indication for an 
override under paragraph 62(b) of the EBA Guidelines on PD and LGD. 

220.  Articles 201 to 203 of the CRR establish requirements for the eligibility of unfunded 
credit protection. To comply with these requirements, institutions may recognise the 
guarantee by applying the risk weight of the guarantor under the standardised 
approach to the covered part of the exposure, provided that no own estimates of 
LGD and CCFs are used (foundation IRB (F-IRB)). This applies when an obligor is 
guaranteed by a third party that is not in the range of application of a PD model and 
the guarantee fulfils all requirements for credit risk mitigation (CRM), consistently 
with paragraph 44 of the EBA Report on the CRM Framework. In such situations, 
under paragraph 74 of the EBA Guidelines on PD and LGD, the guaranteed obligor 
should be included in the calculation of the one-year default rate of the grade the 
obligor is assigned to, before the recognition of the guarantee. 

221. 

In addition, when the institution reflects substitution effects143  arising from CRM in 
the ratings assigned to a material number of exposures within a rating system, there 
is a risk that the process of assigning exposures to grades or pools might not provide 
for a meaningful differentiation of risk, as a result of the inclusion of obligors with 
significantly different risk levels within the same rating grade.144  To mitigate this risk, 
institutions should verify that obligors guaranteed by a third party do not carry a 
significantly different level of risk from those in the same rating grade without such a 

143   Substitution effects are understood as: the application of the treatment set out in Article 236 of the CRR 
(i.e. the possibility to replace the PD of the obligor with the PD of the protection provider, or with a PD 
between that of the borrower and that of the guarantor); or the recognition of a guarantee by applying 
the risk weight of the guarantor under the standardised approach to the covered part of the exposure, 
as described in paragraph 220 of this chapter. 

144   In accordance with Article 170(3)(c) of the CRR, the process of assigning exposures to grades or pools 

must provide for a meaningful differentiation of risk, for a grouping of sufficiently homogenous 
exposures, and must allow for accurate and consistent estimation of loss characteristics at grade or 
pool level. 

ECB guide to internal models – Credit risk 

112 

 
 
guarantee, and that no separate calibration segment as referred to in paragraph 97 
of the EBA Guidelines on PD and LGD is required. 

16.1.5 

Use of shadow rating models 

222.  The ECB understands a shadow rating model to be an internal rating approach that 

selects and weighs the risk drivers to be used for risk differentiation purposes by 
identifying the main factors that explain external ratings provided by an external 
credit assessment institution or similar organisation, rather than internal directly 
observed defaults. 

223. 

In accordance with Article 144(1)(e) of the CRR, institutions must document the 
rationale for their rating systems. To comply with this requirement, institutions should 
justify and document the rationale for the use (and the continued use) of the shadow 
rating model, instead of the internal default prediction model, and also document the 
alternative approaches that have been considered, in accordance with Article 38 of 
Commission Delegated Regulation (EU) No 2022/439. In addition, and without 
prejudice to the risk differentiation requirements, when developing the model 
institutions should set explicit threshold criteria in terms of capacity to explain the 
target ratings and take appropriate action when those thresholds are not met. 

224.  Assignment criteria and processes must be periodically reviewed to determine 

whether they remain appropriate for the current portfolio and external conditions.145 
To comply with this requirement, as part of the review of estimates institutions should 
take all reasonable steps to demonstrate how the model performs on the application 
population in terms of predicting defaults or, if that is not possible (when there are 
not enough internal default data), at least in terms of predicting the target ratings. 

225. 

226. 

In accordance with Article 170(1)(b) of the CRR, institutions’ rating systems must 
have an obligor rating scale which reflects exclusively the quantification of the risk of 
obligor default. To this end, institutions should adjust the ratings used as targets for 
their shadow rating models if they do not solely embed default risk. They should also 
document such adjustments. 

In accordance with Article 174(1)(a) of the CRR, when an institution uses a statistical 
model and other mechanical methods to assign exposures to obligors or facilities, 
the input variables must form a reasonable and effective basis for the resulting 
predictions. To comply with this requirement, when the institution uses a shadow 
rating model external ratings should not be used as risk drivers in addition to target 
variables. 

227.  When assigning obligors and facilities to grades or pools institutions must take all 

relevant information into account.146  To comply with this requirement, when different 
information sources are used institutions should ensure that they understand the 

145   Article 169(2) of the CRR. 
146   Article 171(2) of the CRR. 

ECB guide to internal models – Credit risk 

113 

 
 
impact of any differences between these sources and establish adequate procedures 
to ensure that these differences are adequately addressed. 

228.  Furthermore, the data used to build the model must be representative of the 

population of the institution’s actual obligors or exposures.147  To comply with this 
requirement, institutions should analyse and provide evidence of the 
representativeness of the data used for model development consistently with 
paragraphs 20 to 27 of the EBA Guidelines on PD and LGD. 

16.2 

PD risk quantification 

16.2.1 

Relevant regulatory references 

Table 12 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

26/06/2013 

4 

(1)(78) 

144   

169   

170 

179   

180 

185 

(1)(a) 

(3) 

(1)(b) 

(1)(b) 

(1)(a), (f), (h), (2)(a), (e) 

(b) 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

45, 46 

Other references 

EBA Guidelines on PD and LGD 

20/11/2017 

70-99 

229. 

In accordance with Article 180(1) of the CRR, for exposures to corporates, 
institutions, central governments and central banks and for equity exposures, 
institutions must estimate PDs by obligor grade from the LRA of one-year default 
rates. In accordance with Article 180(2) of the CRR, for retail exposures, institutions 
must estimate PDs by obligor/facility grade or pool from LRAs of one-year default 
rates. To comply with these requirements, institutions should follow Sections 16.2.2 
to 16.2.5 below. 

16.2.2 

Calculation of the one-year default rate and observed average 
default rates 

230.  For the calculation of the one-year default rate and observed average default rates, 

institutions should follow paragraphs 73 to 81 of the EBA Guidelines on PD and 
LGD, also considering the following. 

147   Article 174(c) of the CRR. 

ECB guide to internal models – Credit risk 

114 

 
 
 
 
 
 
 
 
 
 
 
 
(a) 

(b) 

It is the ECB’s understanding that, for retail exposures and when the definition 
of default is applied at facility level, paragraphs 73 to 81 of the EBA Guidelines 
on PD and LGD can be applied at facility level. 

It is the ECB’s understanding that, whenever the definition of default is applied 
at obligor level, a joint obligor148  should be considered as a separate obligor 
and the default on a joint credit obligation should be counted separately from 
the default of individual obligors. Consequently, a specific rating/PD should be 
assigned to the joint obligor and should be counted separately for the default 
rate and risk-weighted asset (RWA) calculation. 

(c)  Exposures for which there is no commitment (considering on-balance sheet 
exposures, off-balance sheet items and unadvised limits) at reference date 
should be excluded from the calculation of the default rate. Conversely, if there 
is an EAD estimate, then these exposures should be included in the calculation 
of the default rate. 

(d)  To calculate the one-year default rate in accordance with paragraph 73 of the 

EBA Guidelines on PD and LGD, it is the ECB’s understanding that each obligor 
– or each facility in cases where point (a) above applies – existing and not 
defaulted at the beginning of the one-year observation period should be 
counted as one in the denominator and, if relevant, in the numerator of the one-
year default rate calculation, even where the obligor – or the facility in cases 
where point (a) above applies – cannot be observed for the entire one-year 
observation period. 

(e) 

It is the ECB’s understanding that obligors – or facilities in cases where point (a) 
above applies – that cease to exist (for example because the relevant credit 
contractual relationship was terminated) during the one-year observation period 
should be included in the calculation of the one-year default rate without any 
adjustment or deviation from the method as described in point (d) above. This is 
without prejudice to appropriate adjustments and/or MoC following any 
identification of deficiencies in data representativeness as described in 
paragraphs 28 to 33 of the EBA Guidelines on PD and LGD and in line with 
paragraph 34 and Section 4.4 of the EBA Guidelines on PD and LGD. 

(f)  Under paragraph 76 of the EBA Guidelines on PD and LGD, institutions should 
analyse whether (i) the migrations to a different rating grade, pool or rating 
model, rating system or approach to calculation of capital requirements within 
the observation period, or (ii) sales of credit obligations during the observation 
period bias the default rate. To this end, institutions should do both of the 
following. 

(i)  Ensure that obligors – or facilities in cases where point (a) above applies – 
are tracked after their migration to a different rating grade, pool, rating 
model, rating system or approach to calculation of capital requirements, 
and that any default identified during the one-year observation period, even 

148   In accordance with paragraph 104 of the EBA Guidelines on DoD, “joint obligor” means a specific set of 

individual obligors that have a joint obligation towards an institution. 

ECB guide to internal models – Credit risk 

115 

 
 
if after the migration, is duly counted for the one-year default rate 
calculation. In the ECB’s understanding, the lack of such tracking is a data 
deficiency in the risk quantification that institutions need to address in line 
with paragraphs 36 to 52 of the EBA Guidelines on PD and LGD. 

(ii)  Analyse whether sales of credit obligations that occurred during the one-

year observation period materially deviate from those that occurred for this 
portfolio during other observation periods of the dataset used for risk 
quantification. In the ECB’s understanding, the occurrence of such sales of 
credit obligations during the one-year observation period is a source of 
increased uncertainty in the risk quantification that institutions need to 
address in line with paragraphs 36 to 52 of the EBA Guidelines on PD and 
LGD. 

231.  For clarity, the above-mentioned requirements for the calculation of one-year default 

rates also apply in case of external data for PD quantification being used at a more 
aggregated level than obligor or facility level. Where aggregated external data of a 
rating agency or similar organisation are used, institutions must ensure that the 
default rate calculation is aligned to the applicable regulations. 

232.  For the purpose of choosing an appropriate approach under paragraph 80 of the 

EBA Guidelines on PD and LGD, it is the ECB’s understanding that overlapping one-
year time windows should preferably be used when the analysis performed by the 
institution under paragraphs 80(a), 80(b) and/or 80(d) of the EBA Guidelines on PD 
and LGD reveals the observed average default rate using overlapping one-year time 
windows is significantly different from the observed average default rate using non-
overlapping one-year time windows and either of the following: 

(a) 

the proportion of short-term and terminated contracts and/or the respective 
distribution of default rates is not stable over time; 

(b) 

there is a significant variation between the observed average default rates 
calculated using non-overlapping one-year time windows on different reference 
calculation dates within a year. 

233. 

Institutions should quantify PDs taking their own internal data into consideration. In 
cases where institutions use external or pooled data series to complement their 
internal data for the purpose of PD quantification, the more internal default 
experience an institution has, the less importance it needs to give to external data. In 
addition, institutions should ensure that these external or pooled data series are 
representative in accordance with Section 15.2 of this chapter.149  To comply with the 
requirement for the data to be representative and as part of their representativeness 
analysis, institutions should ensure that the observed average default rates from 
external data or from the external part of the pooled data are calculated separately 
from, and compared with, those based on internal data.150  This comparison should 

149   See Article 179(1)(d) of the CRR. 
150   If the internal data constitute just a small fraction of the pooled data and are not considered material in 
relation to the pooled data, for the purposes of this analysis the institution may perform a separate 
calculation of the average observed default rates with pooled data and a comparison with those 
calculated based on internal data only. 

ECB guide to internal models – Credit risk 

116 

 
 
be made at the levels at which the observed average default rate is to be 
calculated.151  In accordance with paragraph 79 of the EBA Guidelines on PD and 
LGD, the comparison should be made for each rating grade or pool and for the type 
of exposures covered by the relevant PD model, as well as for any relevant 
calibration segment. The direction and magnitude of the differences between these 
averages should be properly analysed and documented when calibrating the model, 
taking into account the distributions152  of obligors across grades and calibration 
segments, where relevant, and including the need and adequacy of the category A 
MoC considered with regard to paragraph 37(a)(viii) of the EBA Guidelines on PD 
and LGD, and duly followed up in the review of estimates. Where the results of this 
comparison show material differences between the internal and external observed 
average default rates at any of the three levels mentioned which cannot be explained 
by differences in the distribution across grades and calibration segments, the ECB 
considers this is an indication that the representativeness of the external data is not 
proven. 

234.  To assess whether the parameter estimates are biased as per paragraph 187 of this 

chapter, institutions should compare the LRA default rate using only internal data 
with the average PD estimates (before adding a MoC) resulting from their application 
to the internal exposures over the set of all reference dates within the period 
representative of the likely range of variability. In the ECB’s view, the estimates are 
biased if either of the following conditions are met: (a) at calibration segment level, 
there are material differences between the average of the two previous elements of 
comparison; or (b) at grade level, there are systematic differences (i.e. the direction 
of the differences is not random). It is the ECB’s understanding that the identification 
of material differences in (a) and systematic differences in (b) should not rely only on 
considerations of statistical significance. In the ECB’s view, the lack of statistical 
evidence that a PD estimate and the corresponding LRA default rate based on 
internal data (at calibration segment in (a) and grade level in (b)) are different is not 
sufficient to conclude that no material difference exists. For clarity, the ECB 
considers this quantitative analysis to be independent of and complementary to the 
calibration tests required by paragraph 87 of the EBA Guidelines on PD and LGD. 
These calibration tests should be performed on the data used for the calibration 
(including external/pooled data used in the calculation of the default rates and in the 
calculation of the average PD on the calibration sample). 

16.2.3 

Calibration to the LRA default rate 

235.  To calculate the LRA default rate, institutions should follow paragraphs 82 to 86 of 

the EBA Guidelines on PD and LGD. If the historical observation period referred to in 
paragraph 82 of the EBA Guidelines on PD and LGD is considered to be 
representative of the likely range of variability of default rates, the LRA default rate 
should be computed as the observed average default rate in that period, in 
accordance with paragraph 84 of the EBA Guidelines on PD and LGD. Otherwise, if 

151   Considering the maximum common period possible between the internal and external or pooled data. 
152   For instance, institutions might consider the average of the external default rate weighted by the 

internal distribution of exposures across grades for the relevant reference dates. 

ECB guide to internal models – Credit risk 

117 

 
 
the historical observation period is not representative of the likely range of variability 
of default rates and an institution makes adjustments to the observed average 
default rates in order to obtain LRA default rates under paragraph 85 of the EBA 
Guidelines on PD and LGD, these adjustments should be based on (external) default 
rates, or – if no appropriate default rates are available – on other observed indicators 
relevant for the type of exposures considered. 

236.  For the purpose of assessing the representativeness of the historical observation 

period for the likely range of variability of one-year default rates under paragraphs 82 
and 83 of the EBA Guidelines on PD and LGD, the following should be taken into 
account. 

(a)  The historical observation period should contain at least the five most recent 
years available at the time of model calibration and previous available years 
should be added if considered relevant for the historical observation period to 
reflect the likely range of variability of default rates. The ECB is of the view that 
the relevance of the available years should be assessed in accordance with 
points (b) to (d) below and any such available years considered relevant, in 
addition to the most recent five years, should be incorporated as a continuous 
time span. [This means that the additional years should be included as a 
continuous time series without any breaks in the observation period.] 

(b)  When analysing whether the historical observation period contains a 

representative mix of good and bad years that fulfil the requirement under 
Article 180 of the CRR, institutions should pay particular attention to assessing 
the variability of default rates. For this purpose, and according to paragraph 
83(a) and (b) of the EBA Guidelines on PD and LGD, institutions should select 
economic indicators that are relevant for the specific type of exposures153  and 
analyse the correlation between the observed internal default rates series and 
the selected economic indicators – in the longest possible common time period 
–, verifying also the potential presence of time lag effects. Institutions should 
ensure that the economic indicators selected are relevant for the type of 
exposures at least in terms of geographical composition, sectoral distribution, 
and other risk drivers relevant to the portfolio. If an institution does not have a 
long enough internal DR series covering different economic conditions so as to 
ensure a statistically meaningful analysis of the correlation, the historical 
observation period cannot be considered representative of the likely range of 
variability of default rates and point (d) below, together with the adjustments 
referred to in paragraph 85 of the EBA Guidelines on PD and LGD, should be 
applied. 

(c) 

If an institution can show that there is no significant correlation – i.e. a 
correlation that is statistically meaningful of a material magnitude – between the 
available internal default rates and any economic indicators, the analysis of the 
variability of all observed one-year default rates should play a crucial role in the 
assessment. For this purpose, the ECB is of the view that the historical 

153   The relevant economic indicators are those set out in Article 2(1) of Commission Delegated Regulation 

(EU) No 2021/930. 

ECB guide to internal models – Credit risk 

118 

 
 
observation period should typically include at least the maximum and minimum 
observed one-year default rates (among the available data) to be representative 
of the likely range of variability of default rates. 

(d)  Whenever a significant correlation between the economic indicator(s) and the 

internal default rates series is observed, institutions should: 

(i)  Define a criterion for classifying a year as bad or good in terms of the 
relevant economic indicator(s)154  and document it. Institutions should 
invariably ensure that bad years are characterised by actual adverse 
values in the economic indicator(s). 

(ii)  Compute a proportion of bad years to be used as a reference. It is the 

ECB’s understanding that the time window of the series of economic 
indicator(s) for which that proportion of bad years is computed should be 
sufficiently long, corresponding to the last 20 years available at the time of 
calibration155, and not be limited to the period for which internal default 
rates are available. Moreover, the time window should always contain 
sufficiently severe values of the economic indicator(s). If this is not the 
case, the 20-year window should be extended, as long as this does not 
reduce the proportion of bad years observed. 

(iii)  Assess the existence, lack or prevalence of one-year DRs related to bad 
years in the period for which internal DRs are available based on the 
criterion defined under point (i) above, ensuring that the proportion of bad 
years in the chosen historical observation period is not smaller than the 
proportion defined in point (ii). 

(iv)  Since there is a risk that the historical observation period determined in 

accordance with the previous points might not cover the full observed 
variability of one-year DRs, the ECB expects institutions to perform 
analyses on the evolution of internal observed DRs during the available 
period and verify whether or not the maximum observed DR is included. In 
the specific case when institutions do not include such maximum observed 
one-year DRs, the reasons for this should be duly documented and 
justified. 

(e)  Where the scarcity of internal exposures and/or defaults might unduly influence 
the variability of internally observed default rates (i.e. where the variability 
driven by statistical uncertainty is so high that it hampers any analysis of them), 
institutions should assess whether external or pooled default rate series can be 
used to identify the relevant historical observation period for the likely range of 
variability of one-year default rates. The external or pooled default series used 

154   Where several economic indicators are relevant for the type of exposures, institutions should establish 

a methodology such that each year is uniquely classified as either bad or good. 

155   In line with Commission Delegated Regulation (EU) No 2021/930, Recital (13), where it is clarified that: 
“A default time-span of 20 years should be set for each economic indicator. This is to ensure that the 
historical observation period covers at least two economic cycles”. 

ECB guide to internal models – Credit risk 

119 

 
 
should be relevant for the specific portfolio at least in terms of geographical 
composition, sectoral distribution and other relevant risk drivers. 

237. 

Institutions should compare, at the level of the calibration segment, the LRA DR 
obtained (before including a MoC) with a reference LRA DR. For this purpose, 
institutions are expected to: 

(a)  Compute the reference LRA DR while looking at a fixed period. Currently, it is 
considered best practice to use as reference period the dates starting in 
January 2008 and ending in December 2018 (with the observation period 
running until December 2019).156  If the institution does not have available 
internal observed DRs for the full period, it is expected to use 
inferred/extrapolated one-year DRs based on other internal default rates (e.g. 
based on a longer series using the accounting definition of default and applying 
the necessary adjustments to it) and/or external default rates (e.g. a longer 
series of default rates at sector level and applying the necessary adjustments to 
it) to complement the period. 

(b)  When the LRA DR obtained is below the reference LRA DR, the institution 

should provide an appropriate justification as to why the period identified as 
reflecting the likely range of variability of default rates is more adequate than 
the reference period, or otherwise revise their LRA DR accordingly. If the 
institution applies an appropriate adjustment in accordance with paragraph 38 
of the EBA Guidelines on PD and LGD to obtain the LRA DR, the LRA DR after 
that adjustment (but before applying the corresponding MoC) should be used 
for the comparison with the reference LRA DR, including appropriate 
adjustments if the identified deficiencies are also relevant for the reference 
period. 

238.  The reference LRA DR defined in paragraph 237 of this chapter should be used to 
perform a comparison with the institution’s LRA DR in order to guide both the 
supervisor’s and the institution’s assessment of the appropriateness of the historical 
observation period considered by the institution as representative of the likely range 
of variability of one-year default rates and the LRA DR quantification, while not 
constituting a quantification floor. This reference approach complements paragraphs 
235 and 236 of this chapter and the principles set out in the latter need to be fulfilled 
independently of the results on the reference LRA DR, as well as the principles laid 
down in paragraphs 82 to 86 of the EBA Guidelines on PD and LGD. Where 
paragraph 86 of the EBA Guidelines on PD and LGD applies, the reference LRA DR 
should be considered a supplementary value to be compared with the institution’s 
adjusted LRA DR. 

239.  With respect to calibration to the LRA default rate, institutions should follow 

paragraphs 87 to 99 of the EBA Guidelines on PD and LGD. 

156   For exposures in non-EU countries the adequacy of this reference period should be carefully assessed 

on a case-by-case basis. 

ECB guide to internal models – Credit risk 

120 

 
 
240.  For the purposes of complying with the provisions of paragraph 92 of the EBA 
Guidelines on PD and LGD, it is the ECB’s understanding that all the following 
principles apply. 

(a) 

Institutions should document the rationale of their adopted approach and 
provide evidence that, irrespective of whether the calibration considers (i) the 
LRA default rate at grade or pool level according to paragraph 92(a) of the EBA 
Guidelines on PD and LGD or (ii) the LRA default rate at calibration segment 
level according to paragraph 92(b) of the EBA Guidelines on PD and LGD, the 
PD estimates are adequate both at grade or pool level and at calibration 
segment level. In any case, all the requirements on risk differentiation referred 
to in the applicable regulation apply. The ECB’s understanding of these 
requirements is set out in Section 16.1.2 of this chapter. In particular, it follows 
from the applicable rules that under no circumstances should an approach be 
adopted to overcome data scarcity at grade or pool level, lack of evidence of 
discriminatory capacity, homogeneity or heterogeneity across grades. 

(b)  Regardless of the level at which institutions consider the LRA default rate in 
accordance with paragraph 92 of the EBA Guidelines on PD and LGD, in the 
ECB’s view the LRA default rate needs to be calculated at grade or pool level 
and at calibration segment level since these LRA default rates are required 
either directly for calibration purposes or indirectly in order to provide 
meaningful additional calibration tests. 

(c)  For the purposes of obtaining the LRA default rate at grade or pool level and at 

calibration segment level, the availability of long series of observed one-year 
default rates covering the full period representative of the likely range of 
variability of default rates is of utmost importance. The ECB expects institutions 
to take all reasonable efforts to obtain such long series with sufficient data 
quality in line with the provisions of paragraph 70 of the EBA Guidelines on PD 
and LGD. 

In the specific case of changes in the method for assigning exposures to grades 
or pools, and in accordance with paragraph 98(a) of the EBA Guidelines on PD 
and LGD, institutions should make all reasonable efforts to recalculate the new 
assignment back through time covering the full period representative of the 
likely range of variability of default rates, as such grade or pool level information 
is necessary to obtain long series of one-year default rates at grade or pool 
level. Institutions should duly justify and document situations where backwards 
recalculation is not possible. Additionally, in the exceptional cases where such 
recalculation is not possible, institutions should assess whether the use of the 
historical rating assignments based on previous versions of the assignment 
methodology would be adequate. 

(d)  Without prejudice to the application of adequate methodologies to correct 

identified deficiencies in order to overcome biases in risk parameter estimates 
as required in paragraph 38 of the EBA Guidelines on PD and LGD, in cases 
where long series of one-year default rates are available at grade or pool level 
and calibration segment level covering the period representative of the likely 

ECB guide to internal models – Credit risk 

121 

 
range of variability of default rates, in accordance with paragraph 84 of the EBA 
Guidelines on PD and LGD the LRA default rate should be computed as the 
observed average of one-year default rates at grade or pool level and 
calibration segment level in that period. 

(e)  Where an institution is unable to obtain long series of one-year default rates as 
described in point (c) above, the underlying reasons should be duly justified and 
documented. In any case, in accordance with point (b) above, the ECB expects 
institutions to estimate the LRA default rate at grade or pool level, and 
calibration segment level by adjusting the observed average of one-year default 
rates, where necessary, in accordance with paragraph 85 of the EBA Guidelines 
on PD and LGD. The adjustment should at least be reflective157  of the number 
of good and bad years in the available data with respect to the number of good 
and bad years applicable to the period representative of the likely range of 
variability. This means that where the number of bad years is under-
represented in the available data, upward adjustments should be made to the 
observed average of one-year default rates, unless the institution is able to 
provide empirical evidence that the level of observed one-year default rates is 
unrelated to the years being good or bad. The adjustment must be reflective of 
the variability of the default rates, meaning that the larger the variability in the 
default rates, the larger the necessary adjustments might be. As a 
consequence, in the case of the LRA default rate at grade level, the necessary 
adjustment depends on the grade assignment dynamics among other things. 

Moreover, institutions should duly analyse and document the need for a MoC in 
accordance with Article 46(3)(b) of Commission Delegated Regulation (EU) No 
2022/439 and in accordance with paragraph 42 of the EBA Guidelines on PD 
and LGD, which requires the MoC to reflect in particular the uncertainty related 
to the deficiencies referred to in paragraph 37(a)(iii) and 37(a)(x) of the EBA 
Guidelines on PD and LGD. In the ECB’s understanding, and in line with 
paragraph 43(a)(ii) of the EBA Guidelines on PD and LGD, the larger the 
adjustments to the observed average of one-year default rates and the larger 
the unavailable time period in proportion to the period representative of the 
likely range of variability of default rates, the larger the uncertainty of the 
adjustments and hence the greater the need for and magnitude of such a MoC. 

241.  Where, for calibration purposes, the LRA default rate is considered at the level of 

grade or pool in accordance with paragraph 92(a) of the EBA Guidelines on PD and 
LGD, it is the ECB’s understanding that the PD (before MoC) of each grade or pool 
should be equal to the LRA default rate of each grade or pool. This is without 
prejudice to the provisions of the next paragraph. 

242.  Where an institution adopts the approach referred to in paragraph 92(a) of the EBA 

Guidelines on PD and LGD, it should provide additional tests at the level of the 
relevant calibration segment. To this end, as part of the estimation and ongoing 
monitoring of its models, an institution should, at least, compare the LRA PD at 

157   This is also without prejudice to the application of adequate methodologies to correct identified 

deficiencies in order to overcome biases in risk parameter estimates as required in paragraph 38 of the 
EBA Guidelines on PD and LGD. 

ECB guide to internal models – Credit risk 

122 

 
 
calibration segment level with the LRA default rate at calibration segment. In 
performing this comparison, the institution should calculate the LRA PD at calibration 
segment level as the arithmetic average across time158  of the (arithmetic) average 
PD at calibration segment level for each reference date. Deviations should be 
analysed and documented, and should trigger adequate remedial action where 
necessary. Where an institution does not explicitly define calibration segments as 
subsets of the range of application of the PD model, a single calibration segment 
covering the whole range of application of the PD model must be considered for the 
above-mentioned test. 

243.  Where, for calibration purposes, the LRA default rate is considered at calibration 

segment level in accordance with paragraph 92(b) of the EBA Guidelines on PD and 
LGD, it is the ECB’s understanding that institutions should be aware of situations 
where divergences between the LRA default rate at a grade level and the grade level 
PD value could arise. These situations include the following. 

(a)  The use of a calibration sample for the purposes of obtaining the adjustment to 
be made to the scores/raw PDs at grade level in order to meet the LRA default 
rate at calibration segment level which is not fully representative of the likely 
range of variability of default rates may result in PD estimates at grade level 
which are lower than the LRA default rate at grade level. This could happen, for 
example, when the grade assignment is to some extent sensitive to the 
economic conditions159, and bad years are over-represented in the calibration 
sample, in which case a biased adjustment may be obtained as a result of the 
distribution across grades of the calibration sample being overpopulated in 
riskier grades compared with the sample corresponding to the period of the LRA 
default rate. 

(b)  The use of a calibration sample160  for the purposes of obtaining the scores/raw 

PDs at grade level or the use of a calibration methodology where the 
discriminatory power implied by the PDs at grade level is not consistent with the 
discriminatory power implied by the observed average of the one-year default 
rates at grade level from the sample corresponding to the period of the LRA 
default rate161  may result in PD estimates at grade level which do not reflect the 
LRA default rate at grade level. 

158   Considering the same time frame and calculation dates as the LRA default rate, including any most 

recent calculation dates available when the tests are performed as part of the ongoing monitoring of the 
models. 

159   This is without prejudice to the provisions set out in Section 16.1.3 of this chapter. 
160   The ECB understands that any sample used for calibration purposes should fulfil the requirements set 
out for the calibration sample. As such, the term “calibration sample” will be used here not only to refer 
to the sample on which “the resulting PD estimates correspond to the long-run average default rate at 
the level relevant for the applied method” (definition of PD calibration in paragraph 8 of the EBA 
Guidelines on PD and LGD) but also to any other sample used for calibration purposes. 

161   In other words, the slope of the obtained PD curve is not consistent with the slope of the curve of the 

LRA default rate at grade level. For example, one way in which the implied discriminatory power/slope 
can be numerically compared is by computing (a) the AUC (area under the ROC curve) that would be 
obtained on the basis of the number of exposures per grade in a given sample and the number of 
defaults per grade equal to the PD estimates times the number of exposures in the grade, and (b) the 
AUC that would be obtained on the basis of the number of exposures per grade in the same sample 
and the number of defaults per grade equal to the LRA default rate per grade times the number of 
exposures in the grade. 

ECB guide to internal models – Credit risk 

123 

 
 
244.  The ECB expects that institutions will duly justify the choice of the calibration sample 
and methodology and in particular assess its adequacy in terms of situations (a) and 
(b) mentioned in the previous paragraph. 

245.  Where an institution adopts the approach referred to in paragraph 92(b) of the EBA 
Guidelines on PD and LGD, it should perform additional tests as part of the 
development and ongoing monitoring of its models to ensure that the final (post-
calibration) PDs reflect the LRA default rate of each grade. Specifically, institutions 
should ensure that there are no systematic deviations when comparing the estimated 
PDs with the LRA default rate of the grades, i.e. the direction of divergences across 
grades should be random regardless of the materiality or statistical significance of 
the deviations. For example, deviations (statistically material or not) occurring in a 
given direction for a number of consecutive grades are understood by the ECB to be 
systematic deviations. 

In any case, even if the deviations are not systematic, the ECB expects institutions to 
demonstrate that such grade-level deviations do not distort the RWEA calculations. 
For that purpose, institutions should analyse any material difference between the 
RWEAs resulting from the current calibration and the RWEAs resulting from the 
application of alternative PDs calculated on the basis of the LRA default rate at grade 
level for the application portfolio, and reach a conclusion on the appropriateness of 
the adopted methodology on the basis of such a comparison. 

246.  Under paragraph 87 of the EBA Guidelines on PD and LGD, institutions should have 

sound and well-defined processes in place to ensure sound calibration including 
quantitative calibration tests and supplementary qualitative analyses. It is the ECB’s 
understanding that, as part of these tests, institutions should compare the average 
PD (before MoC) at calibration segment level with the one-year default rate and with 
the LRA default rate at calibration segment level for each of the calculation dates 
adopted for LRA default rate calculation.162  Institutions should reach a conclusion on 
the appropriateness of the final (post-calibration) PD level at calibration segment on 
the basis of such comparisons and by taking into consideration the grade 
assignment dynamics of the PD model. 

247.  Under paragraph 89 of the EBA Guidelines on PD and LGD, institutions should 

ensure that for the purpose of calibrating PD estimates to the LRA default rate, any 
overrides applied in the assignment of obligors to grades or pools are taken into 
account. However, where the appropriate consideration of overrides in the calibration 
process is not possible, institutions should apply an appropriate adjustment (AA) to 
the extent possible and a corresponding MoC to account for the uncertainty 
associated with the lack of consideration of overrides within the model calibration. In 
order to evaluate the need for an AA and a MoC and to quantify them, institutions 
may, for example, use the outcome of a re-rating of a representative sample 
(including the application of the new overrides policy if applicable) at a recent date. 
In addition, the appropriateness of this MoC should be reviewed during the review of 
estimates, also taking into consideration the impact of the overrides on the ratings of 

162   Following the expectations of paragraph 240(c) of this chapter, if institutions duly justify and document 
situations where backwards recalculation of assignments in some historical reference dates is not 
possible, this comparison might be conducted in a shorter period. 

ECB guide to internal models – Credit risk 

124 

 
 
the whole portfolio after implementation of the new model in the production 
environment. 

16.2.4 

PD quantification based on mapping to external grades 

248.  The ECB interprets the possibility for institutions to attribute the default rate observed 

for the grades of a rating agency or similar organisation to its own grades in 
accordance with Article 180(1)(f) of the CRR as being equivalent to the use of 
external data for PD quantification at a more aggregated level (external grade) rather 
than at the obligor/facility level. Accordingly, Sections 15.2 and 16.2.2 of this chapter 
are relevant for institutions that do so. 

249. 

In accordance with Article 180(1)(f) of the CRR, mappings must be based on a 
comparison of internal rating criteria with the criteria used by the external 
organisation and on a comparison of the internal and external ratings of any common 
obligors. Biases or inconsistencies in the mapping approach or underlying data must 
be avoided. To comply with these requirements, institutions should follow the 
paragraphs listed below. 

(a) 

Institutions should ensure that the quality of the mapping between internal and 
external rating scales at a given date and over time is consistent and provides 
for an adequate level of predictive ability. 

(b)  When mapping internal grades to external grades, institutions should document 

and analyse any differences between the external and internal rating criteria. 

(c)  The use of common obligors as a basis for the mapping should take into 

account their representativeness for the application portfolio. 

(d) 

Institutions should adjust the external rating scale if such rating scale does not 
solely embed default risk.163  They should also document such adjustments. 

(e)  When mapping internal grades to external grades and using the default rates of 
the external grades provided by the organisation, if the latter has a material 
number of entities for which it no longer provides a rating (withdrawn rating), the 
institution should take this into account. It should adjust the external default 
rates accordingly, if necessary, and take into consideration the provisions of 
paragraph 75 of the EBA Guidelines on PD and LGD. In the event that an 
adjustment is performed, the institution should add the necessary MoC. 

16.2.5 

Specific requirements for direct PD estimates 

250. 

In order to use direct PD estimates for the calculation of own funds requirements in 
accordance with Article 169(3) of the CRR, institutions should follow paragraphs 96 
and 98(b) of the EBA Guidelines on PD and LGD. To assess whether the theoretical 

163   In accordance with Article 170(1)(b) of the CRR, institutions’ rating systems must have an obligor rating 

scale which reflects exclusively the quantification of the risk of obligor default. 

ECB guide to internal models – Credit risk 

125 

 
 
assumptions of the probability model underlying the estimation methodology are 
satisfied to a sufficient extent in practice under paragraph 96 of the EBA Guidelines 
on PD and LGD, institutions should do the following. 

(a)  Ensure good risk differentiation properties across the full PD range of the rating 

system. 

(b)  Have an adequate and documented concept in place specifying the calibration 
function currently implemented (concrete functional form), including the 
underlying theoretical assumptions and the established processes to conduct 
the PD calibration. It is the ECB’s understanding that institutions should ensure 
consistency between the score-inferred PDs and the observed default rates and 
should understand and justify the transformation of the scores into PD values. 

(c)  Ensure that any transformation of the scores resulting from the probability 

model that is applied during the calibration does not change the ranking of the 
obligors/facilities (in other words, co-monotonicity between scores/raw PDs and 
PD values should be ensured). Moreover, institutions should avoid any undue 
influence of extreme values of score-inferred PDs on the shape of the 
calibration function. Additionally, and when institutions use different calibration 
functions for different sub-ranges, they should ensure that this mix is 
appropriate (both in terms of the functional forms used and the cut-offs 
selected) and that it is appropriately justified. 

(d)  Ensure that there is a relevant number of observations across the whole range 
of score-inferred PDs. Particular interest should be paid to situations where the 
probability model is extended to ranges of PD values where there are not 
enough defaulted observations. 

(e)  Ensure that there are no excessive concentrations of exposures or obligors 
within the PD range of the rating system. In addition, high concentrations of 
observations in a specific range of score-inferred PDs should be properly 
analysed and justified in terms of homogeneity. 

(f)  For the purpose of performing the additional tests at grade level referred to in 
paragraph 92(b) of the EBA Guidelines on PD and LGD, grades should be 
understood as sub-ranges of PD values. These sub-ranges should be defined 
in a way that: 

(i) 

represents sufficiently narrow ranges of PD values; 

(ii)  contains a sufficient number of observations to ensure a meaningful 

calculation of the LRA default rate of the sub-range. 

251. 

In cases where institutions map the PDs to a masterscale (defined in terms of PD 
bounds) as a final step in the PD estimation process (using masterscale discrete 
PDs for the purpose of RWEA calculation), there is a risk that the mapping process 
could distort RWEAs. To mitigate this risk, institutions should verify that deviations 
between the masterscale PDs and the average of the direct PDs assigned to 
obligors in each grade do not show a systematic or material bias towards 

ECB guide to internal models – Credit risk 

126 

 
underestimation of PD per grade over time. This analysis should be provided for both 
the portfolio and for each grade. 

17 

Loss given default 

17.1 

Realised LGD 

17.1.1 

Relevant regulatory references 

Table 13 

Legal background 

CRR 

Date of 
issue 

26/06/2013 

Commision Delegated Regulation (EU) No 
2022/439 

20/10/2021 

Article 

Paragraph/Point 

4 

5 

144 

161 

164 

166 

174 

175 

176 

179 

181 

182 

183 

185 

191 

3 

11 

17 

30 

31 

37 

42 

47 

48 

49 

(1)(55) 

(2) 

(1)(e) 

(2), (3) 

(2) 

(1) 

(c) 

(1), (4)(a) 

(4), (5) 

(1)(a), (c), (d) and second sub-paragraph 

(1)(a), (h), (i), (j), (2)(b) and second sub-
paragraph 

(3) 

(2) 

(a) 

(1), (2)(c) 

(2)(a) 

(1)(a) 

(1)(a) 

(2)(a), (b) 

(1)(a), (c), (d), (2)(a), (b) 

(b), (c), (d), (g), (h) 

(b), (c) 

Other references 

EBA Guidelines on PD and LGD 

EBA Guidelines on DoD 

20/11/2017 

18/01/2017 

37(a)(viiii), 100-103, 131-146 

44, 51, 71, 72, 77 

ECB guide to internal models – Credit risk 

127 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
17.1.2 

Reference dataset 

252.  Under paragraph 102 of the EBA Guidelines on PD and LGD, institutions should 

estimate LGDs on the basis of their own loss or recovery experience.164  Institutions 
may supplement their own historical data on defaulted exposures with external data. 
The more own loss experience (i.e. the more internal defaults) an institution has, the 
less importance it needs to give to external data. Institutions should ensure that their 
own historical experience contains a minimum number of defaults in order to 
determine whether external data are sufficiently representative. 

253.  To ensure that LGD estimations are accurate and are not underestimated as a result 
of different external and internal recovery processes, institutions should place 
greater importance on comparisons of internal recovery processes with the recovery 
processes underlying the external data, in cases where a high weight is assigned to 
external data. Where limited representativeness of external data is found, a category 
A MoC should be considered, in order to reflect the uncertainty of the estimation 
under paragraph 37(a)(viii) of the EBA Guidelines on PD and LGD. Its magnitude 
should also be quantified in relation to the weight assigned to the external data. 

254.  When institutions use information derived from the market price of defaulted financial 

instruments to supplement their internal loss or recovery experience data, there is a 
risk of misspecification of their LGD estimates. To mitigate this risk, institutions 
should ensure the following: 

(a) 

institutions should verify whether the development sample is representative of 
the application portfolio at least in terms of regions and product type, even 
when those variables have not been identified as relevant risk drivers; 

(b) 

losses derived from market prices should be increased to reflect indirect costs, 
as specified in paragraph 146 of the EBA Guidelines on PD and LGD. 

17.1.3 

Calculation of realised LGD 

255.  Article 4(1)(55) of the CRR defines LGD as the “ratio of the loss on an exposure 

related to a single facility due to the default of an obligor or, where applicable, of a 
credit facility to the amount outstanding at default or at a given reference date after 
the date of default […]”. For the purposes of Article 181(1)(a) of the CRR, institutions 
are required to calculate realised LGD. To comply with this requirement, it is the 
ECB’s understanding that institutions should calculate realised LGD under 
paragraphs 100 to 103 and 131 to 146 of the EBA Guidelines on PD and LGD for the 
time period for which data are available regardless of the approach considered for 
the LGD estimation, e.g. including approaches where the LGD is the result of a 
combination of different components. In addition, when performing this calculation 
institutions should follow the observations in the succeeding paragraphs. 

164   In accordance with paragraph 109 of the EBA Guidelines on PD and LGD, the RDS should contain all 
relevant information in relation to losses and recovery processes. This should also include climate-
related and environmental information where relevant and material. 

ECB guide to internal models – Credit risk 

128 

 
 
256. 

In accordance with Article 181(1)(h) of the CRR, institutions must have estimates of 
LGD in-default and ELBE on defaulted exposures. To comply with this requirement, it 
is the ECB’s understanding that all principles regarding the calculation of realised 
LGD should be applied for the estimation of LGD on non-defaulted exposures and 
for the estimation of LGD in-default and ELBE on defaulted exposures, unless 
mentioned otherwise (that is, if the reference date is considered instead of the date 
of default). 

257.  Where, in the case of retail exposures and purchased corporate receivables, 

institutions derive LGD estimates from realised losses and appropriate estimates of 
PDs in accordance with Articles 161(2) and 181(2)(a) of the CRR and under 
paragraph 103 of the EBA Guidelines on PD and LGD, all the principles regarding 
realised LGD should apply to realised losses. 

258. 

259. 

Institutions must document the specific definitions of default and loss used internally 
and ensure that they are consistent with the definitions set out in the CRR.165  To 
comply with these requirements, institutions should have in place sufficiently detailed 
policies and procedures to ensure that the realised LGD is calculated consistently 
and accurately, including the implementation of the definition of economic loss. 
These policies and procedures should include sufficiently detailed documentation to 
allow third parties to replicate the calculation of realised LGD. To ensure that the 
policies and procedures are implemented in an appropriate and adequate manner, 
the calculation process should be regularly reviewed by an independent unit. 

In accordance with Article 181(1)(a) of the CRR and under paragraph 100 of the EBA 
Guidelines on PD and LGD, institutions should calculate the realised LGD at single 
facility level for each default, where the definition of facility is provided in Article 5(6) 
of the CRR. In line with paragraph 112 of the EBA Guidelines on PD and LGD, where 
aggregated information is collected and stored, the realised LGD at single facility 
level may be calculated using this more aggregate information, in which case 
institutions should define a proper methodology for the allocation of recoveries and 
costs to each single facility. The ECB expects institutions to duly justify and 
document the underlying reasons for the collection and storage at a more 
aggregated level than single facility level. 

260. 

In exceptional cases, the ECB considers institutions to be compliant with the 
requirement to calculate realised LGD at single facility level if they can prove that the 
recovery is not performed at single facility level but at a more aggregated level (for 
example, several facilities of the same or different types secured by the same 
collateral). The realised LGD can therefore be calculated at a more aggregated level 
than single facility level. For this exceptional deviation from the calculation of realised 
LGD at single facility level to be acceptable, institutions should: 

(a)  Provide evidence that recovery at aggregated level is legally enforceable. 

(b)  On a regular basis (as often as review of estimates is performed or more often), 

provide evidence that recovery at a more aggregated level than single facility 

165   Article 175(3) of the CRR. 

ECB guide to internal models – Credit risk 

129 

 
 
level is in practice enforced. This evidence should be based on the institution’s 
historical practice and data and demonstrate that both the recovery process and 
its outcomes in terms of realised loss or recovery are the same for all the 
facilities considered at the aggregated level. Specifically, institutions should be 
able to prove that all collateral within an aggregation is called irrespective of the 
product triggering default (thus, for a current account as for a home loan) and 
that realised loss or observed recovery is the same for all types of facility within 
the aggregation. 

(c)  For retail exposures where institutions use the definition of default at facility 

level set out in the last sentence of Article 178(1) of the CRR, ensure that the 
default is triggered for all aggregated facilities. 

(d) 

In addition, institutions following this approach should: 

(e)  Ensure that the parameters are applied in a manner that is consistent with how 

they have been estimated, i.e. across aggregated facilities; 

(f)  Ensure that the counting unit used for the purposes of risk quantification is at 

this aggregated level; 

(g)  Ensure that no bias results from the aggregation of facilities, by validating the 

estimates (PD, LGD, CCF) at the more aggregated level also. 

261.  As mentioned in paragraph 255 of this chapter, for the purposes of Article 181(1)(a) 

of the CRR institutions are required to calculate realised LGD, which is defined by 
Article 4(1)(55) of the CRR as the “ratio of the loss on an exposure related to a single 
facility due to the default of an obligor or, where applicable, of a credit facility to the 
amount outstanding at default or at a given reference date after the date of default 
[…]”. Furthermore, Article 5(2) of the CRR defines loss as an economic loss, 
including material discount effects, and material direct and indirect costs associated 
with collecting on the instrument. In accordance with these provisions, it is the ECB’s 
understanding that institutions should calculate realised LGD as a ratio of the 
economic loss to the outstanding amount of the credit obligation at the moment of 
default, including any amount of principal, interest or fee (hereinafter outstanding 
amount at default). To calculate realised LGD, institutions should follow 
paragraphs 131 to 146 of the EBA Guidelines on PD and LGD. In addition, they 
should pay particular attention to the following points. 

(a)  Outstanding amount at default includes any part of the exposure that has been 
forgiven or written off before or at the date of default (paragraph 134 of the EBA 
Guidelines on PD and LGD). Institutions should ensure consistency with the 
accounting value gross of credit risk adjustment (i.e. “provisions”) (Article 166(1) 
of the CRR) by explaining any differences. This amount also includes interest 
and fees capitalised in the institution’s income statement before the moment of 
default. However, interest and fees capitalised after the moment of default are 
not considered (paragraphs 137 to 138 of the EBA Guidelines on PD and LGD). 
Where institutions include additional drawings after the moment of default to 
estimate CCFs, these additional drawings discounted to the moment of default 

ECB guide to internal models – Credit risk 

130 

 
are added to the outstanding amount at default in the denominator 
(paragraphs 139 to 142 of the EBA Guidelines on PD and LGD). In other words, 
institutions should ensure that the exposure used for CCF estimation, where 
additional drawings after default are discounted with the same discount factor 
as applied for LGD, is consistent with the denominator of the LGD. 

(b)  Economic loss is calculated under paragraph 132 of the EBA Guidelines on PD 
and LGD. This also applies in the specific case of facilities that return to non-
defaulted status, where losses arising from payment delays are expected to be 
accounted for as well as the “artificial cash flow” envisaged by paragraph 135 of 
the EBA Guidelines on PD and LGD. 

(c)  When recoveries are not directly observed but calculated on the basis of the 

difference between exposure values at two consecutive dates or derived, even 
partially, from some other treatment, all assumptions should be duly justified 
and clearly documented in order to adequately replicate the recovery flows that 
occur during the recovery process in accordance with letters a) and b) above. 
Institutions are expected to pay particular attention to the treatment of interest 
and fees capitalised after default, the treatment of additional drawings and the 
treatment of write-offs. 

262.  The economic loss as defined in Article 5(2) of the CRR also includes material 

discounts. The ECB’s understanding is as follows. 

(a)  Paragraph 134 of the EBA Guidelines on PD and LGD refers to all losses 

incurred through forgiveness or write-off. 

(b)  Where institutions open new facilities to replace previously defaulted facilities 
as part of restructuring or for technical reasons, the economic loss should 
include the decrease in the degree of financial obligation arising from changes 
in the contractual conditions (i.e. material forgiveness or postponement of 
payment of principal, interest or fees). The amount by which the financial 
obligation has diminished should be calculated under paragraph 51 of the EBA 
Guidelines on DoD. However, no double-counting of debt forgiveness is 
intended (for example, in the case of exposures that return to non-defaulted 
status, a possible double-counting through the diminished financial obligation 
and the artificial cash flow is not intended). 

(c)  Realised LGD for individual facilities may be zero or lower when it is the actual 
result of the recovery process (for example, where additional recoveries offset 
the discounting effect and costs). Institutions should, however, pay particular 
attention to no-loss exposures, since they may reveal issues with the 
calculation of realised losses – for example, costs not being adequately 
allocated to recovery processes, or inadequate treatment of amounts forgiven 
or written off. 

ECB guide to internal models – Credit risk 

131 

 
17.1.4 

Treatment of multiple defaults 

263.  For the purpose of LGD estimation and in order to ensure an appropriate 

measurement of economic loss as defined in Article 5(2) of the CRR, institutions 
should consider an exposure that returns to normal status and subsequently defaults 
in a short period of time as being constantly defaulted from the moment the first 
default occurred. This treatment should be applied under paragraph 101 of the EBA 
Guidelines on PD and LGD. In addition, institutions should follow the observations in 
the following paragraphs. 

(a)  Paragraph 101 of the EBA Guidelines on PD and LGD envisages the definition 
of a period longer than nine months when this is appropriate for the specific 
type of exposures and reflects the economic meaning of the default experience. 
It is the ECB’s understanding that a longer period is adequate when the 
proportion of subsequent defaults occurring on individual facilities over a period 
of more than nine months is significant, unless institutions are able to provide 
evidence that the second (or subsequent) default is unconnected with the 
original default event. This evidence may include analysis of the curing process. 

(b) 

In the particular case of an institution opening new facilities to replace 
previously defaulted facilities as part of restructuring or for technical reasons, it 
should be able to make or trace a connection between the restructured facility 
and the facility (or facilities) previously advanced and which it is restructuring. 

17.1.5 

Treatment of massive disposals (Article 500 of the CRR) 

264.  Article 500 of the CRR allows institutions to adjust their LGD estimates “by partly or 

fully offsetting the effect of massive disposals of defaulted exposures on realised 
LGDs up to the difference between the average estimated LGDs for comparable 
exposures in default that have not been finally liquidated and the average realised 
LGDs including on the basis of the losses realised due to massive disposals”, 
subject to certain conditions. 

265.  Article 500 of the CRR specifies that, irrespective of the date of disposal, the 

adjustment may only be carried out until 31 December 2024. Furthermore, the 
effects of such adjustments may last for as long as the corresponding exposures are 
included in the institution’s own LGD estimates. 

The dates of disposal mentioned in Article 500(1)(b) of the CRR should be the dates 
of transfer of the legal ownership of assets. Article 500 of the CRR contains a time 
limit corresponding to the period from 23 November 2016 to 31 December 2024. 
Only the date of disposal is relevant for determining whether this time limit has been 
complied with. 

266.  An institution must qualify for the use of Article 500 of the CRR by meeting the 

conditions set out therein, or be a subsidiary or parent of an institution which thus 
qualifies. In the case of a parent, the ECB considers that the adjustment at the 
consolidated level should reflect the adjustment conducted by the qualifying 

ECB guide to internal models – Credit risk 

132 

 
subsidiary or subsidiaries only. In other words, if the parent does not by itself meet 
the conditions of Article 500, any additional defaults that are not defaults of the 
subsidiary that qualifies for the use of Article 500 CRR may not be part of the 
adjustment pursuant to Article 500 CRR at the consolidated level of the parent. 

267.  Article 500(1)(c) of CRR sets out a threshold condition that must be met in order to 

qualify for the use of this Article. The denominator of the 20% threshold must be 
understood as the outstanding amount of defaulted exposures as of the date of the 
first disposal according to the plan submitted to the competent authority.166  It is the 
ECB’s understanding that the threshold condition should be evaluated at the level of 
the institution submitting the plan referred to in Article 500(1)(a) of the CRR. 

268.  With respect to whether the inclusion of foreclosed assets (the repossession and 

sale of collateral as referred to in paragraph 115(b) of the EBA Guidelines on PD and 
LGD) in the Article 500 adjustment is permissible, the ECB considers it important to 
distinguish between the sale of an exposure and the sale of collateral. Only the 
former, but not the latter, is covered by Article 500 of the CRR. Consequently, since 
Article 500 of the CRR refers to the use of defaulted exposures for the calculation of 
the threshold and the adjustment itself, foreclosed assets cannot be included in 
either. 

269. 

It is the ECB’s understanding167  that “the average estimated LGDs for comparable 
exposures in default that have not been finally liquidated” can be calculated based 
on the institution’s incomplete workout treatment applied to the exposures as of the 
date before the date of their disposal. This calculation implies an adjustment back to 
the estimated LGD that would have occurred if the standard workout process had 
been followed instead of the massive disposals process. Where an institution follows 
this approach, it should ensure the following. 

(a)  The requirements related to the institution’s incomplete workout treatment 

should be in line with paragraphs 153 to 159 of the EBA Guidelines on PD and 
LGD. In particular, the uncertainty referred to in 159(f) will persist indefinitely, 
and so the related MoC will also have to persist as long as the adjusted 
observations are used for the estimation of parameters. 

(b)  During the annual review of estimates of its LGD models, it should be assessed 

whether the use of newly available information would increase the accuracy of 
the Article 500 adjustment performed in the past. For this purpose the institution 
should have pre-defined, internally approved criteria to decide whether the 
accuracy of the Article 500 adjustment can be increased. If the accuracy can be 
increased, the institutions should perform a new Article 500 adjustment by 
incorporating this new relevant data and information in accordance with Article 
179(1)(a) of the CRR, including appropriate documentation showing that the 
pre-defined criteria have been met. The ECB expects the update to the Article 
500 adjustment to reflect the (economic) conditions and processes as of the 
date of disposal and not as of the date of the adjustment. 

166   See also question ID 2019_4824 in the EBA Single Rulebook Q&A. 
167   See also question ID 2019_4814 in the EBA Single Rulebook Q&A. 

ECB guide to internal models – Credit risk 

133 

 
 
(c) 

It is expected that once a sufficiently long time has passed since the massive 
disposal, there will be no new information that can be considered relevant for 
the adjustment (in particular, a sufficiently long time may be considered to have 
passed once most of the cases that were incomplete as of the date of the 
disposals have been closed or if the maximum period of the recovery process 
has been reached as of the time of the estimation). If this is the case, it will not 
be necessary to modify the Article 500 adjustment performed in previous 
calibrations. The supervised entity should monitor whether most cases that 
were incomplete as of the date of the disposal have been closed. If this is the 
case, it should conclude that a sufficiently long period of time has passed and 
make a final assessment of whether the adjustment needs to be updated. The 
specific MoC related to the uncertainty of the cash flows should be reviewed in 
accordance with the MoC framework, taking newly available information into 
account for the same sufficiently long period of time. 

270.  The data used to develop the incomplete workout treatment should be representative 
of the portfolio of disposed assets. The institution should have criteria in place to 
assess representativeness by comparing key characteristics of the portfolios in line 
with paragraph 37(b)(ii) and Sections 4.2.2 to 4.2.4 of the EBA Guidelines on PD and 
LGD. Any issues of representativeness should be appropriately reflected in the MoC 
related to the Article 500 adjustment. 

271.  For the portfolio of disposed assets to which Article 500 CRR is applied, institutions 

should collect and store both the adjusted, realised LGDs and the actual sale price of 
disposed assets within their RDS. 

272.  Regarding the treatment of incomplete workouts, in order to avoid circular logic if the 

Article 500 adjustment is based on the incomplete workout treatment, then from the 
date of the massive disposal onwards, and in the case of disposed assets only, 
supervised entities are not expected to analyse costs and recoveries as described in 
paragraph 159(a) of the EBA Guidelines on PD and LGD. 

273.  According to the ECB’s understanding, Article 500 authorises adjustments to the 

calculation of the following parameters: observed average LGD; LRA LGD; downturn 
LGD; ELBE; and LGD in-default. 

274.  For the calculation of the observed average LGD, the adjusted realised LGD of the 

exposures subject to the Article 500 adjustment should be included. 

275. 

It is the ECB’s understanding that all the defaults subject to the massive disposal 
adjustment should be treated as closed observations. In particular, they should be 
treated as such for the purpose of determining the maximum period of the recovery 
process as referred to in paragraph 156 of the EBA Guidelines on PD and LGD with 
the date of the massive disposal as the closure date, unless institutions can provide 
firm evidence that this approach has a significant and unjustifiable biasing impact.168 

168   If it is apparent that including these data points unduly inflates the maximum recovery period, which in 
reality should be much shorter, then steps should be taken to use a more appropriate and shorter 
period. 

ECB guide to internal models – Credit risk 

134 

 
 
276.  The relevant downturn period in accordance with paragraph 15 of the 

EBA/GL/2019/03 and the LGD appropriate for a downturn should be identified based 
on the realised LGDs of the observed defaults after the application of the Article 500 
adjustment. 

277.  For LGD in-default and ELBE estimates, it is expected that the massive disposal cash 
flow will be replaced by a cash flow or cash flows adjusted in line with the Article 500 
adjustment. 

278.  Defaults subject to a massive disposal should be removed from the analysis 

underlying the setting of the reference dates as referred to in paragraph 171 of the 
EBA Guidelines on PD and LGD. 

17.2 

LGD structure 

17.2.1 

Relevant regulatory references 

Table 14 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

20/06/2013 

143 

144 

169 

170 

174 

175 

179 

185 

190 

(3) second sub-paragraph 

(1)(a), (f), (h) 

(3) 

(1)(e), (f), (3)(b), (c), (4) 

(d) 

(1), (4)(b) 

(1)(a) 

(a), (b), (c) 

(1) 

(a) 

(i) 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

33, 34, 35, 36 

38 

40 

48 

Other references 

EBA Guidelines on PD and LGD 

20/11/2017 

121, 122, 123 

279.  A grade or pool is understood by the ECB to be the subset of facilities to which the 
same LGD is applied for the calculation of regulatory capital requirements, 
irrespective of how this LGD has been assigned. 

280. 

In order to comply with the requirements regarding the structure of LGD models as 
set out in Article 170(1)(e) and (f) and 170(3)(b) and (c) of the CRR, institutions 
should follow the observations below. 

ECB guide to internal models – Credit risk 

135 

 
 
 
 
 
 
 
 
 
 
 
 
281.  LGD estimates must be based on the material drivers of risk.169  To comply with this 

requirement, institutions should identify and analyse potential risk drivers under 
paragraphs 121 to 123 of the EBA Guidelines on PD and LGD.170  When selecting 
the risk drivers, institutions should take into consideration any changes in product 
mix or characteristics between the reference and default dates. According to 
paragraph 122 of the EBA Guidelines on PD and LGD, “institutions should analyse 
the risk drivers not only at the moment of default but also at least within a year 
before default and should use reference dates for risk drivers that are representative 
of the realisations of the risk drivers within a year before default”. In the ECB’s 
understanding, this means that the choice of reference dates for risk drivers should 
ensure consistency with the expected distribution of defaults over the one-year 
horizon (and corresponding changes in the value of the risk driver) that are expected 
for the exposures to which the estimates are applied. In this context, where risk 
drivers vary over time, an approach consisting of a fixed (for all defaults) time 
horizon before default, particularly where this time horizon is less than 12 months, 
should not be used unless the institution is able to show that such an approach does 
not result in a lack of representativeness (in the sense of the previous sentence) 
leading to the final LGD estimates (at grade or pool level) being underestimated. 

282.  Where an institution relies on one or more statistical models to define the process of 

assigning exposures to facility grades or pools (or parts of this process) in 
accordance with Article 175(4)(b) of the CRR, it is the ECB’s understanding that for 
institutions to comply with the requirement set out in Article 144(1)(a) of the CRR that 
rating systems should provide for a meaningful differentiation of risk as further 
explained in letters (c) and (e) of Article 30(3) of Commission Delegated Regulation 
(EU) No 2022/439, the statistical process followed by the institution in selecting its 
model(s) should include assessing the performance of the model(s) on the basis of 
independent datasets (data points which were left out of the model fitting) in a way 
that limits the risk of overfitting. Independent datasets should correspond not only to 
random sampling (out-of-sample), but also to different time periods (out-of-time) 
unless there are no sufficient data available for the training sample. The expectations 
set out above in this paragraph are specifically related to the model development 
phase. Once the process for assigning exposures to facility grades or pools has 
been defined, the requirements related to the framework for the review of estimates 
under paragraphs 217 to 221 of the EBA Guidelines on PD and LGD apply, together 
with the expectations set out in Section 20 of this chapter. In particular, in 
accordance with paragraph 218(b)(i) of the EBA Guidelines on PD and LGD, the 
institution must carry out an analysis to identify any potential deterioration in the 
model’s performance, including the model’s discriminatory power, by comparing its 
performance at the time of the development with its performance over each 
subsequent observation period. 

283. 

Institutions’ rating systems must provide for a meaningful assessment of obligor and 
transaction characteristics, a meaningful differentiation of risk and accurate and 

169   Article 179(1)(a) of the CRR. 
170   Institutions should consider all appropriate risk drivers in accordance with paragraph 121 of the EBA 

Guidelines on PD and LGD. These should include climate-related and environmental risk drivers where 
relevant and material. 

ECB guide to internal models – Credit risk 

136 

 
 
consistent quantitative estimates of risk.171  It is the ECB’s understanding that to 
comply with this requirement institutions should demonstrate that, in terms of the 
range of application of LGD models, the model performs adequately (in terms of 
discriminatory power and predictive power) on economically significant and material 
sub-ranges of application of the rating systems. The sub-ranges are identified by 
splitting the full range of application of the LGD model into different parts on the 
basis of potential drivers for risk differentiation, among which, where relevant, the 
drivers referred to in paragraph 121 of the EBA Guidelines on PD and LGD. 

284.  The number of grades and pools must be adequate for a meaningful risk 

differentiation and for the quantification of the LGD at the grade or pool level.172  To 
comply with this requirement, institutions should ensure the following 

(a)  an adequate distribution of facilities across grades or pools in the datasets used 

for development and (initial and regular) validation. For this purpose: 

(i)  any unusually low number of facilities in a grade or pool is expected to be 
supported by empirical evidence of the adequacy of isolating those 
facilities in a specific grade or pool; 

(ii)  any unusually high concentration of facilities in a grade or pool is expected 
to be supported by empirical evidence of homogeneity within these grades 
or pools (for example by analysing whether some potential risk drivers 
(e.g. exposure size) that could further differentiate between riskier and less 
risky facilities have not been considered). 

(b)  sufficient homogeneity of the risk within each grade or pool by providing 

empirical evidence that the grade-level LGD is adequate for all facilities in that 
grade. For this purpose, in cases where it is found (through the use of additional 
drivers or a different discretisation of the existing ones) that a material subset of 
facilities within a grade or pool yields a significantly different average realised 
LGD to that of the rest of the grade or pool, this is considered to indicate a lack 
of homogeneity. 

(c)  sufficient heterogeneity of the risk across grades or pools by providing empirical 

evidence that the average realised LGD is different across consecutive grades 
or pools, for subsets for which there is a meaningful order. 

285.  Where an institution uses direct estimates of risk parameters, these may be seen as 

estimates assigned to grades on a continuous rating scale.173  In this case, in the 
ECB’s understanding the same requirements apply when an institution uses direct 
estimates of risk parameters as apply to grade-based models. To comply with these 
requirements, institutions are expected to ensure risk differentiation in accordance 
with the following principles: 

171   Article 144(1)(a) of the CRR. 
172   Article 170(1)(e) and (f) and 170(3)(b) and (c) of the CRR. 
173   Article 169(3) of the CRR. 

ECB guide to internal models – Credit risk 

137 

 
 
(a) 

if the LGD estimates used to calculate the RWEAs are based on default 
weighted LRAs of realised LGDs for grades or pools, irrespective of whether at 
some point direct LGD estimates may have been used to define such grades or 
pools, this grade or pool level is the relevant one for the application of the 
principles set out in paragraph 284 of this chapter; 

(b)  when the situation described in point (a) above does not apply and, instead, 
several components are estimated separately and then combined in order to 
obtain the direct LGD estimates at facility level, institutions should adequately 
analyse and reflect in the model possible dependencies between the 
components (e.g. through relevant risk drivers); 

(c) 

in the case of other direct LGD estimates (i.e. where no components are 
defined) the principles above are expected to be applied where relevant. 

286. 

In addition to paragraph 285 above and where several components are estimated 
separately and then combined in order to obtain the direct LGD estimates at facility 
level, there is a risk that a meaningful differentiation of risk will not be achieved at 
facility level. To mitigate this risk, institutions should ensure that no bias is introduced 
in the risk differentiation when combining the different components in order to obtain 
the final LGD estimate at facility level. Specifically: 

(a) 

the allocation of recovery flows to these components should be adequately 
documented and implemented in a consistent way where applicable; 

(b) 

risk differentiation (analogous to risk quantification) should be ensured with 
respect to facility level. 

ECB guide to internal models – Credit risk 

138 

 
17.3 

Risk quantification 

17.3.1 

Relevant regulatory references 

Table 15 

Legal background 

CRR 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

Commission Delegated Regulation (EU) No 2021/930174 

EBA Guidelines on PD and LGD 

Other references 

01/03/2021 

20/11/2017 

EBA Guidelines on downturn LGD175 

06/03/2019 

17.3.2 

Observed average LGD 

Date of issue 

Article 

Paragraph/Point 

26/06/2013 

179 

181 

185 

47 

48 

(1)(a), (1)(d) 

(1)(a), (b), (e), (f) and (2) 
second sub-paragraph   

(b) 

(c) 

(a) to (f), (i) 

100, 116-118, 147-164 

287.  To comply with the requirement of obtaining an LRA LGD in accordance with 

Article 181(1)(a) of the CRR, institutions should calculate the observed average LGD 
under paragraphs 147, 148, 154-157 and 160 of the EBA Guidelines on PD and 
LGD. This calculation should be performed for the time period for which data are 
available regardless of the approach considered for the LGD estimation, e.g. 
including approaches where the LGD is the result of a combination of different 
components. When performing this calculation, institutions should follow the 
principles set out below. 

288.  Under paragraph 147 of the EBA Guidelines on PD and LGD, default observations 
that are triggered close to the time of the LGD estimation process (i.e. observations 
with a recent default when the LGD is being estimated) are part of the historical 
observation period and should be included in the RDS. Since for these recent 
defaults only limited information is available regarding the full recovery process, the 
treatment of incomplete recovery processes envisaged in paragraph 158 of the EBA 
Guidelines on PD and LGD is more complex and could add uncertainty to the LGD 
estimates. It is the ECB’s understanding that to mitigate this risk institutions may 
establish a minimum period of time during which the default should be observed in 
order for it to be considered in the calculation of the observed average LGD. This 

174   Commission Delegated Regulation (EU) 2021/930 of 1 March 2021 supplementing the CRR with 

regard to regulatory technical standards specifying the nature, severity and duration of an economic 
downturn referred to in Article 181(1), point (b), and Article 182(1), point (b), of that Regulation (OJ L 
204, 10.6.2021, p. 1). 

175   EBA Guidelines for the estimation of LGD appropriate for an economic downturn (“Downturn LGD 

estimation”) (EBA/GL/2019/03), referred to in this guide as the “EBA Guidelines on downturn LGD”. 

ECB guide to internal models – Credit risk 

139 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
minimum period should be adequately justified and institutions should ensure that all 
relevant information regarding defaults observed for a shorter period (e.g. a change 
in the characteristics of defaults) is considered in the LGD estimates. In any case 
this period should not be longer than 12 months. 

289.  For the purposes of LGD estimation (and validation), long recovery processes are 

expected to be considered as closed under paragraph 156 of the EBA Guidelines on 
PD and LGD. The objective of defining the maximum period of the recovery process 
(“time-to-workout”) is to avoid situations where institutions give consideration to 
overly optimistic recoveries from open exposures that are already at a very 
advanced stage of the recovery process. To achieve this, the specification of the 
“time-to-workout” should be supported by evidence of the observed pace of 
recoveries and be consistent with the nature of the products concerned, the type of 
exposures and the operational recovery process. In addition, the institution should 
substantiate and clearly document the studies that support the formulation of the 
time-to-workout and should pay particular attention to the following. 

(a)  The specific moment after the date of default at which nearly nil evolution of the 

average cumulative recovery rates (RRs) is observed. For example, when the 
cumulative recovery curves show a pronounced increase after which they 
flatten out, the time spent in default after the significant increase occurs could 
be used directly as the time-to-workout, especially in the case of unsecured 
exposures. 

(b)  The period of time after the date of default where the cumulative percentage of 

closed/recovered exposures flattens. 

(c)  The number of exposures used to construct the curves referred to at letters (a) 
and (b) above, in order to identify situations where only a few cases contribute 
to the shape of the curves. 

(d)  The expected recovery rate conditioned to vintages higher than the time-to-

workout. 

(e)  For secured exposures, the share of exposures for which recoveries from 

collateral have not yet been realised. 

17.3.3 

Treatment of incomplete recovery processes 

290. 

In order to obtain an LRA LGD in accordance with Article 181(1)(a) of the CRR, 
institutions should ensure that the relevant information from incomplete recovery 
processes is taken into account in a conservative manner. For this purpose, 
institutions should analyse their incomplete recovery processes and extract the 
information relevant for LGD estimation under paragraphs 153 to 159 of the EBA 
Guidelines on PD and LGD. In addition, institutions should: 

ECB guide to internal models – Credit risk 

140 

 
(a) 

(b) 

justify and document their methodology for the treatment of incomplete recovery 
processes, and in particular how they take into account paragraph 159 of the 
EBA Guidelines on PD and LGD; 

for the purpose of paragraph 159(a) of the EBA Guidelines on PD and LGD in 
particular, base the extrapolation of future recoveries on defaults arising from 
vintages (i.e. group of exposures which defaulted in a given period of time) for 
which, during the period already observed, similar average past recoveries 
have been realised on similar exposures; 

(c) 

in order to ensure transparency regarding the impact from the treatment of 
incomplete recovery processes, assess the sensitivity of the treatment with 
respect to the main assumptions. 

17.3.4 

Recovery processes where collateral has been repossessed and 
not yet sold 

291. 

In specific cases where institutions have taken possession of but not yet sold the 
collateral, there is a risk that the value of repossession might not adequately reflect 
the value of the repossessed collateral. To mitigate this risk, institutions should 
estimate haircuts to the value of the collateral under paragraphs 116 to 118 of the 
EBA Guidelines on PD and LGD. In order to ensure transparency regarding the 
impact from the treatment of repossessed collateral, institutions should: 

(a)  compare the estimated haircuts with the available observations regarding the 

repossession and subsequent sale of similar types of collateral; 

(b)  assess the impact on the LRA LGD of the inclusion of the repossessed 

collateral by performing sensitivity analyses based on the application of different 
haircuts to the value of the collateral (at least, by applying a haircut of 100% to 
cases where collateral has been repossessed but not yet sold). 

17.3.5 

Long-run average 

292.  To comply with the requirement of obtaining an LRA LGD by facility grade or pool in 

accordance with Article 181(1)(a) of the CRR, institutions should estimate LGDs 
under paragraphs 100 and 149 to 164 of the EBA Guidelines on PD and LGD. When 
performing this estimation, institutions should follow the observations below. 

293.  Under paragraph 150 of the EBA Guidelines on PD and LGD, institutions should 

calculate the LRA LGD as an arithmetic average of realised LGDs over a historical 
observation period weighted by a number of defaults. When performing this 
calculation, institutions should observe the following points. 

(a) 

In the event of definition of default applied at obligor level, where two facilities of 
the same obligor are assigned to the same facility grade or pool, institutions are 
expected to calculate the average realised LGD as follows: first take the 

ECB guide to internal models – Credit risk 

141 

 
exposure-weighted average realised LGD at the obligor level and then take the 
arithmetic average LGD weighted by the number of defaulted obligors within the 
LGD grade.176  If institutions use a different approach, they should demonstrate 
that there are no systematic deviations from the approach referred to above. 

(b)  Under paragraph 160 of the EBA Guidelines on PD and LGD, the realised LGD 

of each observation should be floored at zero for the purpose of LGD 
estimation. In cases where LGD estimates for specific facility grades or pools 
are low or even zero (in exceptional cases), in order to ensure that these 
estimates are accurate and not driven by (systematic) errors or distortions 
institutions should ensure that their estimation process is accurate. In particular, 
they should ensure that there is a sufficient number of observations supporting 
the estimate and that these outcomes are carefully monitored and scrutinised. 

(c)  Under paragraph 162 of the EBA Guidelines on PD and LGD, institutions should 
apply an appropriate treatment to extremely high values of realised LGDs much 
above 100%, at the level of data quality, risk drivers, assignment to grades or 
pools or assignment to calibration segments. To ensure that the estimates are 
accurate, institutions are not expected to cap realised LGD values (i.e. to 
replace the observed value by a pre-defined value when the observed value is 
above the pre-defined one). 

294. 

Institutions can calibrate LGD estimates to the LRA LGD calculated at the level of the 
calibration segment under paragraph 161(b) of the EBA Guidelines on PD and LGD. 
When calibration segments are used for the purpose of LGD estimations, institutions 
are expected to base their decision on a sound rationale, in particular on quantitative 
evidence. It is the ECB’s understanding that, to comply with Article 181(1)(a) of the 
CRR, institutions should also calculate the LRA LGD at a more granular level than 
the calibration segment (i.e. individual LGD grades or pools if estimation is discrete 
or sub-ranges177  of LGD values if the estimation is continuous). The level should be 
appropriate for the application of the model. In addition, institutions should ensure 
that there are no systematic deviations when comparing the estimated LGDs with the 
LRA of realised LGDs at this more granular level, i.e. the direction of divergences 
should be random. 

295.  Where the LGD is the result of a combination of different components (for example, 

secured and unsecured components), the calibration step according to 
paragraph 294 of this chapter (ensuring that the LRA LGD and the average 
estimated LGD across facilities within the same calibration segment/range of LGD 
values are aligned) is expected to be performed after the aggregation of the 
components. In addition, there is a risk that systematic deviations could be 
introduced to the estimation when combining these different components. In this 
case, the direction of divergences would not be random. To mitigate this risk, 
institutions should do the following. 

176   The same principle applies when quantifying downturn LGDs at grade level. 
177   Sub-ranges of LGD values should be defined analogously to those for PD (see paragraph 250(f) of this 

chapter). 

ECB guide to internal models – Credit risk 

142 

 
 
(a)  For all defaults in the RDS, compare the realised LGD at facility level with the 
estimates of LGD. Separate tests should be performed for the LGD applied to 
the performing portfolio and the LGD in-default. Analogous tests should be 
performed at component level. 

(b) 

In the case of models based on components with underlying data covering time 
windows with different lengths and/or periods for each of the components, 
ensure that no bias is introduced in the LGD estimates at facility level with 
respect to the LRA. The analysis referred to in point (a) should be performed, at 
least, for the available common time period. 

296. 

In accordance with Article 179(1)(a) of the CRR, an institution’s own estimates must 
incorporate all relevant data and must be derived using both historical experience 
and empirical evidence. To comply with these requirements, when institutions use 
external or pooled data to complement their own loss or recovery experience, they 
should ensure that LRA LGDs derived from external or pooled data are also 
calculated separately from, and compared with, those based on internal data.178  In 
addition, the direction and magnitude of the differences between these averages 
should be properly analysed and documented when calibrating the model, including 
the adequacy of the MoC considered, and duly followed up in the review of 
estimates. 

297.  Article 179(1)(d) of the CRR requires, among other things, that the population of 

exposures represented in the data used for estimation, the lending standards used 
when the data were generated and other relevant characteristics must be 
comparable with those of the institution’s exposures and standards. Paragraph 164 
of the EBA Guidelines on PD and LGD further specifies that institutions should take 
into account not only the current characteristics of the portfolio but also, where 
relevant, any changes to the structure of the portfolio that are expected to happen in 
the foreseeable future. When institutions perform adjustments to their LGD estimates 
in order to comply with these requirements, it is the ECB’s understanding that the 
following principles should apply. 

(a)  The adjustment should be based on a comparison of the data used in risk 

quantification with the institution’s application portfolio. In many circumstances 
(for example where a type of product has been discontinued by the institution), 
the addition of these characteristics as risk drivers for LGD estimation is the 
most simple and effective way of dealing with issues of non-representativeness. 

(b) 

In the event of changes in lending or recovery policies, institutions should make 
only conservative adjustments until they are able to provide empirical evidence 
concerning the impact of the new policies. Such evidence should be based on 
the inclusion in the RDS of data from periods more recent than the change of 
policy. 

(c)  All economic and market conditions experienced in the past and reflected in 
historical observations should be considered by institutions as part of 

178   Considering the maximum common period possible between the internal and external or pooled data. 

ECB guide to internal models – Credit risk 

143 

 
 
foreseeable economic and market conditions (paragraph 147 of the EBA 
Guidelines on PD and LGD). They are not, therefore, a reason to perform 
adjustments. 

17.3.6 

Downturn LGD 

298.  To obtain LGD estimates that are appropriate for an economic downturn in 
accordance with Article 181(1)(b) of the CRR, institutions are expected to: 

(a)  Characterise an economic downturn in accordance with the Commission 

Delegated Regulation (EU) No 2021/930; 

(b)  derive LGD estimates which are appropriate for the downturn conditions 
specified, in accordance with the EBA Guidelines on downturn LGD. 

299. 

It is the ECB’s understanding that institutions should not calibrate downturn LGD at a 
more aggregate level than that at which the LGD estimates are calibrated to the LRA 
LGD in accordance with paragraph 161 of the EBA Guidelines on PD and LGD, 
regardless of the type of approach used for calibrating downturn LGD. 

Calibration of downturn LGD based on observed impact 

300. 

It is the ECB’s understanding of paragraph 27 of the EBA Guidelines on downturn 
LGD that, where the calibration of downturn LGD is based on observed impact, 
institutions should assess the impact of the identified downturn period(s) along all the 
dimensions listed in letters (i) to (iv) of that paragraph. 

301.  Where the calibration of downturn LGD (i.e. obtaining the downturn calibration 

target) performed by the institution involves an estimation or analysis of different 
components179, the previously mentioned assessment should be performed for each 
component separately, and considering all the dimensions that are relevant for each 
component. 

In accordance with paragraph 26(a) of the EBA Guidelines on downturn LGD, the 
impact of the identified downturn period(s) should be considered, as a minimum, for 
the component that leads to the highest impact in terms of final downturn LGD 
estimates. It is the ECB’s understanding that the inclusion of impacts on other 
components is relevant if doing so is needed in order to consider all the identified 
effects of the downturn period, and provided that institutions deliver sufficient 
evidence on the adequateness of the aggregation method employed. 

302.  The same principle as described in the second sub-paragraph of paragraph 301 of 
this chapter should be followed whenever aggregating different dimensions, 
including where the aggregation is performed within a component, as set out in 
paragraph 301 of this chapter. 

179   Analogously to the model components referenced in paragraph 295 of this chapter. 

ECB guide to internal models – Credit risk 

144 

 
 
303.  Where the calibration of downturn LGD is based on observed impact, regardless of 

the method chosen for the downturn LGD calibration, i.e. whether or not based on 
components, it is the ECB’s understanding that the final downturn LGD estimates, as 
obtained in accordance with paragraph 28 of the EBA Guidelines on downturn LGD, 
should account at least for the impact stemming from the elevated levels of the 
average realised LGD180  related to all defaults to have occurred in a considered year 
as per paragraph 27(a)(i) of the EBA Guidelines on downturn LGD. In this context, it 
is the ECB’s understanding that the data used to calculate the elevated levels of the 
average realised LGD do not necessarily need to align with the time frame of the 
identified downturn period. 

LGD reference value 

304.  Under paragraph 37 of the EBA Guidelines on downturn LGD, institutions should 

calculate a reference value, to be compared with the final downturn LGD estimates, 
as a two-step process: first by identifying the two worst years with the highest 
observed economic loss, and then by computing the reference value as the simple 
average of the average realised LGD over those years.181  It is the ECB’s 
understanding that the following principles should be adhered to when doing so: 

(a)  For the identification of the two individual years with the highest observed 

economic loss, according to paragraph 37(a) of the EBA Guidelines on 
downturn LGD: 

(i)  all available loss data should be considered when selecting the two 

individual years with the highest observed economic loss; 

(ii) 

the relevant indicator for selecting the two individual years with the highest 
observed economic loss is the ratio of the total economic loss to the total 
outstanding amount182, computed by grouping all defaults according to the 
year in which the defaults occurred, in accordance with paragraph 37(a)(ii) 
of the EBA Guidelines on downturn LGD; 

(iii)  both closed and incomplete recovery processes should be considered in 
point (ii), whereby the economic loss associated with the incomplete 
recovery processes should be derived from the realised LGD after the 

180   For the calculation of average realised LGD, both closed and incomplete recovery processes should be 
accounted for (including the treatment of massive disposals as discussed in Section 17.1.5 of this 
chapter, if relevant), whereby realised LGDs associated with incomplete recovery processes should be 
considered after the treatment of incompletes. 

181   Where the LGD estimates are the result of a combination of different components, the task of 

identifying the relevant years and calculating the reference value described in this paragraph should be 
performed once the components have been aggregated (i.e. with the realised LGD, not at the level of 
each of the underlying components). For models based on components with underlying data covering 
time windows with different lengths and/or periods for each of the components, these should be 
performed for the available common time period. In addition, where an identified downturn period falls 
outside the available common time period among components, the task of identifying the relevant years 
and calculating the reference value, as described in this paragraph, should be performed also at the 
level of the component(s) (by considering the realised value of the component) with available 
underlying data in the identified downturn period, if any. 

182   Where total economic loss and total outstanding amount are, respectively, aligned with the definitions 
employed in the calculation of the numerator and denominator of the realised LGD used in the model. 

ECB guide to internal models – Credit risk 

145 

 
 
treatment of incomplete recovery processes, so as to be consistent with 
the LRA LGD calculation, in accordance with paragraphs 153 to 159 of the 
EBA Guidelines on downturn LGD. 

(b)  For the calculation of the reference value, according to paragraph 37(b) of the 

EBA Guidelines on downturn LGD: 

(i)  both closed and incomplete recovery processes should be accounted 

for183, whereby the realised LGDs associated with the incomplete recovery 
processes should be considered after the treatment of incomplete recovery 
processes, so as to be consistent with the LRA LGD calculation, in 
accordance with paragraphs 153 to 159 of the EBA Guidelines on 
downturn LGD; 

(ii) 

first, a default-weighted average realised LGD should be calculated for 
each of the two years selected; then, the reference value should be 
calculated as the simple average of the two annual averages. 

305. 

In accordance with paragraph 18 of the EBA Guidelines on downturn LGD, 
institutions should compare the final downturn LGD with the reference value 
calculated at least at the level of calibration segments. The identification of the worst 
years as described in paragraph 37(a) of the EBA Guidelines on downturn LGD 
should be performed at the level of the calibration segments, and the reference value 
described in paragraph 37(b) of the on downturn LGD should be calculated at least 
for each calibration segment. 

This approach does not preclude the institution from taking appropriate action in 
case substantial mismatches with a coherent and systematic pattern exist at the 
grade level but remain undetected at the calibration segment level, provided that the 
available data are sufficient to perform a reliable analysis at grade level. 

306.  Paragraph 18 of the EBA Guidelines on downturn LGD also requires institutions to 

compare the final downturn LGD with the reference value on the according RDS. For 
this purpose, it is the ECB’s understanding that, in the case of continuous estimates, 
or where the institution additionally performs the comparison at calibration segment 
level, the institution should obtain the final downturn LGD estimate for each range of 
LGD values (or calibration segment) as the default-weighted average of the final 
LGD estimates for each defaulted exposure in the RDS within that range of LGD 
values (or calibration segment) whose default occurred during the two years selected 
in accordance with paragraph 304(a) of this chapter. For cases where the 
comparison is also performed at grade or pool level, no averaging would be 
necessary. 

307.  The ECB expects institutions to thoroughly analyse cases where the reference value 

is materially larger than the final LGD estimates obtained in accordance with the 
previous paragraphs, on the basis of the downturn LGD estimates before adding a 

183   Including the treatment of massive disposals as discussed in Section 17.1.5 of this chapter, if relevant. 

ECB guide to internal models – Credit risk 

146 

 
 
MoC. In this sense, it is the ECB’s understanding that a material difference would not 
result from a potentially unidentified downturn period in the following two situations: 

(a)  where the two years identified for the calculation of the reference value include, 

or are a subset of, the downturn period(s) identified by the institution in 
accordance with Commission Delegated Regulation (EU) No 2021/930; 

(b)  where the economic conditions during these two years identified for the 

reference value cannot be considered as adverse in accordance with the 
relevant economic indicators, meaning that a material difference is justified 
instead by idiosyncrasies in the realised losses of those years, in which case 
the ECB expects institutions to provide compelling justification of such 
idiosyncrasies. 

When assessing whether a downturn period may have gone unidentified, institutions 
should appropriately consider the existence of any lag between a downturn period 
and its potential impact on the relevant loss data. 

308. 

If points (a) or (b) of paragraph 307 of this chapter apply, it is the ECB’s 
understanding that there are no indications of an unidentified downturn period in the 
context of the reference value comparison. In all other cases, the ECB expects 
institutions to scrutinise the differences by assessing whether a downturn period may 
have gone unidentified and/or reviewing the downturn LGD quantification and taking 
appropriate action. However, institutions are expected to scrutinise any material 
difference if point (a) applies by reviewing and, if necessary, correcting the 
quantification. Such cases should be given particular scrutiny if the reference value 
is also materially higher than the downturn LGD estimates plus final MoC, as the risk 
of an understatement of the downturn effect appears higher. 

17.4 

Estimation of ELBE and LGD in-default 

17.4.1 

Relevant regulatory references 

Table 16 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

26/06/2013 

179 

181   

185 

47 

48 

51 

(1)(c) 

(1)(a), (h), (j) and (2) 
second sub-paragraph   

(a) to (c) 

(c) 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

Other references 

EBA Guidelines on PD and LGD 

20/11/2017 

165 to 193 

ECB guide to internal models – Credit risk 

147 

 
 
 
 
 
 
 
 
 
 
 
 
309. 

310. 

In accordance with Article 181(1)(h) of the CRR, for the specific case of exposures 
already in default institutions must use the sum of their ELBE for each exposure, 
given current economic circumstances and exposure status and their estimate of the 
increased loss rate caused by possible additional unexpected losses during the 
recovery period. To comply with these requirements, institutions should estimate 
ELBE and LGD in-default under paragraphs 165 to 193 of the EBA Guidelines on PD 
and LGD.184  In this process, institutions should follow the observations below. 

In accordance with Article 181(1)(h) of the CRR, the ELBE must represent the best 
estimate of expected loss given current economic circumstances and exposure 
status. To comply with this requirement, it is the ECB’s understanding that institutions 
should take into consideration the economic conditions expected over the period of 
the recovery process, and in particular reflect downturn conditions in the ELBE, if and 
only if current economic conditions are in a downturn or a downturn is expected over 
the period of the recovery process. This can be done by adding the relevant 
macroeconomic and economic factors as drivers of the ELBE model, as would be the 
case for models complying with any condition of paragraph 184 of the EBA 
Guidelines on PD and LGD, or by adjusting the LRA as referred to in paragraph 185 
of the EBA Guidelines on PD and LGD. Furthermore, in accordance with paragraph 
184 of the EBA Guidelines on PD and LGD, if any of the conditions referred to in that 
paragraph is met (i.e. the model includes directly at least one macroeconomic factor 
as a risk driver, or at least one material risk driver is sensitive to economic 
conditions, or the realised LGD for defaulted exposures is not sensitive to the 
relevant economic factors), then in the ECB’s understanding, the ELBE estimated on 
the basis of the LRA LGD reflects current economic circumstances as required by 
Article 181(1)(h) of the CRR and hence no further adjustments to the LRA LGD 
should be performed by institutions to reflect current economic circumstances. This 
means that, in the ECB’s understanding, where paragraph 184 of the EBA 
Guidelines on PD and LGD applies, the ELBE estimates should not deviate from the 
LRA LGD if the argument for the deviation is based on economic conditions. It is the 
ECB’s understanding that institutions should appropriately account for paragraph 
184 of the EBA Guidelines on PD and LGD when back-testing their ELBE estimates in 
accordance with paragraph 170 of the EBA Guidelines on PD and LGD. To this end, 
where one of the conditions of paragraph 184 is met, the evolution of the ELBE 
estimates over time should be in accordance with that of the average realised LGD 
for defaulted exposures, although the variability of the ELBE time series may be lower 
than that of the average realised LGD for defaulted exposures. 

311.  Under paragraph 193 of the EBA Guidelines on PD and LGD, LGD in-default can be 

estimated directly or as the sum of ELBE and an add-on capturing the unexpected 
loss related to the exposures in default that may occur during the recovery period. In 
particular, the following should be taken into consideration. 

184   In accordance with paragraph 177 of the EBA Guidelines on PD and LGD, for the purpose of ELBE and 
LGD in-default estimation, institutions should analyse the potential risk drivers referred to in paragraph 
121 of the EBA Guidelines on PD and LGD, not only until the moment of default but also after the date 
of default and until the date of termination of the recovery process. For the purposes of ELBE and LGD-
in default estimation, this should include climate-related and environmental risk drivers where those risk 
drivers are assessed as relevant and material. 

ECB guide to internal models – Credit risk 

148 

 
 
(a)  The use of a constant value for unexpected losses for all defaulted exposures is 
not risk sensitive. In the ECB’s understanding, therefore, it does not allow an 
accurate assessment of risk. Where an institution does use a constant value, it 
should justify this. It should demonstrate that the constant value in question is 
an adequate estimate of all the components of unexpected loss envisaged in 
paragraph 193(b) of the EBA Guidelines on PD and LGD during the remaining 
recovery period, i.e. between the date for which estimates are being applied 
and the final closure of the recovery process. This analysis should be 
performed at least for every calibration segment. 

(b)  LGD in-default estimates are generally expected to be higher than ELBE 

estimates and only equal for duly justified individual exposures, which are 
expected to be very limited. 

18 

Conversion factors 

18.1 

Commitments, unadvised limits and scope of application 

18.1.1 

Relevant regulatory references 

Table 17 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

26/06/2013 

4 

5 

151 

166 

(1)(56) 

(9), (10), (11) 

(7), (8) 

(1) to (8), (8a), (8b), (8c) 

312. 

In accordance with Article 151(7) of the CRR, institutions must use IRB-CCFs for the 
retail exposure class where applicable pursuant to Article 166(8) and (8b) of the 
CRR. If they have received permission to use own estimates, in accordance with the 
second sub-paragraph of Article 151(8) of the CRR, for the corporates (general 
corporates, specialised lending, corporate purchased receivables), central 
government and central bank, and regional government and local authorities and 
public sector entities exposure classes, except for the exposures referred to in the 
first sub-paragraph of Article 151(8) of the CRR, they must again use IRB-CCFs as 
set out in Article 166(8) and (8b) of the CRR (Article 151(9) of the CRR). In both 
cases (retail and non-retail exposure classes), the scope of IRB-CCF modelling is, in 
the ECB’s understanding, limited to those off-balance sheet items that are undrawn 
revolving commitments, provided that those exposures would not be subject to a SA-
CCF of 100% under the Standardised Approach as referred to in Article 166(8b) of 
the CRR. 

ECB guide to internal models – Credit risk 

149 

 
 
 
 
 
 
Where IRB-CCFs are used, the exposure value for each exposure used as an input 
of the risk-weighted exposure amount and expected loss formulae is subject to a 
CCF input floor, in accordance with Article 166(8c) of the CRR. The treatment of all 
other off-balance-sheet items which are not contracts as listed in Annex II of the 
CRR, particularly of undrawn non-revolving commitments, and for which the 
institution has not received permission to use IRB-CCFs, is specified in Article 166(8) 
and (8a) of the CRR. In accordance with Article 166(8a), the applicable CCF must be 
the SA-CCF as provided for in Chapter 2 of the CRR for the same types of items as 
laid down in Article 111(2) of the CRR, based on the classification of off-balance-
sheet items established in Annex I of the CRR. 

313. 

“Conversion factor”, “credit conversion factor” or “CCF” means the ratio of the 
undrawn amount of a commitment from a single facility that could be drawn from that 
single facility from a certain point in time before default and therefore outstanding at 
default to the undrawn amount of the commitment from that facility (see paragraph 
317(a) of this chapter), the extent of the commitment being determined by the 
advised limit, unless the unadvised limit is higher.185  The exposure value for the 
undrawn revolving commitments specified in Article 166(8b) of the CRR must be 
calculated as the undrawn amount multiplied by an IRB-CCF.186  To calculate the 
exposure value as required by Article 166(8) of the CRR, institutions should adopt 
the following approach. 

(a)  Treat a facility as an exposure from the earliest date at which the facility is 

recorded in the institution’s systems in a way that would allow the obligor to 
make a drawing. An unadvised limit is any credit limit defined by the institution 
(i) that is above the limit the obligor has been informed of by the institution; and 
(ii) according to which additional drawings are possible, at least temporarily. 
This higher (unadvised) credit limit may be disregarded if its availability is 
subject to a further credit assessment by the institution, as long as this 
additional assessment includes a re-rating or a confirmation of the rating of the 
obligor. 

(b)  Consider as “commitment” any contractual arrangement that an institution offers 

to a client, and is accepted by that client, to extend credit, purchase assets or 
issue credit substitutes and any such arrangement that can be unconditionally 
cancelled, as laid down in Article 5(11) of the CRR, and that meets all the 
criteria laid down in Article 5(10) of the CRR.   

(c)  Consider a commitment as revolving according to Article 166(8b) of the CRR. 

314.  For institutions not using IRB-CCFs for exposures to corporates (general corporates, 

specialised lending, corporate purchased receivables), central governments and 
central banks, and regional government and local authorities and public sector 
entities, Article 166(8a) of the CRR specifies that the SA-CCFs must be used for the 
purpose of calculating RWEA. The amount to which the SA-CCF is to be applied is 
specified in Article 166(8a) of the CRR. 

185   Article 4(1)(56) of the CRR. 
186   Article 166(8) of the CRR. 

ECB guide to internal models – Credit risk 

150 

 
 
18.2 

Realised CCFs 

18.2.1 

Relevant regulatory references 

Table 18 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

26/06/2013 

4 

175 

176 

178 

179 

182 

54 

(1)(56) 

(3) 

(4) 

(1) 

(1)(a), (c) 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

Other references 

EBA Guidelines on DoD 

18/01/2017 

16 

315.  To ensure that a consistent and accurate approach is adopted to calculate the 

realised CCFs, institutions should have in place sufficiently detailed policies and 
procedures. For institutions to comply with the data-related requirements set out in 
Articles 176(4) and 182(1d) of the CRR, their RDS: 

(a)  should not be capped at the principal amount outstanding of a facility or the 

available facility limit; 

(b)  should include all credit obligations (paragraph 16 of the EBA Guidelines on 

DoD), especially accrued interest, other due payments (e.g. fees) and drawings 
in excess of facility limits. 

316. 

In accordance with Articles 4(1)(56) and 182(1)(a) of the CRR, institutions must 
calculate the realised CCF at single facility level for each default. In cases where 
realised LGD is calculated at a more aggregated level than single facility level, as 
described in paragraph 259 above, CCF estimation can be performed at facility level 
or at the LGD aggregation level. One such example is where CCF is estimated by 
facility while several facilities are aggregated for LGD purposes, since they are all 
secured by the same collateral. In this case, institutions should: 

(a) 

for retail exposures where they use the definition of default at facility level in 
accordance with the last paragraph of Article 178(1) of the CRR, apply full 
contagion of default across aggregated facilities; 

(b)  ensure consistency between estimation and application of the parameters; 

(c)  ensure that no bias results from the aggregation of facilities by validation of the 

estimates (PD, LGD, CCF) also at the more aggregated level. 

ECB guide to internal models – Credit risk 

151 

 
 
 
 
 
 
 
 
 
 
 
 
317.  For the purposes of Article 182(1)(a) of the CRR, institutions must compute realised 

CCF. To comply with this requirement, in the understanding of the ECB institutions 
should adopt the following approach. 

(a)  Calculate realised CCF as the ratio of the difference between the drawn amount 
at default date and the drawn amount at the reference date in the numerator, 
and the difference between the limit at the reference date and the drawn 
amount at the reference date (i.e. the committed but undrawn amount at the 
reference date) in the denominator. This does not mean that, to address the 
issues with the “region of instability”, institutions may not use direct EAD 
realisation (as referred to in paragraph 324(a) of this chapter). In any case, all 
the requirements regarding CCF risk quantification referred to in the applicable 
regulation apply, together with the ECB’s understanding of those requirements 
as set out in paragraphs 321, 322, 323 and 327(b) of this chapter. 

(b)  Ensure that the definition of exposure is identical to the one used for LGD 

estimation. In particular, treatment of post-default drawings should be identical 
for the exposures used in both the LGD and CCF estimations. Discounted 
additional drawings are expected to be included in CCF when they are included 
in the LGD denominator. See also paragraph 261(a) above. 

(c)  For each reference date and in cases where the same facility defaults more 
than once during the observation period, consider as the date of default 
relevant for CCF purposes the date of the first default. 

18.3 

CCF structure 

18.3.1 

Relevant regulatory references 

Table 19 

Legal background 

Date of issue 

Article 

Paragraph/Point 

CRR 

26/06/2013 

170 

172 

174 

175 

182 

(1)(b), (2) 

(4) 

318.  A grade or pool is understood by the ECB to be the subset of facilities to which the 

same IRB-CCF is applied for the calculation of regulatory capital requirements, 
irrespective of how this CCF has been assigned. 

319.  To comply with the requirements for the structure of the IRB-CCF models established 

in Articles 170 and 182(1a) of the CRR, and particularly when considering the risk 

ECB guide to internal models – Credit risk 

152 

 
 
 
 
 
 
 
 
 
drivers envisaged respectively in paragraphs (4) and (1)(h) of those articles, 
institutions should: 

(a)  Demonstrate a detailed understanding of the impact of changes in customer 

product mix on the exposures reference datasets and associated IRB-CCF 
estimates and show that the impact is immaterial or has been effectively 
mitigated within their estimation process. This is because “product profile 
transformations” (e.g. a revolving commitment that has been converted into a 
term loan) which commonly occur between reference and default dates can 
impact the CCF model. In that regard, the institution must follow the criteria laid 
down in Article 182(1b) of the CRR. 

(b)  The reference date for the calculation of realised CCF should be set as 

12 months prior to the date of default, as laid down in Article 182(1)(g) of the 
CRR and institutions must analyse risk drivers considering information at the 
reference date, as laid down in sub-paragraph four of Article 182(1) of the CRR. 

(c)  Ensure that the IRB-CCF models reflect the institution’s current policies and 
strategies regarding account monitoring, including limit monitoring, and 
payment processing. 

320.  Where an institution relies on one or more statistical models to define the process of 

assigning exposures to facility grades or pools (or parts of this process) in 
accordance with Article 175(4)(b) of the CRR, it is the ECB’s understanding that for 
institutions to comply with the requirement, set out in Article 144(1)(a) of the CRR, 
that rating systems should provide for a meaningful differentiation of risk as further 
explained in letters (c) and (e) of Article 30(3) of Commission Delegated Regulation 
(EU) No 2022/439, the statistical process followed by the institution in selecting its 
model(s) should include assessing the performance of the model(s) on the basis of 
independent datasets (data points which were left out of the model fitting) in a way 
that limits the risk of overfitting. Independent datasets should correspond not only to 
random sampling (out-of-sample), but also to different time periods (out-of-time) 
unless there are no sufficient data available for the training sample. The expectations 
set out above in this paragraph are specifically related to the model development 
phase. Once the process for assigning exposures to facility grades or pools has 
been defined, the requirements related to the framework for the review of estimates 
under paragraphs 217 to 221 of the EBA Guidelines on PD and LGD (which are also 
relevant for the IRB-CCF estimation, according to paragraph 329 of this chapter) 
apply, together with the expectations set out in Section 20 of this chapter. In 
particular, in accordance with paragraph 218(b)(i) of the EBA Guidelines on PD and 
LGD, the institution must carry out an analysis to identify any potential deterioration 
in the model’s performance, including the model’s discriminatory power, by 
comparing its performance at the time of the development with its performance over 
each subsequent observation period. 

ECB guide to internal models – Credit risk 

153 

 
18.4 

CCF risk quantification 

18.4.1 

Relevant regulatory references 

Table 20 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

26/06/2013 

144 

166 

169 

182 

(1)(a) 

(8) 

(3) 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

53 to 56 

Commission Delegated Regulation (EU) No 2021/930 

01/03/2021 

321.  The exposure value for undrawn commitments for institutions that use IRB-CCF 

must be calculated as the undrawn amount multiplied by an IRB-CCF.187  IRB-CCFs 
can also be derived from direct estimates (for example by modelling total facility 
EAD) in accordance with Article 169(3) of the CRR. In this case, and in order to 
comply with Article 182(1)(a) of the CRR, it is the ECB’s understanding that 
institutions should also calculate the LRA CCF at a level more granular than 
calibration segment that is appropriate for the application of the model, namely using 
individual IRB-CCF values if estimation is discrete or sub-ranges188  of CCF values if 
estimation is continuous. In addition, institutions should ensure that there are no 
systematic deviations when comparing the estimated IRB-CCFs with the LRA 
realised CCFs in sub-ranges. In other words, the direction of divergences should be 
random. 

322. 

In accordance with Article 182(1)(a) of the CRR, institutions are required to calculate 
the default weighted LRA CCF separately for each facility grade or pool. To comply 
with this requirement, institutions should adopt the following approach: 

(a)  Ensure that the historical observation period is as broad as possible and 
contains data from different periods characterised by different economic 
circumstances, including bad years as reflected in economic indicators that are 
relevant for the type of exposures considered. 

(b)  Calculate the observed average CCF for each facility grade or pool on all 

defaults observed in the historical observation period. For this purpose, 
institutions must treat negative realised CCFs as laid down in sub-paragraph 
one of Article 182(1)(a) of the CRR. 

(c) 

Institutions should apply an appropriate treatment to extremely high values of 
realised CCF much above 100%, at the level of data quality, risk drivers, 

187   Article 166(8) of the CRR. 
188   Sub-ranges of CCF values should be defined analogously to those of PD (see paragraph 250(f) of this 

chapter). 

ECB guide to internal models – Credit risk 

154 

 
 
 
 
 
 
 
 
 
 
 
assignment to grades or pools or assignment to calibration segments. To 
ensure that the estimates are accurate, it is the ECB’s understanding that 
institutions are not expected to cap realised CCF values. In other words, they 
are not expected to replace the observed value by a pre-defined value when the 
observed value is above the pre-defined one. 

(d)  When the historical observation period is considered to be representative of the 
LRA, the average realised CCFs should be computed as the arithmetic average 
of the yearly averages of realised CCFs in that period. 

(e)  When the historical observation period is not considered to be representative of 

the LRA: 

(i) 

(ii) 

if bad years are under-represented in the historical observation period, the 
observed average CCF should be adjusted upwards in order to estimate 
an LRA CCF; 

if bad years are over-represented in the historical observation period, the 
observed average CCF may be adjusted to estimate an LRA CCF where 
there is a significant correlation between the economic indicators referred 
to in paragraph 298(a) of this chapter and the available observed CCF. 

(f) 

It is the ECB’s understanding that, where IRB-CCF estimates for specific facility 
grades or pools are low or even zero (in exceptional cases) before the MoC and 
CCF input floor are applied, and in order to ensure that these estimates are 
accurate and not driven by (systematic) errors or distortions, institutions should 
ensure that their estimation process is pertinent and accurate. In particular, they 
should ensure that, in these specific facility grades or pools, there is only a very 
limited number of exposures for which the exposure at the moment of default is 
higher than the drawn amount at the reference date, and that these outcomes 
are carefully monitored and scrutinised. 

323.  To comply with the requirements of Article 182(1)(b) of the CRR and to have IRB-
CCF estimates that are appropriate for an economic downturn, institutions should 
characterise an economic downturn in accordance with Commission Delegated 
Regulation (EU) No 2021/930. To this end, an impact assessment should be 
performed to identify which identified downturn period is most strongly evidenced by 
elevated levels of realised CCFs. Any lag between the downturn period and the date 
of the impact on the realised CCFs should be taken into account. This means that 
where high levels of realised CCFs are not experienced simultaneously with the 
downturn periods, but nevertheless result from it, these high realised CCFs should 
be considered as the CCFs appropriate for the economic downturn. 

324. 

In order to ensure a meaningful assessment of transaction characteristics, as 
required by Article 144(1)(a) of the CRR, particular attention should be given to the 
following observations. 

(a) 

In accordance with Article 182(1c) of the CRR, institutions must ensure that 
their IRB-CCF estimates are effectively quarantined from the potential effects of 
region of instability caused by a facility being close to fully drawn at the 

ECB guide to internal models – Credit risk 

155 

 
reference date. In this regard, institutions should ensure that their IRB-CCF 
model is robust and provides estimates that are effectively protected against 
undesirable issues caused by the “region of instability” and/or that their 
estimates are adjusted adequately. 

(b)  Articles 179 and 182 of the CRR lay down the requirements for IRB-CCF 

quantification. In some cases, institutions define IRB-CCF values which are 
mostly based on judgemental considerations. The ECB understands this 
approach to be compliant with the requirements, provided all the following 
circumstances are met. 

(i)  The exposures to which such CCFs are applied are not material. 

(ii)  The data available are scarce to a degree that prevents the institution from 

obtaining sufficient relevant statistical evidence from them. 

(iii) 

In accordance with Article 179(1)(a) and 179(1)(f) of the CRR, where data 
availability is considered to be unsatisfactory, the MoC must be larger, and 
the less data an institution has, the more conservative its estimation must 
be. The institution should provide evidence that, in accordance with (a) the 
internal data available, (b) the contractual terms of the exposures to which 
the value is applied, and (c) the institution’s policies and processes, the 
IRB-CCF value defined is an objectively conservative IRB-CCF estimate 
(in particular, appropriate for an economic downturn and including a 
sufficient MoC). As a consequence, especially in light of the regulatory 
requirement of MoC related to data scarcity, a minimum value of 100% 
must be applied as the final IRB-CCF estimate. 

(iv)  As part of the framework for the review of estimates of the IRB-CCF model, 
the institution should ensure that the three circumstances set out above 
continue to be met. With respect to point (iii) above, it should be ensured 
that the applied values remain conservative over time by comparing them 
with the realised CCFs of each defaulted facility within the subset of 
exposures to which such values are applied as an IRB-CCF estimate. 

ECB guide to internal models – Credit risk 

156 

 
19 

Model-related MoC 

19.1 

Relevant regulatory references 

Table 21 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

26/06/2013 

179 

182 

44 

(1)(f) 

(1) 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

Other references 

EBA Guidelines on PD and LGD 

20/11/2017 

36 to 52, 92(b) 

325. 

Institutions must add to their estimates a MoC that is related to the expected range 
of estimation errors.189  To comply with this requirement, institutions are expected to 
follow paragraphs 36 to 52 of the EBA Guidelines on PD and LGD. The ECB 
understands that the MoC must reflect the uncertainty at the level of the final risk 
estimates (namely, at the level of the grade or pool). It is also the ECB’s 
understanding that institutions should be able to ensure monotonicity in their final 
estimates while still reflecting the uncertainty at grade or pool level. In accordance 
with paragraph 37(a) of the EBA Guidelines on PD and LGD, the MoC should 
consider any deficiencies stemming from missing or inaccurate information including, 
where relevant and material, any missing or inaccurate climate-related information 
considered in risk estimates. 

326.  Since the MoC requirements laid down by the CRR also apply in cases where 

institutions estimate IRB-CCFs, paragraph 325 of this chapter is also relevant in 
such cases. 

327. 

In the understanding of the ECB, to reflect the dispersion of the statistical estimators 
as set out in paragraph 43(b) of the EBA Guidelines on PD and LGD, institutions 
should adopt the following approach. 

(a)  For PD, estimate a MoC to account for statistical uncertainty/sampling error 

affecting the LRA estimate at grade/pool level. This MoC should be based on 
the distribution of the estimator, which is the average of one-year default rates 
of the grade/pool across time (i.e. the distribution of  (ΣDRt) T⁄ ), considering that 
the uncertainty is primarily driven by the statistical uncertainty of each one-year 
default rate and the length of the time series. As a result, it is expected that the 
lower the number of observations per grade and the shorter the time series are, 
the higher the MoC of the grade should be. 

189   Article 179(1)(f) of the CRR. 

ECB guide to internal models – Credit risk 

157 

 
 
 
 
 
 
 
 
 
 
 
 
Institutions need to be aware of and deal adequately with the dependency 
between default rates over time on the quantification of the MoC, e.g. when 
using overlapping windows for the calculation of default rates. 

The above principles also apply for institutions using direct PD estimates and 
for institutions calibrating the LRA default rate at the level of the calibration 
segment, as referred to in paragraph 92(b) of the EBA Guidelines on PD and 
LGD. When using direct PD estimates, the MoC is based on the distribution of 
this direct PD estimator (which includes the risk differentiation function), 
implicitly reflecting the uncertainty of the LRA. When calibration is performed at 
calibration segment level, the general estimation error may be computed at that 
level when the statistical uncertainty/sampling error is neither significantly 
different across grades or PD sub-ranges nor significantly different between the 
calibration segment level and the grades or PD sub-ranges level. 

(b)  Similarly, for LGD and IRB-CCF, estimate a MoC to account for statistical 

uncertainty/sampling error affecting the final estimates. This MoC should be 
defined on the basis of the distribution of the estimators, considering that their 
uncertainty is primarily driven by the statistical uncertainty of the observations 
used to compute the long-run and downturn estimates and the length of the 
time series. 

20 

Review of estimates 

20.1 

Relevant regulatory references 

Table 22 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

26/06/2013 

172 

174 

179 

35 

43 

(3) 

(e) 

(1)(a), (c) 

(2) 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

Other references 

EBA Guidelines on PD and LGD 

20/11/2017 

217 to 221 

328. 

Institutions must review their estimates whenever new information comes to light but 
at least on an annual basis.190  To comply with this requirement, they are expected to 
have in place a framework under paragraphs 217 to 221 of the EBA Guidelines on 
PD and LGD. 

190   Article 179(1)(c) of the CRR. 

ECB guide to internal models – Credit risk 

158 

 
 
 
 
 
 
 
 
 
 
 
 
329.  Since the review of estimates requirements under the CRR also applies in cases 

where an institution estimates CCFs, paragraph 328 of this chapter is also relevant 
to such cases. 

330. 

In the ECB’s understanding and for the purposes of paragraph 328 of this chapter, 
the following principles apply: 

(a)  For PD models and regarding the analysis of the predictive power envisaged by 

paragraph 218(c) of the EBA Guidelines on PD and LGD: 

(i) 

(ii) 

the analysis should be performed at grade level; for institutions using direct 
PD estimates, it should be performed at a sufficient level of granularity; 

institutions should use a range of metrics to assess predictive ability, 
including statistical tests and graphical analysis of the evolution of default 
rates and PD. 

(b)  The analysis referred to in paragraph 218(c)(i) of the EBA Guidelines on PD 
and LGD should also consider, for CCFs, whether including the most recent 
data leads to a significant change in the LRA CCF or downturn CCF. 

(c)  For LGD models that result from a combination of different components (for 

example, secured and unsecured components), the back-testing analysis 
referred to in paragraph 218(c)(ii) of the EBA Guidelines on PD and LGD should 
be run at both component and facility level. 

(d) 

In addition, institutions should consider in their frameworks for the review of 
estimates the availability of data for different exposure types, taking into 
account the specificities of the model architecture, including the existing and 
potential risk drivers, under paragraph 220 of the EBA Guidelines on PD and 
LGD. When data are scarce, they should use complementary analyses for 
those exposure types where quantitative measures prove inconclusive as a 
result, for example, of the low number of exposures available. 

(e)  Where internal data are not considered sufficient to establish fixed targets and 

tolerances for defined metrics and tools to assess the performance of the PD 
model in terms of risk differentiation, institutions should define and put in place 
the appropriate actions to address this.191  These actions could encompass, for 
example, the use of complementary analyses for those cases where the results 
for the application of metrics and tools are proven to be inconclusive. 

(f)  When external credit bureau scores or ratings are used as the main (or one of 

the main) driver(s) of the internal rating, in cases where significant changes are 
applied to the credit bureau scoring institutions should consider the possibility of 
adjusting their internal data following the changes applied to the score, and 
whenever the input variables are no longer considered appropriate in their 
credit rating process. 

191   As set out in Article 35(2) of Commission Delegated Regulation (EU) No 2022/439. 

ECB guide to internal models – Credit risk 

159 

 
 
331. 

In the case of material models where the assignment of the grade is based on a 
statistical model and where there is a risk that slight changes in the ranking of the 
obligors, or in the boundaries between grades, could lead to significant changes in 
the RWEA in that portfolio, the framework referred to in paragraph 328 of this 
chapter should also include an analysis of whether the inclusion of the most recent 
data in the RDS used for model development would lead to materially different model 
outcomes. This analysis should be conducted on a three-yearly basis, or more often, 
depending on the materiality of the model. The analysis should consider, in 
particular, whether the discriminatory power of the PD, LGD or CCF models would 
be materially increased when re-estimating the model parameters on the basis of the 
updated RDS. Portfolios should be considered as falling into this category when, for 
example: (i) a limited number of obligors represent an important share of the total 
exposure; or (ii) exposures are concentrated near the boundaries between two 
grades. 

332.  When the number of default observations is low, to analyse whether the main drivers 
of the observed defaults are appropriately reflected in the model in accordance with 
Article 179(1)(a) of the CRR192  institutions should analyse individual defaults (or at 
least a sample of them where the number of defaults makes analysing all of them 
unduly burdensome). However, the model should not be adapted simply to fit 
singular events from the institution’s file review. 

333. 

In accordance with Article 172(3) of the CRR, for grade and pool assignments 
institutions must document those situations in which human judgement may override 
the inputs or outputs of the assignment process. In addition, institutions must 
complement the statistical model by human judgement and human oversight to 
review model-based assignments and ensure that the models are used 
appropriately.193  Furthermore, review procedures must be designed to find and limit 
errors associated with model weaknesses.194  To comply with these requirements, 
institutions should assess the impact of the application of human judgement on risk 
differentiation capability (e.g. on discriminatory power), under paragraph 218(b) of 
the EBA Guidelines on PD and LGD. 

192   This article requires that estimates be based on the material drivers of the respective risk parameters. 
193   Article 174(e) of the CRR. 
194   Article 174(e) of the CRR. 

ECB guide to internal models – Credit risk 

160 

 
 
21 

Calculation of maturity for non-retail exposures 

21.1 

Relevant regulatory references 

Table 23 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

Commission Delegated Regulation (EU) No 2022/439 

20/10/2021 

26/06/2013 

162 

70 

(1), (2), (3) 

(d)(i), (ii) 

334.  For the cases described in Article 162(2)(f) of the CRR, the maturity parameter (M) 
must be the maximum remaining time (in years) that the obligor is permitted to take 
to fully discharge its contractual obligations, including principal, interest and fees. In 
the ECB’s understanding, M should be calculated using the expiry date of a facility. 
The repayment date of a current drawn amount should not be used. 

335.  To ensure that the calculation of the maturity parameter is correct and to avoid any 

possible errors, for the purposes of Article 162(1), (2) and (3) of the CRR, institutions 
should adequately justify and document any exemptions from the one-year maturity 
floor.

ECB guide to internal models – Credit risk 

161 

 
 
 
 
 
 
Market risk – CRR2 

1 

Scope of the market risk chapter 

1. 

The purpose of this chapter is to provide transparency on how the ECB understands 
a number of topics related to internal models used in the calculation of own funds 
requirements for market risk. It is important to note that this chapter does not aim to 
cover exhaustively all topics that could be subject to review during internal model 
investigations (such as, for example, model governance). The topics covered in the 
market risk chapter have been selected taking into account the requirements of the 
Capital Requirements Regulation (CRR) and focus on certain modelling aspects 
relating, for example, to regulatory back-testing of value-at-risk (VaR) models, to VaR 
and stressed VaR (sVaR) methodologies, and to the incremental default and 
migration risk charge (IRC) methodology. 

ECB guide to internal models – Market risk – CRR2 

162 

 
2 

Scope of the internal model approach 

2.1 

Relevant regulatory references 

Table 24 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/ 
Point 

26/06/2013 

4 

6 

7 

11   

18 

92   

103 

104 

106 

325b,349 

350 

352   

353 

362, 363 

364 

367 

368, 370, 372 

382 

386 

(1) 

(1) 

(1) 

(3), (4) 

(1) 

(1) 

(1), (2) 

(2), (3) 

(3) 

(2) 

(2), (3) 

(4) 

(1), (3) 

Commission Delegated Regulation on materiality of extensions and 
changes of the IMA1 

04/03/2015 

SSM Regulation2 

Other references 

15/10/2013 

10 

EBA Guidelines on the IRC3 

16/05/2012 

4, 7 

Final draft RTS on assessment methodology for IMA and significant share4 

22/11/2016 

Section 2, recital (20) 

1    Commission Delegated Regulation (EU) 2015/942 amending Delegated Regulation (EU) No 529/2014 

supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council as regards 
regulatory technical standards for assessing the materiality of extensions and changes of internal 
approaches when calculating own funds requirements for market risk (OJ L 154, 19.6.2015, p. 1) 
referred to in this guide as the “Commission Delegated Regulation on materiality of extensions and 
changes of the IMA”. 

2    Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European 
Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 
29.10.2013, p. 63), referred to in this guide as the “SSM Regulation”. 

3    EBA Guidelines on the Incremental Default and Migration Risk Charge (IRC) (EBA/GL/2012/3), referred 

to in this guide as the “EBA Guidelines on the IRC”. 

4    EBA Final draft Regulatory Technical Standards on the specification of the assessment methodology 
for competent authorities regarding compliance of an institution with the requirements to use internal 
models for market risk and assessment of significant share under points (b) and (c) of Article 363(4) of 
Regulation (EU) No 575/2013 (EBA/RTS/2016/07), referred to in this guide as the “Final draft RTS on 
assessment methodology for IMA and significant share”. 

ECB guide to internal models – Market risk – CRR2 

163 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Once adopted by the European Commission, the Final draft RTS on assessment 
methodology for IMA and significant share will become an additional relevant 
regulatory reference. Currently that document only exists in a final draft version. 

2.2 

Delimitation of the regulatory trading book 

2. 

3. 

4. 

5. 

6. 

According to Article 4(1)(86) of the CRR, “trading book” means all positions in 
financial instruments and commodities held by an institution either with trading intent, 
or in order to hedge positions held with trading intent in accordance with Article 104 
of the CRR. 

In accordance with Article 104 of the CRR, institutions must have clearly defined 
policies and procedures for determining which positions to include in the trading 
book for the purpose of calculating their capital requirements (referred to in this 
guide as the “regulatory trading book”). The ECB considers that, in this context and 
in accordance with Article 4(1)(86) of the CRR, “positions” refers to positions in 
financial instruments (as defined in Article 4(1)(50) of the CRR) and commodities, 
and not to risk positions as referred to in the abbreviations included in this guide. The 
ECB understands that positions that are classified as “held for trading” for accounting 
purposes are presumed to be included in the regulatory trading book. Therefore, 
institutions should be able to list all positions that are classified as “held for trading” 
for accounting purposes but not included in the regulatory trading book, and should 
be able to justify these exclusions. 

As the instruments and transactions are included either in the regulatory trading 
book or in the non-regulatory trading book (referred to in this guide as the “banking 
book”), the ECB understands that the policies required by Article 104 of the CRR 
should also encompass rules for moving instruments between the regulatory trading 
book and the banking book. 

In order for the ECB to assess the appropriateness and implementation of the 
policies and procedures for determining which positions to include in the regulatory 
trading book, the ECB can, on the basis of Article 10 of the SSM Regulation, require 
institutions to provide a list of types of positions and instruments allocated to the 
regulatory trading or the banking book, identify all related transactions including their 
relevant characteristics, and justify such allocation. 

In view of their nature in terms of trading intent, the ECB considers that the following 
types of instruments and transactions are expected to be included in the regulatory 
trading book: 

(a) 

instruments in the correlation trading portfolio; 

(b) 

instruments resulting from securities underwriting commitments; 

ECB guide to internal models – Market risk – CRR2 

164 

 
(c) 

instruments held as accounting trading assets or liabilities (“held for trading” 
assets and liabilities)5; 

(d) 

instruments resulting from market-making activities; 

(e) 

listed equities (other than equity investment funds); 

(f) 

trading-related repo-style transactions (repo-style transactions that are 
(i) entered into for liquidity management purposes and are (ii) valued at accrual 
for accounting purposes, are not presumed to be trading-related); 

(g) 

instruments that would give rise to net short risk positions6  for equity risk or 
credit risk in the banking book; 

(h)  options including bifurcated embedded derivatives7  from instruments issued out 

of the banking book that relate to credit or equity risk. 

7. 

In view of their nature in terms of trading intent, the ECB considers that the following 
types of instruments and positions are expected be included in the banking book: 

(a)  unlisted equities; 

(b) 

instruments designated for securitisation warehousing; 

(c) 

real estate holdings; 

(d) 

retail credit and credit to small and medium-sized enterprises (SMEs); 

(e)  other types of credit; 

(f)  equity investments in a fund for which the institution cannot obtain daily price 

quotes8; 

(g)  derivative instruments that have any of the types of instrument mentioned in 

points (a) to (f) as an underlying asset; 

(h) 

instruments held for the purpose of hedging a particular risk of a position in any 
of the types of instrument mentioned in points (a) to (g). 

8. 

In addition, for each category listed in paragraphs 6 and 7, institutions should be able 
to indicate to what extent the corresponding positions are included within the scope 
of the internal model approach (IMA). 

5    Under IFRS 9, these instruments would be held within a trading business model and would be 

accounted for at fair value though the profit and loss (P&L) account. 

6    An institution will have a net short risk position for equity risk or credit risk if the present value of the 

position increases when an equity price decreases or when the credit spread of an issuer or group of 
issuers of debt increases. 

7    Bifurcation means the separation of a derivative that is embedded in a hybrid security and that has to 
be separated according to accounting rules from the host security, and which has to be accounted for 
using the accounting rules for derivatives. 

8    Where an institution is aware of the underlying investments of the fund on a daily basis, the underlying 
investments might be assigned to the trading or banking book depending on their characteristics, 
irrespective of the availability of daily price quotes for the fund itself. 

ECB guide to internal models – Market risk – CRR2 

165 

 
 
9. 

In accordance with Article 106(1) of the CRR, internal hedges (as defined in 
Article 4(1)(96) of the CRR) must be properly documented and not be primarily 
intended to avoid or reduce own funds requirements. Therefore, institutions should 
be able to identify9  all internal hedges and should document their treatment for the 
purpose of calculating own funds requirements for market risk. In accordance with 
Article 106(1)(d) of the CRR, the market risk that is generated by an internal hedge 
must be dynamically managed in the regulatory trading book within the authorised 
limits. For this reason, the ECB considers that proper documentation should 
distinguish between 

(a)  hedges of a banking book credit risk exposure (or counterparty credit risk 
exposure) using an internal risk transfer with the regulatory trading book; 

(b)  hedges of a banking book equity risk exposure using a hedging instrument 

purchased from the market through the regulatory trading book; 

(c)  hedges of a banking book interest rate risk exposure using an internal risk 

transfer with the regulatory trading book; 

(d)  hedges of a banking book foreign exchange risk exposure using an internal risk 

transfer with the regulatory trading book; 

(e)  hedges of a banking book commodity risk exposure using an internal risk 

transfer with the regulatory trading book; 

(f)  eligible hedges (as defined in Article 386(1) of the CRR) that are included in the 

credit valuation adjustment (CVA) capital charge. 

Additionally, institutions should be able to identify internal transactions which are in 
the regulatory trading book10  and within the scope of the internal model, and show 
that these transactions do not contribute to the own funds requirements obtained 
using the internal model. 

10. 

In accordance with Article 386(3) of the CRR, eligible CVA hedges that are included 
in the calculation of the own funds requirements for CVA risk must not be included in 
the calculation of the own funds requirements for specific risk of debt instruments. 
The ECB therefore considers that they should be included in the scope of calculation 
of own funds requirements for general risk (for example, included in the VaR and 
sVaR, or treated through the framework for risks-not-in-the-VaR or sVaR engine – 
see Section 7). Additionally, other (i.e. non-eligible) CVA hedges in the regulatory 
trading book should be included in the calculation of own funds requirements for 
market risk (i.e. general and specific risk). The ECB considers that positions entered 
into with the purpose of hedging CVA risks for counterparties which are exempted 
from the own funds requirement for CVA risk, in accordance with Article 382(4) of the 

9    To “identify” here means to be able to spot these trades among the institution’s transactions. The 
institution is not required to be able to segregate internal hedges in dedicated portfolios on which 
specific analysis is carried out. 

10    For example, transactions within the scope of the IMA made between two trading units. 

ECB guide to internal models – Market risk – CRR2 

166 

 
 
CRR, should also be included in the calculation of own funds requirements for 
market risk (i.e. general and specific risk). 

11. 

In accordance with Article 362 of the CRR, position risk on a traded debt instrument 
may be divided into two components: specific risk and general risk. In accordance 
with the same article, general risk of traded debt instruments refers to the risk of a 
price change due to a change in the level of interest rates. The ECB considers that 
this is a reference to risk-free interest rates and does not include counterparty credit 
spread risk (i.e. the risk of a price change due to a change in the credit spread of the 
counterparty to a transaction). In accordance with the same article, specific risk of 
debt instruments refers to the risk of a price change due to factors related to its 
issuer or, in the case of a derivative, the issuer of the underlying instrument. The 
ECB considers that this definition of specific risk does not include counterparty credit 
spread risk. Consistent with this interpretation, the ECB considers that counterparty 
credit spread risk does not fall under the definition of either general or specific risk, 
cannot be included in the scope of the IMA and is not part of the actual or 
hypothetical profit and loss (P&L) for back-testing. 

12.  Back-to-back transactions in the regulatory trading book (i.e. transactions exactly 
matched with a third-party transaction) are generally included in the calculation of 
own funds requirements for market risk. The ECB considers that back-to-back 
transactions included in the scope of the internal model may be excluded from the 
calculation of own funds requirements, provided that institutions are able to 
document them and demonstrate that there are no residual market risks stemming 
from these transactions. However, potential P&L generated by these back-to-back 
transactions should be considered in the back-testing (for those P&L components 
that are not excluded from the actual or hypothetical P&L). This is because, although 
they do not carry residual market risks, such back-to-back transactions could 
generate P&L (for example, at the inception of the trade, or where the transaction is 
closed before maturity). 

13. 

The ECB understands that instruments in the regulatory trading book which are lent 
out or repoed out should be included in the calculation of own funds requirements for 
market risk. Conversely, instruments borrowed/obtained via securities lending or 
reverse repo should not be included in the calculation of own funds requirements for 
market risk. This is because the securities lending or repo transaction does not 
transfer the market risk of the security. Furthermore, the market risk of the securities 
lending or repo transaction should be captured (if this transaction is recorded in the 
trading book). 

2.3 

Treatment of banking book positions 

14. 

In accordance with Article 92(4)(a) of the CRR, for foreign exchange (FX) risk and 
commodities risk the own funds requirements must include those arising from all the 
business activities of an institution. Therefore, the ECB understands that for FX risk 
and commodities risk, the requirements for the calculation of own funds and, in 

ECB guide to internal models – Market risk – CRR2 

167 

 
15. 

16. 

17. 

particular, the IMA are not limited only to regulatory trading book positions but also 
include the positions in the banking book. 

For institutions that have approval to use the IMA for FX risk, the ECB is aware that 
the modelling of banking book FX positions in the internal model may be challenging 
owing to different trade booking systems and different market data processes for the 
banking book and for the regulatory trading book. In accordance with Article 363(2) 
of the CRR, permission to use internal models for market risk will be granted only if 
the internal model covers a significant share of the positions of a certain risk 
category.11  Therefore, institutions may exclude banking book FX positions from the 
scope of the internal model, provided that they can demonstrate to the satisfaction of 
the ECB that the scope of the approved internal model nevertheless covers a 
significant share of the positions of the FX risk category. If that is the case, the 
banking book FX exclusions should be treated in the same way as those positions 
excluded from the regulatory trading book (see Section 2.5). 

In accordance with Article 92(3)(c) of the CRR, the own funds requirements for 
foreign exchange risk must be determined in accordance with the CRR provisions for 
market risk (using either the standardised approach or the IMA). Therefore, where 
excluded from the internal model, the banking book FX positions must be subject to 
own funds requirements calculated according to the standardised approach. The 
ECB considers a prudent approach to be that for the purpose of this own funds 
requirement calculation, banking book FX positions are not netted with regulatory 
trading book FX positions. 

In accordance with Article 368(1)(e) of the CRR, institutions must have established 
procedures for monitoring and ensuring compliance with a documented set of 
internal policies and controls concerning the overall operation of their internal 
models. To satisfy the requirements of Article 368(1)(e) of the CRR, institutions 
should have documented processes and methodologies in place for determining FX 
positions. The ECB considers that in order to adequately cover the overall operation 
of the internal model, such documentation should include, in particular, the 
intermediate steps followed for calculating the FX positions, beginning with each 
individual subsidiary and proceeding to the group level (for example, before and after 
netting, the treatment of intragroup deals, the methodology applied to derive the FX 
position of banking book items including whether the institution applies the provisions 
of Article 352(3) of the CRR). 

If an institution excludes any balance sheet items denominated in foreign currency 
from the FX positions in accordance with the provisions of Article 352(2) of the CRR, 
it should document in detail which positions are covered by the exclusion – including 
details on the materiality of each of them – and the justification for the exclusion, so 
that the institution can demonstrate that the provisions of the article have been 
complied with. In particular, this also applies at the consolidated and sub-
consolidated levels to balance sheet items in foreign currencies that stem from 

11    See also Section 2 of the Final draft RTS on assessment methodology for IMA and significant share. 

ECB guide to internal models – Market risk – CRR2 

168 

 
 
18. 

19. 

consolidated subsidiaries and is without prejudice to the extent and manner of 
prudential consolidation prescribed in Article 18 of the CRR. 

In order for the ECB to assess whether banking book FX positions have been 
excluded from the scope of application of the IMA for the sole purpose of reducing 
the own funds requirements for market risk, the ECB can, on the basis of Article 10 
of the SSM Regulation, require an institution to estimate the difference between the 
own funds requirements calculated under the standardised approach and the own 
funds requirements calculated under the IMA12  for those banking book FX 
positions.13 

The ECB is aware that (in contrast to FX positions) it is not common practice to 
include commodities positions in the banking book. However, where an institution 
has permission to use the internal model for commodities risk, commodities positions 
in the banking book should not be systematically excluded from the scope of 
application of the internal model. 

2.4 

Partial use models 

20. 

21. 

If an institution does not have permission to use an internal model to calculate the 
own funds requirements for market risk for all of the six risk categories listed in 
Article 363(1) of the CRR, but only for some of them (for the purposes of this guide, 
referred to as “partial use”), the institution must apply the standardised approach in 
accordance with Article 363(2) of the CRR to calculate the own funds requirements 
for the risk categories for which it has not been granted permission. 

In the case of portfolios for which the bulk of the risks fall outside the scope of the 
approved risk categories of an internal model14, institutions may completely carve out 
such portfolios from the scope of application of the internal model, provided that the 
internal model still covers a significant share of the relevant risk categories. The ECB 
considers it best practice to carve out such portfolios only if the overall own funds 
requirements for market risk after the carve-out are higher than they would have 
been if the carve-out had not been performed. Institutions should duly notify the ECB 
of such exclusions in accordance with the Commission Delegated Regulation on 
materiality of extensions and changes of the IMA. Institutions should, nevertheless, 
ensure that the risks of these portfolios are adequately managed. Institutions should 
determine the own funds requirements for the carved-out portfolios according to the 
standardised approach (for all risk categories, including those for which the 
institution has permission to use the internal model). 

22.  Portfolios for which the bulk of the risks fall within the scope of the model approval 
should be included in the calculation of own funds requirements using the internal 

12    For estimating the own funds requirements under the IMA, the calculation can be based on only one 

date, rather than the average over the last 60 business days. 

13    FX positions excluded from the scope of the calculation of the own funds requirements for market risk 
in accordance with Article 352(2) of the CRR would not need to be considered for this comparison. 
14    A typical example would be a portfolio of equity options for an institution that has no permission to 

model equity risk, so that it only models the position risk of debt instruments. 

ECB guide to internal models – Market risk – CRR2 

169 

 
 
model (for the risk categories within the scope of the internal model permission). The 
own funds requirements for the risks not included in the scope of the internal model 
permission should be determined according to the standardised approach. 

23. 

In accordance with Article 362 of the CRR, general risk of debt instruments refers to 
the risk of a price change due to a change in the level of interest rates. The ECB 
considers that this is a reference to risk-free interest rates. In accordance with 
Article 362 of the CRR, general risk of equity instruments refers to the risk of a price 
change due to a change of a broad equity-market movement unrelated to any 
specific attributes of individual securities. The ECB considers that this is a reference 
to index movements. An institution without permission to use the IMA for the specific 
risk of debt or equity instruments, and which applies a different definition of general 
risk of debt or equity instruments (as applicable) should be able to demonstrate that 
the definition/s it applies lead to at least the same level of own funds requirements 
that would result from applying the principles of this paragraph. 

2.5 

Exclusion of positions in the regulatory trading book from the scope 
of application of the IMA 

24. 

In accordance with Article 363(2) of the CRR, an internal model must cover a 
significant share of the positions of each risk category for which the permission is 
granted. The ECB understands that this requirement applies not only on the date on 
which the permission is granted, but on an ongoing basis. The ECB is aware that 
institutions have a certain margin of discretion not to include all positions exposed to 
the relevant approved risk categories, provided that the internal model still covers a 
significant share of those positions. In the ECB’s view, exclusions would be justified 
where the inclusion of those positions in the internal model is operationally 
challenging (for example, in the case of products requiring a more sophisticated 
modelling approach). Exclusions should never be made for the sole purpose of 
reducing the overall own funds requirements for market risk. 

The ECB considers that to be able to demonstrate that the internal model covers a 
significant share of positions, institutions should monitor the exclusion of market risk 
positions, including the materiality of those positions. In the case of FX and 
commodities risks, this monitoring should also extend to exclusions of banking book 
positions. This monitoring should consider all excluded positions in accordance with 
each relevant scope of approval of the internal model, which could be at individual 
(“solo”), sub-consolidated, or consolidated level. Institutions should be able to justify 
such exclusions and demonstrate that the risk of the excluded positions is 
adequately managed. 

25. 

The own funds requirements for the positions deliberately excluded by the institution 
from the internal model (including any banking book positions) should be determined 
according to the standardised approach. For these positions, institutions should be 
able to demonstrate that the level of own funds requirements under the standardised 

ECB guide to internal models – Market risk – CRR2 

170 

 
26. 

27. 

28. 

approach is commensurate with their risks and that the exclusion was not made for 
the sole purpose of reducing the overall own funds requirements for market risk.15 

The ECB considers that an appropriate approach to calculating the own funds 
requirements for derivatives on unusual underlyings (such as temperature, weather 
or mortality)16  could be to include them in the scope of the IMA (the “exotic” risks 
might be treated under the risks-not-in-the-model-engines (RNIME)17” framework, 
where necessary). However, institutions may use the standardised approach for 
these positions, provided that they can demonstrate that the level of own funds 
requirements under the standardised approach is commensurate with the risks of 
such positions. 

The ECB considers that a materiality criterion at transaction level (for example, a 
notional amount lower than a certain EUR amount) is not an appropriate criterion by 
itself for an exclusion from the scope, because the cumulative effect of these 
transactions may be a material position. Therefore, this type of exclusion should not 
be applied. 

If back-to-back transactions are excluded from the calculation of own funds 
requirements using the internal model (in the circumstances set out in 
paragraph 12), it is not necessary – as it is with other excluded positions – to 
calculate the own funds requirements for these transactions under the standardised 
approach, as no residual market risks stem from them. 

2.6 

Treatment of specific positions 

2.6.1 

Own-debt exposures 

29. 

For the purposes of this guide, the meaning of “own debt” requires clarification, given 
that the CRR does not provide a definition. As defined in Article 4(1)(47) of the CRR, 
“consolidated situation” means the situation that results from applying the 
requirements of the CRR to an institution as if that institution formed, together with 
one or more other entities, a single institution. As defined in Article 4(1)(49) of the 
CRR, “sub-consolidated basis” means “… on the basis of the consolidated situation 
of a parent entity … that is not the ultimate parent entity”. Therefore, the ECB 
considers an acceptable approach to be that when determining their own-debt 
positions, institutions using an IRC model also take into account the debt positions in 
their subsidiaries within the scope of prudential consolidation, depending on the level 
within the group of the institution using the IRC model. 

15    This understanding is also supported by Article 13(b) of the Final draft RTS on assessment 

methodology for IMA and significant share. 

16    The EBA considers that certain “unusual” underlyings, such as freight rate, weather derivatives or 

emission certificates can be considered as, or assimilated to, commodities (see question ID 2014_934 
in the EBA Single Rulebook Q&A). 

17    See Section 7 of this chapter for more details. 

ECB guide to internal models – Market risk – CRR2 

171 

 
 
30.  By way of illustration, the positions described in the following situations can be 
considered as own-debt exposures. Figures 1, 2 and 3 below each illustrate an 
example, as indicated. 

• 

• 

• 

Figure 1: Where the institution is the group EU parent institution –   
all positions in debt exposures to institutions within the prudential consolidation 
scope should be considered as own-debt exposures. 

Figure 2: Where the institution is the sub-consolidating institution or financial 
holding company that is not the ultimate EU parent institution –   
all positions in debt exposures to institutions within the relevant prudential sub-
consolidation scope should be considered as own-debt exposures. 

Figure 3: Where the institution is a subsidiary without dependent subsidiaries 
(solo) – all debt exposures of an institution to itself at the solo level should be 
considered as own-debt exposures. 

This is without prejudice to other definitions of own debt that institutions may apply 
and that the ECB will assess on a case-by-case basis to take into account specific 
circumstances. 

Figure 1 
Own-debt positions at the consolidated level 

Own-debt positions at the consolidated level are shown with a blue background. 

ECB guide to internal models – Market risk – CRR2 

172 

 
 
Figure 2 
Own-debt positions at the sub-consolidated level of the sub-consolidating institution 
or financial holding company SC1 

Own-debt positions at the sub-consolidated level of the sub-consolidating institution or financial holding company SC1 are shown with 
a blue background, while non-own-debt positions at the sub-consolidated level of SC1 are shown with a red background. 

Figure 3 
Own-debt positions at the solo level of subsidiary S1 

Own-debt positions at the solo level of subsidiary S1 are shown with a blue background, while non-own-debt positions at the solo level 
of S1 are shown with a red background. 

31.  Under paragraphs 7.1 and 7.2 of the EBA Guidelines on the IRC, for long or short 

positions in an institution’s own debt which may arise from trading or market-making 
activity in its own-debt issuances, or from trading protection in the institution’s own 
name (for example, via an index), the institution should only model the migration risk. 
The default risk of these positions should not be modelled in the IRC approach. 

To ensure consistency with the IRC model when modelling the specific risk of debt 
instruments in the VaR and sVaR models, institutions should include their own 
creditworthiness.18  The ECB considers it best practice to model such own 
creditworthiness as (a) separate risk factor(s) in the VaR and sVaR models.19  In 
addition, in accordance with Article 367(1)(a) of the CRR, the model must accurately 
capture all material price risks. Therefore, the ECB understands that the funding risk 
embedded in own liabilities held in the trading book should be modelled in the IMA. 

18    This refers exclusively to position risk taken against debt issued by the institution or derivatives 

referencing that debt and does not refer to debit valuation adjustments (DVA). 

19    This understanding is also supported by Recital (20) of the Final draft RTS on assessment 

methodology for IMA and significant share. 

ECB guide to internal models – Market risk – CRR2 

173 

 
 
 
 
32.  As regards the general risk of debt instruments for own debt, and in the absence of 
any specific provision in the CRR or the EBA Guidelines on the IRC, the ECB 
understands that the general risk of own-debt instruments should be accommodated 
in the internal model if the institution has the relevant approval. 

2.6.2 

Positions in defaulted debt 

33.  Under paragraph 4.5 of the EBA Guidelines on the IRC, institutions should include in 

the calculation of the IRC the positions in defaulted debt that are held in the 
regulatory trading book, where material. In order for the ECB to assess the 
appropriateness of the treatment of such positions, the ECB can, on the basis of 
Article 10 of the SSM Regulation, require institutions to provide a list of all positions 
in defaulted debt that are held in the regulatory trading book, along with the following 
information: 

(a) 

the market value of the exposure; 

(b)  notional value of the exposure; 

(c)  a Boolean variable indicating whether the positions are included in the 

VaR/sVaR; 

(d)  a Boolean variable indicating whether the positions are included in the IRC. 

34. 

The ECB considers that to reflect paragraph 4.5 of the EBA Guidelines on the IRC, 
material positions in defaulted debt should be included in the scope of the IMA. It 
also considers it best practice that non-material positions are included in the IMA; 
either in the VaR, sVaR (and IRC) engines or under the RNIME framework for the 
VaR, sVaR (and IRC). 

35.  Under paragraph 4.5 of the EBA Guidelines on the IRC, positions in defaulted debt 
held in the regulatory trading book should, where material, be included in the 
calculation of the IRC. In accordance with the requirement in Article 372(d) of the 
CRR as it relates to Article 370(e), the IRC model must be sensitive to material 
idiosyncratic differences between similar but not identical positions. Therefore, the 
ECB considers that when modelling the risk of price changes of positions in 
defaulted debt in the IRC, and to account for those idiosyncratic differences, 
institutions should apply a specific calibration of the recovery rates which is 
appropriate for the positions in defaulted debt. If an institution does not have the 
capacity to model price changes of positions in defaulted debt in the IRC model (for 
example, owing to IT constraints), the ECB considers that an appropriate way to 
account for those differences is to apply a stressed price of the positions in defaulted 
debt that is proven to be adequately conservative given the quantile and holding 
period of the IRC. 

36. 

The ECB considers that default should be an absorbing state (i.e. once a position 
has defaulted it does not migrate to a different state). Therefore, the ECB considers 

ECB guide to internal models – Market risk – CRR2 

174 

 
it best practice that no migration from default to non-default states is considered in 
the IRC model. 

2.6.3 

Collective investment undertakings 

37. 

38. 

This paragraph, and the following paragraphs 38 to 43 inclusive, apply to all 
exposures that institutions may have in collective investment undertakings (CIUs), as 
referred to in Article 4(1)(7) of the CRR (including exchange-traded funds (ETFs), 
equity investments in hedge funds, etc.) – which for the purposes of these 
paragraphs are referred to as “positions in CIUs” – and also apply to derivative 
instruments that have these instruments as underlying assets. 

In accordance with Articles 368(1)(e) and 103(1) of the CRR, institutions must have 
established procedures for ensuring compliance with a documented set of internal 
policies and controls concerning the overall operation of their internal models and the 
regulatory trading book. Therefore, the ECB considers that in order to ensure that an 
appropriate treatment is applied to positions in CIUs in their internal models for 
market risk, institutions should have a documented set of policies and controls in 
place to identify, for each CIU, the following: 

(a) 

the risk categories, as listed in Article 363 of the CRR, to which the CIU is 
subject; 

(b)  whether the criteria as defined in Article 349 of the CRR are fulfilled; 

(c)  whether daily look-through is possible, as referred to in Article 350(1) of the 

CRR; 

(d)  where daily look-through is not possible, whether the requirements as laid down 
in Article 350(2) of the CRR are satisfied – in particular, institutions should 
define and document the methodology used to assess the correlation between 
the CIU and the index/basket that it tracks; 

(e) 

the extent to which the CIU can be marked-to-market daily by reference to an 
active, liquid two-way market as referred to in Article 103(1) of the CRR (for 
example, whether a daily liquid price is available). 

39. 

The above information in relation to each CIU should be documented. In the ECB’s 
view it is necessary to update the information regularly, in order to ensure that the 
documented information is based on the current characteristics of the positions in 
CIUs and fully reflects the market risk to which the positions are exposed. The ECB 
considers that an appropriate update frequency for existing positions in CIUs is at 
least annual, as one year is a reasonable time in which significant changes in the 
market or in the positions in CIUs could occur. In addition, this time frame would 
allow institutions to use the outcomes of the updates in the review of their overall risk 
management process, as referred to in Article 368(2) of the CRR. For new positions 
in CIUs, the ECB considers that the procedure should take place before the 
investment in a new CIU is approved internally, in order to ensure that institutions 

ECB guide to internal models – Market risk – CRR2 

175 

 
compute own funds requirements for the positions in CIUs in compliance with the 
CRR requirements. 

40. 

For the foreign exchange market risk related to CIUs, the CRR contemplates a 
specific treatment. In accordance with Article 367(2)(b) of the CRR, the actual foreign 
exchange positions of a CIU must be taken into account in the internal model. 
Institutions may rely on third-party reporting of the foreign exchange positions of a 
CIU where the correctness of that reporting is adequately ensured. If an institution is 
not aware of the foreign exchange positions of a CIU, this position must be carved 
out and treated in accordance with Article 353(3) of the CRR. 

41.  As regards general and specific risk of equity instruments, general and specific risk 
of debt instruments, and commodities risk: for those positions in CIUs for which the 
conditions for either the look-through approach (as referred to in Article 350(1) of the 
CRR) or the representation approach (as referred to in Article 350(2) of the CRR) are 
met, the ECB considers that in order to ensure an accurate risk measurement, the 
own funds requirements for the general and specific risk of equity instruments, the 
general and specific risk of debt instruments and the commodities risk should be 
calculated by incorporating the underlying investments of the relevant CIU – or the 
index/basket that it tracks – into the internal model for the risk categories for which 
the institution has permission to use internal models. 

Where an institution with internal model approval for specific risk of debt instruments 
includes listed equity positions in the IRC, it should be consistent in including in the 
IRC either the underlying listed equity positions of the CIU, or those of the 
index/basket that the CIU tracks. 

42. 

For positions in CIUs where neither the conditions for the look-through approach as 
referred to in Article 350(1) of the CRR nor the conditions for the representation 
approach as referred to in Article 350(2) of the CRR are met, the following apply. 

(a) 

In accordance with Article 364(2)(a) of the CRR, institutions using an internal 
model to calculate their own funds requirements for specific risk of debt 
instruments must fulfil an additional own funds requirement for specific risk of 
debt instruments in accordance with the standardised approach for positions in 
CIUs under Articles 348 to 350 of the CRR. 

(b)  The ECB considers that the positions in CIUs can be incorporated into the VaR 
and sVaR models as a single risk factor to account for the general and specific 
risk of equity, the general risk of debt instruments, and the commodities risk of 
the positions in CIUs. As is the case for any other position, sufficient objective 
information on market risk should be available. The ECB considers that a 
suitable approach is to use the daily liquid price of the CIU. 

43. 

For those risk categories in respect of which the institution does not use an internal 
model to compute own funds requirements for market risk, or for positions in CIUs to 
which none of the above-mentioned provisions apply, the institution should compute 
the own funds requirements for the respective positions in CIUs according to the 
standardised approach for CIUs. 

ECB guide to internal models – Market risk – CRR2 

176 

 
2.7 

Aggregation requirements 

44. 

In accordance with Article 363 of the CRR, competent authorities may grant 
permission to institutions to calculate their own funds requirements for market risk by 
using their internal models instead of, or in combination with, the standardised 
approach – provided that the internal model covers a significant share of the 
positions of a certain risk category. For example, in accordance with Articles 6(1) and 
11(1) of the CRR, institutions must meet their own funds requirements on an 
individual basis (unless, for example, a derogation in the circumstances set out in 
Article 7 of the CRR has been granted), and the parent institution in a Member State 
must comply with the own funds requirements on a consolidated basis. 

Therefore, the institution at the highest level of consolidation operating within the 
framework of the Single Supervisory Mechanism should be able to specify: 

(a)  which legal entities within the group have been granted permission to use an 

internal model for calculating own funds requirements for market risk; 

(b) 

the scope of application of each model permission (i.e. individual, sub-
consolidated or consolidated); 

(c) 

the risk categories listed in Article 363(1) of the CRR for which each permission 
has been granted. 

The ECB also understands that, for institutions to calculate own funds requirements 
at the consolidated level by using their internal models, a permission to use their 
internal models at consolidated level is required under Article 363(2) of the CRR. 

45. 

In those cases in which the scope of the permission applies at the consolidated or 
sub-consolidated level, institutions should be able to provide a list of legal entities 
included in the scope of consolidation or sub-consolidation, specifying which of those 
entities effectively contribute to the market risk own funds requirements determined 
by using the internal model. In order for the ECB to assess how the own funds 
requirements are determined, institutions should also be able to provide information 
on how each legal entity is integrated into the information system infrastructure of the 
risk management system and whether impediments exist to such integration. 

If impediments exist to the integration of the risk numbers from individual legal 
entities, the ECB considers it best practice to integrate the risk numbers from these 
entities into the model-based own funds requirements by applying a simple sum 
aggregation. 

46. 

In accordance with Article 368(1)(a) of the CRR, the internal model must be closely 
integrated into the daily risk management process of the institution and serve as the 
basis for reporting risk exposures to senior management. Therefore, the ECB 
understands that institutions should ensure an integrated and harmonised risk 
management across all legal entities included in the scope of the model permission. 

47. 

In accordance with Article 325b of the CRR, institutions may use positions in one 
institution or undertaking to offset positions in another institution or undertaking only 

ECB guide to internal models – Market risk – CRR2 

177 

 
for the purpose of calculating net positions and own funds requirements for market 
risk on a consolidated basis, and only subject to the permission of the competent 
authorities. The ECB understands that this requirement applies to all positions, in 
particular to intragroup transactions.20  The offsetting of positions can be performed 
irrespective of the calculation approach that is applied for market risk own funds 
requirements (i.e. IMA or standardised approach). In order for the ECB to assess 
how these requirements are fulfilled, institutions should document how the offsetting 
of positions is performed. 

48. 

In accordance with Article 367(3) of the CRR, an institution may use empirical 
correlations within risk categories and across risk categories only if the institution’s 
approach to measuring correlations is sound and implemented with integrity. The 
ECB understands that for empirical correlations to be sound they should be based 
on reliable and objective data. If this cannot be ensured, an institution should use the 
simple sum aggregation of stand-alone risk numbers within risk categories or across 
risk categories. 

In order for the ECB to assess the soundness and integrity of the implementation of 
the use of empirical correlations, the ECB can, on the basis of Article 10 of the SSM 
Regulation, require institutions to provide the stand-alone VaR and sVaR 
corresponding to each of the following risk classes:21  interest rate risk; equity risk; 
commodity risk; foreign exchange risk; and credit spread risk. 

20    This interpretation is also supported by the explanation in footnote 7 of the Final draft RTS on 

assessment methodology for IMA and significant share. 

21    If this is not possible, the calculation should be based on the approved risk categories in accordance 

with Article 363(1) of the CRR. 

ECB guide to internal models – Market risk – CRR2 

178 

 
 
3 

Regulatory back-testing of VaR models 

3.1 

Relevant regulatory references 

Table 25 

Legal background 

CRR 

Date of 
issue 

Article 

Paragraph/Point 

26/06/2013 

34 

SSM Regulation 

Other references 

15/10/2013 

Final draft RTS on assessment methodology for IMA and significant share 

22/11/2016 

105   

352   

366 

368 

386 

10 

40   

43 

(10) 

(2) 

(1) 

(3) 

(4), (5), (10) 

(4) 

Once adopted by the European Commission, the Final draft RTS on assessment 
methodology for IMA and significant share will become an additional relevant 
regulatory reference. Currently that document only exists in a final draft version. 

3.2 

Scope of application of regulatory back-testing 

49. 

50. 

51. 

The scope of application of regulatory back-testing, as referred to in Article 366 of 
the CRR, should be clearly documented. 

In accordance with Article 366(3) of the CRR, regulatory back-testing compares the 
hypothetical and actual changes in the portfolio’s value (“hypothetical P&L” and 
“actual P&L”) with the related one-day VaR number generated by the institution’s 
model. Therefore, the changes in value of all of (and only) the instruments and 
transactions entailing positions included in the scope of calculation of the VaR model 
should be considered in the calculation of the hypothetical P&L and the actual P&L. 

In particular, if the institution is authorised to apply the IMA for foreign exchange 
and/or commodities risk positions, and the banking book positions in these risk 
categories are included in the scope of the internal model, the institution should 
include these banking book positions in the back-testing and should clearly 
document how the actual and the hypothetical P&L of these positions are calculated. 

52.  Regarding positions in the banking book that are included in the IMA, only the 

changes in value of market data pertaining to FX risk and commodity risk should be 
taken into account in the calculation of the actual and the hypothetical P&L. Only for 
those instruments or transactions where the separation of the positions stemming 

ECB guide to internal models – Market risk – CRR2 

179 

 
 
 
 
 
 
 
 
 
 
 
 
from risk categories other than FX risk or commodities risk (for example, risk of debt 
instruments) is operationally challenging or its effect on the total P&L is immaterial, 
an institution may include changes in value of market parameters pertaining to all 
risk categories in the actual and the hypothetical P&L. Institutions should be able to 
justify the immateriality or the operational challenge, if applicable. In particular, 
considering only the effect of FX risk in the actual and the hypothetical P&L is not 
deemed to be operationally challenging. 

53.  Positions excluded from the calculation of the own funds requirements for market 
risk on the basis of a permission granted by the competent authorities under 
Article 352(2) of the CRR (i.e. (i) positions taken in order to hedge against the 
adverse effect of the exchange rate on the institution’s capital ratios, or (ii) positions 
which an institution has which relate to items that are already deducted in the 
calculation of own funds) should also be excluded from the scope of application of 
the back-testing. 

54. 

In accordance with Article 386(3) of the CRR, eligible hedges that are included in the 
calculation of own funds requirements for CVA risk must not be included in the 
calculation of the own funds requirements for specific risk. Therefore, the change in 
value of those positions that are attributable to specific risk of those eligible hedges 
should also be excluded from the actual and the hypothetical P&L. However, if the 
own funds requirements for general risk of these eligible hedges are calculated using 
the VaR model (see paragraph 10), the change in value of those positions that are 
attributable to general risk should be included in the actual and in the hypothetical 
P&L. 

55.  Hedges which under Article 386(3) of the CRR are not eligible hedges for regulatory 
CVA should be included in the VaR calculation and in the scope of calculation of the 
hypothetical P&L and the actual P&L for back-testing. 

3.3 

Historical period used to perform back-testing, definition of 
business days, and documentation 

56. 

57. 

58. 

In accordance with Article 366(2) of the CRR, the addend to the multiplication factors 
must depend on the number of overshootings for the most recent 250 business days. 

For the purpose of paragraph 56, institutions should define and document local and 
global business days according to the guidance set out in paragraphs 58 to 60. 

The ECB considers that when the business trading unit of an institution is conducting 
planned business operations on the risk positions (even with a reduced number of 
staff) on a given day in a given location, this constitutes a local business day for the 
institution in that location. Therefore, as it is a business day, it requires actual and 
hypothetical P&L calculation, VaR calculation and market risk monitoring and 
reporting. Institutions should consistently define their business days, and therefore 
should be able to justify any non-business days. Unchanged risk positions are a 
necessary but not sufficient condition to demonstrate adequately that a particular day 
constitutes a non-business day. 

ECB guide to internal models – Market risk – CRR2 

180 

 
59. 

60. 

The ECB considers that global business days should be defined at the consolidated 
level (or for a national sub-group, at the sub-consolidated level), and that for the 
purpose of defining global business days the institution’s most important trading 
location (the “reference location”) should be used, to ensure that the most important 
trading activity is adequately captured in back-testing. Global business days should 
include at least the local business days of the reference location. If there are two or 
more important trading locations (of approximately the same size), the institution 
should choose one reference location and is allowed to add additional global 
business days based on the local business days of the other important trading 
locations. In such a case, the rationale underlying this choice should be documented. 

For every global business day, actual and hypothetical P&L calculation, VaR 
calculation and market risk monitoring and reporting are required.22  However, if such 
calculations are carried out on non-global business days, these should not be used 
for the purpose of regulatory back-testing. The actual and hypothetical P&L used for 
back-testing should always be the P&L between two consecutive global business 
days, and should be compared with the related one-day VaR forecast for a one-day 
holding period between those two global business days, and be based on the 
composition of the portfolio on the first of those global business days. 

61.  Based on Article 368(1)(e) of the CRR, the ECB understands that institutions should 

have a documented policy and procedure describing how they calculate the actual 
and hypothetical P&L. The ECB considers that to be fit for purpose, the policy and 
procedure should include, at least, the following key information: 

(a)  how the actual P&L is calculated and, in particular, the differences between the 

economic23  and actual P&L; 

(b) 

the fees, commissions and net interest income excluded from the actual P&L; 

(c)  how the hypothetical P&L is calculated and, in particular, the differences 

between the actual and hypothetical P&L; 

(d) 

the valuation adjustments not updated every day and whether or not they are 
included in the P&L time series. 

In order for the ECB to assess the appropriateness and implementation of the policy 
and procedure for the calculation of the actual and hypothetical P&L, the ECB can, 
on the basis of Article 10 of the SSM Regulation, require institutions to provide, for a 
sample of transactions or portfolios, detailed decompositions of economic, actual 
and hypothetical P&L into their elements. 

22    All positions of trading units in a location with local non-business days should be included in the 

calculation of the consolidated figures. 

23    As defined in the abbreviations. 

ECB guide to internal models – Market risk – CRR2 

181 

 
 
3.4 

Calculation of actual P&L 

3.4.1 

General rules 

62. 

In accordance with Article 366(3) of the CRR, actual P&L must be based on actual 
changes in the portfolio’s end-of-day value. Therefore, the ECB understands that the 
actual P&L should correspond closely to the daily economic P&L as reflected in the 
books and records of the institution, with the exception of certain elements as 
specified in the following paragraphs. 

63.  Actual P&L should include the profit and loss stemming from intraday activities, as 

they change the portfolio’s value. In accordance with Article 366(3) of the CRR, fees, 
commissions and net interest income must be excluded from the actual P&L. The 
definitions and methods used to apply this exclusion should be clearly documented. 

64. 

In accordance with Article 366(3) of the CRR, fees, commissions and net interest 
income must be excluded from the portfolio’s actual value when computing the 
actual P&L. The ECB understands that these exclusions from the portfolio’s actual 
end-of-day value are required by the CRR so that fees, commissions, and interest 
gains or losses are removed from the daily actual P&L in order to ensure that the 
back-testing assesses whether P&L fluctuations driven by market risk are accurately 
captured by the VaR model. Furthermore, the ECB acknowledges that the net 
interest income definition applied to banking book items accounted for at amortised 
cost cannot easily be transferred to the fair value items in the regulatory trading 
book. 

The ECB considers that it is acceptable for an institution to define the net interest 
income in the regulatory trading book as equal to zero; this leads to no P&L 
component being excluded as net interest income. 

The ECB considers that where an institution uses another definition for net interest 
income it should be able to duly justify this approach, taking into account its trading 
strategy. In any case, theta effects (for example, options theta) and P&L 
contributions of unearned credit spreads should not contribute to the net interest 
income, because they are susceptible to market risk. 

65. 

The actual P&L is calculated for instruments and transactions entailing positions24  in 
the regulatory trading book and banking book which are within the scope of the IMA. 
In accordance with Article 366(3) of the CRR, the actual P&L must be based on the 
actual value at the end of the subsequent day. Therefore, the ECB considers that the 
change in value of all market risk parameters (even those that are not modelled in 
the VaR) should be taken into account in the actual P&L. 

24    For the purposes of this guide, a “position” is defined as a risk position (as stated in the abbreviations). 
For example, for a bond denominated in FX and where the scope of the IMA approval does not include 
FX risk, the FX risk position is not in the scope of the VaR model, while the FX risk is reflected in the 
actual P&L. 

ECB guide to internal models – Market risk – CRR2 

182 

 
 
66. 

In order to ensure that the actual P&L corresponds closely to the daily economic P&L 
as reflected in the books and records of the institution, the ECB considers that the 
pricing methods, model parametrisations and market data should be the same as 
those used to compute the daily economic P&L. 

3.4.2 

Valuation adjustments 

67.  Because the actual P&L should correspond closely to the daily economic P&L as 

reflected in the books and records of the institution, all valuation adjustments or 
reserves made in the economic P&L are also relevant for the calculation of the actual 
P&L. Therefore, institutions should clearly document all such valuation adjustments 
and reserves (methodology, frequencies, calculation process, etc.). 

68.  Except for the elements referred to in paragraphs 69 to 71 below, fair value 

adjustments25  and all other valuation adjustments or reserves (hereinafter referred to 
as “adjustments”) made in the economic P&L should be included in the actual P&L 
even if they are not computed on a daily basis – provided that they are in the scope 
of market risk. 

69. 

The ECB considers that credit valuation adjustments (CVA) should be excluded from 
the actual P&L26, because they receive a specific regulatory treatment. The same 
applies to debit valuation adjustments (DVA), due to their nature as the reverse side 
of CVA. 

70.  Additional valuation adjustments (AVA)27  that are calculated to obtain the prudent 

value of the positions in the regulatory trading book should also be excluded from the 
actual P&L, as they receive a specific regulatory treatment under Article 34 of the 
CRR as an additional layer of prudence. 

71.  Changes in portfolio value generated by the default of a counterparty should be 

excluded from the actual P&L, provided that the institution demonstrates that they 
are related solely to counterparty credit risk; this is because the corresponding profits 
or losses are taken into account in the institution’s counterparty credit risk 
framework. Conversely, profits or losses due to the default of a bond or other fixed 
income security are not in the scope of counterparty credit risk and should therefore 
be included in the actual P&L. 

72. 

In accordance with Article 366(3) of the CRR, back-testing must be performed daily 
on the portfolio’s end-of-day value. It could therefore be understood that changes in 
valuation adjustment figures should be computed daily to obtain an accurate portfolio 
end-of-day value. However, the ECB is aware that some valuation adjustments are 

25    This refers at least, but is not limited to, the examples of potential valuation adjustments listed in 

Article 105(10) of the CRR. 

26    This understanding is also supported by Article 40(5)(d) of the Final draft RTS on assessment 

methodology for IMA and significant share. 

27    As set out in Commission Delegated Regulation (EU) 2016/101 of 26 October 2015 supplementing 

Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory 
technical standards for prudent valuation under Article 105(14) (OJ L 21, 28.1.2016). Those categories 
may overlap with fair value adjustments (e.g. market price uncertainty, close-out costs, etc.). 

ECB guide to internal models – Market risk – CRR2 

183 

 
 
not calculated daily by some institutions. In such cases, the ECB considers that 
changes in valuation adjustment figures should be taken into account in the actual 
P&L on the business day which is taken as the reference date for the calculation of 
the valuation adjustment. As a consequence, institutions should not apply any kind of 
smoothing or distribution over several dates in relation to changes in valuation 
adjustment figures. 

3.5 

Calculation of hypothetical P&L 

73. 

74. 

In accordance with Article 366(3) of the CRR, the hypothetical P&L is based on 
changes in the portfolio’s value assuming unchanged positions at the end of the 
subsequent day. The ECB understands that the term “unchanged positions” refers to 
an unchanged composition of the portfolio in terms of instruments and transactions. 
Therefore, the P&L generated by intraday trading and by new transactions entered 
(or maturing transactions) during the day is not taken into account. The ECB 
understands that the term “subsequent day” could imply a passage of time of one 
business day and that this could lead to a change in the risk positions due solely to 
this passage of time. Therefore, institutions may choose to include the passage of 
time of one business day in the hypothetical P&L. 

The ECB understands from Article 366(3) of the CRR that back-testing on the 
hypothetical P&L is intended to focus on detecting deficiencies in the internal model. 
Therefore, back-testing on hypothetical P&L should be used as a statistical test of 
the integrity of the VaR measure, allowing for a more “pure” testing of the model.28 

In accordance with Article 366(3) of the CRR, the hypothetical P&L is to be based on 
the portfolio’s value, assuming unchanged positions, while the actual P&L is to be 
based on the portfolio’s actual value. Therefore, the ECB considers that any 
adjustments taken into account in order to obtain the actual value of the portfolio 
should not be considered in the hypothetical P&L, unless they are part of the VaR 
model.29  Consequently, any other profit and loss element – such as credit valuation 
adjustments (CVA), debit valuation adjustments (DVA), additional valuation 
adjustments (AVA) and any other valuation adjustments – as well as fees, 
commissions and net interest income, should not be included in the hypothetical 
P&L.30 

75.  As both the actual and the hypothetical P&L are based on the portfolio’s value, they 
should be calculated using the same pricing framework. Therefore, the hypothetical 
P&L should be computed using the same pricing methods, model parametrisations 
and market data as those used to compute the daily economic P&L. Where an 
institution computes the hypothetical P&L in a system that is different from the one 
that is used to produce the daily economic P&L, the risk is that differences in the 

28    This understanding is also supported by Section 2.3.2 of the report of the Final draft RTS on 

assessment methodology for IMA and significant share. 

29    This understanding is also supported by Article 40(5)(d) of the Final draft RTS on assessment 

methodology for IMA and significant share. 

30    This understanding is also supported by Article 40(4)(d) of the Final draft RTS on assessment 

methodology for IMA and significant share. 

ECB guide to internal models – Market risk – CRR2 

184 

 
 
computations could occur. To minimise this risk, the institution should ensure that 
differences in market value computations at instrument or transaction level and at 
the total hypothetical P&L level are negligible, and should monitor the alignment 
frequently. 

76. 

The back-testing on the hypothetical P&L should be used as a statistical test of the 
integrity of the VaR measure. Therefore, paragraph 75 applies to partial use models 
so that only the changes in market value due to changes in pricing risk factors within 
the risk categories in the scope of the model are considered, and the other pricing 
risk factors outside the scope of the model are held fixed.31  For example, (i) if the 
institution is authorised to use an internal model for general interest rate risk only, the 
hypothetical P&L should include the changes in value of market parameters 
pertaining to general interest rate risk only; or (ii) if FX risk is not in the scope of the 
model, market value changes due to changes in the FX rate should not be reflected 
in the hypothetical P&L.32 

In the case of partial use models, only for those instruments or transactions where 
the exclusion of the P&L stemming from risk categories not included in the scope of 
the internal model is operationally challenging or its effect on the total P&L is 
immaterial, an institution may include in the hypothetical P&L those changes in value 
of market parameters pertaining to all risk categories.33  Institutions should be able to 
justify the immateriality or the operational challenge, if applicable. In particular, 
excluding the effect of FX risk in the hypothetical P&L is not automatically deemed to 
be operationally challenging. 

77. 

The passage of time effect (theta effect) should be considered (or not) in the VaR 
and in the hypothetical P&L in a consistent manner. However, if institutions include 
the passage of time in the P&L and not in the VaR, or vice versa, they should be able 
to demonstrate that the effect of this inconsistency is not material.34 

3.6 

Counting of overshootings 

78. 

In accordance with Article 366(2) and (3) of the CRR, the back-testing addend is 
determined as the higher of the number of overshootings under hypothetical and 
actual changes in the value of the portfolio for the most recent 250 business days. 

31    The requirement to use the market quote or pricing methods and model parametrisations used for the 
economic P&L takes precedence over the requirement to change only the risk factors within the risk 
categories in scope of the model in this case. 

32    For example, let  pv(𝑡; 𝑝; 𝑔𝑡, 𝑠𝑡, 𝑒𝑡, 𝑓𝑡, 𝑥𝑡)  be the present market value of a position at time  𝑡  used in the 
economic P&L calculation, depending on some parameter set  𝑝  (not explicitly time dependent), and 
risk factor sets  𝑔𝑡, 𝑠𝑡, 𝑒𝑡, 𝑓𝑡, 𝑥𝑡  for all risk categories at time  𝑡. If the specific interest rate risk  𝑠  and the 
FX  risk  𝑥  are not in the scope of the model, the risk factor values in those categories do not change 
from the previous time  𝑡0, and the hypothetical P&L at time  𝑡  should be calculated as: 
HypoP&L(𝑡)   =  pv(𝑡𝑥;  𝑝; 𝑔𝑡, 𝑠𝑡0, 𝑒𝑡, 𝑓𝑡, 𝑥𝑡0)  −  pv(𝑡0;  𝑝; 𝑔𝑡0, 𝑠𝑡0, 𝑒𝑡0, 𝑓𝑡0, 𝑥𝑡0), where 
𝑡𝑥   =   𝑡0  if VaR uses an instantaneous shock; or  𝑡𝑥   =  𝑡  if VaR includes theta for consistency. 

33    In cases where the exclusion of the P&L stemming from risk categories not included in the scope of the 
internal model is operationally challenging or its effect on the total P&L is immaterial, if a market price 
that incorporates all risks is used in the economic P&L it should also be used in the hypothetical P&L. 

34    This understanding is also supported by Article 43(4) of the Final draft RTS on assessment 

methodology for IMA and significant share. 

ECB guide to internal models – Market risk – CRR2 

185 

 
 
79. 

80. 

81. 

In accordance with Article 366(5) of the CRR, institutions must notify the competent 
authorities promptly, and in any case no later than within five business days, of 
overshootings that result from their back-testing programme. The ECB understands 
that the period of five business days should start on the first business day after the 
“subsequent day” as referred to in the second and third paragraphs of Article 366(3) 
of the CRR. 

If either a P&L or the VaR is not available or cannot be computed within five business 
days, the ECB considers that there is a risk that an overshooting may have occurred, 
and that in order to ensure that the number of overshootings is not misrepresented, a 
prudent approach would be to consider such an instance as an overshooting under 
hypothetical or actual changes, respectively. 

If an overshooting has occurred due to malfunctions in the calculation of a P&L or 
the VaR and is notified to the ECB, and the institution demonstrates to the 
satisfaction of the ECB that the overshooting was caused by an acceptable reason, 
the institution may withdraw the overshooting notification. The explanation of the 
malfunction should be supported by clear and complete documentation. If 
malfunctions leading to erroneous calculations and overshooting notifications are 
recurrent, this may indicate that the internal model is not implemented with integrity 
as required in Article 368(1) of the CRR, and the ECB may require the institution to 
present a remediation plan. 

82. 

The ECB considers that examples of acceptable reasons for withdrawing an 
overshooting notification could include: 

(a)  errors in the calculation of the actual P&L, hypothetical P&L or VaR due to IT 

issues or incorrect data; 

(b)  errors in the scope of positions for the calculations of the P&L or the VaR; 

(c) 

false or missing bookings, or incorrect positions included in the scope of the 
calculations; 

(d)  delayed reserve releases; 

(e) 

temporary transmission problems between different business locations. 

83.  However, the ECB considers the following to be a non-exhaustive list of reasons for 

withdrawing an overshooting notification which would not be acceptable, because 
they are not considered as malfunctions in the calculation of the P&L or the VaR: 

(a)  differences in pricing functions between the VaR engine and the actual and 
hypothetical P&L calculations (typically using front-office pricing functions); 

(b) 

losses due to the trading or transfer of large positions at a price that deviates 
from the market price as a result of trading volumes; 

(c) 

the overshooting corresponds to a small difference between VaR and a P&L; 

(d)  unexpected market movements; 

ECB guide to internal models – Market risk – CRR2 

186 

 
(e)  a model deficiency that has caused an overshooting in the past has already 
been addressed (there is no backward adjustment of overshootings); 

(f)  a change in the P&L calculation method, pricing function or parameterisation of 

a pricing function or a change in the market data input used in the P&L 
calculation. 

84. 

In accordance with Article 368(1)(a) of the CRR, the internal model must be closely 
integrated into the daily risk management process. In order for institutions to be able 
to meet this requirement, the ECB considers that the VaR numbers should be 
available within three business days. In addition, this would enable institutions to fulfil 
the requirement to notify back-testing overshootings within five business days. 

If delays in the VaR computation are recurrent, this may indicate that the internal 
model is not implemented with integrity as required by Article 368(1) of the CRR, and 
the ECB may require the institution to justify such delays or to present a remediation 
plan. 

3.7 

Analysis of overshootings 

85. 

In accordance with Article 368(1)(b) of the CRR, the risk control unit must produce 
and analyse daily reports on the output of any internal model, including 
overshootings. The ECB considers that such an analysis of overshootings should 
include at least the following areas, as they are the most relevant drivers of the VaR 
number: 

(a) 

identification of the set of positions responsible for the overshooting (portfolio 
analysis); 

(b) 

identification, description and analysis of the market moves contributing to the 
overshooting (market analysis); 

(c) 

identification of possible weaknesses in the internal model in the light of (a) and 
(b) above (analysis of the internal model). 

Paragraphs 86 to 89 explain what the ECB considers are best practices in order to 
analyse each of the three areas referred to in (a), (b) and (c) above. 

The ECB considers it best practice that for every regulatory back-testing 
overshooting a detailed analysis should be performed by the institution and provided 
to the competent authority within one month.35 

In accordance with Article 368(1)(f) of the CRR, any internal model for market risk 
must have a proven track record of reasonable accuracy in measuring risks. In order 
to assess the track record of reasonable accuracy in measuring risk, the ECB can, 
on the basis of Article 10 of the SSM Regulation, request a detailed analysis (in 

35    This understanding is also supported by Article 40(10) of the Final draft RTS on assessment 

methodology for IMA and significant share. 

ECB guide to internal models – Market risk – CRR2 

187 

 
 
accordance with its specific instructions) of overshootings and reporting of time 
series related to back-testing. 

3.7.1 

Portfolio analysis 

86. 

87. 

The analysis of the back-testing overshooting should include a detailed description of 
the trading portfolio for which the one-day VaR forecast calculated was exceeded by 
the one-day change in the portfolio’s value. If the overshooting was notified for the 
actual P&L, the intraday changes in the portfolio that affected the actual change 
should also be analysed. 

The analysis of back-testing overshooting should be performed not only at the 
overall portfolio level, but also at lower portfolio levels, to identify the main positions 
that caused the overshooting. If specific sub-portfolios can be identified, they should 
be mentioned and analysed. 

3.7.2 

Market analysis 

88. 

The analysis of the market should describe the market moves contributing to the 
cause of the overshooting and explain them on the basis of objective market data 
(for example, asset prices, indices, interest rates, FX rates, implied correlations and 
volatilities). To assess the significance of the market data movements, the market 
data, including those that are risk factors in the VaR, should be analysed in a 
historical context. The significance of the change in market data that are risk factors 
in the VaR, and which contributed to the P&L, should be tested against the historical 
99% confidence interval of risk factor changes. Changes in the structure of 
correlations between the risk factors should also be analysed. In addition, the 
analysis should, as far as possible, include the economic reasons for the market 
movements. 

3.7.3 

Analysis of the internal model 

89. 

The suitability of the internal model should be assessed on the basis of the two 
previous analyses. Where positions contributing to the back-testing overshooting can 
be identified, the appropriateness of the model for these particular positions should 
be assessed. To do this, the part of the P&L that can be explained by the model 
(i.e. risk factors and pricing functions) should be distinguished from the part which 
cannot. In addition, the reliability of the VaR calculation and of the actual and 
hypothetical changes in the portfolio should be evaluated. The analysis of the 
internal model should focus on: 

(a) 

the appropriateness of risk factors used; 

(b) 

the modelling of risk factors; 

ECB guide to internal models – Market risk – CRR2 

188 

 
(c) 

the suitability of the processes for calculating VaR, hypothetical P&L and actual 
P&L. 

4 

Aspects of internal validation of market risk models 

4.1 

Relevant regulatory references 

Table 26 

Legal background 

CRR 

SSM Regulation 

Other references 

Date of issue 

Article 

Paragraph/Point 

26/06/2013 

368   

(1), (2) 

15/10/2013 

369 

10 

Final draft RTS on assessment methodology for IMA and significant share 

22/11/2016 

23 

(2) 

Once adopted by the European Commission, the Final draft RTS on assessment 
methodology for IMA and significant share will become an additional relevant 
regulatory reference. Currently that document only exists in a final draft version. 

4.2 

Frequency of internal validation 

90. 

Institutions are required under Article 369(1) of the CRR to conduct a validation of 
their internal models on a periodic basis. The ECB considers that an appropriate 
frequency is at least annually, as one year is a reasonable time in which significant 
changes in the market or in the composition of the portfolio could occur.36  In 
addition, a validation conducted at least annually would allow the institution to use 
the results in the review of its overall risk management process, as referred to in 
Article 368(2) of the CRR. 

4.3 

Internal back-testing of VaR models 

4.3.1 

Granularity of internal back-testing 

91. 

In accordance with Article 369(1)(b) of the CRR, institutions must, in addition to the 
regulatory back-testing programmes, carry out their own internal model validation 
tests – including back-testing – in relation to the risks and the structure of their 
portfolios. The ECB considers that to satisfy the requirement regarding internal back-

36    This understanding is also supported by Article 23(3) of the Final draft RTS on assessment 

methodology for IMA and significant share. 

ECB guide to internal models – Market risk – CRR2 

189 

 
 
 
 
 
 
 
 
 
 
 
 
testing in relation to the risks and the structure of the portfolios, institutions should 
perform separate back-testing at more granular levels than the top-of-the-house 
level37  on at least the hypothetical P&L (i.e. counting and analysing of overshootings 
under the hypothetical P&L). 

(a)  The ECB understands that, at a minimum, internal back-testing should be 

performed: 

(i)  at one level below the top-of-the-house level; 

(ii) 

for each portfolio that is subject to a separate VaR limit established by the 
institution’s management body. 

(b)  Where an institution intends to apply the revisions to the IMA as set out in the 
FRTB in the future, the ECB considers that it would be beneficial if the 
institution identified the sub-portfolios within the current scope of the internal 
model that would most likely satisfy the requirements for becoming FRTB 
trading desks, and performed separate internal back-testing on them. 

This is without prejudice to the requirement for the internal model validation function 
to perform back-testing on both actual and hypothetical P&L under Article 369(2) of 
the CRR, which the ECB understands as relating to the top-of-the-house level. 

The ECB considers it best practice that the internal back-testing defined above in 
this paragraph is performed on a daily basis in order to align it with the regulatory 
back-testing programme.38 

92. 

The ECB understands that Article 369(2) of the CRR requires that the back-testing 
performed in internal validation complies with the same requirements as the 
regulatory back-testing regarding the calculation of actual and hypothetical P&L. 
Therefore, the requirements described in Section 3 regarding the calculation of 
actual and hypothetical P&L should also be applied to internal back-testing, in order 
to ensure consistency. In verifying compliance with this provision of the CRR, the 
ECB will take into account the specific circumstances of the institution. 

4.3.2 

Tests to be performed in internal back-testing 

93. 

In accordance with Article 369(1)(b) of the CRR, institutions must carry out their own 
internal model validation tests, including back-testing. The ECB considers it best 
practice that the periodic internal validation tests include the following (or their 
equivalent) for at least the top-of-the-house level: 

37    See the abbreviations. 
38    This understanding is also supported by Article 23(2)(b) of the Final draft RTS on assessment 

methodology for IMA and significant share. 

ECB guide to internal models – Market risk – CRR2 

190 

 
 
(a)  statistical tests on the overshootings, such as the Kupiec39  and Christoffersen40 
tests, including an analysis of the validity of the hypotheses underlying those 
statistical tests; 

(b)  a test on the uniformity of the distribution of the p-values41  of the daily actual 
P&L and the hypothetical P&L in the daily forecasts of P&Ls of the VaR42 
engine, at least for the daily data of the last year. For example, a P&L value 
equal to the VaR at confidence level of 99% corresponds to a p-value of 0.01. 

94. 

In order to assess whether the periodic internal validation tests used by an institution 
are adequate and fit for their purpose, the ECB can, on the basis of Article 10 of the 
SSM Regulation, require the institution to provide the following information: 

(a) 

for the top-of-the-house level, the complete economic P&L, hypothetical P&L, 
actual P&L, and VaR time series of at least one year, but preferably three years; 

(b) 

(c) 

for the top-of-the-house level, the number of overshootings and the 
corresponding dates when they occurred over at least the last year, but 
preferably over the last three years; 

for the top-of-the-house level, for the overshootings (i.e. −P&L𝑡+1 > VaR𝑡  where 
VaR𝑡 > 0  by convention), the time series of at least one year, but preferably 
three years, of the loss overshooting ratio (LOR) defined as: 

LOR =

−P&L𝑡+1−VaR𝑡
VaR𝑡

, where  −P&L𝑡+1 > VaR𝑡; 

(d) 

for the top-of-the-house level, the time series of p-values of the daily actual P&L 
and the hypothetical P&L in the daily forecasts of P&Ls of the VaR engine of at 
least one year, but preferably three years; 

(e) 

for the more granular levels referred to in paragraph 91: 

(i) 

complete economic P&L, hypothetical P&L and VaR time series of at least 
one year, but preferably three years; 

39    See Kupiec, P.H., “Techniques for verifying the accuracy of risk measurement models”, Journal of 

Derivatives, Vol. 3, Issue 2, 1995, pp. 73-84. 

40    See Christoffersen, P., “Evaluating interval forecasts”, International Economic Review, Vol. 39, Issue 4, 

1998, pp. 841-862. 

41    The probability integral transformation states that for a continuous random distribution  𝑋, applying the 
cumulative distribution function (CDF) of  𝑋,  𝐹𝑋, on  𝑋  yields a uniform distribution. By negation, if the 
resulting distribution is not uniform,  𝐹𝑋  is not the CDF of  𝑋. 
Given a vector of simulated P&L (used to estimate the VaR) sorted in ascending order,  𝑥1, … , 𝑥𝑛, the 
p-value,  𝑝(𝑥), corresponding to a given P&L,  𝑥, should be obtained in the following way: 

𝑥𝑘+1−𝑥
𝑥𝑘+1−𝑥𝑘

⋅ 𝑝𝑘 + 𝑥−𝑥𝑘
𝑥𝑘+1−𝑥𝑘

𝑝(𝑥) =

1+(

𝑝1
1−𝑝1

𝑥
𝑥1
)

(

𝑝1
1−𝑝1

𝑥
𝑥𝑛
)

(

𝑝𝑛
1−𝑝𝑛

𝑥
𝑥1
)

𝑥
𝑥𝑛
)

{

1+(

𝑝𝑛
1−𝑝𝑛

⋅ 𝑝𝑘+1

if 𝑥𝑘 ≤ 𝑥 ≤ 𝑥𝑘+1 for 𝑘 = 1, … , 𝑛 − 1

if 𝑥 < 𝑥1

if 𝑥 > 𝑥𝑛

  where  𝑝𝑘 = 𝑘

𝑛+1

42    If an institution has a model based on a mixture of approaches in several VaR model components, the 

most material approach should be used. 

ECB guide to internal models – Market risk – CRR2 

191 

 
 
 
 
 
 
 
 
 
 
 
(ii)  an analysis of all overshootings, including an explanation of the cause of 

the overshooting over the hypothetical P&L and an assessment of the 
model adequacy on the relevant level. 

4.4 

Validation on hypothetical portfolios 

95. 

96. 

In accordance with Article 369(1) of the CRR, institutions must have processes in 
place to ensure that all their internal models for market risk have been adequately 
validated. Therefore, the requirement of Article 369(1)(c) to use hypothetical 
portfolios in the internal model validation refers in particular to VaR, sVaR, and IRC 
models. 

In accordance with Article 368(1)(e) of the CRR, institutions must have a 
documented set of internal policies and controls in place concerning the overall 
operation of their internal models, including the internal validation. Therefore, 
institutions should have a policy in place that governs the overall processes related 
to the validation of their internal models for market risk using hypothetical portfolios. 
The ECB considers that in order to cover the overall process, such a policy should 
comprise the following aspects: 

(a)  portfolio definition – the processes for defining hypothetical portfolios; 

(b)  analysis – the processes for analysing the performance of the model based on 

the results of the tests performed on hypothetical portfolios, including: 

(i)  an assessment of the ability of the models to capture the risk of the 

hypothetical portfolios; 

(ii)  verification that the insights gained by the analysis of hypothetical 

portfolios are reflected in the models; 

(iii) 

in particular, for back-testing on hypothetical portfolios, an identification of 
the market movements and parameters causing overshootings; 

(c) 

reporting – the processes to ensure that the results of validation on hypothetical 
portfolios are reported to a management body with sufficient authority in respect 
of internal models. 

97. 

In accordance with Article 369(1)(c) of the CRR, institutions must conduct validation 
exercises using hypothetical portfolios in order to ensure that a model is able to 
account for particular structural features.43  The ECB understands that these 
hypothetical portfolios should have targeted compositions so that the model can be 
tested at a level of granularity that enables the identification and isolation of specific 

43    These hypothetical portfolios should not be limited to portfolios defined in the benchmarking exercises 
for market risk conducted by the EBA or the Basel Committee on Banking Supervision, as those 
portfolios cannot account for all relevant particular structural features. Participation in such 
benchmarking exercises is thus not sufficient to meet the requirements of this section of the guide. 

ECB guide to internal models – Market risk – CRR2 

192 

 
 
model performance for those structural features (for example, related to specific 
business lines, instrument features, and/or trading strategies). 

98.  As they should ensure that the risk model is validated for the institution’s risk 

management purposes, such hypothetical portfolios should be designed in line with 
the business model of the institution. For example, it is not necessary to include 
products that are not covered by trader mandates, nor to test specific features that 
are not relevant for potential positions according to the institution’s approved trading 
strategy. Consequently, an institution should review the hypothetical portfolios in the 
event of a change in its business model or trading strategy. 

99. 

For the same reason, the number of hypothetical portfolios should be commensurate 
with the nature, scale and complexity of the activities of the institution. 

4.5 

Validation based on hypothetical portfolios for VaR models by 
internal back-testing 

100.  The ECB considers that the validation requirements of Article 369(1)(c) of the CRR 

for VaR models can be fulfilled by internal back-testing where an institution can 
demonstrate that it has set up internal back-testing for the VaR model using sub-
portfolios at a level which is sufficiently granular to account for the particular 
structural features that may arise in its portfolios. 

101.  Where an institution performs internal back-testing on hypothetical portfolios for the 
VaR model, the P&L calculations for this back-testing of hypothetical portfolios 
should not differ from the P&L calculations for regulatory VaR back-testing as 
described in Section 3, in order to ensure consistency. This back-testing can be 
conducted based on the hypothetical P&L only, as hypothetical portfolios are not part 
of the daily trading activity and therefore the actual P&L is not relevant. 

102.  As the purpose of such internal back-testing is the internal validation of the VaR 

model, the ECB considers that in order to ensure consistency: 

(a) 

the comparison should be carried out using the daily hypothetical P&L and the 
one-day VaR; 

(b)  back-testing periods for hypothetical portfolios should cover at least the period 

used to calibrate the VaR as of the validation date, to ensure that the results are 
relevant for the model at that date; 

(c) 

institutions should ensure that the particular structural feature, as referred to in 
paragraph 97, for which each hypothetical portfolio was selected, continues to 
be in place over time and during the entire historical period for which the back-
testing is performed. 

ECB guide to internal models – Market risk – CRR2 

193 

 
5 

Methodology for VaR and stressed VaR 

5.1 

Relevant regulatory references 

Table 27 

Legal background 

CRR 

SSM Regulation 

Other references 

EBA Guidelines on sVaR44 

Final draft RTS on assessment methodology 
for IMA and significant share 

Date of issue 

Article 

Paragraph/Point 

26/06/2013 

15/10/2013 

16/05/2012 

22/11/2016 

365 

366 

367, 368, 369, 370 

10 

38 

49 

(2) 

6,10 

(1), (2) 

(2) 

Once adopted by the European Commission, the Final draft RTS on assessment 
methodology for IMA and significant share will become an additional relevant 
regulatory reference. Currently that document only exists in a final draft version. 

5.2 

General requirements 

103. 

In accordance with Article 369(1) of the CRR, the appropriateness of any 
assumptions made within the internal model must be demonstrated. Therefore, 
institutions should demonstrate the appropriateness of any assumptions about the 
distribution of risk factors included in the VaR and sVaR models on the basis of 
objective data.45  In order to assess the appropriateness of the distribution 
assumptions, the ECB can, on the basis of Article 10 of the SSM Regulation, require 
institutions to consider different plausible distribution assumptions and compare the 
VaR and sVaR amounts calculated according to those different assumptions to 
demonstrate that the selected assumption is appropriate. 

104. 

In accordance with Article 368(1)(f) of the CRR, an internal model must be 
reasonably accurate in measuring risks. Therefore, when using Monte Carlo 
simulations, institutions should be able to demonstrate that the number of 
simulations used to compute the VaR and sVaR is sufficient to produce accurate and 
stable VaR and sVaR numbers. 

44    EBA Guidelines on Stressed Value At Risk (Stressed VaR) (EBA/GL/2012/2), referred to in this guide 

as the “EBA Guidelines on sVaR”. 

45    Where an institution applies historical returns in its model, the requirement refers to the choice of the 

specific methodology to determine the returns (for example, the use of relative or absolute returns). 

ECB guide to internal models – Market risk – CRR2 

194 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
105.  An institution may apply different methodologies (i.e. the absolute, relative or mixed 

approach46) to calculate returns used to calibrate the VaR and sVaR models for 
different risk factors. The ECB has observed that the best practices used in the VaR 
and sVaR models are the following methodologies: 

Table 28 

Interest rate curves 

Bond spread 

Risk factor category 

Methodology used to calculate returns 

Absolute or mixed approach 

Absolute or mixed approach 

Credit default swap (CDS) spread 

Absolute or mixed approach 

Foreign exchange rate 

Equities spot 

Commodities 

Relative approach 

Relative approach 

Relative approach 

As institutions are required under Article 368(3) of the CRR to apply best practices, 
they should be able to explain deviations from these methodologies and quantify the 
impact of those deviations. 

Article 365(2) of the CRR requires that the calculation of the sVaR is made in 
accordance with the requirements for calculation of the VaR. Therefore, for a given 
risk factor, where a specific methodology is used in the VaR, the same methodology 
is expected to be used for the same risk factor in the sVaR. 

As regime changes could occur between the VaR effective historical observation 
period and the sVaR historical period, the method should be suitable for both 
periods. In accordance with Article 369(1) of the CRR, the appropriateness of any 
assumptions made within the internal model must be demonstrated. The ECB 
considers that this choice of method is one of the assumptions whose 
appropriateness should be demonstrated. 

106. 

In accordance with Article 368(1) of the CRR, the internal model must be 
conceptually sound and implemented with integrity. Therefore, it is expected that the 
returns are calculated on the basis of one single holding period (for example, one 
day or ten days) for all risk factors.47 

107.  Under paragraph 10.3(c) of the EBA Guidelines on sVaR, institutions should be able 
to prove that on the day of the week chosen for the sVaR calculation their portfolio is 
representative of the portfolio held during that week, and that the chosen portfolio 
does not lead to a systematic underestimation of the sVaR numbers when computed 

46    Either of the two examples following could be considered as a “mixed approach”: (i) the case where 
some risk factors within a given risk factor category are calculated via absolute returns while others 
within the same risk factor category are calculated via relative returns (e.g. interest rate curves with low 
interest rate levels calculated via absolute returns and interest rate curves of other currencies with 
higher levels via relative returns); or (ii) the case where a single methodology takes into account 
different regimes (e.g. return close to absolute for low levels of interest rates and close to relative for 
higher levels). 

47    Uniform use of a one-day holding period in VaR and a 10-day holding period in sVaR might be 

permissible if adequately justified by an institution. 

ECB guide to internal models – Market risk – CRR2 

195 

 
 
 
108. 

109. 

weekly; shown, for example, by using sensitivities or by proving that the VaR is not 
systematically lower on the day of the week chosen for sVaR. 

In order to assess that the day of the week when the sVaR amounts are calculated 
does not lead to material bias, the ECB can, on the basis of Article 10 of the SSM 
Regulation, require an institution to recalculate the sVaR for 15 consecutive business 
days (including three reporting days). If it is not possible to perform this calculation in 
the production environment, it can be performed in a test environment that replicates 
the calculation of the regulatory sVaR. 

In accordance with Article 368(1)(e) of the CRR, institutions must ensure compliance 
with a documented set of internal controls. In order for the ECB to assess 
compliance with this requirement, an institution should be able to provide an 
inventory of all open validation findings in relation to the VaR and sVaR models 
including, for each finding, a description thereof, the envisaged remedial action and 
the target date for closure of the finding. In addition, institutions should retain closed 
validation findings for at least one year after the closure date and should be able to 
provide a description of the remedial action implemented. Furthermore, to allow the 
ECB to assess compliance with Article 368(1)(e) of the CRR, an institution should be 
able to provide an inventory of analyses that have been conducted with the purpose 
of developing/justifying the VaR and sVaR models over the last five years. 

5.3 

Data inputs, length of the time series used to calibrate VaR and 
sVaR, and quantile estimation 

110. 

In accordance with Article 365(1)(d) of the CRR, institutions must use an effective 
historical observation period of at least one year for the calculation of the VaR, 
except where a shorter observation period is justified by a significant upsurge in 
price volatility. The ECB considers that this requirement can be fulfilled by taking 
returns referring to 250 consecutive business days48  in order to allow alignment with 
the time frame referred to in Article 366(2) of the CRR. The ECB understands that an 
effective historical observation period of at least one year means that the average 
time lag49  of the scheme used by an institution is at least the average time lag for an 

48    The observation period corresponds to the time frame between the first day of calculation of returns 
and the last day of calculation of returns. Where an institution uses 10-day returns, the minimum 
observation period is 250 business days but the time frame between the first day of calculation of the 
first 10-day return and the end date of the last 10-day return is 260 days. 

49    A weighting scheme is considered to be the set of weights directly or implicitly applied to observations 
of a risk factor,  {𝑤𝑡}𝑡=1,2,…, where typically for giving more weight to more recent observations  𝑤𝑡 ≥
𝑤𝑡+1∀𝑡, and  𝑡  is the lag in number of business days between the VaR or sVaR computation date and 
the historical observation date. The average time lag using the most recent  𝑛  observations is defined 
as: 

Average time lag(𝑛, 𝑤) =

𝑛
∑ 𝑡 ⋅ 𝑤𝑡
𝑡=1
𝑛
∑ 𝑤𝑡
𝑡=1

This definition can be extended to equally weighted schemes by setting  𝑤𝑖 = 1  for all dates. For an 
equally weighted scheme on 250 continuous business days, the formula results in 125.5 days. 

The ECB may, after analysing the particular circumstances of an institution, also consider other 
methods of processing market data or risk factors to be a weighting scheme, and assess whether such 
methods provide an effective historical observation period of at least one year in accordance with 
Article 365(1)(d) of the CRR. 

ECB guide to internal models – Market risk – CRR2 

196 

 
 
 
 
 
equally weighted observation period of one year (i.e. 125.5 days for 250 business 
days).50 

111.  Where the institution uses a shorter effective historical observation period (for 

example, by applying a weighting scheme) due to a significant upsurge in price 
volatility, the ECB considers that this should not lead to a lower VaR risk number. 
Therefore, the institution should use the higher of the following: 

(a) 

the VaR amount calculated with an equally weighted historical observation 
period of at least one year; 

(b) 

the VaR amount calculated with the shorter effective historical observation 
period.51 

In accordance with Article 365(1)(e) of the CRR, this comparison should be 
performed at least monthly, and the institution should continue to apply the resulting 
calibration method until the next comparison. 

112.  For the purpose of the regulatory back-testing conducted under Article 366 of the 

CRR, the higher of the two metrics mentioned in paragraph 111 should be used for 
consistency with the own funds requirement calculation. 

If the institution always uses a VaR calculated with the shorter effective observation 
period as mentioned in paragraph 111 for its risk management, the institution is 
allowed to perform internal back-testing of the VaR under Article 369(1)(b) of the 
CRR using this shorter effective observation period, in order to ensure that the model 
is closely integrated into the daily risk management process. 

113. 

In accordance with Article 365(2) of the CRR, the institution must calculate the sVaR 
calibrated to historical data from a continuous 12-month period of significant financial 
stress relevant to the institution’s portfolio. The ECB considers that this requirement 
can be fulfilled by taking returns referring to 250 consecutive business days in order 
to allow alignment with the time frame referred to in Article 366(2) of the CRR. 

Under paragraph 6.8 of the EBA Guidelines on sVaR, no weighting of historical data 
should be applied when determining the relevant historical period or when calibrating 
the sVaR model.52  The ECB considers that a calibration to historical data from a 
continuous 12-month period implies that no weighting scheme should be applied to 
the historical data used to calibrate the sVaR.53 

114. 

In order to ensure that the approach for measuring empirical correlations is sound 
and implemented with integrity as required by Article 367(3) of the CRR, the 
institution should use one single observation period (i.e. with the same start date and 

50    This understanding is also supported by Article 38(1) of the Final draft RTS on assessment 

methodology for IMA and significant share. 

51    This understanding is also supported by Article 38(1) and (2) of the Final draft RTS on assessment 

methodology for IMA and significant share. 

52    Under paragraph 10.10 of the EBA Guidelines on sVaR, this does not contradict the requirement that 

the sVaR methodology should be based on the current VaR methodology. 

53    This understanding is also supported by Article 49(2)(h) of the Final draft RTS on assessment 

methodology for IMA and significant share. 

ECB guide to internal models – Market risk – CRR2 

197 

 
 
end date, and consequently the same length of observation period) for all risk factors 
modelled in the VaR. This also applies to the sVaR. 

115.  Consequently, if a new instrument (e.g. a single stock or credit index series) is 

issued, the time series corresponding to this instrument should not be used on its 
own for the calibration of the VaR and sVaR models until the length of the available 
time series reaches the length of the observation period used by the institution. In 
this case, because, at the least, the missing portion needs to be completed, a risk 
factor calibrated to this time series is considered to be proxied and the requirements 
for proxies should be observed (see Section 5.5). 

116. 

In accordance with Article 365 of the CRR, the VaR and sVaR are calculated as the 
99th percentile, one-tailed confidence interval, and In accordance with 
Article 367(1)(a) of the CRR, the model must accurately capture all material price 
risks. In accordance with Article 368(1)(f) of the CRR, any internal model must have 
a proven track record of reasonable accuracy in measuring risks. Therefore, the ECB 
considers that for institutions using a simulation approach (either historical or Monte 
Carlo) in their VaR (or sVaR) model, the percentile estimation method used to obtain 
the 99th percentile should be based on reasonable statistical properties that ensure 
its accuracy – that is, it should be asymptotically unbiased, distribution-free, and 
assume that the probability of experiencing a P&L lower (or higher) than the lowest 
(or highest) simulated value is strictly greater than zero. For these reasons the ECB 
considers that both the method proposed by Harrell and Davis54  55  and the simplified 
method proposed below56  are appropriate methods to ensure that price risks are 
accurately captured when using the percentile estimation method. 

Consider the vector of simulated P&L of length  𝑛  for the VaR (or sVaR) percentile 
estimation (P&L1  to  P&L𝑛) in ascending order.57  The result  𝑄(0.99)  is obtained as 
the weighted average of the two subsequent P&L values  −P&LInt(𝑚)  and 
−P&LInt(𝑚)+1, computed as 

Q(0.99) =   (m − Int(m)) ⋅ (−P&LInt(m)+1) + (Int(m) − m + 1) ⋅ (−P&LInt(m))  , 

with  𝑚 =

𝑛+1

100

. 

For example: 
for  𝑛 = 250, the percentile result of this method is   
0.51  ×   (−P&L3) +  0.49  ×   (−P&L2); 

for  𝑛 = 260, the percentile result of this method is 
0.61  ×   (−P&L3) +  0.39  ×   (−P&L2). 

54    See Harrell, F.E. and Davis, C.E., “A new distribution-free quantile estimator”, Biometrika, Vol. 69, 

1982, pp. 635-640. 

55    Corresponding to estimator 9 in Dielman, T., Lowry C. and Pfaffenberger, R., “A comparison of quantile 
estimators”, Communications in Statistics. Simulation and Computation, Vol. 23(2), 1994, pp. 355-371. 
56    Corresponding to definition 6 in Hyndman, R.J. and Fan, Y., “Sample quantiles in statistical packages”, 

American Statistician, Vol. 50, 1996, pp. 361-365. 

57    P&L1  is the lowest P&L (i.e. the highest loss). 

ECB guide to internal models – Market risk – CRR2 

198 

 
 
5.4 

Data quality 

117. 

In accordance with Article 367(2)(e) of the CRR, an internal model must meet 
minimum data standards. This applies in particular to risk factor time series, which 
are fundamental inputs to a VaR model. For each risk factor time series used to 
calibrate the shocks of the VaR model, the institution should have a process in place 
to regularly check the quality of the time series. The ECB considers that an 
appropriate minimum frequency of such checks is quarterly, as this allows alignment 
with the regulatory reporting cycle. This is without prejudice to the discretion of 
institutions to perform certain checks on a more frequent basis if needed to meet 
minimum data standards. Where an institution uses different data sources for its VaR 
model and the daily economic P&L calculation reflected in the inventory referred to in 
paragraph 130, the ECB may request that the institution explain the differences 
between the two sets of data sources, in order to verify that they meet minimum data 
standards. 

118.  The ECB understands that the minimum data standards should ensure that the true 

volatility of a position or portfolio is captured. Therefore, the quality checks on the 
risk factor time series should, at the minimum, identify for each time series: 

(a) 

the number of days for which data points were initially missing and then filled 
using a particular methodology (e.g. interpolation and extrapolation)58; 

(b) 

the number of days for which data points were initially available and were 
replaced using a particular methodology (e.g. interpolation and extrapolation); 

(c) 

the number of days with no daily changes; 

(d) 

the maximum number of consecutive days with no daily change. 

119.  Material or large numbers of changes in the time series may affect the ability to 

capture the true volatility of a position or portfolio. In order to monitor and ensure that 
the operation of the internal model is not adversely affected, institutions should 
maintain up-to-date documentation59  describing any changes in the risk factor time 
series, including in particular any methodology for the replacement of missing data, 
and the list of tasks that may be performed during manual adjustments. This 
documentation should contain the following: 

(a)  a description of the methodology followed to introduce the adjustment – the 

description should be sufficiently detailed so that any staff member of the unit in 
charge is able to produce the same outcome; 

(b)  a description of the processes in place to ensure the appropriate 

implementation of a manual process in accordance with the documentation. 

120. 

In accordance with Article 367(2)(e) of the CRR, the institution’s internal model must 
conservatively assess the risk arising from less liquid positions and positions with 
limited price transparency and must meet minimum data standards. Therefore, the 

58    There should be no missing data points for the final time series of shocks used to calibrate the model. 
59    In accordance with Article 368(1)(e) of the CRR. 

ECB guide to internal models – Market risk – CRR2 

199 

 
 
ECB considers that institutions should have in place documentation which defines 
the minimum data quality standards that risk factor time series should meet, and be 
able to provide justification for the use of time series that include an elevated number 
of consecutive business days with missing data or no daily changes. Moreover, the 
ECB considers that when using time series with only a low number of available data 
points per year institutions should provide justification that the number of data points 
is sufficient to reflect the true volatility of a position or portfolio. 

121. 

In order to ensure that changes in the risk factor time series do not affect the ability 
to capture the true volatility of a position or portfolio, institutions should analyse how 
the replacement of missing data affects the volatilities and correlations of the IMA. 
This applies particularly where time series are used that have: 

(a) 

the value of the same data of the previous day in the case of automatic and 
systematic replacement of missing data points; 

(b)  an elevated number of consecutive business days with missing data or no daily 

changes; 

(c)  only a low number of data points per year before any data cleaning or 

treatment. 

Filtering of data or exclusions of outliers should not be performed unless the 
institution can demonstrate that the excluded data points correspond to erroneous or 
stale data and do not represent the real market volatility of the risk factors. As part of 
the requirement under Article 368(1)(e) of the CRR to have procedures for ensuring 
compliance with controls concerning the overall operation of internal models, the 
ECB considers that institutions should keep track of any exclusion made in the risk 
factor time series used to calculate VaR and sVaR. 

122.  Conversely, automatic and systematic filtering of data leading to exclusions of high 
or low returns should not be performed without further analysis and documentation. 

5.5 

Proxies, beta approximation and regressions 

123.  For the purposes of this guide, the ECB understands that market data are proxied in 
the calculation of the VaR or sVaR60  when market data that are used as inputs in the 
pricing model to compute the economic P&L for an IMA position are replaced with 
other market data61  (or a weighted average of market data) for the purpose of 
calibrating the VaR or sVaR (respectively) for that position. 

60    For the purpose of partial use models this proxy definition should be applied only to market data inputs 
that fall into the approved risk categories of the model. Market data inputs giving rise to risks that are 
out of the scope of the approved risk categories should not automatically be counted as proxied. For 
example, an equity price that is modelled by a regression to an index for a general equity risk model 
(no approval for specific equity risk) should not be counted as proxied. 

61    If market data used for pricing and VaR calculation only differ in the source (for example, P&L pricing 

uses one source and VaR calculations are based on another source), the data used for risk calculation 
should not be considered as a proxy. In any case, the quality of the data should be checked and the 
sources justified by the institution. 

ECB guide to internal models – Market risk – CRR2 

200 

 
 
Where for the economic P&L a certain market data input (for example, the directly 
observable price of an instrument) is used, while the VaR or sVaR model 
(respectively) uses other market data that would lead to an equivalent price, the ECB 
considers that these data should not be considered as proxies.62  Conversely, if the 
data would not lead to an equivalent price, they should be considered as proxies. 

In accordance with Article 367(1)(b) of the CRR, where a risk factor is incorporated 
into the institution’s pricing model but not into the risk measurement model, the 
institution must be able to justify such an omission to the satisfaction of the 
competent authority. Therefore, the ECB considers that in the event of reduced 
granularity of market data inputs for curves or surfaces in the VaR or sVaR model, as 
compared with the economic P&L, an institution should duly justify why the data 
points interpolated owing to the reduced granularity should not be considered as 
proxies (e.g. by means of equivalent price as mentioned above). 

124. 

In accordance with Article 370(e) of the CRR, an internal model used for specific risk 
must capture name-related basis risk, and in particular be sensitive to material 
idiosyncratic differences between similar, but not identical, positions. The ECB 
therefore considers that the use of each single stock price (where available) as a risk 
factor in the VaR or sVaR is the best practice for modelling specific risk for equity 
instruments. Similarly, the direct use of idiosyncratic market data (where available) 
(for example, the idiosyncratic bond spread or each single-name credit default swap) 
as a risk factor is considered to be the best practice for modelling specific risk for 
debt instruments. 

However, the use of beta approximations or regressions could be accepted if they 
are documented and regularly validated (i.e. they are shown to lead to good model 
performance) as required by Articles 368(1)(e) and 369 of the CRR. Institutions with 
internal model approval for specific risk should be able to demonstrate that the 
idiosyncratic volatility of equity or debt instruments with specific risk is correctly taken 
into account in the VaR and sVaR models. 

125.  The ECB considers that in order to demonstrate that the model captures accurately 

all material price risks as required by Article 367(1)(a) of the CRR, the institution 
should document and make available upon request an inventory of time series of risk 
factors that are proxied for the calibration of the VaR and sVaR models, together with 
the materiality of the corresponding risk factors. 

126.  The ECB considers that the requirement to have a documented set of internal 

policies and controls also applies to the use of proxies, as they are part of the overall 
operation of internal models. Therefore, institutions should have a policy in place that 
defines clear processes for deriving and validating each proxy for VaR and sVaR. 
The policy should further define a set of controls (for example, statistical analysis or 
comparison against alternative proxies) that should be performed to ensure the 
appropriateness of proxies. 

62    Examples that could lead to equivalent prices are: (i) where the economic P&L is computed by market 
instrument (yield) rates, while the VaR/sVaR is computed based on zero coupon rates; and (ii) where a 
price-based economic P&L is used (for example, listed options, or the direct bond price), while the VaR 
uses a model-based P&L. 

ECB guide to internal models – Market risk – CRR2 

201 

 
 
127.  As a control to ensure that the proxies are appropriately conservative and are 

reflective of the true volatility where sufficient market data are available, institutions 
should perform analyses to show that the proxy market data (i) are highly correlated 
with the market data used for economic P&L, and (ii) show a similar level of volatility 
for VaR and sVaR. Where analyses based on market data used for economic P&L 
are not feasible, institutions should at least assess alternative plausible proxy 
choices. 

In particular, institutions which have approved internal models for specific risk of debt 
instruments or specific risk of equity instruments should demonstrate that the use of 
a proxy enables the idiosyncratic risk to be appropriately captured as required by 
Article 370(e) of the CRR. 

128.  As proxies are part of the internal models, any proxy should also be validated for 

VaR and sVaR at least annually in accordance with Section 4.2 on the frequency of 
regular internal validation. 

129. 

In order to assess that proxies are appropriately conservative and reflective of the 
true volatility, the ECB can, on the basis of Article 10 of the SSM Regulation, require 
an institution to provide, for a selection of sub-portfolios, business days, and material 
proxies: 

(a) 

the hypothetical P&L used for regulatory back-testing; 

(b) 

(c) 

the hypothetical P&L calculated on the same unchanged positions but 
replacing, for the positions for which proxies are used in the VaR, the market 
data with the market data of their proxies; 

the hypothetical P&L calculated on the same unchanged positions but 
replacing, for the positions for which proxies are used in the sVaR, the market 
data with the market data of their proxies. 

The specific information required will depend on the results of the institution’s 
analysis of the appropriateness of the proxies. 

5.6 

Risk factors in the model 

130. 

In accordance with Article 367(1)(b) of the CRR, the VaR and sVaR models must 
capture a sufficient number of risk factors, depending on the level of activity of the 
institution in the respective markets. Where a risk factor is incorporated into the 
institution’s pricing model (referred to as “market data input” for the purposes of this 
guide) but not into the risk measurement model, the institution must be able to justify 
such an omission to the satisfaction of the competent authority. 

So that it can assess compliance with this requirement, the ECB considers that an 
institution should be able to provide an inventory of all the market data inputs to the 
economic P&L and of all the risk factors used in the VaR and sVaR models. This 
inventory should include a comprehensive mapping between the market data used to 

ECB guide to internal models – Market risk – CRR2 

202 

 
calculate the economic P&L and the corresponding risk factors included in the VaR 
and sVaR model. The inventory should contain at least the following information: 

(a)  a list of the market data inputs used in the calculation of the institution’s 

economic P&L63; 

(b) 

for each market data input, information confirming: 

(i)  whether the market data input is directly modelled in the VaR engine 

(i.e. whether it is a risk factor of the model and involves no use of a proxy); 

(ii)  whether the market data input is proxied in the VaR calculation; 

(iii)  whether the market data input is modelled (or not) in the VaR engine; 

(iv)  where relevant, how the market data input is proxied in the VaR calculation 
(for example, by one market data input or by a combination of several 
market data inputs in a regression approach). 

A similar inventory should be provided for the sVaR model where relevant. 

131. 

Identical underlyings should always be mapped to the same risk factor in order to 
ensure consistency within the model. 

132. 

In order to assess whether VaR and sVaR models capture a sufficient number of risk 
factors and to assess the materiality of missing risk factors, the ECB can, on the 
basis of Article 10 of the SSM Regulation, require institutions to provide, for a 
selection of sub-portfolios, business days, and missing risk factors: 

(a) 

the hypothetical P&L used for regulatory back-testing as defined in Section 3.5; 

(b) 

the P&L calculated assuming simultaneously: 

(i)  unchanged positions and omitting the changes in value of the missing risk 

factors of the VaR and sVaR; 

(ii)  use of the pricing method and model parametrisation used to compute the 

economic P&L.64 

5.7 

Pricing functions and methods in the model 

133. 

In accordance with Article 367(1)(a) of the CRR, models must capture accurately all 
material price risks. In addition, in accordance with Article 368(1)(e) and (f) of the 
CRR, institutions must have a set of documented procedures and controls 
concerning the overall operations of their internal models, and those models must 
have a proven track record of reasonable accuracy in measuring risks. Therefore, 
institutions should be able to produce and update, on a regular basis, an inventory of 

63    For example, inputs in institutions’ pricing models for economic P&L. 
64    This should be identical to the pricing function used to calculate the hypothetical P&L under 

paragraph 75. 

ECB guide to internal models – Market risk – CRR2 

203 

 
 
all the VaR and sVaR pricing functions and methods, and the pricing functions and 
methods used in the economic P&L. This inventory should include a comprehensive 
mapping between the pricing functions and methods used in VaR and sVaR and the 
pricing functions and methods used for the daily economic P&L. It should include the 
following information at the relevant level of granularity: 

(a) 

the pricing functions and methods, and pricing functions and methods 
parametrisation (for example, the number of Monte Carlo simulations) used to 
calculate the daily economic P&L; 

(b) 

the scope of instrument types covered by each pricing function and method 
used to calculate the daily economic P&L; 

(c)  a meaningful indication of the materiality of positions priced with the 

corresponding pricing function and method, for example the number of 
individual positions, as well as the total amount of outstanding notional and 
market value covered by each pricing function and method used to calculate the 
daily economic P&L; 

(d)  corresponding pricing functions and methods as well as the pricing functions 
and methods parametrisation (for example, the number of Monte Carlo 
simulations) used in the VaR engine; 

(e)  a self-assessment by the institution, including a scorecard indicator (green, 
amber, red)65  of the appropriateness of VaR pricing methods (VaR engine 
pricing versus daily economic P&L pricing). 

The criteria for assessing this scorecard indicator should be described in an internal 
policy. 

A similar inventory should be available for the sVaR model, where relevant. 

The ECB considers that an appropriate frequency for updating this inventory is at 
least annually, so that it can be used in the annual review of the institution’s overall 
risk management process as referred to in Article 368(2) of the CRR. 

134.  This inventory should be reviewed at least annually by a unit independent of the one 
that produces it (for example, the internal audit function or internal validation 
function). This review should check the quality, reliability and comprehensiveness of 
the information provided in the inventory. 

135.  As for any other assumption in an internal model, the differences in the pricing 

functions and methods used for the calculation of the VaR and sVaR, compared with 
those used for the calculation of the economic P&L, should be subject to validation66 
in accordance with Article 369(1) of the CRR. This validation should include any 
simplifications of pricing functions and methods introduced for use for VaR or sVaR-
related purposes (for example, a reduced number of parameters or simulations). The 

65    The scorecard indicators are: green – fully appropriate; amber – acceptable; red – weakness detected. 
66    The validation of pricing functions used for economic P&L purposes is expected to be regularly 

performed by an institution and thus is the basis for this additional requirement. 

ECB guide to internal models – Market risk – CRR2 

204 

 
 
validation should be performed at least initially when a pricing method is introduced 
into the VaR or sVaR calculation that is not identical to the one for economic P&L 
purposes, and should assess the impact of the use of different pricing methods. 
Additionally, a regular validation should be performed in order to check that this 
impact remains low. The scorecard indicator mentioned above should be based on 
the results from this (initial and regular) validation. The institution should develop a 
work plan to mitigate the risk or improve the quality of any pricing functions or 
methods that are deemed inadequate according to the institution’s assessment in the 
scorecard (i.e. a red indicator). 

136. 

In order to assess the accuracy and appropriateness of the pricing functions and 
methods in the VaR and sVaR models, the ECB can, on the basis of Article 10 of the 
SSM Regulation, require institutions to provide, for a selection of sub-portfolios, 
business days, and pricing functions/methods: 

(a) 

the hypothetical P&L used for regulatory back-testing as defined in Section 3.5; 

(b) 

the P&L, calculated on the same unchanged positions, by using the pricing 
functions and methods used to compute the VaR and sVaR numbers with the 
market data input used for the hypothetical P&L. 

This information allows assessment of the isolated impact on the hypothetical P&L of 
using the pricing functions and methods in VaR and sVaR calculations, instead of 
those in the economic P&L. 

ECB guide to internal models – Market risk – CRR2 

205 

 
6 

Methodology for IRC models focusing on default risk 

6.1 

Relevant regulatory references 

Table 29 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

26/07/2013 

4 

153,336 

367 

368   

369 

370 

372 

373 

374 

375 

376 

10 

63 

65 

70 

(1) 

(1),(4) 

(1) 

(a), (d) 

(2), (4) 

(1) 

(2), (3), (6) 

17, 25, 29 

(4)(b) 

(3) 

(3) 

SSM Regulation 

Other references 

EBA Guidelines on the IRC 

Final draft RTS on assessment methodology for 
IMA and significant share 

15/10/2013 

16/05/2012 

22/11/2016 

Once adopted by the European Commission, the Final draft RTS on assessment 
methodology for IMA and significant share will become an additional relevant 
regulatory reference. Currently that document only exists in a final draft version. 

6.2 

General requirements 

137.  Under paragraph 29.2 of the EBA Guidelines on the IRC, institutions should be able 
to prove that, on the day of the week chosen for the IRC calculation, their portfolio is 
representative of the portfolio held during the week and that the chosen portfolio 
does not lead to a systematic underestimation of the IRC numbers when computed 
weekly (for example, by using sensitivities or jump-to-default). 

138. 

In order to assess that the day of the week when the IRC numbers are calculated 
does not lead to material bias, the ECB can, on the basis of Article 10 of the SSM 
Regulation, require an institution to recalculate the IRC for 15 consecutive business 
days (including three reporting days). If it is not possible to perform this calculation in 
the production environment, it can be performed in a test environment replicating the 
calculation of the regulatory IRC. 

ECB guide to internal models – Market risk – CRR2 

206 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
139. 

In accordance with Article 374(4) of the CRR, the IRC model must be based on the 
assumptions of a constant level of risk over the one-year time horizon or, 
alternatively, on the assumption of a one-year constant position. As with any other 
modelling assumption, an institution should be able to demonstrate that the chosen 
assumption appropriately captures the risk of its portfolio. 

In order to assess the appropriateness of that choice, the ECB can, on the basis of 
Article 10 of the SSM Regulation, require an institution that uses a constant level of 
risk assumption and liquidity horizons shorter than one year to calculate the impact 
of using a constant position assumption on the IRC and the default risk in the IRC67 
amounts. 

140. 

In accordance with Article 375(1) of the CRR, hedging or diversification effects 
associated with long and short positions may only be recognised by explicitly 
modelling gross long and short positions in the different instruments, and institutions 
must reflect the potential for significant basis risks in hedging strategies, in particular 
by maturity. Therefore, the ECB considers that irrespective of whether a one-year 
constant position assumption or a constant level of risk assumption is used, 
institutions should not overestimate diversification or hedging effects, and in 
particular should ensure that maturity mismatches between long and short positions 
occurring within the liquidity horizon or within the one-year risk modelling horizon do 
not lead to an underestimation of risk.68 

In accordance with Article 376(3)(c) of the CRR, as part of the annual independent 
review and the initial and periodic validation of its IRC model, an institution must 
apply appropriate quantitative validation. Therefore, the ECB considers that 
institutions should, as part of the annual independent review and the initial and 
periodic validation of their IRC models, assess quantitatively how maturity 
mismatches – that may lead to imbalanced positions within the modelling horizon – 
impact the IRC and the default risk in the IRC amounts.69 

141. 

In accordance with Article 372(d) in conjunction with Article 368(1)(f) of the CRR, an 
IRC model must be reasonably accurate in measuring risks. Therefore, an institution 
should be able to demonstrate that the number of simulations used in its model to 
compute the IRC and the default risk in the IRC is sufficient to ensure accurate and 
stable IRC amounts. 

142. 

In order to assess the accuracy of the IRC calculations, the ECB can, on the basis of 
Article 10 of the SSM Regulation, require institutions to calculate a confidence 
interval of IRC estimation with a confidence level of 95%. 

67    For the purposes of this document, default risk in the IRC means the risk charge calculated with the 

institution’s IRC methodology and on the institution’s current IRC portfolio, but without taking the effect 
of rating migrations into account. Thus, default risk in the IRC is a stand-alone risk number and not the 
default risk contribution to the IRC amount. 

68  This understanding is also supported by Article 63(4)(b) of the Final draft RTS on assessment 

methodology for IMA and significant share. 

69    A simple way of testing the impact of maturity mismatches leading to imbalanced positions may be to 
scale down the PDs and migration of maturing positions, taking into account the reduced time horizon 
until maturity. 

ECB guide to internal models – Market risk – CRR2 

207 

 
 
143.  Under paragraph 17.2 of the EBA Guidelines on the IRC, institutions should use one 
(or, where relevant data are available, more than one) migration matrix that is 
specific to sovereign issuers (where relevant). Therefore, institutions should use a 
separate migration matrix for other types of issuers. Where an institution uses only 
one matrix for all types of issuers, it should be able to demonstrate that this leads to 
conservative IRC amounts.70 

144. 

In accordance with Article 372(d) in conjunction with Article 368(1)(e) of the CRR, 
institutions must ensure compliance with a documented set of internal controls 
related to their IRC model. So that the ECB can assess compliance with this 
requirement, an institution should be able to provide an inventory of all open 
validation findings in relation to its IRC model, including a description of the finding, 
the envisaged remedial action and the target date for closure of the finding. In 
addition, institutions should retain closed validation findings for at least one year after 
the closure date and should be able to provide a description of the remedial action 
implemented. Furthermore, to allow the ECB to assess compliance with Article 
372(d) in conjunction with Article 368(1)(e) of the CRR, an institution should be able 
to provide an inventory of analyses that have been conducted with the purpose of 
developing/justifying the IRC model over the last five years. 

6.3 

Data inputs 

145. 

In accordance with Article 376(6) of the CRR, an IRC model must meet minimum 
data standards. This applies in particular to time series used to calibrate the IRC 
model, for which the institution should have a process in place to check the quality of 
the time series regularly. The ECB considers that an appropriate minimum frequency 
for checking the quality of the time series is quarterly, as this allows alignment with 
the regulatory reporting cycle. Therefore, the data quality requirements for VaR and 
sVaR models indicated in paragraphs 118 to 119 and 121 to 122 also apply to the 
market data used for calibration of the IRC model. 

6.4 

Distribution and correlation assumptions 

146. 

In accordance with Article 376(3)(a) of the CRR, an institution must, as part of the 
annual independent review and the initial and periodic validation of its IRC model, 
validate that its modelling approach for correlations and price changes is appropriate 
for its portfolio, including the choice and weights of its systematic risk factors. The 
ECB understands that this provision requires institutions in particular to justify (i) the 
choice of systematic factor types (for example, region and industry) and, for each 
type of systematic factor, its granularity, and (ii) the full correlation structure and its 
calibration for the entire set of risk factors used. 

147.  An institution that does not calibrate the correlations of its IRC model to market data, 

but instead uses internal ratings based (IRB) correlations, should demonstrate their 

70    The impact on the default risk in the IRC should also be provided upon request. 

ECB guide to internal models – Market risk – CRR2 

208 

 
 
148. 

149. 

150. 

appropriateness in relation to its portfolio. The ECB considers that owing to the 
nature of the regulatory trading book, the correlations as defined in Article 153 of the 
CRR should be used for this purpose. 

In accordance with Article 374(2) of the CRR, correlation assumptions must be 
supported by analysis of objective data in a conceptually sound framework. In 
accordance with Article 372(d) in conjunction with Article 369(1) of the CRR, 
institutions must perform tests to demonstrate that any assumptions made within the 
internal model are appropriate. In view of those two provisions, the ECB considers 
that any assumption for correlation modelling made by the institution should be 
supported by objective market data (for example, credit default swap data, equities 
data or rating migrations data) and justified by a quantitative analysis as part of its 
initial and periodic validation process. In particular, this quantitative analysis should 
compare the level of correlation between issuers that is derived from the institution’s 
IRC correlation model and from objective market data. The ECB understands that 
this requirement also applies to those institutions using an IRB-based methodology 
and to those using a vendor model. 

In order to assess the appropriateness of the modelling approach for correlations, 
the ECB can, on the basis of Article 10 of the SSM Regulation, require institutions to 
provide correlations for all issuer pairs, and all relevant correlation values according 
to their factor model, in particular for the systematic factors. 

In accordance with Article 374(2) of the CRR, concentrations under stressed 
conditions must be reflected in the correlation assumptions of the IRC model. The 
ECB understands that the use of a short period of data for calibrating the correlations 
implies the risk that stressed conditions are not appropriately reflected. Therefore, 
institutions should be able to justify that stressed conditions have been adequately 
captured and to quantify the impact of using sufficiently long time series capturing a 
relevant stressed period for calibrating correlations in the IRC and the default risk in 
the IRC. In accordance with Article 370(c) of the CRR in conjunction with 
Article 372(d) of the CRR, the IRC model must be robust to an adverse environment. 
Therefore, the ECB considers that, in order to also ensure a robust calibration of the 
IRC model, a time series of at least 10 years, capturing a relevant stressed period, is 
appropriate.71 

151. 

In accordance with Article 376(3)(b) of the CRR, institutions must perform sensitivity 
analysis and scenario analysis to assess the qualitative and quantitative 
reasonableness of the internal model, particularly with regard to the treatment of 
concentrations. Because the weights of the systematic risk factors are relevant for 
the modelling of concentrations, the ECB considers that institutions should – as part 
of the independent review, and in the initial and periodic validation process – perform 
sensitivity analyses for the IRC and the default risk in the IRC. In particular, the ECB 
considers it best practice that this sensitivity analysis includes, as a minimum, the 
following basic analysis, where systematic risk factor weights or correlations of risk 

71    By using proxies if, and where, necessary. 

ECB guide to internal models – Market risk – CRR2 

209 

 
 
factors72  in the model are shifted up or down by a fixed value or set to generic 
values: 

(a)  all weights of the systematic factors per issuer, for each issuer73, are shifted by 

+10% in absolute value (not going beyond 100%)74; 

(b)  all weights of the systematic factors per issuer, for each issuer, are shifted by 

−10% in absolute value (not going below 0%); 

(c)  all weights of the systematic factors per issuer, for each issuer, are set to 0; 

(d)  all weights of the systematic factors per issuer, for each issuer, are set to 1; 

(e)  all correlations between systematic factors are set to 100% (weights of issuers 

to their respective systematic factors remain unchanged); 

(f)  all correlations between systematic factors are set to 0% (weights of issuers to 

their respective systematic factors remain unchanged). 

In order to assess the appropriateness of the sensitivity analysis and scenario 
analysis performed to validate the reasonableness of the internal model, the ECB 
can, on the basis of Article 10 of the SSM Regulation, require institutions to provide 
the results of the sensitivity analysis as described in this paragraph, points (a) to (f). 

152. 

153. 

In order to assess the appropriateness of the modelling approach for correlations, 
and in particular the choice and weights of the systematic risk factors, the ECB can, 
on the basis of Article 10 of the SSM Regulation, require institutions to calculate the 
IRC and the default risk in the IRC amounts based on a one-factor Merton Model 
(using one single global systematic risk factor) and one flat correlation with different 
correlation assumptions: 0%, 5%,10%, 15%, 20%, 25%, 30%, 35%, 40%, 45%, 50%, 
60%, 70%, 80%. All other inputs into institutions’ IRC models remain unchanged. 

In accordance with Article 374(2) of the CRR, correlation assumptions must be 
supported by analysis of objective data in a conceptually sound framework. In 
accordance with Article 376(3)(a) of the CRR, an institution must, as part of the 
annual independent review and the initial and periodic validation of its IRC model, 
validate that its modelling approach for correlations is appropriate for its portfolio. In 
accordance with Article 376(3)(c) of the CRR, institutions must apply appropriate 
quantitative validation. Under paragraph 25.2(iii) of the EBA Guidelines on the IRC, 
in the validation process the impact of different copula assumptions should be 
analysed, for example by testing the impact of different distributional assumptions. 
Because the copula choice is a key assumption of the modelling approach for 
correlations, the ECB understands that these provisions require, in particular, that 
institutions demonstrate the appropriateness of and validate the copula choice of the 

72    The latent variables of the model that determine the correlation of migration and default events of the 

issuers. 

73    If the asset value  𝐴𝑖  of an obligor  𝑖  is written as follows in a factor model: 𝐴𝑖 = √𝜌 i  𝑋𝑖 + √1 − 𝜌 i 𝜉𝑖 

where  𝑋𝑖  is driven by systemic contributions and  𝜉𝑖  is the idiosyncratic noise term, the weights of the 
issuers to their respective systematic factors correspond to  √𝜌 i . 

74    Which reduces the idiosyncratic weight accordingly. 

ECB guide to internal models – Market risk – CRR2 

210 

 
 
modelling approach for correlations. The copula choice refers to the copula of the 
joint multivariate distribution75  of the risk factors for migration and default and of the 
joint systematic risk factors, where relevant. 

154. 

In accordance with Article 376(3)(b) of the CRR, institutions must perform sensitivity 
analysis and scenario analysis to assess the qualitative and quantitative 
reasonableness of the internal model, particularly with regard to the treatment of 
concentrations. Because the copula choice is a key assumption of the modelling 
approach for correlations and is relevant for the modelling of concentrations, the 
ECB considers that institutions should – as part of the independent review, and in the 
initial and periodic validation process – perform sensitivity analyses for different 
copula assumptions. The ECB considers that the following are suitable choices for 
comparing the impact of different copulas on the IRC and the default risk in the IRC 
with respect to the approved model: 

(a)  using a Student-t copula for all issuer risk factors with 8 degrees of freedom; 

(b)  where relevant, using a Student-t copula for the systematic risk factors with 

8 degrees of freedom; 

(c)  using a Student-t copula for all issuer risk factors where the degrees of freedom 

have been calibrated to market data; 

(d)  where relevant, using a Student-t copula for the systematic risk factors 

calibrated to market data. 

This list is without prejudice to the discretion of an institution to perform additional 
analyses on copula choices that it deems more fitting for its particular circumstances. 

6.5 

Ratings, probabilities of default and recovery rate assumptions 

6.5.1 

Documentation requirements 

155. 

In accordance with Article 372(d) in conjunction with 368(1)(e) of the CRR, an 
institution must have a documented set of internal policies and controls concerning 
the overall operation of its internal models. The ECB considers that for the IRC 
model institutions should have in place, in particular: 

(a)  methodology and process documents for the determination of probabilities of 

default (PDs) and recovery rates (RRs), including a process and documentation 
concerning the fallback approaches applied; 

75    Sklar’s theorem (in Sklar, A., “Fonctions de répartition à n dimensions et leurs marges”, Publications de 
l’Institut de Statistique de L’Université de Paris, Vol. 8, 1959, pp. 229-231) states that every multivariate 
cumulative distribution function of a random vector can be expressed in terms of its marginals and a 
copula. 

ECB guide to internal models – Market risk – CRR2 

211 

 
 
(b)  validation documents demonstrating that the assumptions relating to PDs and 

RRs are appropriate; 

(c)  a documented hierarchy of preferred sources for the determination of PDs and 

RRs, which are applied to all issuers and instruments within the scope of the 
IRC model. 

156. 

In order to assess the appropriateness and implementation of the policies and 
procedures for determining PDs and RRs, the ECB can, on the basis of Article 10 of 
the SSM Regulation, require institutions to provide on request a complete list of 
positions in the IRC model, together with the respective issuer or obligor ratings, the 
PDs of the issuer or obligor and the RRs for the positions. If the ratings, PDs or RRs 
have been adjusted or have not been assigned using the usual automated process 
(for example, by manual intervention or deviation from the usual automated 
process), the institution should maintain a complete list of such ratings, PDs and 
RRs, and provide the rationale for the adjustment, or (for example) manual 
intervention or deviation from the usual automated process (as applicable) in each 
case. 

6.5.2 

Validation requirements 

157. 

In accordance with Article 376(3)(b) of the CRR, institutions must perform sensitivity 
analysis and scenario analysis to assess the qualitative and quantitative 
reasonableness of the internal model. Therefore, the ECB considers that institutions 
should – as part of the independent review and in the initial and periodic validation 
process – perform sensitivity analyses with respect to the PDs and RRs that are 
applied to assess the quantitative impact in terms of the IRC and the default risk in 
the IRC. In particular, the ECB considers it best practice that such sensitivity analysis 
include, as a minimum, the following basic analyses on the main drivers of the IRC 
model: 

(a)  a simultaneous 10% (absolute) up and down shift (not going beyond 0% or 

above 100%) of the RRs used in the portfolio. For models using stochastic RRs, 
institutions are expected to incorporate this impact by adjusting the mean of the 
RR distributions; 

(b) 

for models using stochastic RRs, a simultaneous 30% (relative) up and down 
shift of the standard deviation of RRs; 

(c) 

for all the PDs used in the IRC calculation: 

(i)  a minimum value of 0.01% for all PDs; 

(ii)  a minimum value of 0.03% for all PDs; 

(iii)  a simultaneous 10% relative upshift of all PDs; 

(iv)  a simultaneous 10% relative downshift of all PDs; 

ECB guide to internal models – Market risk – CRR2 

212 

 
(v)  a simultaneous 1bp absolute upshift of all PDs; 

(vi)  a simultaneous 1bp absolute downshift76  of all PDs. 

The change in PD should be compensated for by proportionally increasing (or 
decreasing) all the migration probabilities belonging to the same initial rating class to 
maintain the cumulative 100% migration and default probability.77 

As the sensitivity analyses listed above are part of the model validation, institutions 
should take them into account in detail when assessing and justifying their PDs and 
RRs parameters. The assessment should encompass an analysis of how the most 
important issuers and groups of issuers are affected by the altered PD and RR 
values. 

In order to assess the appropriateness of the sensitivity analysis and scenario 
analysis performed to validate the reasonableness of the internal model, the ECB 
can, on the basis of Article 10 of the SSM Regulation, require institutions to provide 
the results of the sensitivity analysis described in paragraph 157(a) to (c). 

158. 

159. 

In accordance with Article 376(2) of the CRR, the IRC model must be based on data 
that are objective and up to date. In accordance with Article 368(1)(a), any internal 
model must be closely integrated into the daily risk management process of the 
institution and serve as the basis for reporting risk exposures to senior management. 
Therefore, the ECB considers that institutions should demonstrate, on the basis of 
objective data, that the PD estimates78  are appropriate. Furthermore, where the 
estimates of PDs are not derived in combination with current market prices, 
institutions should analyse any observed differences between these estimates and 
estimates that are derived in combination with current market prices where the 
relevant corrections were performed to obtain real-world PDs. The expectation 
outlined in the last sentence does not apply to IRC PDs that are PDs from an IRB 
approach approved by the supervisor. 

In accordance with Article 367(1)(a) of the CRR, any internal model used to calculate 
capital requirements for market risk must capture accurately all material price risks. 
In accordance with Article 368(1) of the CRR, an IRC model must be conceptually 
sound and implemented with integrity. In accordance with Article 372(a) of the CRR, 
the IRC model must give a meaningful differentiation of risk, and accurate and 
consistent estimates of incremental default and migration risk. Therefore, the ECB 
considers that institutions should be able to show that the statistical methodology 
used to derive PDs is conceptually sound and that PDs are accurate and consistent 
across all rating grades. The ECB considers that an analysis of the expected range 
of estimation errors should be performed, in order to assess the accuracy of the 

76    Not going below zero. 
77    Given an initial set of migration probabilities,  𝑝1, … , 𝑝𝑛, where  𝑝𝑛  corresponds to the PD, the 

probabilities  𝑝𝑖  for  𝑖 = 1, … , 𝑛 − 1  should be adjusted by  𝑝𝑖
to the modified PD. 

′ = 𝑝𝑖 ⋅ (1 + 𝑝𝑛−𝑝𝑛
1−𝑝𝑛

′

)  where  𝑝𝑛

′   corresponds 

78    The same requirements apply to the rating agency data. 

ECB guide to internal models – Market risk – CRR2 

213 

 
 
160. 

estimates. Furthermore, the PD for a rating grade should not be set to zero solely on 
the basis that no defaults have been observed in the past for that rating grade. 

In accordance with Article 373 of the CRR, the IRC model must cover all positions 
that are subject to own funds requirements for specific interest rate risk, including 
those with a 0% specific risk capital charge under Article 336 of the CRR. In 
accordance with Article 372(a) of the CRR, the IRC model must give a meaningful 
differentiation of risk, and accurate and consistent estimates of incremental default 
and migration risk. In accordance with Article 375(1) of the CRR, institutions must 
reflect the potential for significant basis risks in hedging strategies by internal or 
external rating and other differences in the instruments.79  Therefore, the ECB 
understands that all annual PDs should be risk sensitive and greater than zero80  for 
all obligors. In this context, the term “greater than zero” is interpreted to mean 
greater than, or equal to, one basis point. Furthermore, in the ECB’s understanding, 
“risk sensitive” implies that all annual PDs should increase strictly in line with the 
decreasing creditworthiness of the obligor. The ECB also considers that institutions 
should calculate the PD ratios between adjacent rating grades and analyse these 
ratios to understand potential differences from other ratios or the median of the 
ratios. 

161. 

In accordance with Article 376(4) of the CRR, the internal model must be consistent 
with the institution’s internal risk management methodologies for identifying, 
measuring and managing trading risks.81  The ECB considers that institutions should 
identify which terms, information or assumptions in the methodology used to 
estimate PDs for IRC are different from the terms, information or assumptions used 
to account for expected credit losses used under accounting rules (e.g. IFRS 9) as 
well as those used to account for expected losses as defined in Article 5 of the CRR. 
Where they differ, institutions should be able to show that the underlying rationale is 
documented and approved by the institution’s management body or a designated 
committee thereof and senior management. 

79    These articles are read in conjunction with the CRR requirements regarding the IRB approach: Article 

144(1)(a) of the CRR requires that the institution’s rating systems provide for a meaningful assessment 
of obligor and transaction characteristics, a meaningful differentiation of risk, and accurate and 
consistent quantitative estimates of risk; Article 170(1)(c) of the CRR requires that an institution 
documents the relationship between obligor grades in terms of the level of default risk each grade 
implies and the criteria used to distinguish that level of default risk. 

80    This understanding is also supported by Article 65(3) of the Final draft RTS on assessment 

methodology for IMA and significant share. 

81    This requirement is also supported by the EBA Guidelines on credit institutions’ credit risk management 

practices and accounting for expected credit losses (EBA/GL/2017/06). In accordance with paragraph 
29 of the Guidelines, credit institutions should, to the maximum extent possible, leverage and integrate 
common processes, systems, tools and data that are used within a credit institution to determine if, 
when, and on what terms, credit should be granted; monitor credit risk; and measure allowances for 
both accounting and capital adequacy purposes. In accordance with paragraph 30, a credit institution’s 
allowance methodologies should clearly document the definitions of key terms related to the 
assessment of credit risk and expected credit loss measurement (such as loss and migration rates, 
loss events and default). Where different terms, information or assumptions are used across functional 
areas (such as accounting, capital adequacy and credit risk management), the underlying rationale for 
these differences should be documented and approved by senior management. Information and 
assumptions used for expected credit loss estimates should be reviewed and updated as required by 
the applicable accounting framework. 

ECB guide to internal models – Market risk – CRR2 

214 

 
 
162. 

In accordance with Article 376(2) of the CRR, the IRC model must be based on data 
that are objective and up to date. Therefore, the ECB considers that institutions 
should demonstrate, based on objective data, that the RR estimates are appropriate. 

Based on its observations of the practices of the industry, the ECB considers it best 
practice that the RRs do not exceed the following values: 

(a)  25% for subordinated debt; 

(b)  55% for senior unsecured debt; 

(c)  88.75% for covered bonds; 

(d)  75% for any other product. 

This does not exclude the possibility that higher RRs may be used, where institutions 
can justify them by objective and up-to-date data in accordance with Article 376(2) of 
the CRR. This best practice also applies to positions under the fallback approach for 
the RRs (i.e. for which no direct data sources are available). 

6.5.3 

Consistency requirements 

163. 

In accordance with Article 372(a) of the CRR, the IRC model must give accurate and 
consistent estimates of incremental default and migration risk. Therefore, and in 
order to ensure that institutions do not use different sources for PDs and RRs for the 
sole purpose of reducing their overall own funds requirements for market risk, the 
ECB considers that they should apply consistent sources for PDs and RRs in the 
IRC model. Therefore, institutions using internal ratings should use the 
corresponding internal RRs, and those using external ratings should use historical, 
market implied or market convention RRs.82 

6.5.4 

Requirements for PD fallback values 

164. 

In accordance with Article 376(6) of the CRR, proxies must be appropriately 
conservative and may be used only where the available data are insufficient. The 
ECB is aware that for positions where a reliable PD assignment is not possible due 
to a lack of adequate data (for example, where no internal or external ratings or 
liquid credit spread time series are available) institutions apply a fallback PD value. 
As fallback PD values are used when the available data are insufficient, the ECB 
considers them as proxies. In order to ensure that fallback PDs are appropriately 
conservative, the ECB considers it best practice that the fallback PD assigned to 
each of those issuers and positions is at least equal to the higher of the following. 

(a)  The PD that is equivalent to the worst investment grade rating applicable, 
according to the institution’s sources for the determination of PDs – those 

82    This understanding is also supported by Article 70(3) of the Final draft RTS on assessment 

methodology for IMA and significant share. 

ECB guide to internal models – Market risk – CRR2 

215 

 
 
institutions using internal rating approaches for the assignment of PDs should 
use the PD that is equivalent to the worst investment grade rating in their 
internal rating scales. 

(b)  The equally weighted83  average PD84  of those issuers included in the IRC 

model which are not subject to the fallback approach. Institutions may exclude 
defaulted issuers when calculating the equally weighted average PD, provided 
that they can ensure that the fallback PD is not applied to defaulted issuers. 

165. 

In accordance with Article 372(a) of the CRR, the IRC model must provide a 
meaningful differentiation of risk, and accurate and consistent estimates of risk. In 
accordance with Article 376(2) of the CRR, the IRC model must be based on data 
that are objective and up to date. Therefore, the ECB considers that institutions 
should periodically assess the materiality of those issuers and positions that are 
assigned a fallback PD in the IRC model. The ECB considers that a suitable analysis 
for this purpose consists of the following: 

(a)  a comparison of the jump-to-default risk (where applicable, by using the 

average of the RRs in the case of a stochastic RR) of those positions that are 
assigned fallback PDs with the jump-to-default risk of all positions in the IRC 
model; 

(b)  a calculation of the ratio of the incremental85  IRC contributions and the 

incremental default risk in the IRC contributions of the positions assigned 
fallback PDs, to the IRC number as calculated by the IRC model: 

IRC(full scope) - IRC(non-fallback for PD)
IRC(full scope)

; 

Default risk in the IRC(full scope) - Default risk in the IRC(non-fallback for PD)
Default risk in the IRC(full scope)

166. 

In accordance with Article 372(a) of the CRR, the IRC model must provide a 
meaningful differentiation of risk. The ECB considers that if a significant percentage 
of the IRC is calculated using fallback PDs, there is a risk that the IRC model may 
not provide the meaningful differentiation of risk required. The ECB considers that if 
the percentage of the IRC calculated using fallback PDs is larger than 10%86, the 
institution should investigate whether additional data sources are available to reduce 
the percentage of issuers subject to the fallback PD assignment. 

In accordance with Article 376(3)(b) of the CRR, institutions must perform sensitivity 
analysis and scenario analysis to assess the qualitative and quantitative 

83    All issuers have the same weights. 
84    The PD may be derived from the rating of the issuer by applying the migration matrix of the IRC model. 
In addition, defaulted positions are included in the calculation of the average with a PD equal to 100% 
as issuers subject to the fallback approach could be in default. 

85    Risk management literature is not uniform in the use of the terms “incremental” risk number 
(e.g. incremental value-at-risk) and “marginal” risk number. We adopt the convention that an 
incremental risk number refers to the exact finite change in a risk number when adding a finite position, 
whereas “marginal” risk number refers to the derivative of a risk number with respect to a position 
(infinitesimal change rate). 

86    This threshold of 10% is set by analogy with the Commission Delegated Regulation on materiality of 

extensions and changes of the IMA, which establishes 10% as the threshold for assessing materiality. 

ECB guide to internal models – Market risk – CRR2 

216 

 
 
 
reasonableness of the internal model. In the event that the resulting percentage of 
the IRC calculated using fallback PDs is larger than 10%, the ECB considers that 
institutions should perform, as part of the independent review and validation, a 
sensitivity analysis for the IRC and the default risk in the IRC. In particular, the ECB 
understands that this requirement implies assessing the sensitivity of the IRC and 
default risk in the IRC amounts by assigning one rating grade higher and one rating 
grade lower than the one used in the fallback PD assigned on the basis of 
paragraph 164.87 

6.5.5 

Requirements for the calculation of losses based on recovery rates 

167. 

168. 

169. 

In accordance with Article 372(a) of the CRR, the IRC model must provide accurate 
and consistent estimates of incremental default risk. Therefore, the ECB considers 
that the market value change following the default of an issuer should be calculated 
as the difference between the current market value of the position and the expected 
market value subsequent to default. 

In accordance with Article 372(a) of the CRR, the IRC model must provide a 
meaningful differentiation of risk. In accordance with Article 375(1) of the CRR, 
institutions must reflect the potential for significant basis risks in hedging strategies 
by product, seniority in the capital structure, internal or external rating, maturity, 
vintage and other differences in the instruments. The ECB considers that in order to 
provide a meaningful differentiation of risk and to reflect the potential for significant 
basis risks, recovery rates should at least reflect the type of product, including the 
collateralisation of the position, and its seniority in the capital structure. 

In accordance with Article 372(a) of the CRR, the IRC model must provide accurate 
and consistent estimates of incremental default risk. In accordance with 
Article 372(d) in conjunction with Article 369(1) of the CRR, institutions must 
demonstrate that any assumptions made within the IRC model are appropriate. The 
ECB considers that this applies also to RRs. An RR measures the expected market 
value subsequent to default of a position as a percentage of the base value (for 
example, notional). For a long credit position (for example, the holding of a long bond 
position) a default of the issuer would lead to a loss. For RRs based on notional 
value, a negative RR indicates a negative expected market value subsequent to 
default, whereas an RR above 100% indicates that the expected market value 
subsequent to default is higher than the notional value. The ECB is aware that RRs 
generally range between 0% and 100%. RRs outside this range could indicate that 
the assumptions made within the IRC model are not appropriate – because they 
could imply an expected profit subsequent to default – and so institutions should be 
particularly prudent in applying such RRs or be able to demonstrate that they are 
conservative. 

87    When the average PD is used as a fallback approach, institutions should, by analogy, apply this 

requirement (i.e. identify the rating grade that is closest to the average PD and shift up and down 
starting from this rating grade). 

ECB guide to internal models – Market risk – CRR2 

217 

 
 
6.6 

Treatment of groups of connected issuers 

170. 

171. 

In accordance with Article 374(2) of the CRR, the IRC model must appropriately 
reflect issuer concentrations. As defined in Article 4(1)(39) of the CRR, two or more 
legal persons in the same group of connected clients constitute a single risk, unless 
it is shown otherwise. The ECB considers that groups of connected clients are 
relevant for modelling issuer concentrations. Therefore, such groups should be 
appropriately reflected in the IRC model and their treatment in the model is subject to 
the same requirements as any other component of the model, in particular 
documentation and validation. 

In accordance with Article 374(2) of the CRR, the IRC model must appropriately 
reflect issuer concentrations. As defined in Article 4(1)(39) of the CRR, a group of 
connected clients constitutes a single risk, unless it is shown otherwise. Therefore, 
the ECB considers that institutions should model issuers and obligors in the same 
group of connected clients as a single risk (this means, for example, that in an asset 
value model they should be modelled as a single asset value). However, the 
existence of different rating grades within a group of connected clients indicates the 
possibility that not all of those in the group default or migrate simultaneously. 
Therefore, the ECB considers that a suitable method of modelling is to distinguish 
within a group of connected clients by sub-groups of issuers that have the same 
internal or external rating grade and where the default or migration of each sub-
group would occur simultaneously in the IRC model – unless it is demonstrated that 
another treatment is more appropriate in view of the definition in Article 4(1)(39) of 
the CRR. 

172. 

In accordance with Article 376(3)(a) of the CRR, an institution must, as part of the 
annual independent review and the initial and periodic validation of its IRC model, 
validate that its modelling approach for correlations is appropriate for its portfolio. 
Because modelling groups of connected clients is relevant for modelling issuer 
concentrations and the correlations among them, the ECB considers that validation 
of the modelling of groups of connected clients is part of the annual independent 
review and the initial and periodic validation of the institution’s IRC model. 

ECB guide to internal models – Market risk – CRR2 

218 

 
7 

Risks-not-in-the-model engines 

7.1 

Relevant regulatory references 

Table 30 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

26/06/2013 

103 

105 

363   

366, 367, 368 

369 

372 

377 

430 

10 

7a 

7b 

(1) 

(1) 

(1) 

(a) 

(1) 

(1)(c) 

SSM Regulation 

Commission Delegated Regulation on materiality of extensions and 
changes of the IMA 

15/10/2013 

04/03/2015 

Commission Implementing Regulation on supervisory reporting88 

17/12/2020 

5 

(a) 

Annex III 

Part II, Section 2(13) 

7.2 

The framework for risks-not-in-the-model engines 

173. 

In accordance with Article 367(1)(a) of the CRR, any internal model used to calculate 
capital requirements for market risk must capture accurately all material price risks. 
For IRC models, the accuracy of the risk estimates is also required by Article 372(a) 
of the CRR. In accordance with Article 367(1)(b) of the CRR, where a risk factor is 
incorporated into the institution’s pricing model but not into the risk measurement 
model, the institution must be able to justify such an omission to the satisfaction of 
the competent authority. In accordance with Article 368(2)(d) of the CRR, the annual 
review of an institution’s overall risk management process must consider the scope 
of risks captured by the risk measurement model. In accordance with Article 369(1) 
of the CRR, institutions must have processes in place to ensure that all their internal 
models for market risk have been adequately validated to ensure that they are 
conceptually sound and adequately capture all material risks. In accordance with 
Article 368(1)(e) of the CRR, the institution must have in place established 
procedures for monitoring and ensuring compliance with a documented set of 
internal policies and controls concerning the overall operation of its internal models. 

88    Commission Implementing Regulation (EU) 2021/451 of 17 December 2020 laying down implementing 
technical standards for the application of Regulation (EU) No 575/2013 with regard to supervisory 
reporting of institutions and repealing Implementing Regulation EU No 680/2014 (OJ L 97, 19.3.2021, 
p. 1), referred to in this guide as “Commission Implementing Regulation on supervisory reporting”. 

ECB guide to internal models – Market risk – CRR2 

219 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
Based on the provisions referred to above, the ECB considers that the processes set 
out in detail in this section for risks not captured in the model89  engines (also 
referred to in this guide as “risks-not-in-the-model engines”, or “RNIME”90) are an 
integral part of the overall processes of the IMA for market risks. Therefore, 
institutions should develop an RNIME framework, the elements of which are further 
elaborated on in the following paragraphs. 

174.  For the purposes of this guide and in relation to the RNIME framework, the following 

diagram shows schematically different components of the market risk own funds 
requirements and the RNIME framework.91  The ECB considers that an internal 
model comprises all of the required methods, processes, policies, controls, and IT 
systems. Each internal model includes, inter alia, the following constituent elements. 

(a)  An “engine” – that is, the calculation methodology for each risk number, referred 
to collectively as “risk engines”. The ECB understands that Articles 367 and 368 
of the CRR refer to an engine as a “risk measurement model”. There is one risk 
engine for each risk number and the risk engine is used to compute the daily 
risk number. Typically, an engine models and computes all risks in an integrated 
manner. However, it may comprise several components, for example, a main 
component for the bulk of the risks, and some “satellite” components. A satellite 
component is part of a model engine, typically for a subset of products or risk 
positions, meeting all applicable CRR requirements for risk measurement 
models on an ongoing basis (for example, for particular risks not modelled in 
the main component). In accordance with Article 367(3) of the CRR, institutions 
may, in any internal model used for market risk, use empirical correlations; 
where they are not used, the model uses a simple sum aggregation of these 
components. 

(b)  An RNIME framework relating to all risk engines, in which RNIME are identified, 

quantified, managed and, if appropriate, capitalised by RNIME add-ons to the 
risk exposure amounts. The process for determining RNIME add-ons is part of 
the RNIME framework. An RNIME add-on is understood as a temporary risk 
exposure amount92  that remains in place until the corresponding RNIME is 
incorporated into the model engine(s) in a manner compliant with the CRR. The 
ECB considers that the RNIME add-ons are not part of the model engines, and 
are therefore not included in the risk numbers. In particular, RNIME add-ons are 
not included in the VaR number used for regulatory back-testing. 

89    In this section, the generic reference to “model” means a reference to the VaR, sVaR, IRC, and 
comprehensive risk measure (CRM) models for correlation trading portfolios as referred to in 
Article 377 of the CRR. 

90    In this document, the abbreviation “RNIME” may be singular or plural depending on whether it refers to 

a single risk, several risks, or collectively all risks not captured in the model engines. 

91    In order to simplify the diagram, CRM is not explicitly included. It should be treated in the same way as 

IRC. 

92    To be reported in COREP as “Additional risk exposure amount due to Article 3 CRR” (COREP C02.00 

Row 0760, Column 0010) together with any other own-initiative capital buffers. 
Moreover, there could be supervisory imposed add-ons related to market risk which are not shown in 
the figure. 

ECB guide to internal models – Market risk – CRR2 

220 

 
 
Figure 4 
Components of market risk own funds requirements and risk exposure amounts 
(blue filled boxes), internal models (green frames), and RNIME framework (black 
frame) 

In accordance with Article 363(1) of the CRR, institutions may calculate their own 
funds requirements for market risk using their internal models instead of, or in 
combination with, the methods of the standardised approaches for market risk. 
Because the positions exposed to RNIME according to the process and 
requirements described in this Section 7 are within the scope of the IMA, they do not 
need to be accounted for under the standardised approaches for market risk. 

Exclusions of positions from the scope of the IMA in risk categories for which the IMA 
is approved are subject to the requirements described in Section 2.5 of this chapter. 

175. 

In accordance with Article 368(1)(e) of the CRR, institutions must have established 
procedures for monitoring and ensuring compliance with a documented set of 
internal policies and controls concerning the overall operation of internal models. 
Therefore, the ECB considers that an institution should have a policy and controls in 
place that govern the overall process for the identification, quantification and 
management of RNIME. In order to enable efficient monitoring of RNIME, the ECB 
considers that the documented policies should include a description of the different 
tasks and responsibilities, and the frequency of their execution. This policy and these 
controls constitute the RNIME framework. The ECB considers that the RNIME 
framework should cover the tasks described in the following paragraphs of this 
section. 

176. 

In accordance with Article 368(1)(b) of the CRR, the risk control unit is responsible 
for the overall risk management system. Because the RNIME framework is an 
integral part of the overall IMA processes, the ECB considers that the risk control unit 
is also responsible for the overall RNIME framework. 

ECB guide to internal models – Market risk – CRR2 

221 

 
 
 
In accordance with Article 368(1)(b) of the CRR, the risk control unit must conduct 
the initial and ongoing validation of any internal model for market risk. Therefore, the 
ECB considers that the RNIME framework and methodologies should be initially and 
periodically validated internally, and updated if necessary. 

7.3 

Identification of RNIME 

177.  A single RNIME identified refers to a distinct risk not accurately captured or omitted, 
and related to positions or instruments within the approved risk categories in the IMA 
in the VaR, sVaR, IRC or CRM models. This can refer to a single risk factor, a set of 
risk factors (e.g. related to a yield curve), a particular effect (e.g. volatility skew) or 
specific instruments. 

The ECB considers that RNIME can emerge as a result of the following 
circumstances. 

(a)  Differences in the positions, risk factors and pricing methods captured in VaR, 

sVaR, and IRC (and CRM if applicable) engines, in comparison with those of 
the end-of-day valuation process for the books and records of an institution.93 
In particular, these may include risk factors that are taken into account in the 
economic P&L, but not in the risk measurement model as referred to in 
Article 367(1)(b) of the CRR. 

Some examples could be: simplified pricing models or sensitivities based P&L 
in the risk engines; use of proxies for risk factors; calibration of pricing models 
in the risk engines; and risks not adequately modelled, such as basis risk 
between two different classes of shares. 

(b)  Weaknesses and limitations in the stochastic modelling of risk factors in the risk 

engines that are not linked to the valuation produced by the end-of-day 
valuation process. 

Some examples could be: distributional assumptions for risk factors of both the 
marginal distributions and joint distributions (i.e. correlation structure); jump 
risks; calibration of model parameters; regression approach calibration and 
deviations; IRC factor model assumptions and calibration; and insufficient or 
unreliable data for risk factors. 

(c)  Other factors leading to risks not being captured accurately or being omitted 

from the risk engines. 

Some examples could be: instruments on exotic underlyings in the IMA scope 
that may be treated under the RNIME framework in the manner referred to in 
paragraph 26 of this chapter; positions in defaulted debt, as referred to in 

93    Those potential RNIME are different from valuation adjustments that an institution might have made in 

order to satisfy the fair value and prudent valuation requirements under Article 105 of the CRR. 

ECB guide to internal models – Market risk – CRR2 

222 

 
 
paragraph 34 of this chapter; some risks not accurately captured due to position 
data not being updated daily. 

178. 

In accordance with Article 368(1)(e) of the CRR, an institution must have established 
procedures for monitoring and ensuring compliance with a documented set of 
internal policies and controls concerning the overall operation of its internal models. 
Therefore, the ECB considers that in order to ensure a comprehensive coverage of 
such risks, the institution should clearly describe and document each RNIME in an 
inventory, as part of its RNIME framework. 

In order to properly monitor each RNIME, the ECB considers that institutions should 
explain how each RNIME is identified and defined, and should, in particular, be able 
to justify the cases where a single RNIME is defined across portfolios or product 
classes. In order to properly assess materiality, the ECB understands that the current 
portfolio composition and trading strategy of the institution should be taken into 
account when assessing each RNIME. The ECB understands that, generally, all 
RNIME need to be included in the RNIME framework described below. It 
understands that the only exception is where the institution can demonstrate that the 
effect of an identified RNIME is negligible in the current portfolio and will remain 
negligible taking into account the trading strategy, in which case the institution might 
exclude that RNIME from the RNIME quantification and management processes that 
are part of the RNIME framework. The institution should be able to provide 
justification as to why any particular RNIME is not included in its risk engines. 

179. 

In accordance with Article 367(1)(a) of the CRR, any internal model must capture 
accurately all material price risks. The ECB considers that in order to ensure an 
accurate capture of risks, institutions should not rely solely on the monitoring of 
current RNIME, but strive to identify RNIME on an ongoing basis, and as early as 
possible, as part of the overall risk management. The ECB considers it best practice 
to use existing processes efficiently to identify RNIME. 

As part of such best practice, and in order to maximise efficiency, institutions should, 
at a minimum, use the following processes to identify RNIME: 

(a)  a review of the institution’s trading strategy, as referred to in Article 103(2) of the 

CRR, considering, in particular, the expansion and reorientation of the trading 
business, given that expanding a particular business could lead to RNIME 
becoming significant, or to additional risks that are not currently covered in the 
RNIME process; 

(b) 

the regulatory back-testing process, as referred to in Article 366 of the CRR, as 
part of which the institution should review the results and analyses of 
overshootings in order to identify RNIME; 

(c)  market data quality assurance processes for risk factors, as referred to in 

Article 367(2)(e) of the CRR, where market data display insufficient quality; 

(d) 

initial and ongoing internal validation of internal models, as referred to in 
Articles 368(1)(b) and 369(1) of the CRR, at least where differences between 
the institution’s pricing model and risk measurement model are identified (for 

ECB guide to internal models – Market risk – CRR2 

223 

 
example, risk factors that are used for the valuation of a product for the end-of-
day valuation process, but not for risk measurement), and where internal back-
testing shows a high number of overshootings; 

(e) 

introduction of new products, where the institution should analyse whether the 
market risks inherent in the new products and their related trading strategies 
can be adequately captured by the risk engines in order to ensure that these 
new products – which may pose additional risk factors or require 
methodological changes – are fully compatible with the comprehensive risk 
control and validation by the risk control unit, as required by Article 368(1)(b) of 
the CRR. 

In accordance with Article 368(2)(d) of the CRR, the annual review of an institution’s 
overall risk management process must consider the scope of risks captured by the 
risk measurement model. Therefore, the ECB considers that a review of the 
inventory of RNIME should be carried out at least once a year. 

7.4 

Quantification of RNIME 

180. 

In accordance with Article 367(1)(a) of the CRR, any internal model used to calculate 
capital requirements for market risk must capture accurately all material price risks. 
In order to ensure a meaningful quantification of RNIME in relation to the internal 
models, the ECB considers that the risk parameters for RNIME quantification should 
be aligned to the regulatory specifications. Therefore, the quantification of risks-not-
in-the-VaR engine should aim to reflect a loss at a 99% confidence level and a 
holding period of ten days. Similarly, the quantification of risks-not-in-the-sVaR 
engine should aim to reflect a loss at a 99% confidence level and a holding period of 
ten days, and be calibrated to historical data from the stressed period used to 
calibrate the sVaR model. The quantification of risks-not-in-the-IRC engine (or CRM 
engine, if applicable) should aim to reflect a loss at a 99.9% confidence interval over 
a time horizon of one year. 

181. 

In accordance with Article 367(1)(a) of the CRR, any internal model used to calculate 
capital requirements for market risk must capture accurately all material price risks. 
Therefore, the ECB considers that in order to ensure that the internal models capture 
all material price risks, institutions should quantify RNIME in an appropriate way and 
document and duly justify the methodology applied. The ECB understands that the 
quantification of the impact of the identified i-th RNIME (denoted by  RNIME𝑖) serves 
to assess the need to incorporate the i-th RNIME into the engine. 

The ECB considers it best practice that for each  RNIME𝑖  identified, the impact 
quantification  𝑀𝑖  should be estimated as the incremental risk number94  where 
RNIME𝑖  would be incorporated into the model engine; this is in comparison with the 
current engine using the same portfolio as reference, 

𝑀𝑖 ≝ risk number(engine with RNIME𝑖 incorporated) − risk number(current engine),  

94    See footnote 85 above for details. 

ECB guide to internal models – Market risk – CRR2 

224 

 
 
risk number ∈ {VaR, sVaR, IRC, CRM} 

where no RNIME add-ons (or other add-ons) are included in the risk numbers. 

The impact quantification  𝑀𝑖  is a signed number and could be negative if 
incorporating  RNIME𝑖  were to be risk-reducing. 

The estimation of  𝑀𝑖  should be as accurate as possible using reasonable effort. 
Therefore, the ECB understands that the  𝑀𝑖  estimation methodology can use 
appropriate approximations, assumptions, or a stress methodology when duly 
justified and documented. 

Because the impact quantification should allow the different RNIME to be assessed 
individually, no diversification effect should be applied between different RNIME 
when quantifying the individual RNIME. 

182.  The ECB considers that a more conservative impact quantification than described in 
paragraph 181 could be used where this is duly justified. In particular, where an 
appropriate impact quantification using an incremental risk number cannot be 
performed, the ECB considers it a prudent approach to resort to a stand-alone 
impact estimation for  RNIME𝑖, 

𝑀̃𝑖 ≝ risk number(RNIME𝑖 as only source of risk), 
risk number ∈ {VaR, sVaR, IRC, CRM}, 

and  𝑀𝑖  is set to  𝑀̃𝑖  for the impact quantification. 

The estimation of  𝑀̃𝑖  should be as accurate as possible using reasonable effort. 
Therefore, the ECB understands that the  𝑀̃𝑖  estimation methodology can use 
appropriate approximations, assumptions, or a stress methodology when duly 
justified and documented. 

As an illustration, in the case of the VaR, and where  RNIME𝑖  can be well described 
as a sensitivity  𝑝𝑖  to an additional risk factor (i.e. a risk position), the impact 
quantification  𝑀𝑖  corresponds to its incremental VaR, i.e. the incremental effect on 
VaR of adding the risk position  𝑝𝑖  to the existing set of risk positions. Let  𝑝  denote 
the set of current risk positions, and let  VaR(𝑝)  denote the current VaR, then the 
impact quantification  𝑀𝑖  of  RNIME𝑖  interpreted as an additional risk position  𝑝𝑖  is 

𝑀𝑖 = VaR(𝑝 + 𝑝𝑖) − VaR(𝑝) 

The impact quantification as incremental risk,  M𝑖, is different from the assessment of 
the risk on a stand-alone basis as a sole source of risk,  𝑀̃𝑖. In the setting above, the 
stand-alone risk would be  𝑀̃𝑖 = VaR(𝑝𝑖), which in general is different from 
VaR(𝑝 + 𝑝𝑖) − VaR(𝑝).  If the sub-additivity property  VaR(𝑝) + VaR(𝑝𝑖) ≥ VaR(𝑝 + 𝑝𝑖) 
holds, the stand-alone risk  VaR(𝑝𝑖)  is a conservative estimate of the incremental 
risk, 

𝑀̃𝑖 = VaR(𝑝𝑖) ≡ VaR(𝑝) + VaR(𝑝𝑖) − VaR(𝑝) ≥ VaR(𝑝 + 𝑝𝑖) − VaR(𝑝) = 𝑀𝑖. 

ECB guide to internal models – Market risk – CRR2 

225 

 
Because VaR, sVaR, IRC and CRM are all value-at-risk-based risk measures, the 
same applies for those, by analogy. 

183. 

In accordance with Article 367(1)(a) of the CRR, any internal model used to calculate 
capital requirements for market risk must capture accurately all material price risks. 
The ECB considers that in order to ensure that the quantification of RNIME is 
appropriately accurate, the quantification should, where possible, make use of 
objective market data, even if the data quality is not sufficient to model these risks in 
the model engine. 

In order to ensure alignment with the internal models when quantifying an RNIME – 
for example, by using sensitivities – the shocks applied in order to quantify it should 
be based on the same holding period and, in principle, on the same observation 
period as those for the shocks for the other risk factors used in the relevant internal 
model. Differences in the observation period should be duly justified. If scarce data 
are used to calibrate these shocks, the shocks should be estimated conservatively. 
This may involve relying to some extent on expert judgement. 

7.5 

Management of RNIME and implementation in an institution’s risk 
engines 

184. 

In accordance with Article 367(1)(a) of the CRR, any internal model must capture 
accurately all material price risks. The ECB considers that in order to ensure ongoing 
accurate risk capture, the risk control unit should carry out regular impact 
quantification and monitoring of all RNIME. 

If an institution can provide justification that an impact quantification of a VaR RNIME 
also applies for sVaR, the sVaR impact quantification and monitoring may be based 
on the VaR impact quantification. If it cannot provide such justification, or where 
certain RNIME have been identified specifically for the sVaR engine, a specific 
impact quantification and monitoring for those sVaR RNIME should be performed. 
Monitoring of RNIME should include, in particular, checking whether RNIME are 
above certain thresholds, as further detailed below in this Section 7.5. 

185. 

In accordance with Article 430(1) of the CRR in conjunction with Article 5(a) of the 
Commission Implementing Regulation on supervisory reporting, institutions must 
submit the information relating to own funds requirements with a quarterly frequency. 
Therefore, the ECB considers that in order to assess the adequacy of own funds, 
institutions should quantify and monitor the RNIME at least quarterly. 

The risk control unit should report the outcome of the quantification and monitoring to 
the committee or persons responsible for deciding on the management of RNIME in 
terms of identification, quantification, treatment, limitation, reporting frequency, etc. 

186. 

In accordance with Article 367(1)(a) of the CRR, any internal model must capture 
accurately all material price risks. Therefore, the ECB considers that in order to 
ensure that the models accurately capture all material price risks including RNIME 

ECB guide to internal models – Market risk – CRR2 

226 

 
and thereby result in a sufficient level of own funds, institutions should take into 
account all of the following points. 

(a)  An  RNIME𝑖, where  𝑀𝑖   <  0  does not allow the reduction of own funds 

requirements until the related risk has been incorporated into the relevant 
engine. 

(b) 

Institutions should determine thresholds for assessing, at their own discretion, 
the impact of individual RNIME above which an individual RNIME is considered 
a “substantial” RNIME. 

The ECB considers that if a single RNIME already has a 5% impact, there is a 
risk that the risk engine might not capture accurately all material risks. 
Therefore, the ECB considers it best practice that the i-th individual RNIME is 
considered substantial if the impact quantification  𝑀𝑖  corresponds to more than 
5% of the amount computed by the risk engine95  96  (without taking into account 
any add-ons, as they are not included in the relevant risk number). 

That is,  RNIME𝑖  is considered substantial if 

𝑀𝑖
risk number 

> 5% , risk number ∈ {VaR, sVaR, IRC, CRM} 

This is without prejudice to the discretion of an institution to set a lower 
threshold than 5%. 

The ECB considers it best practice and prudent that institutions should include 
any substantial  RNIME𝑖  in their total risk exposure amount by way of an 
RNIME𝑖  add-on of size  𝑀𝑖  multiplied by 12.5, in order to calculate the 
corresponding risk exposure amount. In so doing they should take into account 
the multiplication factors (mc) and (ms) for VaR and sVaR as referred to in 
Article 366 of the CRR without the back-testing addend, until they have 
incorporated it into the engine affected. Consistent with the impact 
quantification, the ECB considers that there should not be any diversification 
effect between different RNIME add-ons. 

(c) 

Institutions should determine, at their own discretion, thresholds above which 
RNIME are incorporated into the model engines. 

In accordance with Article 7a(1)(c)(ii) of the Commission Delegated Regulation 
on materiality of extensions and changes of the IMA, a change of 10% or more 
of a relevant risk VaR, sVaR, IRC, or CRM number is to be considered a 

95    The calculation should be made at the end of the quarter by comparing the impact quantification of the 
RNIME, e.g. at the end of the quarter, with the previous 60-business day average of the VaR or sVaR, 
or the previous 12-week average of the IRC or CRM amount (without any add-ons). 

96    Please note that it is generally expected that the RNIME quantification, as described in paragraphs 181 
and 182, is performed only once a quarter (for one day in the quarter, e.g. at the end of the quarter), to 
avoid overly burdensome computations. In the unlikely case that an institution is able to quantify an 
RNIME daily, for VaR/sVaR, or weekly, for IRC/CRM, it would be possible to use an average-based 
impact calculation for that RNIME, as long as the same dates are used for this average as for the 60-
business day average of the VaR/sVaR or the 12-week average of the IRC or CRM amount 
respectively. In this case, the Mi of paragraphs 181, 182 and 186 should be determined based on this 
average. 

ECB guide to internal models – Market risk – CRR2 

227 

 
 
 
material change to the IMA. Therefore, the ECB considers, by analogy, that if 
the cumulative RNIME impact corresponds to more than 10% of the amount 
computed by the risk engine, this indicates that an engine might not capture 
accurately all material price risks97, as the change needed to incorporate them 
into the engine could amount to a material model change. 

In order to assess whether that is the case, institutions should calculate the 
cumulative impact quantification  CIQrisk number  per risk number by adding the 
positive impacts of all RNIME related to that risk number, including those 
subject to an RNIME add-on, without taking any diversification among the 
different RNIME into account, and dividing by the risk number computed by the 
model engine without taking any add-ons into account.98  If the resulting ratio is 
greater than 10%, the ECB considers that the model engine might not 
accurately capture all material price risks, 

CIQrisk number =

∑

all RNIME𝑖 related to risk number
risk number 

max[𝑀𝑖, 0]

  >  10%, 

risk number ∈ {VaR, sVaR, IRC, CRM} 

This is without prejudice to the discretion of an institution to set a lower 
threshold than 10%. 

If it is the case that the ratio as calculated above is greater than 10% (or a lower 
threshold set by the institution), the institution should provide the ECB with an 
implementation plan for the incorporation of some or all of these RNIME in the 
model engine(s), such that the cumulative impacts are reduced below the 
threshold. 

(d)  The ECB considers it a prudent approach that RNIME which are to be 

incorporated into the relevant engine(s) are capitalised with RNIME add-ons as 
part of the implementation plan, until they are incorporated into the relevant 
engine(s). If the institution deems it convenient, the remaining RNIME may also 
be capitalised with RNIME add-ons. 

187.  With reference to the previous paragraphs in this Section 7.5, the incorporation of 

RNIME into the model engine should be performed so that the engine complies with 
all relevant requirements of the CRR including, in particular, internal validation. The 
term “incorporation” here means the integration of RNIME into the relevant risk 
engine, and into its methodology and processes, typically allowing for risk 
diversification. This is without prejudice to the discretion of an institution not to use 
empirical correlations within risk categories or across risk categories, as referred to 
in Article 367(3) of the CRR, by applying instead a simple sum aggregation. 

97    This is without prejudice to a determination by the ECB, based on an assessment taking into account 
the specific circumstances of the institution, that the model does not accurately capture all material 
price risks. 

98    The calculation should be made at the end of the quarter by comparing the sum of impact quantification 
of the RNIME, e.g. at the end of the quarter, with the 60-business-day average of the VaR or sVaR, or 
the 12-week average of the IRC or CRM amount of the preceding quarter. 

ECB guide to internal models – Market risk – CRR2 

228 

 
 
188. 

In accordance with Article 430(1) of the CRR in conjunction with Article 5(a) of the 
Commission Implementing Regulation on supervisory reporting, institutions must 
submit the information relating to own funds requirements with a quarterly frequency. 
Therefore, the ECB considers that in order to ensure an accurate quarterly reporting 
of own funds requirements and risk exposure amounts, the RNIME add-ons should 
be updated at least quarterly. 

In order to enable monitoring of RNIME add-ons, the ECB can, on the basis of 
Article 10 of the SSM Regulation, require an institution to provide an overview of 
RNIME add-ons in a suitable format chosen by the institution. 

189.  Because the RNIME framework is an integral part of the overall IMA processes, a 

change to the RNIME framework – in particular one that relates to the RNIME 
identification methodology, the consideration of new types of RNIME, the impact 
quantification methodology, or the RNIME add-on methodology – constitutes an IMA 
model change and should therefore be assessed in accordance with the 
Commission Delegated Regulation on materiality of extensions and changes of the 
IMA. 

In accordance with Article 7b and Annex III, Part II, Section 2(13) of the Commission 
Delegated Regulation on materiality of extensions and changes of the IMA, any 
structural, organisational or operational change to the core processes in risk 
management or risk controlling functions requires ex ante notification to the 
competent authorities. The ECB considers that because the RNIME framework is an 
integral part of the overall IMA processes, a change to the RNIME framework should 
accordingly be notified ex ante to the competent authorities. 

However, changes within the existing RNIME framework which do not need new 
methodologies or processes to be implemented should be notified to the competent 
authorities through ex post notifications only. 

190.  Ceasing to capitalise an RNIME, or capitalising an RNIME with an RNIME add-on 
according to the thresholds of the RNIME framework, does not constitute a model 
change and does not need to be separately notified as a model change, provided 
that it is based on the approved methodology of the RNIME framework. 

191.  The incorporation of  RNIME𝑖  into the model engine, irrespective of whether it was 
previously treated as an RNIME add-on or not, and irrespective of whether it is an 
RNIME identified previously or is newly identified, constitutes an IMA model change 
and should therefore be assessed in accordance with the Commission Delegated 
Regulation on materiality of extensions and changes of the IMA. The materiality 
assessment, in accordance with Article 7a(1)(c)(ii) of that Commission Delegated 
Regulation, should be based on the new risk number, i.e. on the following ratio, 

risk number(engine with RNIME𝑖 incorporated)
risk number(current engine)

, risk number ∈ {VaR, sVaR, IRC, CRM} 

For the sum of market risk requirements, the assessment of materiality in 
accordance with Article 7a(1)(c)(i) of that Commission Delegated Regulation should 
be made analogously. 

ECB guide to internal models – Market risk – CRR2 

229 

 
192.  Because the RNIME add-ons are not included in the VaR number, they should not be 
taken into account when performing regulatory back-testing. However, all VaR 
engine components that constitute the VaR engine (including, where applicable, 
satellite components) should be taken into account in the regulatory back-testing.

ECB guide to internal models – Market risk – CRR2 

230 

 
Market risk – CRR3 

1 

Scope of the chapter on market risk 

1. 

The purpose of this chapter is to provide transparency on how the ECB understands 
a number of topics related to internal models used to calculate own funds 
requirements for market risk. It is important to note that this chapter does not aim to 
cover exhaustively all topics that could be subject to review during an internal model 
investigation. 

ECB guide to internal models – Market risk – CRR3 

231 

 
2 

Scope of the internal model approach 

2.1 

Relevant regulatory references 

Table 31 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

20/05/2019 

(1) 

(1) 

(1) 

(2),(5),(6) 

(4) 

(1),(3) 

(1) 

(1),(2) 

(5),(6) 

(1),(2) 

(1) 

(2) 

(4) 

4 

6 

7 

11 

18 

103 

104 

104b 

104c 

106 

325b 

325 

325az 

325ba 

325bb 

325bc 

325bd 

325bf 

325bh 

325bi 

325bl 

325bm 

325bo 

382 

382a 

386 

1 

2 

3 

4 

10 

16 

10 

Commission Delegated Regulation (EU) No 2022/2059 (on 
back-testing requirements and P&L attribution requirements)1 

14/06/2022 

SSM Regulation2 

15/10/2013 

ECB guide to internal models – Market risk – CRR3 

232 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2.2 

Delimitation of the regulatory trading book 

2. 

3. 

4. 

5. 

6. 

According to Article 4(1)(86) of the CRR, “trading book” means all positions in 
financial instruments and commodities held by an institution either with trading intent, 
or in order to hedge positions held with trading intent in accordance with Article 104 
of the CRR. 

In accordance with Article 104 of the CRR, institutions must have clearly defined 
policies and procedures for determining which positions to include in the trading 
book for the purpose of calculating their capital requirements (referred to in this 
guide as the “regulatory trading book”). The ECB considers that, in this context and 
in accordance with Article 4(1)(86) of the CRR, “positions” refers to positions in 
financial instruments as defined in Article 4(1)(50) of the CRR and commodities, and 
not to risk positions as referred to in the abbreviations included in this guide. The 
ECB understands that positions that are classified as “held for trading” for accounting 
purposes are presumed to be included in the regulatory trading book. Therefore, 
institutions should be able to list all positions that are classified as “held for trading” 
for accounting purposes but not included in the regulatory trading book, and should 
be able to justify these exclusions. 

As the instruments and transactions are included either in the regulatory trading 
book or in the non-regulatory trading book (referred to in this guide as the “banking 
book”), the ECB understands that the policies required under Article 104 of the CRR 
should also encompass rules for moving instruments between the regulatory trading 
book and the banking book. 

In order for the ECB to assess the appropriateness and implementation of the 
policies and procedures for determining which positions to include in the regulatory 
trading book, the ECB may, under Article 10 of the SSM Regulation, require 
institutions to provide a list of types of positions and instruments allocated to the 
regulatory trading or the banking book, identify all related transactions, including their 
relevant characteristics, and justify such allocation. 

In accordance with Article 325az(2) of the CRR, competent authorities must grant 
permission to institutions to calculate their own funds requirements for the portfolio of 
all positions assigned to trading desks by using their internal models, provided that 
all the conditions set out in Article 325az(2) of the CRR are met. As regards, in 
particular, compliance with the condition under Article 325az(2)(a) on the 
establishment of the trading desks in accordance with Article 104b, and more 
specifically with Article 104b(2)(a), of the CRR (which provides that each trading 
desk must have a clear and distinctive business strategy and a risk management 

1    Commission Delegated Regulation (EU) 2022/2059 of 14 June 2022 supplementing Regulation (EU) 
No 575/2013 of the European Parliament and of the Council with regard to regulatory technical 
standards specifying the technical details of back-testing and profit and loss attribution requirements 
under Articles 325bf and 325bg of Regulation (EU) No 575/2013. 

2    Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European 
Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 
29.10.2013, p. 63), referred to in this guide as the “SSM Regulation”. 

ECB guide to internal models – Market risk – CRR3 

233 

 
 
structure that is adequate for its business strategy), the ECB may, under Article 10 of 
the SSM Regulation, require an institution to specify which trading desk: 

(a) 

includes banking book instruments; 

(b) 

is used for internal risk transfers with the banking book; 

(c) 

is used to hedge banking book interest rate risk exposure; 

(d)  spans multiple legal entities applying for separate approval; 

(e) 

includes positions that contain at least one risk factor that has been mapped to 
the broad categories of “equity” or “credit spread” risk factors in accordance 
with Article 325bd(1) of the CRR; 

(f) 

includes any kind of valuation adjustment hedges (xVA-hedges);   

(g) 

includes back-to-back transactions. 

7. 

Title II of the CRR regulates the level of application of requirements, whereby 
institutions may be required to calculate own funds requirements on an individual 
basis (Title II, Chapter 1) or on a (sub-)consolidated basis (Title II, Chapter 2). 
According to Article 104b of the CRR, institutions must establish trading desks and 
assign each of their trading book positions3  to one of those trading desks. 
Accordingly, as a general rule the requirements of Article 104b of the CRR must be 
met on each level of approval given to institutions, where level of approval means 
the level of application in accordance with Title II of the CRR (e.g. solo, sub-
consolidated or consolidated) on which the IMA is applied for reporting own funds 
requirements. 

In particular, institutions requesting approval to use the IMA on several consolidation 
levels (e.g. solo, sub-consolidated and/or consolidated level) must comply with 
Article 104b of the CRR at each level for which they request approval. If the trading 
desk at higher level is different from the one at lower level (e.g. where it contains 
additional trades at the higher consolidation level), compliance must be 
demonstrated separately for both levels. If the trading desk at the higher level is the 
same as the one at the lower level, it is sufficient to demonstrate compliance at the 
higher consolidation level. 

Institutions applying the IMA at a consolidated level need only demonstrate 
compliance with Article 104b of the CRR on that (consolidated) level, even if they 
have trading desks spanning several legal entities that all contribute trades to that 
(consolidated) trading desk. 

The same levels that are relevant for trading desk requirements are also the ones for 
which compliance with back-testing and P&L attribution requirements must be 
demonstrated. 

3    The ECB understands that this also applies to banking book positions in scope of the (alternative) 

internal model approach. 

ECB guide to internal models – Market risk – CRR3 

234 

 
 
8. 

In accordance with Article 106(1) of the CRR, internal hedges (as defined in Article 
4(1)(96) of the CRR) must be properly documented and not be primarily intended to 
avoid or reduce own funds requirements. Therefore, institutions should be able to 
identify4  all internal hedges and should document their treatment for the purpose of 
calculating own funds requirements for market risk. In accordance with Article 
106(1)(d) of the CRR, the market risk generated by an internal hedge must be 
dynamically managed in the regulatory trading book within the authorised limits. For 
this reason, the ECB considers that proper documentation should distinguish 
between: 

(a)  hedges of a banking book credit risk exposure (or counterparty credit risk 
exposure) using an internal risk transfer with the regulatory trading book; 

(b)  hedges of a banking book equity risk exposure using a hedging instrument 

purchased from the market through the regulatory trading book; 

(c)  hedges of a banking book interest rate risk exposure using an internal risk 

transfer with the regulatory trading book; 

(d)  hedges of a banking book foreign exchange risk exposure using an internal risk 

transfer with the regulatory trading book; 

(e)  hedges of a banking book commodity risk exposure using an internal risk 

transfer with the regulatory trading book; 

(f)  eligible hedges (as defined in Article 386 of the CRR) that are included in the 

credit valuation adjustment capital charge. 

Additionally, institutions should be able to identify internal transactions that are in the 
regulatory trading book5  and within the scope of the internal model, show that these 
transactions do not contribute to the overall own funds requirements calculated using 
the internal model, and explain the impact these internal transactions have on the 
trading desk risk numbers calculated using the internal model. In accordance with 
Article 104(2) of the CRR, certain instruments must be split. If so, the embedded 
option, or other derivative, must be allocated to the trading book while the own 
liability must be left in the non-trading book. The ECB is of the view that such a split 
occurs at inception of the trade and does not constitute an internal hedge. 

9. 

Articles 1, 2, 3 and 4 of Commission Delegated Regulation (EU) No 2022/2059 (on 
back-testing requirements and P&L attribution requirements) specify that actual P&L 
(APL) and hypothetical P&L (HPL) must not include any of the adjustments listed in 
paragraph 3 of those articles. Based on the ECB’s understanding, this implies that 
CVA, DVA and AVA should be excluded from the regulatory defined APL and HPL, 
regardless of how an institution might handle those adjustments in its accounting or 
internal risk management processes. To ensure consistency between risk and P&L, 

4    To “identify” here means to be able to spot these trades among the institution’s transactions. While an 

institution is not generally required to be able to segregate internal hedges in dedicated portfolios on 
which specific analysis is carried out, the requirement of Article 106(5) of the CRR to assign internal 
interest rate risk transfers to a separate portfolio still remains. 

5    For example, transactions within the scope of the IMA made between two trading units. 

ECB guide to internal models – Market risk – CRR3 

235 

 
 
10. 

11. 

the ECB is of the view that CVA, DVA and AVA should also not be included in the 
internal model.   

In accordance with Article 106(3) and (4) of the CRR, institutions must include in the 
trading book for the purposes of calculating the own funds requirements for market 
risk both the recognised internal (credit/equity) hedge in accordance with Article 
106(1) and the corresponding credit/equity derivative entered into with the eligible 
third-party protection provider. The ECB considers that back-to-back transactions in 
the regulatory trading book (i.e. transactions exactly matched with a third-party 
transaction) are generally included in the calculation of own funds requirements for 
market risk and that potential profit and loss (P&L) generated by these back-to-back 
transactions should be considered in the back-testing (for those P&L components 
that are not excluded from the APL or HPL). This is because, while they do not carry 
residual market risks, such back-to-back transactions could generate P&L (for 
example, at the inception of the trade, or where the transaction is closed before 
maturity). 

The ECB understands that instruments in the regulatory trading book which are lent 
out or repoed out should be included in the calculation of own funds requirements for 
market risk. Conversely, instruments borrowed/obtained via securities lending or 
reverse repo should not be included in the calculation of own funds requirements for 
market risk. This is because a securities lending or repo transaction does not 
transfer the market risk of the security. Furthermore, the market risk of the securities 
lending or repo transaction should be captured (if the transaction is recorded in the 
trading book). 

2.3 

Treatment of banking book positions 

12. 

In accordance with Article 104b(6) of the CRR, by way of derogation from Article 
104b(5) of the CRR, institutions may establish trading desks to which they assign 
exclusively non-trading book positions subject to forex exchange risk or commodity 
risk. In accordance with Article 104b(5) of the CRR, these positions may also be 
allocated to existing trading desks. Significant institutions (SIs) that have trading 
book and banking book positions at one single desk must be able to fulfil other 
requirements under the CRR, such as those specifically targeting banking book 
positions only (e.g. Commission Delegated Regulation (EU) No 2023/15776, in 
relation to the calculation of the own funds requirements for market risk for non-
trading book positions subject to foreign exchange risk or commodity risk) and those 
targeting only the trading book (e.g. Article 103 of the CRR). 

13. 

In accordance with Article 325bi(1)(e) of the CRR, institutions must have established 
procedures for monitoring and ensuring compliance with a documented set of 

6    Commission Delegated Regulation (EU) 2023/1577 of 20 April 2023 supplementing Regulation (EU) No 

575/2013 of the European Parliament and of the Council with regard to regulatory technical standards 
on the calculation of the own funds requirements for market risk for non-trading book positions subject 
to foreign exchange risk or commodity risk and the treatment of those positions for the purposes of the 
regulatory back-testing requirements and the profit and loss attribution requirement under the 
alternative internal model approach (OJ L 193, 1.8.2023, p. 1–6). 

ECB guide to internal models – Market risk – CRR3 

236 

 
 
internal policies and controls concerning the overall operation of their internal 
models. To satisfy the requirements of Article 325bi(1)(e) of the CRR, institutions 
should have documented processes and methodologies in place for determining FX 
positions. The ECB considers that, in order to adequately cover the overall operation 
of the internal model, such documentation should include, in particular, the 
intermediate steps followed for calculating FX positions, beginning with each 
individual subsidiary and then proceeding to the group level (for example, before and 
after netting, the treatment of intragroup deals, or the methodology applied to derive 
the FX position of banking book items). If an institution excludes any balance sheet 
items denominated in foreign currency from the FX positions in accordance with the 
provisions of Article 104c of the CRR, it should document in detail which positions 
are covered by the exclusion – including details of the materiality of each of them – 
and the justification for their exclusion, so that the institution can demonstrate that 
the provisions of the article have been complied with. This applies also – and 
especially so – at the consolidated and sub-consolidated levels to balance sheet 
items denominated in foreign currency that stem from consolidated subsidiaries and 
is without prejudice to the extent and manner of prudential consolidation prescribed 
in Article 18 of the CRR. 

2.4 

Trading desks in scope of the IMA 

14. 

In accordance with Article 325ba(1) of the CRR, institutions using an (alternative) 
internal model approach must calculate the own funds requirements for the portfolio 
of all positions assigned to the trading desks for which the institution has been 
granted permission, as referred to in Article 325az(2). Pursuant to Article 325az(6), if 
an institution does not have permission to use an internal model to calculate its own 
funds requirements for market risk for all trading desks, the institution must apply the 
(alternative) standardised approach to calculate its own funds requirements for those 
positions assigned to the trading desks for which it has not been granted permission. 
The ECB understands that Article 325az(6) implies that no risk class-specific partial 
use within a trading desk is possible. All risk positions of approved trading desks 
which are classified green or yellow according to Commission Delegated Regulation 
(EU) No 2022/2059 (on back-testing requirements and P&L attribution requirements) 
must be capitalised using the IMA.7  In accordance with Article 325az(2)(e) of the 
CRR, trading desks that have been assigned at least one of the trading book 
positions referred to in Article 325bl (i.e. scope of the internal default risk model) 
satisfy the requirements set out in Article 325bm for the internal default risk model. 
Therefore, the ECB considers that if the expected shortfall/stress scenario risk 
measure (ES/SSRM) model is used for a trading desk, the default risk capital (DRC) 
model must also be used, and vice versa. 

15. 

In accordance with Article 325az(2) of the CRR, not including a trading desk in the 
scope of the (alternative) internal model approach must not be motivated by the fact 
that the own funds requirement calculated under the (alternative) standardised 

7    All risk positions of approved trading desks which are classified as neither green nor yellow according 
to Commission Delegated Regulation (EU) No 2022/2059 (on back-testing requirements and P&L 
attribution requirements) must be capitalised using the (alternative) standardised approach. 

ECB guide to internal models – Market risk – CRR3 

237 

 
 
16. 

17. 

18. 

approach would be lower than the own funds requirement calculated under the 
(alternative) internal model approach. In assessing whether or not trading desks 
have been excluded from the scope of application of the IMA for the sole purpose of 
reducing the own funds requirements for market risk, the ECB may, under Article 10 
of the SSM Regulation, require an institution to estimate the difference between the 
own funds requirements calculated under the (alternative) standardised approach 
and the own funds requirements calculated under the IMA for an individual trading 
desk or for a set of trading desks. 

In accordance with Article 325(4) of the CRR, institutions may use in combination the 
(alternative) standardised approach and the (alternative) internal model approach 
within a group, provided that the total own funds requirements for market risk 
calculated using the (alternative) internal model approach represent at least 10% of 
the total own funds requirements for market risk. In accordance with Article 
325bi(1)(e) of the CRR, institutions must have a documented set of internal policies, 
procedures and controls in place for monitoring and ensuring compliance with the 
overall operation of their internal risk measurement models. Therefore, the ECB 
expects institutions to have documented processes in place for monitoring the 10% 
threshold at least for the end-of-quarter reporting date. If the (alternative) 
standardised approach exceeds the 90% threshold, those processes should ensure 
that, for the respective end-of-quarter reporting, the standardised approach is used 
for all their trading desks. The ECB understands that this threshold works at each 
level for which approval is granted.8   

In accordance with Article 325bi(1)(e) of the CRR, institutions must have in place a 
documented set of internal policies, procedures and controls for monitoring and 
ensuring compliance with the overall operation of its internal risk-measurement 
models. In accordance with Article 325bi(1)(a) of the CRR, the IMA must serve as 
the basis for reporting risk exposures to senior management. The ECB expects 
institutions to report the ES, SSRM and DRC for the individual trading desks to a 
management body with sufficient authority in respect of internal models. 

In accordance with Article 325ba(1) of the CRR, institutions using an alternative 
internal model must calculate the own funds requirements for the portfolio of all 
positions assigned to the trading desks for which the institution has been granted 
permission. The ECB considers that new trading desks would require new 
permission from the ECB before positions assigned to those trading desks can be 
capitalised using an IMA. In accordance with Article 325az(7) of the CRR, material 
changes to the use of (alternative) internal models that an institution has received 
permission to use, the extension of the use of (alternative) internal models that the 
institution has received permission to use, and material changes to the institution’s 
choice of the subset of the modellable risk factors referred to in Article 325bc(2) of 
the CRR all require separate permission from the competent authorities.9  In 

8    This implies that (a) the threshold applies at consolidated level if an institution applies for approval only 
on consolidated level; (b) the threshold applies at solo and consolidated level if an institution applies for 
approval at solo and consolidated level; and (c) the threshold applies at solo level if an institution 
applies for approval only on a solo level. 

9    As further specified in Recital 2 of the final draft RTS on the conditions for assessing the materiality of 
extensions and changes to the use of alternative internal models and changes to the subset of the 
modellable risk factors referred to in Article 325bc under Article 325az(8)(a) of the CRR. 

ECB guide to internal models – Market risk – CRR3 

238 

 
 
accordance with Article 325bi(1)(e) of the CRR, institutions must have a documented 
set of internal policies, procedures and controls in place for monitoring and ensuring 
compliance with the overall operation of their internal risk measurement models. 
Therefore, the ECB expects institutions to keep documentation describing the trading 
desks for which IMA approval has been requested and granted. Moreover, 
institutions should specify the manner and timeliness of how this change in the 
approval status is reflected when calculating the capital charge. This documentation 
should provide the actual status quo of each trading desk and track back the status 
history of each trading desk for at least three years.10 

2.5 

Treatment of specific positions 

2.5.1 

Own-debt exposures 

19. 

For the purposes of this guide, the meaning of “own debt” requires further 
clarification, given that the CRR does not provide a definition. As defined in Article 
4(1)(47) of the CRR, “consolidated situation” means the situation that results from 
applying the requirements of the CRR to an institution as if that institution formed, 
together with one or more other entities, a single institution. As defined in Article 
4(1)(49) of the CRR, “sub-consolidated basis” means “… on the basis of the 
consolidated situation of a parent entity … that is not the ultimate parent entity”. 
Therefore, in the eyes of the ECB, an acceptable approach for determining own-debt 
positions would be for an institution using a DRC model to also consider held in the 
debt of their subsidiaries within the scope of prudential consolidation, depending on 
the level within the group of the institution using the DRC model. 

20.  By way of example, the positions described in the following situations can be 
considered as own debt exposures. Figures 5, 6 and 7 below each provide a 
separate example. 

• 

• 

• 

Figure 5: Where the institution is the group EU parent institution –   
all positions in debt exposures to institutions within the prudential consolidation 
scope should be considered as own-debt exposures. 

Figure 6: Where the institution is the sub-consolidating institution or financial 
holding company that is not the ultimate EU parent institution – 
all positions in debt exposures to institutions within the relevant prudential sub-
consolidation scope should be considered as own-debt exposures.   

Figure 7: Where the institution is a subsidiary without dependent subsidiaries 
(solo) – all debt exposures of the institution to itself at the solo level should be 
considered as own-debt exposures. 

10    The status history should include at least material changes to the IMA, the extension of the IMA and 
material changes to the institution’s choice of the subset of the modellable risk factors referred to in 
Article 325bc(2). 

ECB guide to internal models – Market risk – CRR3 

239 

 
 
This is without prejudice to other definitions of own debt that institutions may apply 
and that the ECB will assess on a case-by-case basis to account for specific 
circumstances. 

Figure 5 
Own-debt positions at the consolidated level 

Note: Own-debt positions at the consolidated level are shown with a blue background. 

Figure 6 
Own-debt positions at the sub-consolidated level of the sub-consolidating institution 
or financial holding company SC1 

Note: Own-debt positions at the sub-consolidated level of the sub-consolidating institution or financial holding company SC1 are 
shown with a blue background, while non-own-debt-positions at the sub-consolidated level of SC1 are shown with a red background. 

Figure 7 
Own-debt positions at the solo level of subsidiary S1 

Note: Own-debt positions at the solo level of subsidiary S1 are shown with a blue background, while non-own-debt positions at the 
solo level of S1 are shown with a red background. 

ECB guide to internal models – Market risk – CRR3 

240 

 
 
 
 
21. 

In accordance with Article 325ba(1) of the CRR, an institution must not include its 
own credit spreads when calculating the ES and SSRM for positions in the 
institution’s own debt instruments. As regards the interest rate risk of debt 
instruments for own debt, and given that the CRR is silent on the matter, the ECB 
understands that the interest rate risk of own debt instruments should be 
accommodated in the internal model if the institution holds respective positions in 
approved trading desks. 

2.5.2 

Positions in defaulted debt 

22. 

In accordance with Article 325bj(1) of the CRR, institutions must ensure that all 
internal models are conceptually sound and adequately capture all material risks. 
Therefore, the ECB considers that institutions should include risks resulting from 
positions in defaulted debt that are held in the regulatory trading book in their IMA. 
The ECB considers it best practice that non-material positions in defaulted debt 
should also be included in the IMA; either in the ES, SSRM (and DRC) engines or 
under the RNIME framework. When assessing the appropriateness of the treatment 
of such positions, the ECB may, under Article 10 of the SSM Regulation, require 
institutions to provide a list of all positions in defaulted debt that are held in the 
regulatory trading book, along with the following information: 

(a) 

the market value of the exposure; 

(b) 

the notional value of the exposure; 

(c)  a Boolean variable indicating whether the positions are included in the 

ES/SSRM; 

(d)  a Boolean variable indicating whether the positions are included in the DRC. 

23. 

In accordance with Article 325bo(2) of the CRR, institutions must take into account 
basis risks between different issuers in the DRC. Therefore, the ECB considers that 
when modelling the risk of price changes of positions in defaulted debt in the DRC, 
and to account for material idiosyncratic differences between similar but not identical 
positions, institutions should apply a specific calibration of the recovery rates which 
is appropriate for the positions held in defaulted debt. If an institution does not have 
the capacity to model price changes of positions in defaulted debt in the DRC model 
(perhaps owing to IT constraints), the ECB believes that an appropriate way of 
accounting for those differences would be to apply a stressed price for the positions 
held in defaulted debt that is proven to be adequately conservative given the quantile 
and holding period of the DRC. 

2.5.3 

Collective investment undertakings 

24. 

This and the following paragraphs of this subsection apply to any exposures that 
institutions may have in collective investment undertakings (CIUs), as referred to in 
Article 4(1)(7) of the CRR (including exchange-traded funds (ETFs), equity 

ECB guide to internal models – Market risk – CRR3 

241 

 
investments in hedge funds, and so forth) and which, for the purposes of these 
paragraphs, are referred to as “positions in CIUs”. They also apply to derivative 
instruments that have these same instruments as underlying assets. 

25. 

In accordance with Articles 325bi(1)(e) and 103(1) of the CRR, institutions must have 
procedures in place to ensure compliance with a documented set of internal policies 
and controls concerning the overall operation of their internal models and the 
regulatory trading book. Therefore, to help ensure that positions in CIUs are treated 
accordingly under an institution’s internal model for market risk, the institution should 
have a documented set of policies and controls in place to identify, for each CIU, the 
following: 

(a) 

the broad risk factor categories, as listed in Table 2 of Article 325bd of the CRR, 
to which the CIU is subject; 

(b)  whether the institution is able to obtain sufficient information about the individual 

underlying exposures of the CIU, as defined in Article 104(8)(a)11; 

(c)  whether the CIU is included in the (alternative) internal model approach or in 

the (alternative) standardised approach; 

(d) 

if the CIU is included in the (alternative) internal model approach:   

(i) 

the trading desk at which the CIU is included; 

(ii) 

the frequency of the look-through to the underlying positions under Article 
325bh(1)(i); 

(e)  where the institution relies on third-party information for the look-through of a 

CIU, how it is ensured that the third party fulfils the criteria set out in Article 
325bh(1)(i)(i), (ii) and (iii) for the CIU. 

26. 

The above information in relation to each CIU should be documented. In the ECB’s 
view, it is necessary to update the information on an ongoing basis at least for 
paragraph 25(a) to 25(d) of this chapter, so as to ensure that the documented 
information is based on the current characteristics of the positions held in CIUs and 
fully reflects the market risk to which the positions are exposed, and at least annually 
for paragraph 25(e) of this chapter. For new positions in CIUs, the ECB considers 
that the procedure should take place before the investment in a new CIU is approved 
internally, so as to ensure that institutions compute own funds requirements for the 
positions in CIUs in compliance with CRR requirements. 

27. 

The CRR contemplates a specific treatment for foreign exchange market risk related 
to CIUs. In accordance with Article 325bh(1)(d) of the CRR, the actual foreign 
exchange positions of a CIU must be taken into account in the internal model. 
Institutions may rely on third-party reporting of the foreign exchange positions of a 
CIU where the correctness of that reporting is adequately ensured. If an institution is 

11    In accordance with Article 325 az(2)(g) of the CRR, positions in CIUs that meet the condition set out in 
Article 104(8)(b) cannot be assigned to the trading desks. Consequently, those CIUs cannot be under 
the IMA, as the IMA approval is given for trading desks. Only CIUs that meet the condition set out in 
Article 104(8)(a) can be assigned to the trading desks and hence included in the IMA. 

ECB guide to internal models – Market risk – CRR3 

242 

 
 
not aware of the overall foreign exchange position of a CIU, the position must be 
carved out and treated in accordance with the (alternative) standardised approach. 
In accordance with Article 325az(6) of the CRR, the own funds requirements for 
market risk must be calculated in accordance with the (alternative) standardised 
approach for positions assigned to the trading desks for which an institution has not 
been granted internal model permission. Therefore, the ECB considers that the 
above-mentioned carve-out should be carried out by moving the respective CIUs to 
trading desks that are capitalised under the (alternative) standardised approach. 

2.6 

Aggregation requirements 

28. 

In accordance with Article 325az of the CRR, competent authorities may permit 
institutions to calculate their own funds requirements for market risk by using their 
internal models for some trading desks while using the (alternative) standardised 
approach for other trading desks. For example, under Articles 6(1) and 11(1) of the 
CRR, institutions must meet their own funds requirements on an individual basis 
(unless, for example, a derogation under the circumstances set out in Article 7 of the 
CRR has been granted), while the parent institution in a Member State must comply 
with the own funds requirements on a consolidated basis. 

Therefore, the institution at the highest level of consolidation operating within the 
framework of the Single Supervisory Mechanism should be able to specify: 

(a)  which legal entities within the group have been granted permission to use an 

internal model for calculating own funds requirements for market risk; 

(b) 

the scope of application of each model permission (i.e. individual, sub-
consolidated or consolidated); 

(c) 

the trading desks for which each permission has been granted. 

The ECB is also of the view that, for institutions to calculate own funds requirements 
at the consolidated level by using their internal models, permission to use their 
internal models at consolidated level is required under Article 325az(2) of the CRR. 

29.  Where the scope of the permission applies at the consolidated or sub-consolidated 

level, institutions should be able to provide a list of legal entities included in the 
scope of consolidation or sub-consolidation, specifying which of those entities 
effectively contribute to the market risk own funds requirements determined using 
the internal model. In order for the ECB to assess how own funds requirements are 
determined, institutions should also be able to provide information on how each legal 
entity is integrated into the information system infrastructure of the risk management 
system and whether any impediments exist to such integration. 

If impediments do exist to integrating the risk numbers from individual legal entities, 
the ECB considers it best practice to integrate the risk numbers from these entities 
into the model-based own funds requirements by applying a simple sum 
aggregation. 

ECB guide to internal models – Market risk – CRR3 

243 

 
30. 

31. 

32. 

33. 

34. 

In accordance with Article 325bi(1)(a) of the CRR, the internal model must be closely 
integrated into the daily risk management process of the institution and serve as the 
basis for reporting risk exposures to senior management. Therefore, the ECB 
expects institutions to ensure integrated and harmonised risk management across all 
legal entities included in the scope of the model permission. 

In accordance with Article 325b of the CRR, institutions may use positions in one 
institution or undertaking to offset positions in another institution or undertaking for 
the sole purpose of calculating net positions and own funds requirements for market 
risk on a consolidated basis, and subject only to the permission of the competent 
authorities. The ECB understands that this requirement applies to all positions, 
particularly intra-group transactions. Positions can be offset irrespective of the 
calculation approach applied for market risk own funds requirements (i.e. IMA or 
(alternative) standardised approach). In order for the ECB to assess how these 
requirements are fulfilled, institutions should document how the offsetting of positions 
is performed. 

In accordance with Article 325bh(2) of the CRR, an institution may use empirical 
correlations within broad categories of risk factors and, for the purpose of calculating 
the unconstrained expected shortfall measure  𝑈𝐸𝑆𝑡  as referred to in Article 
325bb(1) of the CRR across broad categories of risk factors only where the 
institution’s approach for measuring those correlations is sound, consistent with 
either the applicable liquidity horizons or, to the satisfaction of the institution’s 
competent authority, with the base time horizon of 10 days set out in Article 
325bc(1), and implemented with integrity. The ECB understands that for empirical 
correlations to be sound they should be based on reliable and objective data. If this 
cannot be ensured, an institution should use the simple sum aggregation of stand-
alone risk numbers within broad categories and, for the purpose of calculating the 
unconstrained expected shortfall  𝑈𝐸𝑆𝑡, across broad categories of risk factors. 

In accordance with Article 325bi(1)(e) of the CRR, the institution must have a 
documented set of internal policies, procedures and controls in place for monitoring 
and ensuring compliance with the overall operation of its internal risk measurement 
models. Institutions must determine IMA own funds requirements for market risk in 
accordance with Article 325ba(3). Therefore, the ECB considers that institutions 
should maintain documentation detailing: (i) how the individual components specified 
in Article 325ba(3) are computed, and how the individual components are 
aggregated; and (ii) the responsibilities for the relevant input numbers and for the 
calculation and aggregation processes. 

In accordance with Article 106(6) of the CRR, the own funds requirements for the 
market risk of all (GIRR IRT portfolio) positions assigned to the single trading desk 
referred to in Article 106(5)(b) must be calculated on a stand-alone basis. Therefore, 
those own funds requirements are added to the own funds requirements for the other 
trading book positions (i.e. overall portfolio excluding GIRR IRT desk). If the GIRR 
IRT desk is within the scope of the IMA, this implies that: (i) in a first step, the 
computation according to Article 325ba(3) is performed (a) on the GIRR IRT desk 
and (b) on the overall portfolio excluding the GIRR IRT desk; and (ii) the own funds 
requirements obtained in (a) and (b) are added. Therefore, institutions should 

ECB guide to internal models – Market risk – CRR3 

244 

 
determine the stressed periods, reduced set of risk factors, back-testing add-on and 
PLAT-surcharge for the GIRR IRT portfolio on a standalone basis. This would imply 
that:   

(a)  The reduced set of risk factors (for the expected shortfall (ES)) is determined 
twice, once for the GIRR IRT portfolio and once for the overall portfolio 
excluding the GIRR IRT trading desk. The bank must ensure that the 75% 
criterion is met at the level of the GIRR IRT portfolio and also for the overall 
portfolio excluding GIRR IRT. 

(b)  The ES stressed period is determined twice, once for the GIRR IRT portfolio 

and once for the overall portfolio excluding GIRR IRT. 

(c)  The stressed expected shortfall (SES) stress periods are determined twice, 
once for the GIRR IRT portfolio and once for the overall portfolio excluding 
GIRR IRT. 

(d)  The back-testing add-on is determined twice, once for the GIRR IRT portfolio 

and once for the overall portfolio excluding GIRR IRT. 

(e)  The PLAT surcharge is determined twice, once for the GIRR IRT portfolio and 

once for the overall portfolio excluding GIRR IRT. 

35. 

36. 

37. 

The ECB recognises that performing all these calculations twice could impose a high 
operational burden, which might not be justified if the GIRR IRT portfolio is of little 
significance compared to the overall portfolio excluding the GIRR IRT. Therefore the 
ECB is of the view that simplifications might be warranted when determining, for the 
GIRR IRT portfolio: (i) the ES stress period; (ii) the SES stress periods; and (iii) the 
reduced set of risk factors, as well as when ensuring that the ES of the reduced set 
of risk factors should be equal to at least 75% of the fully specified ES model on 
average measured over the preceding 12-week period. However, the ECB does not 
envisage simplifications to determine the back-testing add-on and the PLAT 
surcharge for the GIRR IRT portfolio, both of which should be determined individually 
for the: (i) overall portfolio excluding GIRR IRT; and (ii) GIRR IRT portfolio, because 
in accordance with Article 325bf(3) and bg of the CRR, back-testing and PLAT must 
be performed at the trading desk level. 

In accordance with Article 325bi(1) of the CRR, any internal risk measurement model 
must be conceptually sound and must be calculated and implemented with integrity. 
The ECB is of the view that this requirement must be met particularly when, due to 
the abovementioned simplifications, no stand-alone determination for the GIRR IRT 
portfolio is performed. 

In accordance with Article 325bi(1) of the CRR, an institution must have a 
documented set of internal policies, procedures and controls in place for monitoring 
and ensuring compliance with the overall operation of its internal risk measurement 
models. Therefore, the above-mentioned simplifications should be duly documented 
so as to allow for a comprehensive assessment by the supervisor. 

ECB guide to internal models – Market risk – CRR3 

245 

 
3 

Regulatory back-testing and profit and loss attribution 

3.1 

Relevant regulatory references 

Table 32 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

20/05/2019 

(1),(2),(3),(4),(6),(7) 

(2) 

(1)(2) 

(1),(3),(5) 

(3),(4) 

(1),(3),(5) 

(1),(3),(4) 

325ba 

325bd 

325bf 

325bg 

325bi 

325d 

1 

2 

3 

4 

5 

6 

7 

15 

10 

Commission Delegated Regulation (EU) No 
2022/2059 (on back-testing requirements and 
P&L attribution requirements) 

14/06/2022 

SSM Regulation 

15/10/2013 

3.2 

Scope of application of regulatory back-testing and P&L attribution 

38. 

39. 

Institutions should clearly document the scope of application of regulatory back-
testing, as referred to in Article 325bf of the CRR, and the scope of application of the 
profit and loss (P&L) attribution requirement, as referred to in Article 325bg of the 
CRR. 

In accordance with Articles 325bf(1) and 325bf(2) of the CRR, regulatory back-
testing at trading desk level is used to compare the hypothetical and actual changes 
in value (“hypothetical P&L” and “actual P&L”) of the trading desk portfolio with the 
related one-day value-at-risk numbers at the 99th and 97.5th percentile one-tailed 
confidence interval generated by the institution’s VaR model. In accordance with 
Article 325bf(4) of the CRR, regulatory back-testing at top-of-the-house level12  is 
used to compare the hypothetical P&L and actual changes in P&L of the 
top-of-the-house portfolio with the related one-day value-at-risk number at the 99th 
percentile one-tailed confidence interval generated by the institution’s VaR model. In 
accordance with Article 325bg(1) of the CRR, the institution’s trading desk meets the 
P&L attribution requirement where the theoretical changes in the trading desk 
portfolio’s value, based on the internal risk measurement model, as referred to in 

12    As defined in the abbreviations. 

ECB guide to internal models – Market risk – CRR3 

246 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Article 325ba of the CRR (the “risk-theoretical P&L”), are either close or sufficiently 
close to the hypothetical P&L. 

The hypothetical P&L, the actual P&L and the risk-theoretical P&L, all at trading desk 
level, should therefore be calculated considering the changes in value of all 
instruments and transactions that entail positions included in the respective trading 
desk. The top-of-the-house portfolio should include every position included in the 
trading desks for which the supervised entity has been granted permission to use the 
IMA and that meet both the regulatory back-testing and the P&L attribution 
requirements, as further specified in Section 5.2 of this chapter. 

40.  Positions excluded from the calculation of the own funds requirements for market 

risk by virtue of a permission granted by the competent authorities under Article 104c 
of the CRR (i.e. positions taken in order to hedge against the adverse effect of the 
exchange rate on the institution’s capital ratios), or under Article 325(a) of the CRR 
(i.e. positions relating to items that are already deducted when calculating own 
funds), should also be excluded from the scope of application of the back-testing and 
P&L attribution. 

41. 

42. 

In accordance with Article 386(4) of the CRR, eligible hedges that are included in the 
calculation of own funds requirements for CVA risk must not be included in the 
calculation of the own funds requirements for market risk. It is the ECB’s 
understanding that this implies that such eligible hedges should not be included in 
the calculation of the actual, hypothetical and risk-theoretical P&L for regulatory 
back-testing and P&L attribution. 

In accordance with Article 386(5) of the CRR, positions not recognised as eligible 
hedges for regulatory CVA risk must be subject to the own funds requirements for 
market risk. In the ECB’s view, this implies that such positions should be included in 
the calculation of actual, hypothetical and risk-theoretical P&L for regulatory back-
testing and P&L attribution. 

3.3 

Historical period used to perform back-testing and P&L attribution, 
definition of business days, and documentation 

43. 

In accordance with Articles 325bf(3) and 325bf(6) of the CRR, the number of 
overshootings relevant for the trading desk back-testing requirements and for 
determining the multiplication factor add-on must be counted over the most recent 
250 business days. In accordance with Articles 7 and 8 of Commission Delegated 
Regulation (EU) No 2022/2059 (on back-testing requirements and P&L attribution 
requirements), the Spearman correlation coefficient and the Kolmogorov-Smirnov 
test metric must also be determined over the most recent 250 business days. 

44. 

For the purposes of paragraph 43 above, institutions should define and document 
local and global business days according to the guidance set out in paragraphs 45 to 
48 below. 

ECB guide to internal models – Market risk – CRR3 

247 

 
45. 

The ECB is of the view that when the business trading unit of an institution is 
conducting planned business operations on the risk positions (even with a reduced 
number of staff) on a given day and in a given location, this constitutes a local 
business day for the institution in that location. Therefore, as it is a business day, it 
requires actual, hypothetical and risk-theoretical P&L calculation, VaR, ES and 
SSRM calculation, and market risk monitoring and reporting. Institutions should 
consistently define their business days, and should therefore be able to justify any 
non-business days. Unchanged risk positions are a necessary but not sufficient 
condition to demonstrate adequately that a particular day constitutes a non-business 
day. 

46.  According to Article 6 of Commission Delegated Regulation (EU) No 2022/2059 (on 

back-testing requirements and P&L attribution requirements), the purpose of P&L 
attribution tests for trading desks is to ensure that theoretical changes in a trading 
desk portfolio’s value are sufficiently close to the hypothetical changes in that 
portfolio’s value. The ECB considers that the outcome of the P&L attribution test 
should be no different if the same trading desk is included in the IMA at different 
consolidation levels. 

Therefore, for the P&L attribution test of trading desks and, for consistency, for 
trading desk regulatory back-testing, the institution should apply one definition of 
business days for each trading desk regardless of the consolidation level at which 
the trading desk is considered. The definition of business days for a specific trading 
desk should be determined at the lowest level of consolidation for which the trading 
desk is in the scope of the IMA. 

Consequently, a trading desk at the lowest level of consolidation of a banking group 
should apply local business days to determine whether the trading desk meets the 
back-testing and P&L attribution requirements, for the purpose of both the local entity 
and the consolidating entity. Conversely, if a trading desk operates only at the 
highest level of consolidation, it should apply global business days. 

For the avoidance of any doubt, top-of-the-house back-testing at local entity level 
should be based on local business days, while top-of-the-house back-testing at 
consolidating entity level should be based on global business days. 

47. 

The ECB believes that global business days should be defined at the consolidated 
level (or for a national sub-group, at the sub-consolidated level), and that for the 
purpose of defining global business days, the institution’s most important trading 
desk location (the “reference location”) should be used, thus ensuring that the most 
important trading activity is adequately captured in the back-testing. Global business 
days should include at least the local business days of the reference location. If there 
happen to be two or more important trading desks locations (of approximately the 
same size), the institution should choose just one reference location, but is allowed 
to add additional global business days based on the local business days of the other 
important trading desk locations. In such a case, the reasons for this choice should 
be documented. 

ECB guide to internal models – Market risk – CRR3 

248 

 
48. 

For every global business day, actual P&L, hypothetical P&L, VaR, ES and SSRM 
calculation at top-of-the-house level of the consolidating entity and market risk 
monitoring and reporting are required.13  However, if calculations of actual P&L, 
hypothetical P&L and VaR are carried out on non-global business days, these should 
not be used for the purpose of regulatory back-testing. The actual and hypothetical 
P&L used for back-testing at top-of-the-house level of the consolidating entity should 
always be the P&L between two consecutive global business days. It should also be 
compared with the related one-day VaR forecast for a one-day holding period 
between those two global business days, and be based on the composition of the 
portfolio on the first of those global business days. This paragraph applies also to 
risk-theoretical P&L and P&L attribution where trading desks are defined at the 
highest consolidating entity level, rather than at a lower level in the banking 
structure. 

49.  Based on Article 325bi(1)(e) of the CRR and Articles 5 and 15 of Commission 

Delegated Regulation (EU) No 2022/2059 (on back-testing requirements and P&L 
attribution requirements), the ECB expects institutions to have documented policies 
and procedures describing how they calculate the actual, hypothetical and 
risk-theoretical P&L. The ECB considers that to be fit for purpose, the policies and 
procedures should not only satisfy the requirements laid down in Articles 5 and 15 of 
the Commission Delegated Regulation (EU) No 2022/2059(on back-testing 
requirements and P&L attribution requirements), but also include at least the 
following key information: 

(a)  differences between the actual and hypothetical P&L; 

(b)  how the risk-theoretical P&L is calculated. 

In order for the ECB to assess the appropriateness and implementation of the 
policies and procedures for calculating the actual, hypothetical and risk-theoretical 
P&L, the ECB may, under Article 10 of the SSM Regulation, require institutions to 
provide, for a sample of transactions or portfolios, detailed decompositions of 
end-of-day valuation process P&L, actual P&L, hypothetical P&L, and risk-theoretical 
P&L into their components. 

3.4 

Calculation of actual and hypothetical P&L 

3.4.1 

General rules 

50. 

In accordance with Article 325bf(4)(b) of the CRR, actual P&L must be based on 
actual changes in the portfolio’s end-of-day value. Article 1(1) of Commission 
Delegated Regulation (EU) No 2022/2059 (on back-testing requirements and P&L 
attribution requirements) further specifies that actual P&L must be computed using 
the same techniques, including the same pricing methods, model parametrisations 

13    All positions of trading desks in a location with local non-business days should be included in the 

calculation of the consolidated figures. 

ECB guide to internal models – Market risk – CRR3 

249 

 
 
and market data, as those used in the end-of-day valuation process, taking into 
account the independent price verification process, with the exception of certain 
elements as specified in Article 325bf(4)(b), or Commission Delegated Regulation 
(EU) No 2022/2059 (on back-testing requirements and P&L attribution requirements) 
and in the next subsection. 

51. 

52. 

In accordance with Article 325bf(4)(a) of the CRR, hypothetical P&L is based on 
changes in the portfolio’s value assuming unchanged positions at the end of the 
subsequent day. The ECB understands that the term “unchanged positions” means 
an unchanged composition of the portfolio in terms of instruments and transactions. 
Therefore, the P&L generated by intraday trading and by new transactions entered 
(or maturing) during the day is not taken into account. 

In accordance with Articles 3(1) and 4(1) of Commission Delegated Regulation (EU) 
No 2022/2059 (on back-testing requirements and P&L attribution requirements), 
hypothetical P&L must be computed using the same techniques, including the same 
pricing methods, model parametrisations and market data, as those used in the end-
of-day valuation process. Calculating hypothetical P&L using a system that is 
different from the one used for the end-of-day process carries the risk of producing 
differences in the resulting calculations. To minimise this risk, institutions should 
ensure that differences in market value computations at instrument or transaction 
level and at the total hypothetical P&L level are negligible, and should monitor the 
alignment frequently. 

3.4.2 

Valuation adjustments 

53.  Articles 1(3) and 2(3) of Commission Delegated Regulation (EU) No 2022/2059 (on 

back-testing requirements and P&L attribution requirements) state that institutions 
must include, in their actual P&L, any adjustments considered in the end-of-day 
valuation process that are market risk-related. Articles 3(3) and 4(3) of Commission 
Delegated Regulation (EU) No 2022/2059 (on back-testing requirements and P&L 
attribution requirements) state that institutions must include, in their hypothetical 
P&L, any adjustments considered in the end-of-day valuation process that are 
market risk-related, are calculated on a daily basis, and are included in the 
institution’s risk measurement model. Therefore, institutions should clearly document 
all such valuation adjustments and reserves (methodology, frequencies, calculation 
process, etc.). 

54.  Except for the elements referred to in Article 1(3) and, when derogation is applied, 

Article 1(5) for the trading desk level, and Article 2(3) for the top-of-the-house level of 
Commission Delegated Regulation (EU) No 2022/2059 (on back-testing 
requirements and P&L attribution requirements) and in paragraph 55 below, fair 
value adjustments14  and all other valuation adjustments or reserves (hereinafter 
referred to as “adjustments”) made in the end-of-day valuation process should be 
included in the actual P&L even if they are not computed on a daily basis – provided 

14    This refers at least, and without limitation, to the examples of potential valuation adjustments listed in 

Article 105(10) of the CRR. 

ECB guide to internal models – Market risk – CRR3 

250 

 
 
that they are in the scope of market risk. No derogation is allowed at the top-of-the-
house level and these inclusions should be performed according to Article 1(5) of 
Commission Delegated Regulation (EU) No 2022/2059 (on back-testing 
requirements and P&L attribution requirements). The choices made must also be 
justified. 

55.  Changes in portfolio value generated by the default of a counterparty should be 

excluded from actual P&L and from hypothetical P&L, provided that the institution is 
able to demonstrate that they relate solely to counterparty credit risk; this is because 
the corresponding profits or losses are taken into account in the institution’s 
counterparty credit risk framework. Conversely, profits or losses due to the default of 
a bond or other fixed income security are not in the scope of counterparty credit risk 
and should therefore be included in actual P&L and in hypothetical P&L. 

56.  Commission Delegated Regulation (EU) No 2022/2059 (on back-testing 

requirements and P&L attribution requirements) states, in Articles 1(5) and 3(5) 
respectively, that institutions may exclude, from the calculation of the actual changes 
and hypothetical changes in value of a trading desk portfolio, an adjustment 
computed across sets of positions, assigned to more than one trading desk on a net 
basis, where the conditions in points (a) and (b) of the same articles are met and 
subject to the documentation requirements set out in point (c) of those same articles. 
Once an institution has provided the reasoning and justification supporting the 
computation of the adjustment on the set of positions, the ECB is of the view that this 
should not change going forward unless the institution can provide thorough 
motivation for the change and to the competent authority. 

57.  Commission Delegated Regulation (EU) No 2022/2059 (on back-testing 

requirements and P&L attribution requirements) likewise states, in Articles 2(4) and 
4(4) respectively, that institutions may decide, for the purpose of calculating the 
actual and hypothetical changes in the top-of-the-house portfolio’s value, whether to 
compute the value of an adjustment (a) on the basis of only those positions that are 
assigned to the trading desks in scope, or (b) on the basis of all positions subject to 
own funds requirements for market risk. The ECB understands that once the 
institution has made a choice on whether to follow approach (a) or approach (b), this 
should not change going forward, although, in extraordinary circumstances, an 
institution might want to change its choice. If so, the ECB expects the institution to 
provide thorough motivation for the change to the competent authority of the 
reasons. 

3.5 

Counting of overshootings 

58. 

59. 

In accordance with Article 325bf(6) of the CRR, the back-testing addend is 
determined as the higher of the number of overshootings under hypothetical and 
actual changes in the value of the portfolio for the most recent 250 business days. 

In accordance with Article 325bf(7) of the CRR, institutions must notify the competent 
authorities promptly, and in any case no later than within five business days, of 
overshootings that result from their back-testing programme. In the ECB’s view, the 

ECB guide to internal models – Market risk – CRR3 

251 

 
period of five business days should start on the first business day following the 
“subsequent day” as referred to in Article 325bf(4) of the CRR. The ECB further 
understands that this reporting requirement applies at both top-of-the-house and 
trading desk level. However, given the significant burden that reporting 
overshootings at trading desk level might impose, the ECB expects the level of 
analysis performed by the institution to be reduced, compared to top-of-the-house 
overshootings, as further specified in Section 3.6 of this chapter. 

60. 

If an overshooting has occurred due to malfunctions in the calculation of a P&L or 
VaR and is notified to the ECB, and if the institution demonstrates to the satisfaction 
of the ECB that the overshooting occurred for a reason considered acceptable, and 
also provides corrected P&L and VaR showing that without the malfunction the 
overshooting would not have occurred, the institution may withdraw the overshooting 
notification. The explanation of the malfunction should be supported by clear and 
complete documentation. Recurring malfunctions leading to erroneous calculations 
and overshooting notifications may indicate that the internal model has not been 
implemented with integrity as required under Article 325bi(1) of the CRR, and the 
ECB may require the institution to present a remediation plan. 

61.  According to the ECB, acceptable reasons for withdrawing an overshooting 

notification might include, without limitation: 

(a)  errors in calculating actual P&L, hypothetical P&L or VaR due to IT issues or 

incorrect data; 

(b)  errors in the scope of positions for the calculations of P&L or VaR; 

(c) 

false or missing bookings, or incorrect positions included in the scope of the 
calculations; 

(d) 

temporary transmission problems between different business locations. 

62.  Meanwhile, the ECB considers the following to be a non-exhaustive list of 

unacceptable reasons for withdrawing an overshooting notification, because they do 
not qualify as malfunctions when calculating P&L or VaR: 

(a)  differences in pricing methods, model parametrisations, market data or any 

other technique between the actual and hypothetical P&L calculations and the 
end-of-day valuation process; 

(b) 

losses due to the trading or transfer of large positions at a price that deviates 
from the market price as a result of trading volumes; 

(c)  where the overshooting corresponds to a small difference between VaR and 

P&L; 

(d)  unexpected market movements; 

(e)  where a model deficiency that in the past has caused an overshooting has 
since been addressed (there is no backward adjustment of overshootings); 

ECB guide to internal models – Market risk – CRR3 

252 

 
(f)  a change in the P&L calculation method, pricing function or parameterisation of 

a pricing function or a change in the market data used in the P&L calculation. 

63. 

In accordance with Article 325bi(1)(a) of the CRR, the internal model must be closely 
integrated into the daily risk management process. For institutions to be able to meet 
this requirement, the ECB expects the VaR numbers at trading desk and 
top-of-the-house level to be available within three business days. This would also 
enable institutions to fulfil the requirement to notify back-testing overshootings within 
five business days. 

Recurrent delays in the VaR computation may indicate that the internal model has 
not been implemented with integrity as required under Article 325bi(1) of the CRR, 
and the ECB may require the institution to justify such delays or to present a 
remediation plan. 

3.6 

Analysis of back-testing overshootings 

64. 

In accordance with Article 325bi(1)(b)(iii) of the CRR, the risk control unit must 
produce and analyse daily reports on the output of any internal model used to 
calculate capital requirements for market risk, including overshootings. The ECB 
considers that such an analysis of overshootings, at both top-of-the-house and 
trading desk portfolio level, should include the following areas, as further specified in 
the following paragraphs, as they are the most relevant drivers of the VaR number: 

(a) 

identification of the set of positions responsible for the overshooting (portfolio 
analysis); 

(b) 

identification, description and analysis of the market moves contributing to the 
overshooting and P&L explain (market analysis); 

(c) 

identification of possible weaknesses in the internal model in light of points (a) 
and (b) above (analysis of the internal model). 

Paragraphs 65 to 69 of this chapter explain what the ECB considers to be best 
practices when analysing each of the three areas referred to in points (a), (b) and (c) 
above. 

The ECB considers it best practice for institutions to conduct, for every regulatory 
back-testing overshooting, a detailed analysis . Moreover, the analysis performed in 
case of regulatory overshootings at top-of-the-house portfolio level should be 
provided to the competent authority within one month. 

In particular, the ECB considers it best practice for institutions to perform, for 
overshootings that occur at trading desk level, a portfolio analysis, market analysis 
and P&L explain (see Sections 3.6.1 and 3.6.2 of this chapter). 

The ECB also considers it best practice for institutions to perform, for those trading 
desks for which a significant number of overshootings is recorded, an internal review 
to verify the adequacy of the internal model. The ECB expects each institution to 

ECB guide to internal models – Market risk – CRR3 

253 

 
establish and document for which number of overshootings an internal review should 
be performed in order to verify the adequacy of the internal model. Such analysis 
should cover at least the points of the internal model analysis specified below (see 
Section 3.6.3 of this chapter). To detect those trading desks that require an internal 
model analysis, the ECB expects institutions to set overshooting thresholds that are 
well below the number of overshootings that would lead to a failure of the back-
testing requirements set out in Article 325bf(3) of the CRR, so as to allow for 
potential improvements to the internal model before any such failure occurs. The 
results of the review should be adequately documented. 

In accordance with Article 325bi(1)(f) of the CRR, any internal model for market risk 
must have a proven track record of reasonable accuracy in measuring risks. In order 
to assess the track record of reasonable accuracy in measuring risk, the ECB may, 
under Article 10 of the SSM Regulation, request a detailed analysis (as per its 
specific instructions) of overshootings and reporting of time series related to back-
testing. 

3.6.1 

Portfolio analysis 

65. 

66. 

67. 

The analysis of top-of-the-house back-testing overshooting should include a detailed 
description of the trading desks for which the one-day VaR forecast calculated was 
exceeded by the one-day change in the portfolio’s value. If the overshooting was 
notified for the actual P&L, the intraday changes in the portfolio that affected the 
actual change should also be analysed. 

The analysis of top-of-the-house back-testing overshooting should be performed not 
only at the overall portfolio level, but also at trading desk level, to identify the main 
positions that caused the overshooting. If specific sets of transactions can be 
identified, they should be mentioned and analysed. 

The analysis of trading desk back-testing overshooting should identify the main 
positions that caused the overshooting. If the overshooting was due to actual P&L 
changes, the intraday changes in the portfolio (e.g. new positions due to intraday 
trading) that affected the actual change should also be analysed. 

3.6.2 

Market analysis and P&L explain 

68. 

The market analysis should describe the market moves that caused or contributed to 
the top-of-the-house or trading desk level overshooting and explain them on the 
basis of objective market data (for example, asset prices, indices, interest rates, FX 
rates, implied correlations and volatilities). The end-of-day valuation process P&L 
should be explained at least for the main positions that were identified as the main 
loss contributors for the overshooting. For those days in which an overshooting is 
recorded, the P&L should be explained by attributing the P&L moves of the positions 
to the market data moves. Additionally, the P&L analysis should explain the 

ECB guide to internal models – Market risk – CRR3 

254 

 
differences between the end-of-day valuation process P&L, the actual P&L and the 
hypothetical P&L. 

The market analysis and P&L explain should be performed at a level commensurate 
to the complexity of the market situation and the risk positions, with the goal of 
adequately explaining the most material P&L contributions. 

The analysis should also, as far as possible, address the economic reasons for the 
market movements. 

3.6.3 

Analysis of the internal model 

69. 

The suitability of the internal model should be assessed on the basis of the two 
previous analyses (i.e. portfolio analysis and market analysis and P&L explain). 
Where positions contributing to the back-testing overshooting can be identified, the 
appropriateness of the model for these particular positions should be assessed. To 
assess the significance of the market data moves, the market data should be 
analysed in a historical context and institutions should explain the P&L due to the 
market data moves that are not risk factors of the model and those that are risk 
factors of the model. The part of the P&L that can be explained by the model (i.e. risk 
factors and pricing functions) should be distinguished from the part that cannot. In 
doing so, banks should compare the risk-theoretical P&L to the hypothetical and 
actual P&L and attribute the differences to missing risk factors, deviations in pricing 
models and other categories leading to those deviations. 

The significance of the change in market data that relates to risk factors in the VaR, 
and which contributed to the P&L, should be tested against the historical 99% 
confidence interval of risk factor changes for overshootings at both top-of-the house 
portfolio and trading desk level, and at a 97.5% confidence level for overshootings at 
trading desk level, unless a 99% confidence level overshooting is also recorded at 
trading desk level at the same time. Where the institution uses a parametric or 
simulation approach, changes in the structure of correlations between the risk factors 
should also be analysed. 

In addition, the reliability of the VaR calculation and of the actual and hypothetical 
changes in the portfolio should be evaluated. The analysis of the internal model 
should focus on: 

(a) 

the appropriateness of the risk factors used; 

(b) 

the modelling of the risk factors; 

(c) 

the suitability of the processes for calculating VaR, hypothetical P&L and actual 
P&L. 

ECB guide to internal models – Market risk – CRR3 

255 

 
4 

Internal validation of market risk models 

4.1 

Relevant regulatory references 

Table 33 

Legal background 

Date of issue 

Article 

Paragraph/Point 

CRR 

20/05/2019 

325bf 

325bi 

325bj 

(1),(2),(4)(a) 

(1),(2) 

(1),(2),(3) 

4.2 

Frequency and governance of internal validation 

70.  Article 325bj(2)(b) of the CRR requires institutions to conduct validations of their 

internal risk measurement models on a periodic basis. The ECB considers that these 
validations should be conducted at least once a year, as one year is a reasonable 
time in which significant changes in the market or in the composition of the portfolio 
could occur. In addition, a validation conducted at least annually would allow the 
institution to include the results when reviewing its overall risk management process, 
as referred to in Article 325bi(2) of the CRR. 

71.  Given this expected annual frequency, the validation process should last no longer 
than one year from start (reference date of the data) to finish (approval of the 
validation results). Deviations from this requirement should be clearly justified and 
documented by the institution and reported to senior management. 

72.  According to Article 325bi(1)(c) of the CRR, the management body and senior 

management must be actively involved in the risk control process. To comply with 
this requirement, the ECB expects institutions to ensure that the conclusions, 
findings and relevant recommendations of the validation report are directly 
communicated to, and scrutinised by, the institution’s management body or the 
committee designated by it. There should be a decision-making process in place to 
ensure that the conclusions, findings and recommendations of the validation process 
are properly taken into account by the institution’s senior management. 

73.  Article 325bj(1) of the CRR requires internal models to be conceptually sound and to 
capture all material risks. To comply with this requirement, the ECB expects all 
necessary corrective measures resulting from the validation process to be reflected 
in the validation report and implemented in a timely manner. Adequate processes 
should be in place to track the status of the measures adopted to remedy any 
deficiencies. 

ECB guide to internal models – Market risk – CRR3 

256 

 
 
 
 
 
 
4.3 

Internal back-testing of ES/VaR models 

4.3.1 

Scope and granularity of internal back-testing 

74. 

In accordance with Article 325bj(3)(b) of the CRR, institutions must, in addition to the 
regulatory back-testing programmes, carry out their own validation tests of their 
internal risk measurement models including back-testing in addition to the regulatory 
back-testing programmes, in relation to the risks and structures of their portfolios. To 
satisfy the requirement regarding internal back-testing in relation to the risks and 
structures of the portfolios, the ECB expects institutions to assess whether, for their 
ES model and VaR model (which must be based on the same assumptions as 
described for the VaR model under Article 325bf(1) of the CRR), the regulatory back-
testing of the actual and hypothetical changes in the value of the portfolio at trading 
desk level using the VaR model, as required under Article 325bf(2) of the CRR, is 
commensurate in relation to the risks and structures of their portfolios. If an 
institution manages risks on more granular levels or if relevant portfolios below desk 
level exist, the ECB expects internal back-testing to be performed also, at least for 
each portfolio that is subject to a separate VaR or ES limit established by the 
institution’s management body. 

The ECB considers it best practice for the internal back-testing to be performed on a 
daily basis so that it is aligned with the regulatory back-testing programme. 

75. 

In analogy to the requirements of Article 325bf(4)(a) and (b) of the CRR on 
regulatory back-testing of the VaR model, the ECB considers that to satisfy the 
requirements regarding the internal back-testing for the ES model and the VaR 
model performed in internal validation, institutions should comply with the same 
requirements as for the regulatory back-testing regarding the calculation of actual 
and hypothetical P&L. Therefore, the requirements described in Section 3 of this 
chapter regarding the calculation of actual and hypothetical P&L should also be 
applied to internal back-testing, so as to ensure consistency. In verifying compliance 
with this provision of the CRR, the ECB will take into account the institution’s specific 
circumstances. 

4.3.2 

Tests to be performed in internal back-testing 

76. 

In accordance with Article 325bj(3)(b) of the CRR, institutions must carry out their 
own internal model validation tests, including back-testing. The ECB considers it best 
practice for the periodic internal validation tests to include at least the tests (or their 
equivalent) described in points (a) to (e) below for the top-of-the-house level, as well 
as the tests described in points (a) and (b) for each trading desk for which the 
institution has been granted permission to use the IMA: 

ECB guide to internal models – Market risk – CRR3 

257 

 
(a)  Statistical tests on the overshootings, such as the Kupiec15  and Christoffersen16 
tests, including an analysis of the validity of the hypotheses underlying those 
statistical tests. 

(b)  A test on the uniformity of the distribution of the p-values17  of the daily actual 

P&L and the hypothetical P&L in the daily forecasts of P&Ls of the ES and 
VaR18  engine, at least for the daily data of the last year. For example, a P&L 
value equal to the VaR at a 99% confidence level corresponds to a p-value of 
0.01. 

(c)  A comparison between the ES and the VaR risk measures. For this comparison, 

institutions should analyse at least the average ratio between the 97.5th 
percentile ES and the 99th percentile daily VaR (for a one-day holding period) 
over both (i) a period of 250 business days and (ii) the most recent quarter. 
According to the ECB, the ratios averaged over the periods specified in points 
(i) and (ii) above should not fall below a threshold of 0.9.19  The model used to 
calculate the 97.5th percentile ES should be based on the same modelling 
assumptions as those used to calculate  PESt
325bc(4)(a) of the CRR. 

FC, as referred to in Article 

(d)  A back-testing of the ES model, since Article 325bj(3)(b) of the CRR requires 
back-testing in addition to the regulatory back-testing programmes using the 
VaR model. Given the current status of studies and developments on the topic 
of ES back-testing, the ECB does not expect a specific ES back-testing 
methodology, but rather for institutions to explore and apply direct ES back-
testing approaches to their portfolios drawing on current literature and any own 
studies, and also provide motivation for their choice of the ES back-testing 
methodology ultimately applied. 

(e)  A back-testing that allows the institution to identify the contribution of modellable 

risk factors and non-modellable risk factors to the back-testing results. 

15    See Kupiec, P.H., “Techniques for verifying the accuracy of risk measurement models”, Journal of 

Derivatives, Vol. 3, Issue 2, 1995, pp. 73-84. 

16    See Christoffersen, P., “Evaluating interval forecasts”, International Economic Review, Vol. 39, Issue 4, 

1998, pp. 841-862. 

17  The probability integral transformation states that for a continuous random distribution  𝑋, applying the 
cumulative distribution function (CDF) of  𝑋,  𝐹𝑋, on  𝑋  yields a uniform distribution. By negation, if the 
resulting distribution is not uniform,  𝐹𝑋  is not the CDF of  𝑋. Given a vector of simulated P&L (used to 
estimate the VaR) sorted in ascending order,  𝑥1, … , 𝑥𝑛, the p-value,  𝑝(𝑥), corresponding to a given 
P&L,  𝑥, should be obtained in the following way: 

𝑥𝑘+1−𝑥
𝑥𝑘+1−𝑥𝑘

⋅ 𝑝𝑘 + 𝑥−𝑥𝑘
𝑥𝑘+1−𝑥𝑘

⋅ 𝑝𝑘+1

if 𝑥𝑘 ≤ 𝑥 ≤ 𝑥𝑘+1 for 𝑘 = 1, … , 𝑛 − 1

𝑝(𝑥) =

1+(

𝑝1
1−𝑝1

𝑥
𝑥1
)

(

𝑝1
1−𝑝1

𝑥
𝑥𝑛
)

(

𝑝𝑛
1−𝑝𝑛

𝑥
𝑥1
)

𝑥
𝑥𝑛
)

{

1+(

𝑝𝑛
1−𝑝𝑛

if 𝑥 < 𝑥1

if 𝑥 > 𝑥𝑛

  where  𝑝𝑘 = 𝑘

𝑛+1

18    If an institution has a model based on a mixture of approaches in several ES model components, the 

most material approach should be used. 

19    This threshold represents the one-sided lower confidence interval at 95% confidence level, assuming a 

t-distribution with five degrees of freedom for the P&L and 250 P&L scenarios used for ES estimation, 
with an average calculated over 250 days. 

ECB guide to internal models – Market risk – CRR3 

258 

 
 
 
 
 
 
 
 
 
 
 
 
77. 

In order to assess whether the periodic internal validation tests used by an institution 
are adequate and fit for purpose, the ECB may, under Article 10 of the SSM 
Regulation, require the institution to provide at least the following information, for the 
top-of-the-house level and for the level of each trading desk for which the institution 
has been granted permission to use the IMA: 

(a) 

(b) 

(c) 

the complete economic P&L, hypothetical P&L, actual P&L, and time series of 
the ES at the 97.5th percentile (at both top-of-the-house and trading desk level) 
and of the VaR used for regulatory back-testing, calculated at the 99th 
percentile (at both top-of-the-house and trading desk level), and at the 97.5th 
percentile (at trading desk level only) for at least one year, though preferably 
three years; 

the number of overshootings, the corresponding dates when they occurred over 
the last year at least, though preferably over the last three years, and an 
explanation of the cause of the overshooting; 

for the overshootings (i.e. −P&L𝑡+1 > VaR𝑡  where  VaR𝑡 > 0  by convention), the 
time series of at least one year, though preferably three years, of the loss 
overshooting ratio (LOR) defined as: 

LOR =

−P&L𝑡+1−VaR𝑡
VaR𝑡

, where  −P&L𝑡+1 > VaR𝑡; 

(d) 

the time series of p-values of the daily actual P&L and the hypothetical P&L in 
the daily forecasts of P&Ls of the ES and VaR engine of at least one year, 
though preferably three years. 

4.4 

Validation on hypothetical portfolios 

78. 

79. 

In accordance with Article 325bj(1) of the CRR, institutions must have processes in 
place to ensure that all their internal risk -measurement models for market risk have 
been adequately validated. Therefore, the requirement of Article 325bj(3)(c) to use 
hypothetical portfolios in the internal model validation refers in particular to ES, VaR, 
SSRM and DRC models. 

In accordance with Article 325bi(1)(e) of the CRR, institutions must have a 
documented set of internal policies, procedures and controls in place for monitoring 
and ensuring compliance with the overall operation of their internal risk 
measurement models. Therefore, institutions should have a policy in place governing 
the overall processes used to validate their internal models for market risk using 
hypothetical portfolios. The ECB considers that in order to cover the overall process, 
such a policy should comprise the following aspects: 

(a)  portfolio definition – the processes for defining hypothetical portfolios; 

(b)  analysis – the processes for analysing the performance of the model based on 

the results of the tests performed on hypothetical portfolios, including: 

ECB guide to internal models – Market risk – CRR3 

259 

 
(i)  an assessment of the ability of the models to capture the risk of the 

hypothetical portfolios; 

(ii)  verification that the insights gained by analysing the hypothetical portfolios 

are reflected in the models; 

(iii) 

in particular, for back-testing on hypothetical portfolios (as described in 
Section 4.5 of this chapter), an identification of the market movements and 
parameters to have caused overshootings and deviations from the model 
forecast; 

(c) 

reporting – the processes to ensure that the results of validation on hypothetical 
portfolios are reported to a management body with sufficient authority in respect 
of internal models. 

80. 

In accordance with Article 325bj(3)(c) of the CRR, institutions must conduct 
validation exercises using hypothetical portfolios in order to ensure that a model is 
able to account for particular structural features.20  The ECB understands that these 
hypothetical portfolios should have targeted compositions so that the model can be 
tested at a level of granularity enabling the identification and isolation of specific 
model performance for those structural features (for example, related to specific 
business lines, instrument features, trading strategies and/or the risks associated 
with the use of proxies). 

81.  As institutions should ensure that the risk model is validated for risk management 

purposes, such hypothetical portfolios should be designed in line with the institution’s 
business model. For example, it is neither necessary to include products that are not 
covered by trader mandates, nor to test specific features that are not relevant for 
potential positions according to the institution’s approved trading strategy. 
Consequently, an institution should review the hypothetical portfolios in the event of 
a change in its business model or trading strategy. 

82. 

For the same reason, the number of hypothetical portfolios should be commensurate 
with the nature, scale and complexity of the institution’s trading activities. 

4.5 

Validation based on hypothetical portfolios for ES and VaR models 
through internal back-testing 

83. 

The ECB considers that the validation requirements of Article 325bj(3)(c) of the CRR 
for ES and VaR models can be met through internal back-testing where an institution 
can demonstrate that it has set up internal back-testing for the ES and VaR models 
using sub-portfolios at a level which is sufficiently granular to account for the 
particular structural features that may arise in its portfolios. 

20    These hypothetical portfolios should not be limited to portfolios defined in the benchmarking exercises 
for market risk conducted by the EBA or the Basel Committee on Banking Supervision, as those 
portfolios cannot account for all relevant structural features. Participation in such benchmarking 
exercises is thus not sufficient to meet the requirements of this section of the guide. 

ECB guide to internal models – Market risk – CRR3 

260 

 
 
84.  Where an institution performs internal back-testing on hypothetical portfolios for the 
ES and VaR models, the P&L calculations for this back-testing should not differ from 
the P&L calculations for regulatory back-testing as described in Section 3 of this 
chapter, so as to ensure consistency. This back-testing can be conducted based on 
hypothetical P&L only, as hypothetical portfolios are not part of the daily trading 
activity, making actual P&L irrelevant. 

85.  As the purpose of such internal back-testing is the internal validation of the ES and 

VaR models, the ECB considers that in order to ensure consistency: 

(a) 

the comparison should be carried out using the daily hypothetical P&L and the 
one-day VaR calculated at the 99th and 97.5th percentiles as well as the ES at 
the 97.5th percentile; 

(b)  back-testing periods for hypothetical portfolios should cover at least the period 

used to calibrate the model as of the validation date, so as to ensure that the 
results are relevant for the model at that date; 

(c) 

institutions should ensure that the particular structural feature, as referred to in 
paragraph 80 of this chapter, for which each hypothetical portfolio was selected, 
remains in place over time and during the entire historical period for which the 
back-testing is performed. 

ECB guide to internal models – Market risk – CRR3 

261 

 
5 

Methodology for ES and SSRM 

5.1 

Relevant regulatory references 

Table 34 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

20/05/2019 

92 

325az 

325ba 

325bc 

325bd 

325be 

(3) 

(2) 

(1) 

(2), (3), (4) 

(1), (3), (4) 

(1), (2) 

325bf 

(1), (3), (6), (7) 

Commission Delegated Regulation (EU) No 2022/2059 (on back-
testing requirements and P&L attribution requirements) 

Commission Delegated Regulation (EU) No 2022/2060 specifying 
the criteria for assessing the modellability of risk factors under the 
internal model approach)21 

14/06/2022 

14/06/2022 

Commission Delegated Regulation (EU) No 2024/397 (on the 
calculation of the stress scenario risk measure)22 

20/10/2023 

Commission Delegated Regulation (EU) No 2024/1085 (on the 
assessment methodology to use internal models for market risk)23 

13/03/2024 

Commission Implementing Regulation (EU) No 2021/451 (with 
regard to supervisory reporting of institutions) 

SSM Regulation 

17/12/2020 

15/10/2013 

(1), (2) 

(1), (2), (3) 

(1) 

(1), (2) 

(1) 

325bh 

325bi 

325bj 

325bk 

9 

1 

12 

34 

5 

10 

5.2 

General requirements 

86. 

In accordance with Article 325bi(1)(f) of the CRR, an internal risk measurement 
model must be reasonably accurate in measuring risks. Therefore, when using 
Monte Carlo simulations, institutions should be able to demonstrate that the number 

21    Commission Delegated Regulation (EU) 2022/2060 of 14 June 2022 supplementing Regulation (EU) 
No 575/2013 of the European Parliament and of the Council with regard to regulatory technical 
standards specifying the criteria for assessing the modellability of risk factors under the internal model 
approach (IMA) and specifying the frequency of that assessment under Article 325be(3) of that 
Regulation. 

22    Commission Delegated Regulation (EU) 2024/397 of 20 October 2023 supplementing Regulation (EU) 

No 575/2013 of the European Parliament and of the Council with regard to regulatory technical 
standards on the calculation of the stress scenario risk measure. 

23    Commission Delegated Regulation (EU) 2024/1085 of 13 March 2024 supplementing Regulation (EU) 

No 575/2013 of the European Parliament and of the Council with regard to regulatory technical 
standards on the assessment methodology under which competent authorities verify an institution’s 
compliance with the requirements to use internal models for market risk. 

ECB guide to internal models – Market risk – CRR3 

262 

 
 
 
 
 
 
 
 
 
 
 
 
of simulations used to compute ES and SSRM is sufficient to produce accurate and 
stable ES and SSRM numbers. 

87.  An institution may apply different methodologies (i.e. the absolute, relative or mixed 
approach24) to calculate the returns used to calibrate the ES and SSRM models for 
different risk factors. Based on observations made on VaR models, the ECB 
considers the following methodologies to be best practices for the ES and SSRM 
models: 

Table 35 

Interest rate curves 

Bond spread 

Risk factor category 

Methodology used to calculate returns 

Absolute or mixed approach 

Absolute or mixed approach 

Credit default swap (CDS) spread 

Absolute or mixed approach 

Foreign exchange rate 

Equities spot 

Commodities 

Relative approach 

Relative approach 

Relative approach 

In accordance with Article 325bi(3) of the CRR, institutions shall update the 
techniques and practices they use for any of the internal risk measurement models 
to factor in new techniques and best practices in respect of those internal risk 
measurement models. Therefore, the ECB considers that institutions should be able 
to explain any deviations of techniques and practices used in the institution's internal 
risk measurement models from new evolving techniques and best practices and 
quantify the impact of those deviations. 

88. 

To calculate the OFR for market risk, institutions must determine the: 

(a) 

trading desks within the IMA approval that are in scope of IMA, based on the 
results of the back-testing at trading desk level in accordance with Article 
325bf(3) of the CRR; 

(b) 

trading desks in scope of IMA based on the results of the PLA test at trading 
desk level, in accordance with Article 325bg of the CRR; 

(c) 

risk factors that are modellable and non-modellable. based on the results of the 
risk factor modellability assessment (RFMA), in accordance with Article 325be 
of the CRR; 

(d) 

risk factors in the reduced set according to Article 325bc(2) of the CRR; 

(e)  ES stressed period in accordance with Article 325bc(2) of the CRR and SSRM 
stressed periods in accordance with Article 12 of Commission Delegated 

24    Either of the following two examples could be considered as a “mixed approach”: (i) the case where 
some risk factors within a given risk factor category are calculated via absolute returns while others 
within the same risk factor category are calculated via relative returns (e.g. interest rate curves with low 
interest rate levels calculated via absolute returns and interest rate curves of other currencies with 
higher levels via relative returns); or (ii) the case where a single methodology takes into account 
different regimes (e.g. return close to absolute for low levels of interest rates and close to relative for 
higher levels). 

ECB guide to internal models – Market risk – CRR3 

263 

 
 
 
Regulation (EU) No 2024/397 (on the calculation of the stress scenario risk 
measure). 

In accordance with Article 5 of Commission Implementing Regulation (EU) No 
2021/451(with regard to supervisory reporting of institutions), institutions must report 
information on own funds requirements on a quarterly basis. In the ECB’s view, this 
implies that points (a) to (e) above should be determined on a quarterly basis. 

In accordance with Article 325ba of the CRR for IMA OFR, institutions should 
consider ES and SSRM for the preceding 60 business days and DRC over the 
preceding 12 weeks. Pursuant to Article 325bi(1) of the CRR, any internal risk 
measurement model must be conceptually sound and must be calculated and 
implemented with integrity. The ECB is therefore of the view that risk measures (ES, 
SSRM, DRC) entering the 60 business-day (or 12-week) averages used for IMA 
capital computation at the end of the quarter should be calculated based on a stable 
set of desks. 

In accordance with Article 1(1) of Commission Delegated Regulation (EU) No 
2022/2060 (specifying the criteria for assessing the modellability of risk factors under 
the internal model approach), the assessment should be performed over an 
observation period of 12 months ending at the preceding reporting reference date. 
This period may be replaced by a 12-month period ending no earlier than one month 
before the preceding reporting reference date if the conditions under Article 1(2) of 
Commission Delegated Regulation (EU) No 2022/2060 (specifying the criteria for 
assessing the modellability of risk factors under the internal model approach) are 
met. In accordance with Article 325bi(1) of the CRR, any internal risk measurement 
model must be conceptually sound and must be calculated and implemented with 
integrity. In the ECB’s understanding, this implies that the results of back-testing and 
PLA for the IMA scope should be considered in a timely manner. The ECB is of the 
view that a treatment as set out in Article 1(1) of Commission Delegated Regulation 
(EU) No 2022/2060 (specifying the criteria for assessing the modellability of risk 
factors under the internal model approach) would ensure that the results of the back-
testing and PLA tests, as outlined in paragraphs 88(a) and 88(b) of this chapter, are 
taken into account in a timely manner. 

In accordance with Article 325bi(1) of the CRR, any internal risk measurement model 
must be conceptually sound and must be calculated and implemented with integrity. 
The ECB therefore understands that dependencies between the processes 
described in paragraph 88(a) to 88(e) of this chapter should be addressed as part of 
the institution’s policies and procedures. The ECB is of the view that the tests 
outlined in points (d) and (e) should consider the latest available results of points (a), 
(b) and (c). 

In accordance with Article 325bi(1) of the CRR, any internal risk measurement model 
must be conceptually sound and must be calculated and implemented with integrity. 
Therefore, the ECB believes that the outcome of the processes listed in paragraph 
88(a) to 88(e) of this chapter, as determined in accordance with paragraphs 90 and 
91 of this chapter, should be considered for the quarter-end reporting and therefore 
for all risk measures entering the end-of-quarter reporting (ES and SSRM for the 

89. 

90. 

91. 

92. 

ECB guide to internal models – Market risk – CRR3 

264 

 
preceding 60 business days and DRC over the preceding 12 weeks according to 
Article 325ba of the CRR). 

93. 

In accordance with Article 325bc(2)(a) of the CRR, institutions must verify that the 
ratio of PESR,C to PESF,C averaged over the preceding 60 business days is greater or 
equal to 75% and immediately notify the competent authorities if this requirement is 
not met. The ECB is therefore of the view that the average ratio should be calculated 
on and for every business day. Article 325bc(2)(a) of the CRR further specifies that 
an institution that no longer meets the ratio requirement shall immediately notify the 
competent authorities thereof and shall update the subset of the modellable risk 
factors within two weeks in order to meet that requirement; where, after two weeks, 
that institution has failed to meet that requirement, the institution should revert to the 
standardised approach calculation until the institution is able to demonstrate to the 
competent authority that it is meeting the requirement set out in the first sub-
paragraph of Article 325bc(2)(a) of the CRR. The ECB considers that two weeks 
should be counted as ten business days starting on the day subsequent to the day in 
which the ratio is not met. 

94.  Article 325bi(1) of the CRR requires models to be conceptually sound and 

implemented with integrity, and Article 325bi(1)(e) requires institutions to ensure 
compliance with a documented set of internal policies and procedures. The ECB 
therefore understands that institutions should have documented procedures and 
processes in place with defined timelines and responsibilities for calculating the 
overall OFR for market risk and all its components, especially including details on the 
processes described in paragraphs 88(a) to 88(e) and 93 of this chapter.   

95. 

In accordance with Article 325bi(1)(e) of the CRR, institutions must ensure 
compliance with a documented set of internal controls. In order for the ECB to 
assess compliance with this requirement, an institution should be able to provide an 
inventory of all open validation findings in relation to the ES and SSRM models, 
including, for each finding, a description thereof, the envisaged remedial action and 
the target date for closure of the finding. In addition, institutions should retain closed 
validation findings for at least one year after the closure date and should be able to 
provide a description of the remedial action undertaken. Furthermore, to allow the 
ECB to assess compliance with Article 325bi(1)(e) of the CRR, an institution should 
be able to provide an inventory of analyses that have been conducted for the 
purpose of developing/justifying the ES and SSRM models over the last five years. 

5.3 

Data inputs, length of the time series used to calibrate ES, and 
quantile and ES estimation 

96. 

In accordance with Articles 325bc(3)(c) and 325bc(4)(c) of the CRR, institutions must 
use data from the 12 preceding months in order to calibrate the shocks applied in the 
PESR,C and PESF,C. In the event of a significant upsurge in price volatility, competent 

ECB guide to internal models – Market risk – CRR3 

265 

 
authorities might require an institution to use a shorter period.25  It is the ECB’s 
understanding that a weighting scheme cannot be used. 

97. 

In accordance with Article 325bc(2)(c) of the CRR, the institution must calculate the 
PESR,S calibrated to historical data from a continuous 12-month period of financial 
stress chosen to maximise PESR,S. In accordance with Articles 325bc(3)(c) and 
325bc(4)(c), the institution must calculate the PESR,C and PESF,C calibrated to 
historical data from the preceding 12-month period. The ECB considers that these 
requirements can be fulfilled by at least 250 and at most 260 consecutive 10-
business-day returns. The ECB believes that overlapping periods of 10-day returns 
should be used to calculate PESR,S, PESR,C and PESF,C. 

The ECB considers that a calibration to historical data from a continuous 12-month 
period implies that no weighting scheme should be applied to the historical data used 
to calculate PESR,S, PESR,C and PESF,C. 

98.  According to Article 325bi(1)(f) of the CRR, risk measurement must be reasonably 

accurate, while according to Article 325bh(2), the approach for measuring empirical 
correlations must be sound and implemented with integrity. Consequently, if a new 
instrument (e.g. a single stock or credit index series) is issued, the time series 
corresponding to that instrument should not be used on its own for the calibration of 
PESF,C and PESR,C until the length of the available time series reaches 12 months, as 
required under Article 325bc(4)(c) of the CRR. If proxy data are used to fill the 
missing portion of the risk factor time, the requirements for proxies should be 
observed (see Section 5.5 of this chapter). 

99. 

100. 

In accordance with Article 325bd(3) of the CRR, institutions may replace the liquidity 
horizon of a broad sub-category of risk factors listed in that article with those listed in 
Table 1 of Article 325bc. In accordance with Article 325bd(4), institutions must 
calculate the effective liquidity horizon for any modellable risk factor. The ECB is of 
the view that, since point 3 of Article 325bd(4) is a derogation from point 1 of Article 
325bd(4), when institutions make use of Article 325bd(3) to replace the liquidity 
horizon of a broad sub-category of risk factors, they should use those replaced 
liquidity horizons in order to calculate the effective liquidity horizon with the method 
laid down in point 4 of Article 325bd(4). 

In accordance with Article 325bf(6)(a) of the CRR, the VaR used for back-testing at 
overall portfolio level is calculated as the 99th percentile, one-tailed confidence 
interval. Meanwhile, Article 325bf(3) states that the VaR used for back-testing at 
trading desk level must be calculated at the 99th and 97.5th percentile one-tailed 
confidence interval. In accordance with Article 325bf(1)(d), the model used to 
calculate VaR must be based on the same modelling assumptions as those used to 
calculate ES. According to Article 325bj(1), any internal model used to calculate 
capital requirements for market risk must adequately capture all material risks. 
Pursuant to Article 325bi(1)(f), any internal model used to calculate capital 

25    In such a case, and depending on the individual situation, the ECB might decide, under Article 10 of the 
SSM Regulation, to require institutions to provide data in order to analyse whether/verify that the use of 
a shorter historical observation period does not lead to a lower ES risk number. 

ECB guide to internal models – Market risk – CRR3 

266 

 
 
requirements for market risk must have a proven track record of reasonable 
accuracy in measuring risks. 

Therefore, the ECB considers that for institutions using a simulation approach (either 
historical or Monte Carlo) in their VaR calculation, the percentile estimation method 
used to obtain the 99th and the 97.5th percentiles should be based on reasonable 
statistical properties that ensure its accuracy – that is, it should be statistically 
unbiased, distribution-free, and assume that the probability of experiencing a P&L 
lower (or higher) than the lowest (or highest) simulated value is strictly greater than 
zero. 

For these reasons, the ECB considers that both the method proposed by Harrell and 
Davis26,27  and the simplified method proposed below28  are appropriate methods to 
ensure that price risks are adequately captured when using the percentile estimation 
method. 

Looking at the vector of simulated P&L of length 𝑛 for the VaR percentile estimation 
(P&L1 to P&L𝑛) in ascending order,29  the result 𝑄(α) is obtained as the weighted 
average of the two subsequent P&L values −P&LInt(𝑚) and −P&LInt(𝑚)+1, computed as 

𝑄(α)= (𝑚−Int(𝑚))⋅(−P&LInt(𝑚)+1)+(Int(𝑚)−𝑚+1)⋅(−P&LInt(𝑚)),   

with m=(n+1)(1-α)   

For example:   

• 

• 

• 

For α=99% and 𝑛=250, the percentile result of this method is 0.51 × (−P&L3) + 
0.49 × (−P&L2);   

For α=99% and 𝑛=260, the percentile result of this method is 0.61 × (−P&L3) + 
0.39 × (−P&L2). 

For α=97.5% and n=250 the percentile result of this method is 0.275 × (−P&L7) 
+ 0.725 × (−P&L6). 

In accordance with Article 325bi of the CRR, any internal risk measurement must be 
conceptually sound and be calculated and implemented with integrity. According to 
Article 325bf(1)(d), the model used to calculate VaR must be based on the same 
modelling assumptions as those used for the calculation of the ES. The ECB expects 
an institution to be able to justify its choice of the expected shortfall estimator in 
relation to its choice of the VaR estimator, and also to provide motivation for its 
choice of the expected shortfall estimator in relation to the underlying assumptions 
on the tail of the distribution of losses. 

26    See Harrell, F.E. and Davis, C.E., “A new distribution-free quantile estimator”, Biometrika, Vol. 69, 

1982, pp. 635-640. 

27    Corresponding to estimator 9 in Dielman, T., Lowry C. and Pfaffenberger, R., “A comparison of quantile 
estimators”, Communications in Statistics - Simulation and Computation, Vol. 23(2), 1994, pp. 355-371. 
28    Corresponding to definition 6 in Hyndman, R.J. and Fan, Y., “Sample quantiles in statistical packages”, 

American Statistician, Vol. 50, 1996, pp. 361-365. 

29    P&L1 is the lowest P&L (i.e. the highest loss). 

ECB guide to internal models – Market risk – CRR3 

267 

 
 
5.4 

Data quality 

101. 

In accordance with Article 325bi(1) of the CRR, any internal risk measurement model 
used must be conceptually sound and must be calculated and implemented with 
integrity, while Article 325bi(2)(e) states that the data must be accurate and 
complete. This applies particularly to risk factor time series, which are fundamental 
inputs for ES and SSRM models. For each risk factor time series used to calibrate 
the shocks of the ES and SSRM models, the institution should have a process in 
place to regularly check the quality of the time series. The ECB expects such checks 
to be carried out at least quarterly, as this allows for alignment with the regulatory 
reporting cycle. However, institutions may, if they so wish, conduct certain checks on 
a more frequent basis if needed in order to meet minimum data standards. Where an 
institution uses different data sources for its ES and SSRM models and the daily 
economic P&L calculation reflected in the inventory referred to in paragraph 119 of 
this chapter, the ECB may ask the institution to explain the differences between the 
two sets of data sources, in order to verify that they meet minimum data standards. 

102.  The ECB understands that data should be sufficiently accurate and complete to 
capture the true volatility of a position or portfolio. Therefore, the quality checks 
carried out on the risk factor time series should, as a minimum, identify for each time 
series: 

(a) 

the number of days for which data points were initially missing and then filled 
using a particular methodology (e.g. interpolation and extrapolation)30; 

(b) 

the number of days for which data points were initially available and were 
replaced using a particular methodology (e.g. interpolation and extrapolation); 

(c) 

the number of days with no daily changes; 

(d) 

the maximum number of consecutive days with no daily change. 

103.  Material or large numbers of changes in the time series may affect the ability to 

capture the true volatility of a position or portfolio. In order to monitor and ensure that 
the operation of the internal model is not adversely affected, institutions should 
maintain up-to-date documentation31  describing any changes in the risk factor time 
series, including in particular any methodology for the replacement of missing data, 
and the list of tasks that may be performed during manual adjustments. This 
documentation should contain the following: 

(a)  a description of the methodology used to introduce the adjustment (the 

description should be sufficiently detailed so that any staff member of the unit in 
charge is able to produce the same outcome); 

(b)  a description of the processes in place to ensure the appropriate 

implementation of a manual process in accordance with the documentation. 

30    There should be no missing data points for the final time series of shocks used to calibrate the model.   
31    In accordance with Article 325bi(1)(e) of the CRR. 

ECB guide to internal models – Market risk – CRR3 

268 

 
 
104.  To ensure that changes in the risk factor time series do not affect the ability to 

capture the true volatility of a position or portfolio, institutions should analyse how 
replacing missing data might affect the volatilities and correlations of the IMA. This 
applies in particular where an institution uses time series that have: 

(a) 

the value of the same data of the previous day in the case of automatic and 
systematic replacement of missing data points; 

(b)  an elevated number of consecutive business days with missing data or no daily 

changes; 

(c)  only a low number of data points per year before any data cleaning or 

treatment. 

Filtering of data or exclusions of outliers should not be performed unless the 
institution can demonstrate that the excluded data points correspond to erroneous or 
stale data and do not represent the real market volatility of the risk factors. As part of 
the requirement under Article 325bi(1)(e) of the CRR to have procedures for 
ensuring compliance with controls concerning the overall operation of internal risk 
measurement models, the ECB expects institutions to keep track of any exclusion 
made in the risk factor time series used to calculate ES and SSRM. 

105.  Conversely, automatic and systematic filtering of data leading to exclusions of high 
or low returns should not be performed without further analysis and documentation. 

5.5 

Proxies 

106.  For the purposes of this guide, the ECB understands that the term “proxy/proxies” is 
used solely where time series data needed for a risk factor in the IMA (for generating 
10-business-day returns in the ES or SSRM model to calculate MR OFR) do not 
relate directly to the risk factor that has been subject to the RFMA. Proxy data should 
be adequate for the risk dynamics of the risk factor. In the ECB’s understanding, the 
checks as to the adequateness of the dynamics of the risk factors should be 
performed based on the metrics used to calculate the risk measures, and should 
therefore be based on the time series of 10-day risk factor returns. 

Differences of risk factors in the IMA compared with pricing factors in the end-of-day 
valuation process (in the front-office systems) are not regarded as proxies in this 
document. Consequently, legal requirements for the selection of risk factors in the 
IMA would apply and not the adequateness of proxy data. Moreover, filling 
techniques for a risk factor solely depending on existing data of the risk factor itself 
(e.g. by maximum likelihood estimation, Brownian bridge) as well as inter- and 
extrapolation would not be regarded as proxy data. 

107. 

In accordance with Article 325bh(1)(g) of the CRR, proxies must be used only where 
the available data are insufficient, such as during the period of stress referred to in 
point (c) of Article 325bc(2). In the ECB’s view, this implies that data should not be 

ECB guide to internal models – Market risk – CRR3 

269 

 
replaced only because zero-returns data are recorded in the market but that an 
additional analysis and justification would be needed. 

108. 

It is the ECB’s understanding that the condition stated in Article 325bh(1)(g) of the 
CRR, whereby proxy data must be used only where available data are insufficient, is 
fulfilled where an institution would need to apply the SSRM fallback approach for the 
original risk factor data because the respective N is lower than 12. If N would allow 
for the historical method or the asymmetrical sigma method to be used, i.e. if N is at 
least 12, then the ECB is of the view that a clear rationale for using a proxy approach 
would be needed, as also specified in Article 34(1)(c) of Commission Delegated 
Regulation (EU) No 2024/1085 (on the assessment methodology to use internal 
models for market risk), because the respective methods are already suited to low 
data availability. 

109. 

In accordance with Article 325bd(1) of the CRR, institutions must map each risk 
factor to one of the sub-broad categories of risk factors listed in Table 2 of the same 
article. In the ECB’s view, this implies that the determination of the liquidity horizon 
should be based on the risk factor that has been subject to the RFMA and is not 
linked to the shocks used to compute the ES and consequently not linked to potential 
proxy data for the risk factor. 

110.  The ECB is aware that for the time series of some risk factors, the exact risk factor 

data might be only available for part(s) of the history. For example, while for the 
current period the exact risk factor data might be available, it might not be for the 
stress period. As a result, proxy data would be needed where an institution wishes to 
keep the risk factor in the reduced set for the stress period PES calculation. In the 
ECB’s view, the use of proxy and non-proxy data for a time series is possible, 
provided that the data used fulfil the respective regulatory requirements. In 
accordance with Article 325bi(1) of the CRR, all internal risk measurement models 
must be conceptually sound. In the understanding of the ECB, this implies that there 
is exactly one risk factor return for each (business-) day in the time series of each 
risk factor. This means that PESRC should be calculated based on the same time 
series data as PESFC. Furthermore, the use of proxy time series data for PESRS does 
not imply the use of proxy time series for PESRC. 

111. 

In accordance with Article 325bc(2)(a), (3)(a) and (4)(a) of the CRR, when 
calculating PESRS and PESRC institutions must apply scenarios of future shocks only 
to a subset of the modellable risk factors, while when calculating PESFC institutions 
must apply scenarios of future shocks to all modellable risk factors. Hence, if a risk 
factor is not in the reduced set, the exposure to the risk factor is neither modelled in 
PESRS nor in PESRC, but is taken into account in PESFC. The ECB is aware that if an 
exposure in a risk factor that is not in the reduced set is hedged with an exposure in 
a risk factor that is in the reduced set, this could lead to “broken hedges” when 
calculating PESRS and PESRC. While a mapping of the exposure (on a risk factor not 
included in the reduced set) to a risk factor in the reduced set is not directly 
applicable under EU regulation, it is the ECB’s view that institutions could consider 

ECB guide to internal models – Market risk – CRR3 

270 

 
including, in the reduced set, those risk factors for which appropriate proxy data are 
available. This could be effective in avoiding broken hedges.32 

112. 

In accordance with Article 12 of Commission Delegated Regulation (EU) No 
2022/2059 (on back-testing requirements and P&L attribution requirements), 
institutions must calculate the theoretical changes based on a comparison between 
the portfolio’s end-of-day value and the value of that portfolio at the end of the 
subsequent day. In the understanding of the ECB, this implies that the RTPL is 
based on a change of value of the risk factor that has been subject to the RFMA and 
is not linked to the shocks used to compute the ES and, consequently, not linked to 
potential proxy data for the risk factor. The ECB is of the view that the term “market 
data” in Article 12.2 refers only to the level of the risk factor before applying the 
shock, not to the shocks themselves. 

32    Economically the result is likely to be similar to a mapping, as outlined in principle six (MAR 

31.26(6)(a)) of the Basel framework. 

ECB guide to internal models – Market risk – CRR3 

271 

 
 
Table 36 
Proxy definition and implications for selected cases 

Starting point: An institution holds a position in a "Single Name A" 

Time series 
data used to 
generate the 
shocks/scena
rios of 10 
business 
days returns 
from RF… 

RFMA on 
RF... 

Is this a proxy case? 

Case 
1 

"Single 
Name A" 

"Single Name 
A" 

Case 
2 

"Single 
Name B" 

"Single Name 
B" 

No 

No 

PES 
calculations 
(FC, RC and 
RS) must be 
calibrated 
on time 
series data 
of RF… 

The RTPL 
must reflect 
changes in 
the value of 
RF…(*) 

"Single 
Name A" 

"Single 
Name B" 

"Single 
Name A" 

"Single 
Name B" 

“Index I” 

“Index I” 

No 

"Index I" 

"Index I" 

Case 
3 

Yes - "Index I" 

Yes - "Index I" 

"Single 
Name A" 

"Single 
Name B" 

Yes - "Index I", "Single 
Name B" 

"Single 
Name A" 

Yes - "Index I", "Single 
Name B" 

"Single 
Name A"   

No - This is an 
interpolation case 

"Single 
Name A" 

Case 
4 

"Single 
Name A" 

Case 
5 

"Single 
Name B" 

Case 
6 

"Single 
Name A" 

Case 
7 

"Single 
Name A" 

Case 
8 

"Single 
Name A" 

“Index I” for the 
stress period 
"Single Name 
A" for the 
current period 

“Index I” for the 
stress period 
and "Single 
Name B" for 
the current 
period 

“Index I” for the 
stress period 
and "Single 
Name B" for 
part of the 
current period 
"Single Name 
A" for the most 
recent part of 
the current 
period (e.g. a 
new stock) 

“Index I” for the 
stress period 
and "Single 
Name B" for 
some dates of 
the current 
period 
"Single Name 
A" for some 
dates of the 
current period 
(e.g. a very 
illiquid stock) 

Interpolation of 
"Single Name 
A" for parts of 
the stress 
period 
"Single Name 
A" for the 
current period 

- FC and RC 
on “Single 
Name A”   
- RS on 
"Index I" 

- FC and RC 
on “Single 
Name B”   
- RS on 
"Index I" 

- FC and RC 
on a 
combination 
of “Single 
Name A” and 
"Single 
Name B" 
depending 
on data 
availability 
- RS on 
"Index I" 

- FC and RC 
on 
combination 
of “Single 
Name A” and 
“Single 
Name B” 
depending 
on data 
availability 
- RS on 
"Index I" 

- RS on 
interpolation 
of “Single 
Name A”   
- FC and RC 
on “Single 
Name A”   

The SI must further ensure 
that… 

The choice of "Single Name 
B" as RF is justified, 
adequate and validated, 
because the RF is different 
from the pricing 
factor/position 

The choice of "Index I" as 
risk factor is justified, 
adequate and validated, 
because the RF is different 
from the pricing 
factor/position 

The basis risk between 
“Single Name A” and “Index 
I” is sufficiently small and 
validated   

The choice of "Single Name 
B" as RF is justified, 
adequate and validated, 
because the RF is different 
from the pricing 
factor/position. 
The basis risk between 
“Single Name B” and “Index 
I” is sufficiently small and 
validated   

The basis risk between 
“Single Name A” and “Index 
I” and between "Single Name 
A" and "Single Name B" is 
sufficiently small and 
validated   

The basis risk between 
“Single Name A” and “Index 
I” and between "Single Name 
A" and "Single Name B" is 
sufficiently small and 
validated   

The interpolation of "Single 
Name A" is justified, 
adequate and validated. 

ECB guide to internal models – Market risk – CRR3 

272 

 
  
  
(*) This column is introduced to emphasise that the RTPL must reflect changes in value of the risk factor that has been subject to the 
RFMA, and therefore its entries are identical to those in the second column. For example, for case 7, “Single name A” values, and not 
“Single name B” values, should be used for RTPL computation. 

113.  The ECB believes that in order to demonstrate that proxies show a good track record 

for the actual position, are appropriately conservative, and are used only where the 
available data are insufficient, as required under Article 325bh(1)(g) of the CRR, the 
institution should document and make available, upon request, an inventory of time 
series of risk factors for which proxy data are used for the calibration of the ES and 
SSRM models, together with the materiality of the corresponding risk factors. 

114.  The ECB considers that the requirement to have a documented set of internal 

policies and controls as laid out in Article 325bi(1)(e) of the CRR applies also to the 
use of proxies, as they are part of the overall operation of internal risk measurement 
models. Therefore, institutions should have a policy in place that describes clear 
processes for deriving and validating each proxy for ES and SSRM models. The 
policy should further define a set of controls (for example, statistical analysis or 
comparison against alternative proxies) that should be performed to ensure the 
appropriateness of proxies. 

115.  As a control to ensure that the proxies are appropriately conservative and reflect the 

true volatility where sufficient market data are available, institutions should conduct 
analyses to show that the proxy market data (i) are highly correlated with the market 
data used for economic P&L, and (ii) show a similar level of volatility for ES and 
SSRM. Where analyses based on market data used for economic P&L are not 
feasible, institutions should at least assess alternative plausible proxy choices. 

116. 

In order to assess that proxies are appropriately conservative and reflect the true 
volatility, the ECB may, under Article 10 of the SSM Regulation, require an institution 
to provide, for a selection of sub-portfolios, business days, and material proxies: 

(a) 

the risk-theoretical P&L used for regulatory back-testing; 

(b) 

(c) 

(d) 

the risk-theoretical P&L calculated on the same unchanged positions but 
replacing, for the positions for which proxy data are used in the PESF,C , the 
market data with the proxy data; 

the risk-theoretical P&L calculated on the same unchanged positions but 
replacing, for the positions for which proxy data are used in the PESR,S , the 
market data with the proxy data; 

the risk-theoretical P&L calculated on the same unchanged positions but 
replacing, for the positions for which proxy data are used in the PESF,C or the 
PESR,S, the market data with the proxy data. 

The specific information required will depend on the results of the institution’s 
analysis of the appropriateness of the proxies. 

ECB guide to internal models – Market risk – CRR3 

273 

 
5.6 

Risk factors in the model 

117. 

In accordance with Article 325bi(1)(e) of the CRR, institutions must have in place a 
set of documented procedures and controls regulating the overall operation of their 
internal risk measurement models. 

In accordance with Article 325be(1) of the CRR, institutions must assess the 
modellability of all risk factors. In the ECB’s view, this implies that a new risk factor 
appearing (over the course of a quarter) should be considered non-modellable until 
an RFMA assessment leads to the result that this risk factor is modellable. According 
to Article 325be(2), institutions must calculate the own funds requirements for market 
risk in accordance with Article 325bk for those risk factors that are not modellable. 
Under Article 325bd(1), institutions must calculate PESF,C, PESR,C and PESR,S. For 
the ECB to be able to assess compliance with this requirement, an institution should 
be able to produce and update, on a regular, at least quarterly33  basis, an inventory 
of all risk factors and how they are used in the ES and SSRM models. This inventory 
should include at least the following information at the relevant level of granularity: 

• 

• 

• 

Risk factor broad category and subcategory and respective liquidity horizon. 

Risk factor modellability assessment. 

For risk factors classified as non-modellable: 

• 

• 

• 

information on the kind of NMRF (idiosyncratic equity risk factor 
aggregated with zero correlation, idiosyncratic credit risk factor aggregated 
with zero correlation, other); 

information if the NMRF belongs to a bucket or surface; 

SSRM per NMRF. 

• 

For risk factors classified as modellable: information if this risk factor is also 
included in the reduced set of risk factors. 

In accordance with Article 325bc(2)(c) of the CRR, certain ES measures must be 
calibrated to historical data from a continuous 12-month period of financial stress. 
For the purpose of identifying that stress period, institutions must use an observation 
period starting at least from 1 January 2007. In accordance with Article 12 of 
Commission Delegated Regulation (EU) No 2024/397 (on the calculation of the 
stress scenario risk measure), institutions must determine the stress period for the 
non-modellable risk factors for each broad risk factor category. Changes to the 
modellabilty of risk factors might have an influence on the respective stress periods 
identified as a basis for calculating ES and SSRM. Therefore, institutions should also 
include, in the above-mentioned inventory, information on the stressed periods that 

33    In accordance with Article 5 of Commission Implementing Regulation (EU) No 2021/451 (with regard to 
supervisory reporting of institutions), institutions must report information on own funds requirements 
with a quarterly frequency. Hence the data listed in this paragraph should also be provided at least 
quarterly. 

ECB guide to internal models – Market risk – CRR3 

274 

 
 
are used as a basis to calculate ES and SSRM and the relevant observation periods 
used as a basis for identifying the stressed periods. 

118. 

In accordance with Article 325bh(1)(b) of the CRR, an internal risk measurement 
model must capture basis risk. The ECB therefore considers that the model should 
capture name-related basis risk and in particular be sensitive to material 
idiosyncratic differences between similar, but not identical, positions. The ECB 
therefore considers that the use of each single stock price (where available) as a risk 
factor in the ES or SSRM models, depending on the results of the RFMA, is the best 
practice for modelling risk for equity instruments. Similarly, the direct use of 
idiosyncratic market data (where available) (for example, the idiosyncratic bond 
spread or each single-name credit default swap) as a risk factor is considered to be 
the best practice for modelling basis risk for debt instruments. 

However, the use of beta approximations or regressions could be accepted if they 
are documented and regularly validated (i.e. if they are shown to lead to good model 
performance), as required under Articles 325bi(1)(e) and 325bj of the CRR. 
Institutions should be able to demonstrate that the idiosyncratic volatility of equity or 
debt instruments is duly taken into account in the ES and SSRM models. 

119. 

In accordance with Article 325bh(1)(a) of the CRR, the ES and SSRM models must 
capture a sufficient number of risk factors, depending on the level of activity of the 
institution in the respective markets. Where a risk factor is incorporated into the 
institution’s pricing model (referred to as “pricing factor” for the purposes of this 
guide) but not into the ES and SSRM models, the institution must be able to justify 
such omission to the satisfaction of the competent authority. 

So that it can assess compliance with this requirement, the ECB expects an 
institution to be able to provide an inventory of all the pricing factors to the economic 
P&L and of all the risk factors used in the ES and SSRM models. This inventory 
should include a comprehensive mapping between the pricing factors used to 
calculate the economic P&L and the corresponding risk factors included in the ES 
and SSRM models. The inventory should contain at least the following information:   

(a)  a list of the pricing factors used to calculate the institution’s economic P&L34;   

(b) 

for each pricing factor, information confirming whether (or not) the pricing factor 
is directly modelled in the ES or SSRM;   

(c) 

if the pricing factor is modelled in the ES or SSRM:   

(i)  whether the risk factor of the model is exactly the same as the pricing 

factor; or 

(ii)  whether the pricing factor is represented by a different risk factor/risk 

factors in the model, including a description thereof. 

120. 

In order to assess whether the ES and SSRM models capture a sufficient number of 
risk factors and to assess the materiality of any missing risk factors, the ECB may, 

34    For example, inputs in institutions’ pricing models for economic P&L. 

ECB guide to internal models – Market risk – CRR3 

275 

 
 
under Article 10 of the SSM Regulation, require an institution to provide, for a 
selection of sub-portfolios, business days, and missing risk factors:   

(a) 

the hypothetical P&L used for regulatory back-testing;   

(b) 

the P&L calculated assuming simultaneously: 

(i)  unchanged positions and omitting the changes in value of the missing risk 

factors of the ES and SSRM;   

(ii)  use of the pricing models and models parametrisation used to compute the 

economic P&L.35 

5.7 

Pricing functions and methods in the model 

121. 

In accordance with Article 325bi(1)(e) and (f) of the CRR, institutions must have a set 
of documented procedures and controls in place regulating the overall operation of 
their internal risk measurement models, and moreover those models must have a 
proven track record of reasonable accuracy in measuring risks. Therefore, 
institutions should be able to produce and update, on a regular basis, an inventory of 
all the ES and SSRM pricing functions and methods, as well as the pricing functions 
and methods used in the economic P&L. This inventory should include a 
comprehensive mapping between the pricing functions and methods used in ES and 
SSRM and the pricing functions and methods used for the daily economic P&L. It 
should include the following information at the relevant level of granularity: 

(a) 

the pricing functions and methods, as well as their parametrisation (for 
example, the number of Monte Carlo simulations) used to calculate the daily 
economic P&L; 

(b) 

the scope of instrument types covered by each pricing function and method 
used to calculate the daily economic P&L; 

(c)  a meaningful indication of the materiality of positions priced with the 

corresponding pricing function and method, such as the number of individual 
positions, as well as the total amount of outstanding notional and market value 
covered by each pricing function and method used to calculate the daily 
economic P&L; 

(d) 

the pricing functions and methods, as well as their parametrisation (for 
example, the number of Monte Carlo simulations) used in the ES and SSRM 
engine; 

35    This should be identical to the pricing function used to calculate the hypothetical P&L under paragraph 

5 of this chapter. 

ECB guide to internal models – Market risk – CRR3 

276 

 
 
(e)  a self-assessment by the institution, including a scorecard indicator (green, 

amber, red)36  of the appropriateness of ES and SSRM pricing methods (ES and 
SSRM engine pricing versus daily economic P&L pricing). 

The criteria for assessing this scorecard indicator should be described in an internal 
policy. 

In the ECB’s view, this inventory should be updated at least once a year, so that it 
can be used in the annual review of the institution’s overall risk management 
process, as referred to in Article 325bi(2) of the CRR. 

122.  This inventory should be reviewed at least annually by a unit independent of the one 

that produces it (e.g. the internal audit function or internal validation function). This 
review should check the quality, reliability and comprehensiveness of the information 
provided in the inventory. 

123.  Like other assumptions used in an internal risk measurement model, the differences 
in the pricing functions and methods used to calculate the ES and SSRM compared 
with those used to calculate economic P&L should be subject to validation37  in 
accordance with Article 325bj(1) of the CRR. This validation should include any 
simplifications of pricing functions and methods introduced for use for ES and 
SSRM-related purposes (e.g. a reduced number of parameters or simulations). The 
validation should be performed at least initially when a pricing method is introduced 
into the ES and SSRM calculation that is not identical to the one used for economic 
P&L purposes, and should assess the impact of using different pricing methods. 
Further regular validations should be performed so as to make sure that this impact 
remains low. The scorecard indicator mentioned above should be based on the 
results of this (initial and regular) validation. The institution should develop a work 
plan to mitigate the risk or improve the quality of any pricing functions or methods 
that are deemed inadequate according to the institution’s assessment in the 
scorecard (i.e. a red indicator). 

124. 

In order to assess the accuracy and appropriateness of the pricing functions and 
methods used in the ES and SSRM models, the ECB may, under Article 10 of the 
SSM Regulation, require institutions to provide, for a selection of sub-portfolios, 
business days, and pricing functions/methods: 

(a) 

the hypothetical P&L used for regulatory back-testing; 

(b) 

the P&L, calculated on the same unchanged positions, by using the pricing 
functions and methods used to compute the ES and SSRM numbers with 
market data aligned to the extent possible with the market data used for the 
hypothetical P&L. 

36    The scorecard indicators are: green – fully appropriate; amber – acceptable; and red – weakness 

detected. 

37  The validation of pricing functions used for economic P&L purposes is expected to be regularly 

performed by an institution and thus provides the basis for this additional requirement. 

ECB guide to internal models – Market risk – CRR3 

277 

 
 
This information can be used to assess the isolated impact on the hypothetical P&L 
of using the pricing functions and methods in the ES and SSRM calculations, instead 
of those in the economic P&L. 

6 

Methodology for DRC 

6.1 

Relevant regulatory references 

Table 37 

Date of issue 

Article 

Paragraph/Point 

Legal background 

CRR 

20/05/2019 

4 

325bi 

325bj 

325bl 

325bm 

325bn 

325bo 

325bp 

(1) 

(1), (2) 

(3) 

(1) 

(1) 

(1), (2), (3) 

(2), (3) 

(1), (2), (3), (4), (5), (6), (7), (8), (10), (11) 

SSM Regulation 

15/10/2013 

6.2 

General requirements 

125. 

In accordance with Article 325bn(2) of the CRR, institutions must calculate the own 
funds requirement for default risk using an internal default risk model at least on a 
weekly basis. The ECB expects institutions to be able to prove that, on the day of the 
week chosen for the DRC calculation, their portfolio is representative of the portfolio 
held during the week and that the chosen portfolio does not lead to a systematic 
underestimation of the DRC numbers when computed weekly (for example, by using 
sensitivities or jump-to-default). 

126. 

  In order to assess whether the day of the week on which the DRC numbers are 
calculated lead to material bias, the ECB may, under Article 10 of the SSM 
Regulation, require an institution to recalculate the DRC for 15 consecutive business 
days (including three reporting days). If it is not possible to perform this calculation in 
the production environment, it can be performed in a test environment replicating the 
calculation of the regulatory DRC. 

127. 

In accordance with Article 325bo(2) of the CRR, hedging or diversification effects 
associated with long and short positions may only be recognised by explicitly 
modelling gross long and short positions in the different instruments, and institutions 
must reflect the potential for significant basis risks in hedging strategies, especially 
by maturity. Therefore, the ECB considers that institutions should not overestimate 

ECB guide to internal models – Market risk – CRR3 

278 

 
 
 
 
 
 
 
 
diversification or hedging effects, and in particular should ensure that maturity 
mismatches between long and short positions occurring within the 60-day time 
horizon, for equity positions for which the derogation provided for in Article 325bn(3) 
of the CRR is applied, or within the one-year time horizon, for the other positions, do 
not lead to an underestimation of risk. 

In accordance with Article 325bp(7)(c) of the CRR, an institution must, as part of the 
annual independent review and the initial and periodic validation of its DRC model, 
apply appropriate quantitative validation. Therefore, the ECB considers that 
institutions should, when carrying out this review and validation exercise, assess 
quantitatively how maturity mismatches – which may lead to imbalanced positions 
within the modelling horizon – affect the DRC amounts.38 

128. 

In accordance with Article 325bm in conjunction with Article 325bi(1)(f) of the CRR, a 
DRC model must be reasonably accurate in measuring risks. Therefore, an 
institution should be able to demonstrate that the number of simulations used in its 
model to compute the DRC is sufficient to ensure accurate and stable DRC amounts. 

129. 

In order to assess the accuracy of the DRC calculations, the ECB may, under Article 
10 of the SSM Regulation, require institutions to calculate a 95% confidence interval 
for the DRC estimation. 

130. 

In accordance with Article 325bm in conjunction with Article 325bi(1)(e) of the CRR, 
institutions must ensure compliance with a documented set of internal controls 
related to their DRC model. So that the ECB can assess compliance with this 
requirement, an institution should be able to provide an inventory of all open 
validation findings in relation to its DRC model, including a description of the finding, 
the envisaged remedial action and the target date for closure of the finding. In 
addition, institutions should retain closed validation findings for at least one year after 
the closure date and should be able to provide a description of the remedial action 
taken. Furthermore, to allow ECB to assess compliance with Article 325bm in 
conjunction with Article 325bi(1)(e) of the CRR, an institution should be able to 
provide an inventory of analyses that have been conducted for the purpose of 
developing/justifying the DRC model over the last five years. 

6.3 

  Data inputs 

131. 

In accordance with Article 325bp(4) of the CRR, a DRC model must be based on 
data that are objective and up to date. This applies in particular to time series used 
to calibrate the DRC model, for which the institution should have a process in place 
to regularly check the quality of the time series. In the ECB’s view, the time series 
should be checked at least quarterly to ensure its quality, as this ties in with the 
regulatory reporting cycle. 

38    A simple way of testing the impact of maturity mismatches leading to imbalanced positions may be to 
scale down the probabilities of default of maturing positions, taking into account the reduced time 
horizon until maturity. 

ECB guide to internal models – Market risk – CRR3 

279 

 
 
132. 

In accordance with Article 325bm in conjunction with Article 325bi(1) of the CRR, any 
internal risk measurement must be calculated and implemented with integrity, while 
according to Article 325bi(2)(e) and (f), institutions must ensure the accuracy and 
completeness of position data, accuracy and appropriateness for generating data 
proxies, and the consistency, timeliness and reliability of data sources, including the 
independence of those data sources. In the ECB’s understanding, this provision 
requires institutions to have a process in place to check the consistency of the 
quality of data inputs in the DRC model with the qualitative requirements set out in 
Article 325bi(2)(e) and (f). 

6.4 

Distribution and correlation assumptions 

133. 

134. 

135. 

136. 

In accordance with Article 325bp(7) of the CRR, an institution must, as part of the 
annual independent review and the initial and periodic validation of its DRC model, 
validate that its modelling approach for correlations and price changes is appropriate 
for its portfolio, including the choice and weights of its systematic risk factors. The 
ECB understands that this provision requires institutions in particular to justify (i) the 
choice of systematic factor types (for example, region and industry) and, for each 
type of systematic factor, its granularity, and (ii) the full correlation structure and its 
calibration for the entire set of risk factors used. 

In accordance with Article 325bn(1)(c) of the CRR, institutions must determine 
default correlations between different issuers on the basis of a conceptually sound 
methodology, while according to Article 325bm in conjunction with Article 325bj(3)(a), 
institutions must perform tests to demonstrate that any assumptions made within the 
internal model are appropriate. Pursuant to Article 325bn(1)(c) of the CRR, 
institutions must determine default correlations between different issuers using 
objective historical data on market credit spreads or equity prices. In view of those 
provisions, the ECB considers that any assumption for correlation modelling between 
different issuers made by the institution should be supported by objective market 
data (credit default swap data or equities data) and justified by a quantitative 
analysis as part of its initial and periodic validation process, as outlined in Article 
325bp(7)(c) of the CRR. In particular, this quantitative analysis should compare the 
level of correlation between issuers that derives from the institution’s DRC 
correlation model and from objective market data. 

In order to assess the appropriateness of the modelling approach for correlations, 
the ECB may, under Article 10 of the SSM Regulation, require institutions to provide 
correlations for all issuer pairs and all relevant correlation values according to their 
factor model, especially for the systematic factors. 

In accordance with Article 325bp(1) of the CRR, the DRC model must be capable of 
modelling the default of individual issuers as well as the simultaneous default of 
multiple issuers. For that purpose, the default of each individual issuer must be 
modelled using two types of systematic risk factors. The ECB understands that this 
provision requires institutions to have exactly two types of systematic risk factors and 
also to have at least one non-zero factor loading for the first type of systematic risk 

ECB guide to internal models – Market risk – CRR3 

280 

 
factor and at least one non-zero factor loading for the second type of systematic risk 
factor per obligor.39  The ECB considers it best practice for region and industry to be 
used as types of systematic risk factors. 

137.  According to Article 325bn(1)(c) of the CRR, the calculation of default correlations 

between different issuers must be calibrated to a one-year time horizon. In the 
understanding of the ECB, the calibration to a one-year horizon40  could be achieved 
if the correlations are determined on the basis of one-year returns. If other 
approaches are used, the ECB believes that the institution would need to 
demonstrate that its approach is consistent with the requirement to calibrate default 
correlations between different issuers to a one-year horizon. In accordance with 
Article 325bm in conjunction with Article 325bi(1) of the CRR, the DRC model must 
be conceptually sound and be calculated and implemented with integrity. In the 
ECB’s view, this implies that sufficiently stable estimators should be used. The ECB 
believes that sufficiently stable correlation estimators – calibrated to a one-year time 
horizon – can be determined by using either overlapping one-year returns or non-
overlapping one-year returns. When using one-year returns, a sufficiently stable 
estimator will likely be hard to achieve if the one-year returns are non-overlapping. If 
non-overlapping one-year returns are used, multiple correlation estimates from 
non-overlapping one-year returns with varying starting dates41  should be used to 
increase statistical stability. The correlation estimate is then defined as the average 
of the correlation estimates based on non-overlapping one-year returns with varying 
start dates. The institution should also weigh up the need for an outlier correction.42 

138. 

In accordance with Article 325bp(7)(b) of the CRR, institutions must perform 
sensitivity analyses and scenario analyses to assess the qualitative and quantitative 
reasonableness of the internal default risk model, particularly with regard to the 
treatment of concentrations. The ECB considers that institutions using a stochastic 
recovery rate (RR) should perform all the sensitivity analyses included in paragraphs 
138, 139, 141 and 146 of this chapter by using (i) the stochastic RR and (ii) the 
deterministic mean RR. Because systematic risk factor weights are relevant when 
modelling concentrations, the ECB understands that institutions should – as part of 
the independent review, and during the initial and periodic validation process – 
perform sensitivity analyses for default risk. In particular, the ECB considers it best 
practice for this sensitivity analysis to include, as a minimum, the following basic 
analysis, where systematic risk factor weights or correlations of risk factors43  in the 
model are shifted up or down by a fixed value or set to generic values: 

39    This understanding is supported by respective guidance at Basel level (MAR 33.20 FAQ3). 
40    In accordance with Article 325bn(3) of the CRR, an institution may replace the one-year time horizon 
with a time horizon of sixty days for the purpose of calculating the default risk of some or all of the 
equity positions, where appropriate. 

41    E.g: (1) The non-overlapping annual returns computed from the first trading day per year to the last 

trading day of that year; (2) The annual returns computed from the second trading day per year to the 
first trading day of the following year; (3) The annual returns computed from the third trading day per 
year to the second trading day of the following year; 

42    E.g. not considering the lowest and highest 10% of the correlation estimates. 
43    The latent variables of the model that determine the correlation of default events of the issuers. 

ECB guide to internal models – Market risk – CRR3 

281 

 
 
(a)  all systematic factor weights per issuer, for each issuer44, are shifted by +10% in 

absolute value (not going beyond 100%);45 

(b)  all systematic factor weights per issuer, for each issuer, are shifted by −10% in 

absolute value (not going below 0%); 

(c)  all systematic factor weights per issuer, for each issuer, are set to 0; 

(d)  all systematic factor weights per issuer, for each issuer, are set to 1; 

(e)  all correlations between systematic factors are set to 100% (weights of issuers 

to their respective systematic factors remain unchanged); 

(f)  all correlations between systematic factors are set to 0% (weights of issuers to 

their respective systematic factors remain unchanged); 

(g)  assume independence between recovery rates and systematic risk factors. 

In order to assess the appropriateness of the sensitivity analysis and scenario 
analysis performed to validate the reasonableness of the internal model, the ECB 
may, under Article 10 of the SSM Regulation, require institutions to provide the 
results of the sensitivity analysis as described in points (a) to (g) above. 

139.  To assess the appropriateness of the modelling approach for correlations, especially 
the choice and weights of the systematic risk factors, the ECB may, under Article 10 
of the SSM Regulation, require institutions to calculate the DRC amounts based on a 
one-factor Merton model (using one single global systematic risk factor) and one flat 
correlation with different correlation assumptions: 20%, 30%, 40%, 50%, 60%, 70% 
and 80%. All other inputs into an institution’s DRC model remain unchanged. 

140. 

In accordance with Article 325bn(1)(c) of the CRR, default correlations between 
different issuers must be determined on the basis of a conceptually sound 
methodology, while according to Article 375bp(7)(a), an institution must, as part of 
the annual independent review and the initial and periodic validation of its DRC 
model, validate that its modelling approach for correlations is appropriate for its 
portfolio. Pursuant to Article 375bp(7)(c), institutions must apply appropriate 
quantitative validation. The ECB believes that the impact of different copula 
assumptions should be analysed during the validation process, for example by 
testing the impact of different distributional assumptions. Because the copula choice 
is a key assumption of the modelling approach for correlations, in the ECB’s view 
these provisions require, in particular, institutions to demonstrate and validate the 
appropriateness of the copula choice of the modelling approach for correlations. The 
copula choice refers to the copula of the joint multivariate distribution46  of the risk 

44    If the asset value  𝐴𝑖  of an obligor  𝑖  is written as follows in a factor model: 𝐴𝑖 = √𝜌 i  𝑋𝑖 + √1 − 𝜌 i 𝜉𝑖 

where  𝑋𝑖  is driven by systemic contributions and  𝜉𝑖  is the idiosyncratic noise term, the weights of the 
issuers to their respective systematic factors correspond to  √𝜌 i . 

45    Which reduces the idiosyncratic weight accordingly. 
46    Sklar’s theorem (in Sklar, A., “Fonctions de répartition à n dimensions et leurs marges”, Publications de 
l’Institut de Statistique de L’Université de Paris, Vol. 8, 1959, pp. 229-231) states that every multivariate 
cumulative distribution function of a random vector can be expressed in terms of its marginals and a 
copula. 

ECB guide to internal models – Market risk – CRR3 

282 

 
 
factors for default – and the risk factors underlying stochastically varying RRs, if 
implemented – and of the joint systematic risk factors, where relevant. 

141. 

In accordance with Article 325bp(7)(b) of the CRR, institutions must perform 
sensitivity analyses and scenario analyses to assess the qualitative and quantitative 
reasonableness of their internal default risk model, particularly with regard to the 
treatment of concentrations. Because the copula choice is a key assumption of the 
modelling approach for correlations and is relevant for the modelling of 
concentrations, the ECB understands that institutions should – as part of the 
independent review, and also during the initial and periodic validation process – 
perform sensitivity analyses for different copula assumptions. The ECB considers 
that the following are suitable choices for comparing the impact of different copulas 
on the DRC with respect to the approved model: 

(a)  using a Student-t copula for all issuer risk factors with 5, 8 or 10 degrees of 

freedom; 

(b)  where relevant, using a Student-t copula for the systematic risk factors with 8 

degrees of freedom; 

(c)  where relevant, using a Student-t multivariate distribution with 8 degrees of 

freedom for both the multivariate distribution of all obligor asset values and the 
multivariate distribution defining the stochastic RRs (and binding these to the 
obligor asset values). 

Institutions are free to perform further analyses on the copula choices if they 
consider these more fitting given their particular circumstances. 

6.5 

Ratings, probabilities of default and recovery rate assumptions 

6.5.1 

Documentation requirements 

142. 

In accordance with Article 325bm in conjunction with Articles 325bi(1)(e), 325bp(10) 
and 325bp(11) of the CRR, an institution must have a documented set of internal 
policies and controls in place regulating the overall operation of its internal models. 
The ECB considers that for the DRC model, institutions should have in place, in 
particular:47 

(a)  methodology and process documents for determining probabilities of default 
(PDs) and recovery rates (RRs), including a process and documentation 
regulating the fallback approaches followed; 

(b)  validation documents demonstrating that the assumptions relating to PDs and 

RRs are appropriate; 

47    Respective IRB methodology and validation can be referenced. 

ECB guide to internal models – Market risk – CRR3 

283 

 
 
(c)  a documented hierarchy of preferred sources for the determination of PDs and 

RRs, which are applied to all issuers and instruments within the scope of the 
DIRC model. 

143. 

In order to assess the appropriateness and implementation of the policies and 
procedures in place for determining PDs and RRs, the ECB may, under Article 10 of 
the SSM Regulation, require institutions to provide, on request, a complete list of 
positions in the DRC model, together with the respective issuer or obligor ratings, the 
PDs of the issuer or obligor, and the RRs for the positions. If the PDs or RRs have 
been adjusted or have not been assigned using the usual automated process (for 
example, by manual intervention or deviation from the usual automated process), the 
institution should maintain a complete list of such PDs and RRs, and provide the 
rationale for the adjustment, or (for example) manual intervention or deviation from 
the usual automated process (as applicable) in each case. 

6.5.2 

Validation requirements 

144. 

145. 

In accordance with Article 325bp(2) of the CRR, the internal default risk model must 
reflect the economic cycle, including the dependency between recovery rates and 
systematic risk factors. According to Article 325bm in conjunction with Article 
325bj(3), the validation of the internal risk measurement models of an institution 
must include tests to verify whether the assumptions made in the internal model are 
appropriate and do not underestimate or overestimate the risk. In the ECB’s view, 
this provision implies that institutions should validate how the economic cycle is 
taken into account and how the dependence between RRs and systematic risk 
factors is modelled. 

In accordance with Article 325bp(5)(d) of the CRR, an institution that has been 
granted permission to estimate default probabilities using an IRB approach48, for the 
exposure class and the rating system corresponding to a given issuer, must use the 
respective approved IRB methodology to calculate default probabilities of that issuer, 
provided that data for such estimation are available. According to Article 325bp(6)(c), 
an institution that has been granted permission to estimate LGDs using an IRB 
approach – for the exposure class and the rating system corresponding to a given 
issuer – must use the respective approved IRB methodology to calculate the LGDs 
of that issuer, provided that data for such estimation are available. As limitations and 
obligations are part of the supervisory IRB approval process, the ECB expects 
institutions to validate that the limitations and obligations imposed as part of the IRB 
approval process are taken into account for the PDs and LGDs used in the DRC 
model. 

146. 

In accordance with Article 325bp(7)(b) of the CRR, institutions must perform 
sensitivity analyses and scenario analyses to assess the qualitative and quantitative 
reasonableness of the internal model. Therefore, the ECB considers that institutions 
should – as part of the independent review and also the initial and periodic validation 
process – perform sensitivity analyses with respect to the PDs and RRs that are 

48    In accordance with Title II, Chapter 3, Section 1. 

ECB guide to internal models – Market risk – CRR3 

284 

 
 
applied to assess the quantitative impact in terms of the default risk. In particular, the 
ECB considers it best practice for such sensitivity analyses to include, as a 
minimum, the following basic analyses on the main drivers of the DRC model: 

(a)  a simultaneous 10% (absolute) up- and downshift (not going beyond 0% or 

above 100%) of the RRs used in the portfolio. For models using stochastic RRs, 
institutions are expected to incorporate this impact by adjusting the mean of the 
RR distributions; 

(b) 

for models using stochastic RR, a simultaneous 30% (relative) up- and 
downshift of the standard deviation of recovery rates; 

(c) 

for all the PDs used in the DRC calculation:49 

(i)  a simultaneous 25% relative upshift of all PDs; 

(ii)  a simultaneous 25% relative downshift of all PDs floored, as described in 

Article 325bp(5)(a) of the CRR; 

(iii)  a simultaneous 1 bp absolute upshift of all PDs; 

(iv)  a simultaneous 1 bp absolute downshift of all PDs floored, as described in 

Article 325bp(5)(a) of the CRR. 

As the sensitivity analyses listed above are part of the model validation process, 
institutions should consider them closely when assessing and justifying their PD and 
RR parameters. The assessment should include an analysis of how the most 
important issuers and groups of issuers are affected by the altered PD and RR 
values. 

To assess the appropriateness of the sensitivity analysis and scenario analysis 
performed to validate the reasonableness of the internal model, the ECB may, under 
Article 10 of the SSM Regulation, require institutions to provide the results of the 
sensitivity analysis described in points (a) to (c) above. 

147. 

148. 

In accordance with Article 325bm in conjunction with Article 325bj of the CRR, the 
DRC model must be conceptually sound and adequately capture all material price 
risks. Therefore, the ECB considers that institutions should calculate the PD ratios 
between adjacent rating grades and analyse these ratios to understand potential 
differences from other ratios or the median of the ratios. 

In accordance with Article 325bp(2) of the CRR, the internal default risk model must 
reflect the economic cycle, including the dependency between recovery rates and 
the systematic risk factors. The ECB considers that this best practice should be 
applied in both a positive and a negative economic cycle. Hence, the ECB considers 
it best practice that institutions apply even lower thresholds to the RR in a negative 
economic cycle. 

49    Institutions should consider Monte-Carlo uncertainty when performing the analysis. 

ECB guide to internal models – Market risk – CRR3 

285 

 
 
6.5.3 

Requirements for PD fallback values 

149. 

In accordance with Article 325bm in conjunction with Article 325bi(1)(f) of the CRR, 
the DRC model must have a proven track record of being reasonably accurate in 
measuring risks. According to Article 325bp(4) of the CRR, the DRC model must be 
based on data that are objective and up to date. Therefore, the ECB expects 
institutions to periodically assess the materiality of those issuers and positions that 
are assigned a fallback PD in the DRC model. The ECB considers that a suitable 
analysis for this purpose would involve comparing the jump-to-default risk (where 
applicable, by using the average of the RRs in the case of a stochastic recovery rate) 
of those positions that are assigned fallback PDs with the jump-to-default risk of all 
positions in the DRC model. 

6.5.4 

Requirements for calculating losses based on recovery rates 

150. 

151. 

152. 

In accordance with Article 325bp(1) of the CRR, the DRC model must be capable of 
modelling the default of individual issuers and must take into account the impact of 
those defaults on the market values of the positions included in the scope of that 
model. Therefore, the ECB considers that the market value change following the 
default of an issuer should be calculated as the difference between the current 
market value of the position and the expected market value subsequent to default.50 

In accordance with Article 325bo(3) of the CRR, institutions must reflect the potential 
for material basis risks in hedging strategies that arise from differences in the type of 
product, seniority in the capital structure, internal or external ratings, maturity, 
vintage, or other differences. The ECB considers that in order to reflect the potential 
for material basis risks, recovery rates should reflect at least the type of product, 
including the collateralisation of the position, and its seniority in the capital structure. 

In accordance with Article 325bl(1) of the CRR, the DRC model should include in 
particular all positions that contain at least one equity risk factor. Pursuant to Article 
325bp(3), the internal default risk model must reflect the nonlinear impact of options 
and other positions with material nonlinear behaviour with respect to price changes. 
The ECB considers that only in the case of equity derivatives positions with multiple 
underlyings may simplified modelling approaches be applied.51  Institutions should 
also pay due regard to the amount of model risk inherent in the valuation and 
estimation of price risks associated with those equity derivative products. To estimate 
this model risk, simplified approaches should be compared with more sophisticated 
ones. In accordance with Article 325bp(7)(a) of the CRR, an institution must, as part 
of the annual independent review and the initial and periodic validation of its DRC 
model, validate that its modelling approach for correlations and price changes is 
appropriate for its portfolio, including the choice and weights of its systematic risk 
factors. In the ECB’s view, this provision implies that institutions should, in particular, 

50    According to Article 325bn(1)(b) of the CRR, the default of the issuers of equity positions must be 

represented by the value for the issuers’ equity prices being set to zero. 

51    This understanding is supported by respective guidance at Basel level (MAR 33.32 and FAQ1). 

ECB guide to internal models – Market risk – CRR3 

286 

 
 
justify any simplifications in the valuation of equity derivatives positions with multiple 
underlyings, as well as other equity derivatives with exotic features. 

6.6 

Treatment of groups of connected issuers 

153. 

154. 

In accordance with Article 325bp(8) of the CRR, the DRC model must appropriately 
reflect issuer concentrations and concentrations that can arise within and across 
product classes under stressed conditions. As defined in Article 4(1)(39) of the CRR, 
two or more legal persons in the same group of connected clients constitute a single 
risk, unless it is shown otherwise. The ECB considers that groups of connected 
clients are relevant for modelling issuer concentrations. Therefore, such groups 
should be appropriately reflected in the DRC model and their treatment in the model 
is subject to the same requirements as any other component of the model, 
particularly as regards documentation and validation. 

In accordance with Article 325bp(8) of the CRR, the DRC model must appropriately 
reflect issuer concentrations and concentrations that can arise within and across 
product classes under stressed conditions. As defined in Article 4(1)(39) of the CRR, 
a group of connected clients constitutes a single risk, unless it is shown otherwise. 
Therefore, the ECB considers that institutions should model issuers and obligors in 
the same group of connected clients as a single risk (this means, for example, that in 
an asset value model they should be modelled as a single asset value). However, 
the fact that different rating grades exist within a group of connected clients means it 
is possible that not all of those in the group will default simultaneously. Therefore, the 
ECB considers that a suitable modelling method would be to distinguish, within a 
group of connected clients, between sub-groups of issuers that have the same 
internal or external rating grade and where the default of each sub-group would 
occur simultaneously under the DRC model – unless it is demonstrated that another 
treatment would be more appropriate, in view of the definition of “group of connected 
clients” provided in Article 4(1)(39) of the CRR. 

155. 

In accordance with Article 325bp(7)(a) of the CRR, an institution must, as part of the 
annual independent review and the initial and periodic validation of its DRC model, 
validate that its modelling approach for correlations is appropriate for its portfolio. 
Because modelling groups of connected clients is relevant when modelling issuer 
concentrations and the correlations among them, the ECB believes that validating 
the way groups of connected clients have been modelled should be part of the 
annual independent review and the initial and periodic validation of the institution’s 
DRC model. 

ECB guide to internal models – Market risk – CRR3 

287 

 
7 

Risks not in the model engines 

7.1 

Relevant regulatory references 

Table 38 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

20/05/2019 

103 

105 

325az, 325bh, 325bi, 325bf, 325bg, 325bj, 
325bb, 325bk 

(2)(a) 

(3) 

325bd 

Table 2 

Council Regulation on SSM52 

Commission Implementing Regulation (EU) 
No 2021/451 (with regard to supervisory 
reporting of institutions) 

Other references 

Final Draft RTS on the conditions for 
assessing the materiality of extensions and 
changes to the use of alternative internal 
models 

15/10/2013 

17/12/2020 

04/03/2015 

10 

5 

7a 

7b 

(1) 

(1)(i) 

Section 2 of Part II of Annex III 

(13) 

Once adopted by the European Commission, the final draft RTS for assessing the 
materiality of model extensions and changes of the IMA under the FRTB will become 
an additional relevant regulatory reference. Currently, “Other references” are used to 
complement the ECB’s understanding in lieu of a specific regulatory source text. 

7.2 

Framework for risks not in the model engines 

156. 

In accordance with Article 325bj(1) of the CRR, any internal model used to calculate 
capital requirements for market risk must capture adequately all material risks. For 
DRC models, risk estimates must also be accurate pursuant to Article 325bi(1)(f) of 
the CRR. According to Article 325bh(1)(a) of the CRR, where a risk factor is 
incorporated into an institution’s pricing model but not into the risk measurement 
model, the institution must be able to justify that omission to the satisfaction of the 
competent authority. In accordance with Article 325bi(2)(d) of the CRR, the annual 
review of an institution’s overall risk management process must consider the scope 
of risks captured by the risk measurement model. Under Article 325bj(1) of the CRR, 
institutions must have processes in place to ensure that all their internal models for 
market risk have been adequately validated to ensure that they are conceptually 
sound and adequately capture all material risks. In accordance with Article 
325bi(1)(e) of the CRR, an institution must have established procedures in place for 

52    Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European 

Central Bank concerning policies relating to the prudential supervision of credit institutions. 

ECB guide to internal models – Market risk – CRR3 

288 

 
 
 
 
 
 
 
 
 
 
 
 
 
monitoring and ensuring compliance with a documented set of internal policies and 
controls concerning the overall operation of its internal models. 

Based on the provisions referred to above, the ECB considers that the processes set 
out in detail in this section for risks not captured in the model53  engines (also 
referred to in this guide as “risks not in the model engines”, or “RNIME”54) are an 
integral part of the overall processes of the IMA for market risks. Therefore, 
institutions should develop an RNIME framework, the core elements of which are 
further explained in the following paragraphs. 

157.  For the purposes of this guide and in relation to the RNIME framework, the following 

diagram schematically shows different components of the market risk own funds 
requirements and the RNIME framework. In the ECB’s view, an internal model 
comprises all of the required methods, processes, policies, controls and IT systems, 
with each internal model including, inter alia, the following components: 

(a)  An “engine”, meaning the calculation methodology for each risk number, 

referred to collectively as “risk engines”.55  The ECB understands that Articles 
325bh and 325bi of the CRR refer to an engine as a “risk measurement model”. 
There is one risk engine for each risk number and the engine is used to 
compute the daily risk number. Typically, an engine models and computes all 
risks in an integrated manner. However, it may comprise several components, 
such as a main component for the bulk of the risks, along with certain “satellite” 
components. A satellite component is part of a model engine – typically for a 
subset of products or risk positions – that meets all applicable CRR 
requirements for risk measurement models on an ongoing basis (such as for 
specific risks not modelled in the main component). In accordance with Article 
325bh(2) of the CRR, institutions may, in any internal model used for market 
risk, use empirical correlations (to the extent allowed by regulation); where they 
are not used, the model uses a simple sum aggregation of these components. 

(b)  An RNIME framework relating to all risk engines, in which RNIME are identified, 
quantified, managed and, as the case may be, capitalised through RNIME add-
ons to the risk exposure amounts. The process for determining RNIME add-ons 
is part of the RNIME framework. An RNIME add-on is understood as a 
temporary risk exposure amount56  that remains in place until the corresponding 
RNIME is incorporated into the model engine(s) in a manner compliant with the 
CRR. The ECB considers that RNIME add-ons are not part of the model 
engines, and are therefore not included in the risk numbers. In particular, 

53    In this section, the generic reference to “model” refers to the ES, SSRM and DRC. 
54    In this document, the abbreviation “RNIME” may be singular or plural, depending on whether it refers to 

a single risk, several risks, or collectively all risks not captured in the model engines. 

55    In the following, the ES and SSRM models are considered in combination as one engine, as the 

calculated risk measures aim to model market risk, stemming from volatilities in market prices, and 
furthermore, every risk factor can move between ES and SSRM and vice versa depending on their 
modellability assessment. 

56    To be reported in COREP as “Additional risk exposure amount due to Article 3 CRR” (COREP C02.00 

Row 0760, Column 0010), together with any other own-initiative capital buffers. 
There could also be supervisory imposed add-ons related to market risk which are not shown in the 
figure. 

ECB guide to internal models – Market risk – CRR3 

289 

 
 
RNIME add-ons are not included in the VaR number used for regulatory 
back-testing. 

Figure 8 
Components of market risk own funds requirements and risk exposure amounts 
(blue filled boxes), internal models (green frames), and RNIME framework (black 
frame) 

158. 

In accordance with Article 325bi(1)(e) of the CRR, institutions must have procedures 
in place for monitoring and ensuring compliance with a documented set of internal 
policies and controls concerning the overall operation of internal models. Therefore, 
the ECB considers that an institution should have a policy and controls in place that 
govern the overall process for the identification, quantification and management of 
RNIME. To enable efficient monitoring of RNIME, the ECB considers that the 
documented policies should include a description of the different tasks and 
responsibilities and state how often they are to be performed. This policy and these 
controls constitute the RNIME framework. The ECB considers that the RNIME 
framework should cover the tasks described in the following paragraphs of this 
section. 

159. 

In accordance with Article 325bi(1)(b) of the CRR, the risk control unit is responsible 
for the overall risk management system. Because the RNIME framework is an 
integral part of the overall IMA processes, the ECB considers that the risk control unit 
is also responsible for the overall RNIME framework. 

According to Article 325bi(1)(b) of the CRR, the risk control unit must conduct the 
initial and ongoing validation of any internal model used for market risk. Therefore, 
the ECB considers that the RNIME framework and methodologies should be 
validated internally, both initially and thereafter on a regular basis, and updated if 
necessary. 

ECB guide to internal models – Market risk – CRR3 

290 

 
 
 
7.3 

Identification of RNIME 

160.  A single RNIME identified refers to a distinct risk not adequately captured or omitted, 
and related to positions or instruments within the “current IMA trading desks”, 
understood as those satisfying the conditions listed in Article 325az of the CRR and 
currently classified as either “green” or “yellow”, under the ES/SSRM or DRC 
models. It can refer to a single risk factor, a set of risk factors (e.g. related to a yield 
curve), a particular effect (e.g. volatility skew) or specific instruments.   

In the ECB’s view, RNIME can emerge as a result of the following circumstances: 

(a)  Differences in the positions, risk factors and pricing methods captured in 
ES/SSRM and DRC engines, in comparison with those of the end-of-day 
valuation process for the books and records of an institution as well as proxy 
data used in the risk factor times series.57  In particular, these may include risk 
factors that are taken into account in economic P&L, but not in the risk 
measurement model as referred to in Article 325bh(1)(a) of the CRR.All risk 
factors captured in ES and SSRM are relevant when it comes to identifying 
missing risk factors. 

Examples here include missing positions in the IMA; pricing factors not included 
in the IMA, included with a reduced granularity, represented by different risk 
factors or not adequately modelled (such as basis risk between two different 
classes of shares); simplified pricing models or sensitivities-based P&L in the 
risk engines; calibration of pricing models in the risk engines; proxy data used 
for the full or partial time series of a risk factor in the IMA. 

(b)  Weaknesses and limitations in the stochastic modelling of risk factors in the 

ES/SSRM or DRC models within the risk engines that are not linked to the 
valuation produced by the end-of-day valuation process. 

Examples here include distributional assumptions for risk factors of both the 
marginal distributions and joint distributions (i.e. correlation structure); jump 
risks; calibration of model parameters; regression approach calibration and 
deviations; DRC factor model assumptions and calibration; and insufficient or 
unreliable data for risk factors. 

(c)  Other factors leading to risks not being captured adequately or being omitted 

from the risk engines. 

Examples here include instruments on exotic underlyings; positions in defaulted 
debt; some risks not adequately captured due to position data not being 
updated daily58; maturity mismatches between a hedging instrument and the 
hedged instrument that could occur during the one-year time horizon for the 
DRC. 

57    Those potential RNIME are different from the valuation adjustments that an institution might have made 
in order to satisfy the fair value and prudent valuation requirements under Article 105 of the CRR. 

58    This applies to CIUs when look-through is performed less than daily. 

ECB guide to internal models – Market risk – CRR3 

291 

 
 
161. 

In accordance with Article 325bi(1)(e) of the CRR, an institution must have 
procedures in place for monitoring and ensuring compliance with a documented set 
of internal policies and controls concerning the overall operation of its internal 
models. Therefore, the ECB considers that in order to ensure the comprehensive 
coverage of such risks, the institution should clearly describe and document each 
RNIME in an inventory, as part of its RNIME framework. 

In order to properly monitor each RNIME, the ECB expects institutions to explain 
how each RNIME is identified and defined, and, in particular, to be able to justify any 
cases where a single RNIME is defined across trading desks. In order to properly 
assess materiality, the ECB understands that the portfolio composition and trading 
strategy of the current IMA trading desks should be taken into account when 
assessing each RNIME. The ECB understands that, generally, all RNIME need to be 
included in the RNIME framework described below. The only exception would be 
where the institution can demonstrate that the effect of an identified RNIME is 
negligible in the current portfolio of IMA trading desks and will remain negligible 
taking into account the trading strategy. If this can be reliably shown, the institution 
may exclude that RNIME from the RNIME quantification and management processes 
that are part of the RNIME framework. The institution should be able to provide 
justification as to why any particular RNIME is not included in its risk engines. 

162. 

In accordance with Article 325bj(1) of the CRR, an internal model must adequately 
capture all material risks. To ensure that all risks are adequately captured, the ECB 
is of the view that institutions should not rely solely on the monitoring of current 
RNIME, but should strive to identify RNIME on an ongoing basis, and as early as 
possible, as part of their overall risk management. The ECB considers it best 
practice to use existing processes efficiently to identify RNIME. 

As part of such best practice, and in order to maximise efficiency, institutions should, 
as a bare minimum, use the following processes to identify RNIME: 

(a)  a review of the institution’s trading strategy, as referred to in Article 103(2)(a) of 
the CRR, considering, in particular, the expansion and reorientation of the 
trading business, given that expanding a particular business could lead to 
RNIME becoming significant, or to additional risks that are not currently covered 
in the RNIME process; 

(b) 

the regulatory back-testing process, as referred to in Article 325bf of the CRR, 
as part of which the institution should review the results and analyses of 
overshootings in order to identify RNIME at both trading desk and 
top-of-the-house level; 

(c) 

the P&L attribution process, as referred to in Article 325bg of the CRR, to 
identify RNIME at trading desk level. 

(d) 

the accuracy and appropriateness of volatility and correlation assumptions, as 
referred to in Article 325bi(2)(e) of the CRR, and the related market data quality 
assurance processes for risk factors, where market data display insufficient 
quality; 

ECB guide to internal models – Market risk – CRR3 

292 

 
(e) 

initial and ongoing internal validation of internal models, as referred to in Articles 
325bi(1)(b) and 325bj of the CRR, at least where differences between the 
institution’s pricing model and risk measurement model are identified (for 
example, risk factors that are used for the valuation of a product for the end-of-
day valuation process, but not for risk measurement), and where internal back-
testing shows a high number of overshootings, or where the P&L attribution test 
done at trading desk level reveals higher deviations between hypothetical P&L 
and risk-theoretical P&L; 

(f)  where new products are introduced, the institution should analyse whether the 

market risks inherent in the new products and their related trading strategies 
can be adequately captured by the risk engines in order to ensure that these 
new products – which may pose additional risk factors or require 
methodological changes – are fully compatible with the comprehensive risk 
control and validation by the risk control unit, as required by Article 325bi(1)(b) 
of the CRR. 

(g) 

In accordance with Article 325bi(2) of the CRR, the annual review of an 
institution’s overall risk management process must consider the scope of risks 
captured by the risk measurement model. Therefore, the ECB considers that an 
institution should review its RNIME inventory at least once a year. 

7.4 

Quantification of RNIME 

163. 

In accordance with Article 325bj(1) of the CRR, any internal model used to calculate 
capital requirements for market risk must adequately capture all material risks. In 
order to ensure a meaningful quantification of RNIME in relation to the internal 
models, the ECB considers that the risk parameters for RNIME quantification should 
be aligned with regulatory specifications. Therefore, the quantification of risks not 
captured in the ES/SSRM engine should aim to reflect the average of losses above a 
97.5% confidence level over the appropriate liquidity horizon. Meanwhile, the 
quantification of risks not captured in the DRC engine should aim to reflect a loss at 
a 99.9% confidence interval over a time horizon of one year. 

164. 

In accordance with Article 325bj(1) of the CRR, any internal model used to calculate 
capital requirements for market risk must adequately capture all material risks. 
Therefore, the ECB considers that in order to ensure that the internal models capture 
all material risks, institutions should quantify RNIME in an appropriate way and 
document and duly justify the methodology applied. The ECB understands that by 
quantifying the impact of the identified i-th RNIME (denoted by  RNIME𝑖), an 
institution can assess the need to incorporate the i-th RNIME into the engine. 

The ECB considers it best practice that for each  RNIME𝑖  identified, the impact 
quantification  𝑀𝑖  should be estimated as the incremental risk number where 
RNIME𝑖  would be incorporated into the model engine; this is in comparison with the 
current engine using the same portfolio of all current IMA trading desks as reference, 

ECB guide to internal models – Market risk – CRR3 

293 

 
𝑀𝑖 ≝ risk number(engine with RNIME𝑖 incorporated)

− risk number(current engine),  

risk number ∈  {

ES

SSRM59

, DRC} 

where no RNIME add-ons (or other add-ons) are included in the risk numbers. 

The impact quantification  𝑀𝑖  is a signed number and could be negative if 
incorporating  RNIME𝑖  were to be risk-reducing. 

The estimation of  𝑀𝑖  should be as adequate as possible using reasonable effort. 
Therefore, the ECB understands that the  𝑀𝑖  estimation methodology can use 
appropriate approximations, assumptions, or a stress methodology when duly 
justified and documented. 

Because the impact quantification should allow the different RNIME to be assessed 
individually, no diversification effect should be applied between different RNIME 
when quantifying the individual RNIME. 

165.  The ECB considers that a more conservative impact quantification than described in 
paragraph 164 of this chapter could be used where this is duly justified. In particular, 
where an appropriate impact quantification using an incremental risk number cannot 
be performed, the ECB considers it a prudent approach to resort to a stand-alone 
impact estimation for  RNIME𝑖, 

𝑀̃𝑖 ≝ risk number(RNIME𝑖 as only source of risk), 

risk number ∈  {

, DRC}, 

ES
SSRM

and  𝑀𝑖  is set to  𝑀̃𝑖  for the impact quantification. 

The estimation of  𝑀̃𝑖  should be as adequate as possible using reasonable effort. 
Therefore, the ECB understands that the  𝑀̃𝑖  estimation methodology can use 
appropriate approximations, assumptions, or a stress methodology when duly 
justified and documented. 

166. 

In accordance with Article 325bj(1) of the CRR, any internal model used to calculate 
capital requirements for market risk must adequately capture all material risks. To 
help ensure that RNIME are adequately quantified, the institution should, where 
possible, make use of objective market data, even if the data quality is not sufficient 
to model these risks in the model engine.   

To ensure alignment with the internal models when quantifying an RNIME (such as 
by using sensitivities), the shocks applied in order to quantify such risks should be 
based on the same liquidity horizon and, in principle, on the same observation period 
as those for the shocks for the other risk factors used in the relevant internal model 
belonging to the same broad risk category of risk factors, as specified in Table 2 of 

59    The risk number ES/SSRM equals the sum of the ES (including the multiplication factor “of at least 1.5” 
as specified in Article 325bf, but without the quantitative add-on determined in accordance with table 3) 
and the SSRM. 

ECB guide to internal models – Market risk – CRR3 

294 

 
 
Article 325bd of the CRR. Differences in the observation period should be duly 
justified. If scarce data are used to calibrate these shocks, the shocks should be 
estimated conservatively, which may involve relying to some extent on expert 
judgement. 

7.5 

Management of RNIME and implementation in an institution’s risk 
engines 

167. 

In accordance with Article 325bj(1) of the CRR, any internal model must adequately 
capture all material risks. The ECB considers that in order to ensure ongoing 
adequate risk capture, the risk control unit should carry out regular impact 
quantification and monitoring of all RNIME. 

Monitoring of RNIME should include, in particular, checking whether RNIME are 
above certain thresholds, as further explained below in this section. 

168.  According to Article 5(1) of Commission Implementing Regulation (EU) No 2021/451 
(with regard to supervisory reporting of institutions), institutions must submit the 
relevant information relating to own funds requirements on a quarterly basis. 
Therefore, to assess the adequacy of own funds, the ECB expects institutions to 
quantify and monitor the RNIME at least quarterly. 

The risk control unit should report the outcome of the quantification and monitoring to 
the committee or persons responsible for deciding on the management of RNIME, in 
terms of identification, quantification, treatment, limitation, reporting frequency, and 
so forth. 

169. 

In accordance with Article 325bj(1) of the CRR, any internal model must adequately 
capture all material risks. Therefore, to help ensure that the models adequately 
capture all material risks, including RNIME, thus resulting in a sufficient level of own 
funds, institutions should consider all of the following points: 

(a)  An  RNIME𝑖, where  𝑀𝑖   <  0  does not allow the reduction of own funds 

requirements until the related risk has been incorporated into the relevant 
engine. 

(b) 

Institutions should determine thresholds for assessing, at their own discretion, 
the impact of individual RNIME above which an individual RNIME is considered 
a “substantial” RNIME. For RNIMEs which are explicitly covered in the PLAT, no 
separate own funds requirement add-on needs to be determined. 

The ECB considers that if a single RNIME already has a 5% impact, there is a 
risk that the risk engine might not adequately capture all material risks. 
Therefore, the ECB considers it best practice for the i-th individual RNIME to be 
considered substantial if the impact quantification  𝑀𝑖  corresponds to more than 

ECB guide to internal models – Market risk – CRR3 

295 

 
5% of the amount computed by the risk engine60,61  (without taking into account 
any add-ons, as they are not included in the relevant risk number).   

That is,  RNIME𝑖  is considered substantial if   

𝑀𝑖
risk number 

> 5%, risk number ∈ {ES/SSRM, DRC} 

This is without prejudice to the discretion of an institution to set a lower 
threshold than 5%. 

The ECB considers it best practice and prudent that institutions include any 
substantial  RNIME𝑖  in their own funds requirements by way of an  RNIME𝑖  add-
on of size  𝑀𝑖  multiplied by 12.5, in order to calculate the corresponding risk 
exposure amount. In so doing they should take into account the multiplication 
factor (mc) for ES, as referred to in Article 325bf(5) of the CRR, without the 
back-testing addend, until they have incorporated it into the engine concerned. 
Consistent with the impact quantification, the ECB considers that there should 
be no diversification effect between different RNIME add-ons. 

(c) 

Institutions should determine, at their own discretion, thresholds above which 
RNIME are incorporated into the model engines. 

In the ECB’s view, if the cumulative RNIME impact corresponds to more than 
10% of the amount computed by the risk engine, the engine might fail to 
adequately capture all material risks62, as the change needed to incorporate 
them into the engine could amount to a material model change. 

In order to assess whether that is the case, institutions should calculate the 
cumulative impact quantification  CIQrisk number  per risk number by adding the 
positive impacts of all RNIME related to that risk number, including those 
subject to an RNIME add-on, without taking any diversification among the 
different RNIME into account, and dividing by the risk number computed by the 
model engine without taking any add-ons into account.63  If the resulting ratio is 

60    The calculation should be made at the end of the quarter by comparing the impact quantification of the 
RNIME (i.e. the Mi), say,. at the end of the quarter, with the previous 60-business day average of the 
ES (including the multiplication factor “of at least 1.5” as specified in Article 325bf, but without the 
quantitative add-on determined in accordance with table 3) and the SSRM, or the previous 12-week 
average of the DRC. 

61    Please note that it is generally expected that the RNIME quantification, as described in paragraphs 164 
and 165 of this chapter, be performed only once a quarter (for one day in the quarter, e.g. at the end of 
the quarter), to avoid overly burdensome computations. In the unlikely case that an institution is able to 
quantify an RNIME daily, for ES/SSRM, or weekly, for DRC, it would be possible to use an average-
based impact calculation for that RNIME, as long as the same dates are used for this average as for 
the 60-business day average of the ES/SSRM or the 12-week average of the DRC amount 
respectively. In this case, the Mi of paragraphs 164, 165 and 169 of this chapter should be determined 
based on this average. 

62    This is without prejudice to a determination by the ECB, based on an assessment taking into account 
the institution’s specific circumstances, that the model does not adequately capture all material risks. 
63    The calculation should be made at the end of the quarter by comparing the sum of impact quantification 
of the RNIME (e.g. at the end of the quarter) with the 60-business day average of the ES (including the 
multiplication factor “of at least 1.5”, as specified in Article 325bf, but without the quantitative add-on 
determined in accordance with table 3) and the SSRM, or the 12-week average of the DRC amount of 
the preceding quarter. 

ECB guide to internal models – Market risk – CRR3 

296 

 
 
greater than 10%, the ECB considers that the model engine might not 
adequately capture all material price risks, 

CIQrisk number =

∑

all RNIME𝑖 related to risk number
risk number 

max[𝑀𝑖, 0]

  >  10%, 

risk number ∈ {

ES
SSRM

, DRC} 

This is without prejudice to the discretion of an institution to set a lower 
threshold than 10%. 

If the ratio as calculated above happens to be greater than 10% (or a lower 
threshold set by the institution), the institution should provide the ECB with an 
implementation plan for incorporating some or all of these RNIME into the 
model engine(s), such that the cumulative impacts are brought below the 
relevant threshold. 

(d)  The ECB considers it a prudent approach for RNIME which are to be 

incorporated into the relevant engine(s) to be capitalised with RNIME add-ons 
as part of the implementation plan, until they are incorporated into the relevant 
engine(s). If the institution sees fit, the remaining RNIME may also be 
capitalised with RNIME add-ons. 

170.  With reference to the previous paragraphs of this section, the incorporation of 

RNIME into the model engine should be performed so that the engine complies with 
all relevant requirements of the CRR including, in particular, internal validation. The 
term “incorporation” here means the integration of RNIME into the relevant risk 
engine, and into its methodology and processes, typically allowing for some degree 
of risk diversification. This is without prejudice to the discretion of an institution not to 
use empirical correlations within risk categories or across risk categories (to the 
extent allowed by regulation), as referred to in Article 325bh(2) of the CRR, applying 
instead a simple sum aggregation. 

171.  According to Article 5(1) of Commission Implementing Regulation (EU) No 2021/451 
(with regard to supervisory reporting of institutions), institutions must submit the 
relevant information relating to own funds requirements every quarter. Therefore, to 
ensure accurate quarterly reporting of own funds requirements and risk exposure 
amounts, the ECB expects the RNIME add-ons to be updated at least quarterly. 

For the purpose of monitoring RNIME add-ons, the ECB may, under Article 10 of the 
SSM Regulation, require an institution to provide an overview of RNIME add-ons in a 
suitable format chosen by the institution. 

172.  Because the RNIME framework is an integral part of the overall IMA processes, a 

change to the RNIME framework – in particular one that relates to the RNIME 
identification methodology, the consideration of new types of RNIME, the impact 
quantification methodology, or the RNIME add-on methodology – constitutes an IMA 
model change and should therefore be assessed in accordance with the EBA final 
draft RTS on the conditions for assessing materiality of extensions and changes to 
the use of alternative internal models. 

ECB guide to internal models – Market risk – CRR3 

297 

 
In accordance with Article 3 and the Annex, Part II, paragraph 7 of the EBA final draft 
RTS on the conditions for assessing materiality of extensions and changes to the 
use of alternative internal models, any structural, organisational or operational 
change to the core processes in risk management or risk controlling functions 
requires ex ante notification to the competent authorities with additional information. 
The ECB considers that because the RNIME framework is an integral part of the 
overall IMA processes, a change to the RNIME framework should be notified ex ante 
to the competent authorities with additional information. 

173.  Ceasing to capitalise an RNIME, or capitalising an RNIME with an RNIME add-on 
according to the thresholds of the RNIME framework, does not constitute a model 
change and does not need to be separately notified as a model change, provided 
that it is based on the approved methodology of the RNIME framework. 

174.  The incorporation of  RNIME𝑖  into the model engine, irrespective of whether or not it 

was previously treated as an RNIME add-on, and irrespective of whether it is an 
RNIME identified previously or is newly identified, constitutes an IMA model change 
and should therefore be assessed in accordance with the EBA final draft RTS on the 
conditions for assessing materiality of extensions and changes to the use of 
alternative internal models. The ECB considers that the materiality assessment, in 
accordance with Article 2(1)(b)(iii) and (iv) of the EBA final draft RTS, should be 
based on the new risk number, i.e. on the following ratio, 

risk number(engine with RNIME𝑖 incorporated)
risk number(current engine)

− 1 

risk number ∈  {

ES
SSRM

, DRC} 

The ECB considers that for the sum of market risk requirements, the assessment of 
materiality under Article 2(1)(b)(i) and (ii) of the EBA final draft RTS should be carried 
out in the same way. 

175.  As the RNIME add-ons are not included in the ES number, they should not be taken 

into account in the VaR when performing regulatory back-testing. However, all ES 
engine components that constitute the ES engine (including, where applicable, 
satellite components) should be taken into account when calculating the VaR 
number used for the regulatory back-testing. 

ECB guide to internal models – Market risk – CRR3 

298 

 
8 

Risk management, governance and audit 

8.1 

Relevant regulatory references 

Table 39 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

20/05/2019 

103 

325az 

325ba 

325bi 

325bj 

325bn 

(2) 

(7), (8) 

(1), (2) 

(1) 

(2) 

(2) 

Other references 

Final Draft RTS on the conditions for assessing the materiality of 
extensions and changes to the use of alternative internal models 

04/03/2012 

8.2 

The risk control unit 

176. 

In accordance with Article 325bi(1)(b) of the CRR, the risk control unit is responsible, 
inter alia, for designing and implementing any risk measurement model, and also for 
the overall risk management system. In the ECB’s view, the risk control unit should 
ensure the accuracy and ongoing maintenance of the internal models. In addition, 
the risk control unit should address any deficiencies identified during the validation 
process and carry out the approved remediation activities. 

8.3 

Limits 

177. 

In accordance with Article 103(2)(b) of the CRR, institutions should have policies in 
place defining how limits are set. In order to actively manage the position entered to 
by the institution, the ECB expects these limits to be assessed on a regular basis. 
According to Article 325bi(1)(c) of the CRR, the management body and senior 
management must be actively involved in the risk management process. In the 
understanding of the ECB, this implies that at least the management body, or the 
committee designated by it, should regularly review the limits. 

178. 

In accordance with Article 325bi(1)(b) of the CRR, the risk control unit should 
produce reports on the appropriateness of measures to be taken in terms of trading 
limits. The ECB understands that institutions should have clear remediation 
procedures in place in the event that limits are breached. Instances of limit lending or 
temporary increase of limits should be exceptional and monitored closely. 

ECB guide to internal models – Market risk – CRR3 

299 

 
 
 
 
 
 
 
 
 
 
 
 
 
8.4 

Model applications, extensions and changes 

179. 

In accordance with Article 325bi(1)(f) of the CRR, any internal risk measurement 
model, including any pricing model, should have a proven track record of being 
reasonably accurate in measuring risks, and should not differ significantly from the 
models that the institution uses for its internal risk management. Therefore, the ECB 
expects institutions to provide: 

(a)  when applying for a new model, a one-year time series of back-testing and 

PLAT results; and 

(b)  when applying for a model change/extension, a one-year time series showing 

the impact of the planned change/extension to the extent possible and covering 
at least 15 days used for the impact calculation.64 

(c) 

(d) 

In accordance with Article 325bi(1) of the CRR, any internal risk measurement 
model should be calculated and implemented with integrity. Therefore, when 
applying for a new model, or a model change/extension, the institution should 
also provide all risk figures (ES, SSRM, DRC) and the components thereof, as 
well as additional data needed for the calculation (e.g. list of RF, RFMA results, 
stressed periods). 

In accordance with Article 325bi(1)(a) of the CRR, any internal risk 
measurement model used to calculate capital requirements for market risk 
should be closely integrated into the institution’s daily risk management process 
and should serve as the basis for reporting risk exposures to senior 
management. Pursuant to Article 325bi(1) of the CRR, any internal risk 
measurement model should be calculated and implemented with integrity. 
Therefore, the ECB expects the institution to perform daily runs of the new or 
changed/extended model at least from the date of confirmation of the 
investigation until the end of the investigation. Running the new model or the 
model including the change/extension should comprise at least the production 
of PnLs, VaR at TD and ToH level, ES, SSRM and DRC (weekly) figures. 

180. 

In accordance with Article 325az(7) of the CRR, material changes to the use of 
alternative internal models that an institution has received permission to use, the 
extension of the use of alternative internal models that the institution has received 
permission to use, and material changes to the institution’s choice of the subset of 
the modellable risk factors referred to in Article 325bc(2) CRR require separate 
permission from the competent authorities. According to Article 325bi(1)(e) of the 
CRR, institutions must have a documented set of internal policies in place for 
monitoring and ensuring compliance with the overall operation of their internal risk 
measurement models. The ECB understands that to comply with those 
requirements, institutions should have policies in place regulating model 
extensions/changes. In particular, those policies should define the methodology and 
processes used to identify, assess and classify model extensions/changes in 

64    15 days of impact calculation are required by the RTS on model extensions and changes and the ECB 
expects them to be performed as well when applying for model changes/extensions that are material 
based on qualitative characteristics (Annex, Part II of the same RTS). 

ECB guide to internal models – Market risk – CRR3 

300 

 
 
compliance with the EBA final draft RTS on the conditions for assessing materiality 
of extensions and changes to the use of alternative internal models. They should 
seek to ensure that model extensions/changes are not classified in such a way as to 
evade or minimise supervisory scrutiny. As a minimum, they should ensure that a 
model extension/change is not split into several model extensions/changes in order 
to give the appearance of lower materiality. 

181.  These policies should contain at least the following information: 

(a)  A definition of the different levels of materiality, particularly with regards to 

communication with the competent authority: ex ante notifications, or material 
model extensions/changes requiring a new approval. 

(b)  The qualitative and quantitative criteria used to assess the materiality of 

extensions/changes. For quantitative criteria in particular, institutions should 
clearly define the metrics used and provide a clear definition of the scope on 
which those metrics should be computed. The ECB encourages institutions to 
follow the criteria classification for model extensions/changes as specified in the 
RTS on the conditions for assessing the materiality of extensions and changes 
to the use of alternative internal models.   

(c)  Responsibilities, reporting lines and procedures for the internal approval of 
extensions/changes, taking into account the institution’s organisational 
characteristics. This policy should define at least the unit(s) responsible for 
assessing and classifying extensions/changes as well as the 
function/committee responsible for confirming and countersigning that 
classification. 

(d)  Procedures to identify and monitor extensions/changes, and to notify them to 

the competent authorities or apply for permission to make such 
extensions/changes. In particular, institutions should establish an end-to-end 
process from identification to notification/application and describe how they 
perform the activities at each step. 

(e)  Procedures for the implementation of extensions/changes, including their 

documentation. 

8.5 

Internal audit 

182. 

In accordance with Articles 325bi(1)(h) and 325bi(2) of the CRR, institutions must 
conduct a review of their overall risk management process at least once a year. 
According to Article 325bi(1)(e), institutions must have a documented set of internal 
policies in place for monitoring and ensuring compliance with the overall operation of 
their internal risk measurement models. Pursuant to Article 325bi(1)(c), the 
management body and senior management must be actively involved in the risk 
control process. To comply with those requirements in the context of an audit, the 
ECB expects the annual audit work plan and audit policies to be approved by the 
management body. Policies and processes for the production of audit reports and 

ECB guide to internal models – Market risk – CRR3 

301 

 
auditing techniques should also be documented and approved so as to ensure that 
the assessments are consistent. 

183.  Under Article 325bj(2)(a) of the CRR, institutions must validate any significant 

change made to their internal risk measurement models. In accordance with Article 
325bi(2)(d), institutions must independently review the validation of any change to 
the internal risk measurement model. The ECB considers it best practice to share 
the results of these validation and review activities with the competent authorities 
when applying for approval of the change. 

184.  According to Article 325bi(2)(d) of the CRR, the independent review must also focus 
on the accuracy and appropriateness of the risk measurement system. In the 
understanding of the ECB, this implies that the independent review should not only 
focus on the internal risk measurement models (e.g. ES, DRC), but also consider the 
overall risk measurement system (e.g. valuation models). 

ECB guide to internal models – Market risk – CRR3 

302 

 
Counterparty credit risk 

1 

Scope of the counterparty credit risk chapter 

1. 

2. 

3. 

The purpose of this chapter is to provide transparency on how the ECB understands 
a number of topics related to the principles defined for the Internal Model Method 
(IMM1, as referred to in Part Three, Title II, Chapter 6, Section 6 of the CRR). This 
chapter does not contain an exhaustive list of topics relevant for compliance with 
IMM requirements that could be subject to review during future internal model 
investigations.2 

In the understanding of the ECB and in order to comply with Article 6(1) of the CRR, 
all requirements of Part Three, Title II, Chapter 6, Section 6 must also be met by all 
legal entities that have approval to use the IMM for solo capital requirement 
calculations. This is especially important when underlying portfolios differ and the 
portfolio at consolidated level is not representative of that at the solo level. In 
particular, these requirements are relevant for stress period determination in 
accordance with Article 292(3) of the CRR and for all validation requirements when 
selecting, for example, relevant risk factors and synthetic portfolios for back-testing. 

The following sections are structured in the same manner and cover those issues 
relating to counterparty credit risk (CCR) for which the targeted review of internal 
models (TRIM) project was intended to ensure the consistent application of 
regulatory requirements. For each item the following apply. 

(a)  References are only made to the relevant CRR provisions that require more 

guidance. Other relevant provisions of the CRR are therefore not mentioned in 
the guide, but are not to be disregarded; this refers specifically to paragraphs 7, 
19, 32, 44, 49, 56, 61, 65, 70, 85, 86, 89 and 93 of this chapter. 

(b)  Principles are expressed following CRR requirements as they are understood 

by the ECB. 

(c)  Several sections of this chapter refer to Article 368 of the CRR, which is valid 

not only for the existing market risk IMA, but also for the IMM, due to 
Article 293(1)(a) making reference to the qualitative requirements set out in Part 
Three, Title IV, Chapter 5 of the CRR. Following the entry into force of Part 
Three, Title IV, as amended by CRR33, which implements the fundamental 
review of the trading book (FRTB) standards, the existing market risk IMA, 
including Article 368 of the CRR, will be replaced with the FRTB IMA. Under 
these rules, Article 325bi of the CRR will replace Article 368 of the CRR with 
regard to qualitative requirements. 

1    Note that the advanced method for the CVA capital requirement is not in scope here. 
2    A prominent example is data quality. 
3    See paragraph 6 of the foreword of this Guide. 

ECB guide to internal models – Counterparty credit risk 

303 

 
 
(i)  Article 293(1)(a) of the CRR is also expected to be changed, referring 

thereafter to Part Three, Title IV, Chapter 1b on qualitative requirements, 
which includes Article 325bi of the CRR.4 

(ii) 

In that case, all paragraphs of the CCR chapter of this guide referring to 
Article 368 of the CRR should be read as referring instead to Article 325bi 
of the CRR, which will have the same internal structure as Article 368 of 
the CRR.5 

(iii) 

In the understanding of the ECB, this change of references does not imply 
any content change for the IMM. 

2 

Trade coverage 

4. 

5. 

6. 

For the purposes of this section, “IMM transactions” are transactions for which the 
institution has approval to use the IMM to estimate the related exposure value. 

This section refers to transactions for which the institution does not have approval to 
use the IMM, and IMM transactions, for which the related exposure is not fully 
simulated in the IMM.6 

The section also addresses potential carve-outs of transactions from the IMM scope 
to a non-IMM method, for example due to price differences compared with 
benchmarking systems7, and the consequences of the potential creation of synthetic 
netting sets. 

4    Such a change would require a corrigendum given Article 1(196) of the CRR (due to amended 

Regulation 2024/1623 of 31 May 2024). If there is no change in Article 293(1)(a) of the CRR when the 
FTRB IMA becomes legally effective and if Article 368 of the CRR is deleted, then the ECB regards 
Article 325bi of the CRR as the successor of Article 368 for the purpose of Article 293(1)(a) of the CRR. 

5    For example, Article 368(1)(f) of the CRR (valid before the amended Regulation 2024/1623 of 31 May 
2024) corresponds to Article 325bi(1)(f) of the CRR (valid after the amended Regulation 2024/1623 of 
31 May 2024). 

6   

“Fully simulated” in this context means that, for each of the simulated market data paths with a joint 
dependency structure at the pre-defined grid points, a full revaluation of the transactions is performed. 
All material risk drivers of the valuation routine are simulated, and the pricing function is not 
approximated compared with the benchmarking system. 
7    See the definition in the counterparty credit risk abbreviations. 

ECB guide to internal models – Counterparty credit risk 

304 

 
 
2.1 

Relevant regulatory references 

Table 40 

Legal background 

CRR 

Other references 

Date of issue 

Article 

Paragraph/Point 

26/06/2013 

273 

283 

284 

293 

294 

(6) 

(1), (3) 

(1) 

(4) 

(1)(d), (l), (o) 

ECB Guide on options and discretions available in Union law 

28/03/2022 

Section II, Chapter 3, paragraph 8 

7. 

The regulatory provisions relating to the topic addressed in this section that require 
further guidance are the following. 

(a)  Articles 283(1) (permission to use the IMM) and 283(3) (sequential 

implementation of the IMM) of the CRR, further specified for banking 
supervision in Section II, Chapter 3, paragraph 8 of the ECB Guide on options 
and discretions available in Union law, form the basis for IMM approval. 

(b)  Article 273(6) of the CRR requires, for all methods in Part Three, Title II, 

Chapter 6, Sections 3 to 6 of the CRR (Articles 274 to 294), that the exposure 
value for a given counterparty is calculated as the sum of exposure values, 
calculated for each netting set with that counterparty. 

(c)  Article 294(1)(d) of the CRR requires that actions be taken to address the 

inaccuracy of the model if model validation indicates that the effective expected 
positive exposure (EEPE) is underestimated. 

(d)  Article 294(1)(l) of the CRR requires that pricing functions be tested against an 

appropriate independent benchmark. 

(e)  According to Article 294(1)(o) of the CRR, the initial and ongoing validation 

“shall assess whether or not the counterparty level and netting set exposure 
calculations … are appropriate”. 

(f)  According to Article 293(4) of the CRR, any “institution shall define criteria with 

which to assess its CCR exposure models and the models that input into the 
calculation of exposure and maintain a written policy that describes the process 
by which unacceptable performance will be identified and remedied”. 

(g)  Article 284(1) of the CRR requires that the exposure value at netting set level 

be calculated for those transactions where the institution has the permission to 
use the IMM in accordance with Article 283(1) of the CRR. 

(h)  Article 284(1)(a) of the CRR provides that the model used by the institution 

must “specify the forecasting distribution for changes in the market value of the 

ECB guide to internal models – Counterparty credit risk 

305 

 
 
 
 
 
 
 
 
 
netting set attributable to joint changes in relevant market variables, such as 
interest rates, foreign exchange rates”. 

(i)  Article 284(1)(b) of the CRR provides that the model used by the institution 

must “calculate the exposure value for the netting set at each of the future dates 
on the basis of the joint changes in the market variables”. 

2.2 

Principles of ECB banking supervision 

8. 

The CRR does not explicitly establish a requirement regarding how to handle netting 
sets in cases where transactions which the institution has general approval to treat 
with the IMM need to be carved out from the IMM to a non-IMM method for any 
reason. 

9.  With regard to the coverage of the IMM, institutions should comply with Section II, 

Chapter 3, paragraph 8 of the ECB Guide on options and discretions available in 
Union law, where the IMM coverage mentioned covers transactions treated under 
the method described in Part Three, Title II, Chapter 6, Section 6 of the CRR. 
Transactions treated under any non-IMM method are, however, excluded. In 
particular, transactions which are carved out from the IMM are excluded from the 
IMM coverage. 

10. 

11. 

12. 

For cases where, for a given legally enforceable netting agreement as defined in 
Part Three, Title II, Chapter 6, Section 7 of the CRR, one part of the transactions is 
treated under the method described in Section 6 (IMM) and another part is covered 
by one of the non-IMM methods8, the ECB considers, as a best practice, the creation 
of different synthetic netting sets, one per method. Hence, one synthetic netting set 
covers all the transactions under the IMM, and the other synthetic netting sets cover 
all the transactions under each non-IMM method (one per non-IMM method). 

It is the ECB’s understanding that synthetic netting sets created for the purposes 
described in paragraph 10 of this chapter should cover only transactions under the 
same contractual netting agreement; that is, Article 273(6) of the CRR (netting set-
specific application of any CCR method) is understood to apply also to synthetic 
netting sets. 

In relation to the requirement provided for by Article 294(1)(l) of the CRR9  and in 
accordance with Article 294(1)(d) of the CRR, it is the ECB’s understanding that 
institutions should implement a framework that enables them to identify significant 
pricing model deficiencies at transaction level. It is considered as best practice to 
apply at least the following filter criteria to ensure the consistent identification of such 
deficiencies (in accordance with Article 294(1)(o) of the CRR) when comparing the 
IMM transaction’s  𝑡0  value and the respective benchmark value: 

8    This implies that not all transactions covered by the contractual netting agreement are treated under 

the IMM. 

9    See paragraph 81 of this chapter with regard to how to detect value differences of transactions 

between the IMM and the benchmarking system. 

ECB guide to internal models – Counterparty credit risk 

306 

 
 
(a)  a threshold based on the absolute price difference; 

(b)  a threshold for differences expressed as a percentage of the notional amount; 

(c)  a threshold for differences expressed as a percentage of the absolute value of 

the respective benchmark. 

The institution should be able to justify the setting of the above filter criteria, which 
should be regularly validated and defined so that unacceptable model performance 
as set out in Article 293(4) of the CRR can be assessed, especially for pricing. 

13. 

The ECB considers that appropriate measures to address identified model 
weaknesses as referred to in the above assessment are as follows. 

(a)  A carve-out of transactions to one of the non-IMM methods, together with the 
creation of synthetic netting sets to remedy unacceptable performance of the 
CCR exposure model in accordance with Article 293(4) in conjunction with 
Article 294(1)(d) of the CRR. This is proposed provided that one of the identified 
price differences referred to in paragraph 12 of this chapter is observed for 
longer than the number of business days that is pre-defined by the institution for 
this case. The ECB considers it best practice that this number is limited to ten 
business days during the reference quarter. 

(b)  Measures other than carve-outs and the creation of synthetic netting sets that 
could be applied to address model deficiencies, provided that these other 
measures (i) can be justified, (ii) are regularly validated, and (iii) meet the 
purpose set out in Article 294(1)(d) of the CRR of not systematically 
underestimating exposure, in conjunction with the purpose of Article 293(4) of 
the CRR of identifying and remedying unacceptable exposure model 
performance. 

This includes, in the ECB’s understanding as further explained in paragraph 81 of 
this chapter, that institutions should take all necessary remediation actions to solve 
the root causes creating the most significant differences between the values of 
pricing functions used for revaluation under the IMM and the respective 
benchmarking value in a timely manner. 

14. 

For all transactions that have been identified according to the assessment described 
in paragraph 12 of this chapter and that remain in the IMM because they have not 
been carved out to address identified model weaknesses in accordance with 
paragraph 13(a) of this chapter, it is the ECB’s understanding that the differences 
between the  𝑡0  transaction values and the benchmarks as referred to in 
Article 294(1)(l) of the CRR should be taken into account. For such transactions, the 
ECB regards the following corrections as appropriate measures to remedy 
weaknesses in the exposure calculation as a result of pricing model deficiencies in 
accordance with Article 293(4) of the CRR. 

(a)  At  𝑡0, IMM transaction values are adjusted to match the respective benchmark 

value. 

ECB guide to internal models – Counterparty credit risk 

307 

 
15. 

16. 

17. 

(b)  At future grid points, an adjustment to the modelling of the transaction’s future 

values is applied in such a way that the EEPE of the netting set after correction 
is not lower than that without any correction. Rather than using the observed 
difference at  𝑡0, the correction could be estimated using more sophisticated 
methods, taking future market scenarios and amortising transactions into 
account. 

The corrections should be regularly validated (see paragraph 81(b) of this chapter). 

The ECB may see it as a violation of Article 292(1) CRR if the price differences as 
identified in accordance with paragraph 12 of this chapter (i) are persistent, (ii) do not 
lead to remediation of model deficiencies and (iii) lead to a systematic 
underestimation of exposure, In such cases, the ECB may consider supervisory 
measures regarding affected transaction types. 

In the ECB’s understanding, transactions carved out as a result, for example, of price 
differences with a benchmarking system should not be considered as contributing to 
the required IMM coverage explained in Section II, Chapter 3, paragraph 8 of the 
ECB Guide on options and discretions available in Union law. 

The ECB considers it best practice to perform a full simulation in accordance with 
paragraph 5 of this chapter for all IMM transactions to directly comply with the 
requirements of Article 284(1) of the CRR. In cases where this practice is not 
feasible, the ECB considers that the following approach would still be compliant with 
the CRR: 

(a) 

(b) 

if other (approximate) pricing methods are used, they should be subject to the 
validation requirements described in paragraphs 81 and 83(a) to 83(c) of this 
chapter; 

if any alternative way to calculate exposures10  is used, then the following points 
should be taken into account along with the validation requirements described 
in paragraphs 81 and 83(d) of this chapter. 

(i)  The institution should be able to demonstrate that the sole reason for using 
this exposure calculation method is pricing performance, or a performance 
issue related to calibrating certain transaction-specific risk factors. For 
example, including these transactions in a full simulation in accordance 
with paragraph 5 of this chapter would delay regulatory reporting by more 
than one business day. 

(ii)  Correlations with the other risk factors simulated in the CCR exposure 

model should be taken into account when calculating or calibrating such 
exposures. This would also hold in the case of new or aggregated risk 
factors only used for this exposure calculation method. 

10    Examples could be scenario-independent, pre-defined time profiles per transaction starting at the  𝑡0 

value, or scenario-independent, pre-defined value increases per transaction during MPOR, or new risk 
factors aggregated from those used in Article 284(1)(a) of the CRR with an own stochastic process. 

ECB guide to internal models – Counterparty credit risk 

308 

 
 
(iii)  The underlying risk factor simulation should account for the exposure time 
dependency, in particular for margined trading regarding the time grid point 
to which the margin period of risk (MPOR) is attached. 

(iv)  This exposure calculation method should account for potential trade-

related cash flows (CFs) during the MPOR, either directly or in such a way 
as to avoid systematic underestimation of the exposure. 

(v)  Pricing functions used for the purpose of calculating or calibrating the 

current exposure of affected transactions should be an explicit part of the 
IMM framework and governance. 

(vi)  The sum of the absolute  𝑡0  values of these transactions is below 20%11  of 
the total sum of absolute  𝑡0  values from all transactions covered by the 
IMM. 

3 

Margin period of risk and cash flows 

18. 

This section refers to the modelling of the MPOR12, including the following aspects. 

(a)  Treatment of margin call and trade-related CFs in all currencies. The trade-
related CFs include here both intermediary flows and the settlements at 
maturity related to trades, as well as flows in the form of a commodity or 
precious metal or any other asset that may be paid/received during the MPOR. 
Trade-related CFs paid by the institution to the counterparty result in upward 
jumps of the exposure time profile (hereinafter called “spikes”). 

(b)  Taking the default management process (DMP) into account when modelling 

CFs paid/received during the MPOR. The DMP refers to all legal and 
operational actions performed by the institution upon counterparty default 
before the institution stops paying margin call and trade-related CFs to the 
defaulted counterparty. 

(c) 

Interpolation techniques that may be applied to estimate the netting set market 
value at MPOR time points that do not belong to the simulation time grid used. 

(d)  Mapping between each time grid point t, for which EE(t) is calculated, and the 

associated MPOR.13 

(e)  Clarifying the term “most recent exchange of collateral” regarding the definition 

of the MPOR and thus specifying the point in time in the modelling when the 
MPOR starts. 

11    This percentage may decrease in the future. 
12    Note that the modelling of collateral is addressed in Section 4 of this chapter. 
13    Due to the small distance between the adjacent grid points (t), MPORs related to the two adjacent grid 

points may overlap. 

ECB guide to internal models – Counterparty credit risk 

309 

 
 
(f)  The concepts of “illiquid collateral”, of over-the-counter (OTC) derivatives that 
“cannot be easily replaced” in the context of “stressed market conditions”, and 
of “concentration” of transactions or securities in a particular counterparty. 

3.1 

Relevant regulatory references 

Table 41 

Legal background 

Date of issue 

Article 

Paragraph/Point 

CRR 

26/06/2013 

272 

284 

285 

289 

292 

294 

(9) 

(1), (4) 

(2), (3), (4), (5) 

(5) 

(1)(a), (b) 

(1)(g), (i) 

19. 

The regulatory provisions relating to the topic addressed in this section that require 
further guidance are the following. 

(a)  Article 292(1)(a) of the CRR, which requires the model to reflect transaction 
terms and specifications in a timely, complete and conservative fashion. 

(b)  Article 292(1)(b) of the CRR, which requires that netting agreements (including 
actions upon counterparty default or outstanding payments of the counterparty 
as part of netting arrangements) be reflected. 

(c)  Article 289(5) of the CRR, which notably provides that an “institution shall 

estimate EE daily, if necessary, unless it demonstrates to the satisfaction of its 
competent authorities that its exposures to CCR warrant less frequent 
calculation. The institution must estimate EE along a time profile of forecasting 
horizons that adequately reflects the time structure of future CFs and maturity of 
the contracts and in a manner that is consistent with the materiality and 
composition of the exposures”. 

(d)  Article 272(9) of the CRR, which provides a definition of the MPOR: “‘margin 
period of risk’ means the time period from the most recent exchange of 
collateral covering a netting set of transactions with a defaulting counterparty 
until the transactions are closed out and the resulting market risk is re-hedged”. 

(e)  Article 284(4) of the CRR, which specifies how to calculate the exposure value 
as the product of alpha times Effective EPE. The alpha parameter should equal 
1.4 unless the competent authorities require a higher alpha or permit institutions 
to use their own estimates in accordance with paragraph 9 of the same article. 

(f)  Article 294(1)(g) of the CRR, which notably requires, as part of the initial and 

ongoing validation of an institution’s CCR exposure model and risk measures, 

ECB guide to internal models – Counterparty credit risk 

310 

 
 
 
 
 
 
that the CCR exposure model includes transaction-specific information to 
capture the effects of margining in the model. 

(g)  Article 294(1)(i) of the CRR, which requires the back-testing of key assumptions 
of the CCR exposure model and the relevant risk measures. It is the ECB’s 
understanding that this provision to be complied with implies the use of 
“Brownian Bridge”-based interpolation for additional time grid points in the 
MPOR. 

(h)  According to Article 284(1)(b)of the CRR, the exposure value needs be 

calculated at the level of the netting set and the model shall “’calculate the 
exposure value for the netting set at each of the future dates on the basis of the 
joint changes in relevant market variables”. 

(i)  Article 285(2) to (5) of the CRR, relating to the exposure value for netting sets 

subject to a margin agreement, sets the length of the MPOR to not less than 
five business days for netting sets consisting only of repurchase transactions, 
securities or commodities lending or borrowing and margin lending transactions, 
and to not less than ten business days for all other netting sets. 

(j)  According to Article 284(4) of the CRR, the “model shall estimate EE at a series 

of future dates t1, t2, t3, etc.”. 

(k)  Article 285(3) of the CRR provides for two exceptions for the calculation of the 
MPOR for transactions subject to daily re-margining and mark-to-market 
valuation, namely (i) if the number of trades exceeds 5,000 at any point during a 
quarter, or (ii) if a netting set contains one or more trades involving either illiquid 
collateral or an over-the-counter derivative (OTC derivative) that cannot be 
easily replaced. In these two cases, the MPOR must not be less than 20 
business days. The provision provides for the following two obligations in this 
context. 

(i) 

Institutions must determine whether collateral is illiquid or whether OTC 
derivatives cannot be easily replaced in the context of stressed market 
conditions, characterised by the absence of continuously active markets 
where a counterparty would, within two days or fewer, obtain multiple price 
quotations that would, however, not move the market or represent a price 
reflecting a market discount for collateral or a premium for OTC 
derivatives. 

(ii) 

Institutions must also consider whether trades or securities it holds as 
collateral are concentrated in a particular counterparty and, if that 
counterparty exited the market precipitously, whether the institution would 
be able to replace those trades or securities. 

ECB guide to internal models – Counterparty credit risk 

311 

 
3.2 

Principles for ECB Banking Supervision 

20. 

The requirements of Articles 292(1)(a) and 289(5) of the CRR are also seen as being 
applicable to the modelling of exposure changes of margined trading within the 
MPOR. The term “margin arrangement”, as mentioned in Article 292(1)(b) of the 
CRR, is understood as comprising all contractual features, the margining mechanism 
with margin call triggers, grace periods and close-out provisions, which, according to 
Article 292(1)(a) of the CRR, must be reflected in the model. 

(a) 

In the view of the ECB, with regard to the modelling of margin call-related CFs 
within the MPOR, Article 272(9) of the CRR should be understood as requiring 
that none of these CFs be received from the counterparty after the beginning of 
the MPOR. As regards trade-related CFs, an institution may model to receive 
trade-related CFs after the beginning of the MPOR if it can justify that its 
assumptions are consistent with its modelling of the counterparty default time 
within the MPOR, its DMP and its assumptions regarding non-payment of 
CFs.14 

(b)  Furthermore, the counterparty is supposed to default at some point in time 
during the MPOR, and non-payment of trade-related CFs to the defaulting 
counterparty may be assumed to the extent that this assumption is consistent 
with: 

(i) 

(ii) 

the DMP and the features of enforceable settlement mechanisms 
(e.g. agreements to net CFs with related margin calls or analogues to the 
Continuous Linked Settlement system); 

the grace period and close-out requirements specified in the netting 
agreement, and in particular how the close-out is affected by paid or non-
paid CFs. 

It is considered best practice and cautious modelling (for example, given that 
watchlists of critical counterparties include only a subset of all potentially critical 
counterparties) that trade-related CFs from the institution to the counterparty 
that are due according to the underlying contract are assumed to be paid at 
least for a time period after the beginning of the MPOR corresponding to the re-
margining period. 

(c) 

If the institution has no defined DMP or the DMP is not taken into account in the 
modelling, all trade-related CFs due by the institution should be assumed to be 
paid to the counterparty during the whole MPOR. 

(d)  Regarding possible payments by any party which are due during the MPOR in 

line with the above points (a) to (c), in the view of the ECB, the same netting 
rules for trade-related CFs should be applied in both the margined and 
unmargined cases. Consequently, the following CF modelling within the MPOR 

14    While CFs are still modelled to be received from the counterparty, it should be assumed that CFs are 
also paid to the counterparty. Nevertheless, for the purpose of close-out netting under point (d)(i), 
further CFs from the counterparty can be assumed to be received at days where payments from the 
institution are modelled. 

ECB guide to internal models – Counterparty credit risk 

312 

 
 
is seen as best practice, beside modelling market price-driven changes as 
mentioned in paragraph 24 of this chapter: 

(i)  For all dates inside the MPOR, where payments from any party are due 
according to the modelling, netting set value changes resulting from any 
trade-related CFs that fall on one of the dates within the MPOR should be 
taken into account by applying the usual close-out netting rules of the 
agreement. Any resulting margin calls15  in favour of the counterparty may 
be assumed to be paid or withheld depending on (i) details of modelling of 
the default time, (ii) communication flows resulting from the DMP (if 
existing and applied in modelling) and (iii) contractual provisions such as 
grace periods. 

(ii) 

If a margin agreement allows margin-related CFs to be offset with trade-
related CFs falling on the same date or inside a contractually agreed time 
window within the re-margining period, the resulting net CF should 
substitute the value change identified in sub-point (i). 

(e)  A modelling different from the expected modelling described above showing 

discrepancies with the DMP could be accepted if it is shown that the 
quantitative impact of this approach on the EEPE is not material. 

21. 

If (i) an institution does not comply with the requirements of Articles 292(1)(a) and 
289(5) of the CRR as explained in paragraphs 20(a) to 20(d) above, and (ii) there is 
a material impact as referred to in paragraph 20(e) of this chapter, the ECB has the 
power to impose an appropriate and proportionate supervisory remediation measure, 
which can consist – as provided for by Article 284(4) of the CRR – in an increase of 
the alpha parameter. 

22.  MPOR modelling may require the estimation of netting set market values at time 

points that do not belong to the simulation time grid. It is the ECB’s understanding of 
Article 294(1)(g) of the CRR that interpolation/extrapolation techniques16  used by 
institutions to perform such estimations should be validated by studies showing that 
impacts on the EEPE, compared with full revaluation, are not material. 

23. 

In the view of the ECB, backward17  and forward18  modelling of the MPOR setting, as 
well as a mix of both19, can be considered CRR-compliant. In particular the following 
holds. 

(a)  Backward modelling approach: 

For time grid points t falling within the interval  [𝑡0, 𝑡0 + 𝑀𝑃𝑂𝑅], institutions 

15    This can be more than one if several days of the MPOR contribute to CF-induced netting set value 

changes. 

16    For example, a Brownian Bridge-based interpolation. 
17    In backward modelling, 𝐸𝐸(𝑡)  is calculated on the basis of the evolution of exposure (as a result of the 
evolution of transaction and collateral values) in the time interval  [𝑡 − 𝑀𝑃𝑂𝑅, 𝑡], where MPOR denotes 
the time length of the MPOR. 

18    In forward modelling,  𝐸𝐸(𝑡)  is calculated on the basis of the evolution of exposure in the time interval 

[𝑡, 𝑡 + 𝑀𝑃𝑂𝑅]. In this approach, the MPOR starts at t and ends at  𝑡 + 𝑀𝑃𝑂𝑅. 

19    This includes variants of attaching the MPOR to the  𝑡  of  𝐸𝐸(𝑡), where the  𝑡  is not at the border of the 

time interval set by the MPOR. 

ECB guide to internal models – Counterparty credit risk 

313 

 
 
should calculate expected exposure  𝐸𝐸(𝑡)  as required in Article 284(4) of the 
CRR by modelling joint changes in relevant market variables mentioned in 
Article 284(1)(b) of the CRR starting from  𝑡0, since Article 284(5) of the CRR 
defines this date as the earliest date for the calculation of exposure. 

(b)  Forward modelling approach: 

When using the forward modelling approach, institutions should calculate 
expected exposure  𝐸𝐸(𝑡)  as required by Article 284(4) of the CRR by taking 
into account close-out amounts that are determined after  𝑡  within the MPOR 
period as given by Article 285(2) to (5) of the CRR. This also applies when  𝑡 ∈
[1𝑦 − 𝑀𝑃𝑂𝑅, 1𝑦], i.e. for such a  𝑡,  𝑡 + 𝑀𝑃𝑂𝑅 ≥ 1𝑦  holds. 
Furthermore, if  𝑡  equals the maturity (𝑇), of the longest-lasting transaction in 
the netting set, and if no collateral is modelled as held by the institution at  𝑇  for 
a given scenario, the effective length of the MPOR may shorten, as no close-
out or re-hedging is due after maturity of the last transaction in the netting set. 

The ECB understands that the effective length of the MPOR for these grid points 
may be shortened and considers that this will not affect the formal length of the 
MPOR as provided for by Article 285(2) to (5) of the CRR. 

24. 

In the view of the ECB, the term “exchange of collateral” in Article 272(9) of the CRR 
means that the margin call has been issued and has a high probability of being 
completed, or is expected to be completed, even if the collateral called actually 
arrives only after the start of the MPOR. This understanding implies that the default 
time is not necessarily immediately at the start of the MPOR but could occur at a 
later point in time. For modelling purposes, it may still be assumed that collateral will 
be delivered for margin calls issued at the time the MPOR starts or earlier. 
Furthermore, this understanding implies that changes in value that arise after a 
margin call is issued and that affect both collateral and underlying transactions in the 
collateral agreement can happen within the full MPOR. 

25.  Where a netting set contains one or more trades involving either illiquid collateral or 

an OTC derivative that cannot be easily replaced, the ECB considers that the correct 
application of Article 285(3)(b) of the CRR should imply that the following items are 
defined and determined by each institution based on its portfolio and market data 
history: 

(a) 

illiquid collateral, which includes the collateral legs of securities financing 
transactions (SFTs); 

(b)  OTC derivatives that cannot be easily replaced (hereinafter referred to as “hard-

to-replace transactions”); 

(c) 

trades or securities that are held as collateral, concentrated in a particular 
counterparty; 

(d)  stressed market conditions. 

ECB guide to internal models – Counterparty credit risk 

314 

 
This means that institutions should implement processes to reliably identify the 
securities or transactions concerned and the related netting sets, and to monitor 
them. 

26. 

In establishing the definitions of the items mentioned in paragraph 25(a) to 25(c) 
above, along with the related processes, the ECB considers it best practice if an 
institution considers, for each counterparty, the following features and attributes of 
transactions and collateral, beside others, as possible determinants of illiquidity or 
concentration: 

(a)  For illiquid collateral and hard-to-replace transactions: 

(i)  product type, underlying asset(s) and complexity (e.g. path-dependent 
features, payoffs in different currencies or multiple underlyings, etc.)20; 

(ii)  accounting classification21; 

(iii)  clearing22; 

(iv)  currency; 

(v)  size/notional amount; 

(vi) 

time-to-maturity; 

(vii)  issuer concentration23; 

(viii)  frequency and depth of marking/market price observations; 

(ix) 

type(s)24  of underlying25; 

(x) 

liquidation cost.26 

(b)  For illiquid collateral in addition to point (a) above: 

(i) 

security type and categorisation as a “liquid asset” under Article 416 of the 
CRR; 

20    The ECB suggests that, when assessing complexity, institutions take into consideration the Final draft 

RTS on assessment methodology for IMA and significant share, in particular Article 7. 

21    The concept of “fair value hierarchy” in IFRS 13 may be one useful input for institutions’ definitions. 
22    For example, a transaction that is offered for central clearing and is therefore more standardised could 

be more liquid or easier to replace under stressed market conditions, even if the particular OTC 
derivative itself is not cleared but could be cleared because the institution has access to a CCP that 
offers the clearing possibility. 

23    Concentration relative to the market in which the institution trades, taking into account, for example, 

single equity stocks and bonds that have a significant share relative to the overall market capitalisation 
or issued volumes. 

24    For example, a basket of (different) securities in the collateral leg of an SFT or components of an index. 
25    Liquidity may be different for an option on a highly traded equity share (that is part of an index) than for 

a thinly traded equity share. 

26    For example, a quantitative indicator to measure market impacts of liquidating positions could be used. 

ECB guide to internal models – Counterparty credit risk 

315 

 
 
(ii) 

time period (number of business days) since the most recent market 
price27  was observed; 

(iii) 

issuer’s financial health (based, for instance, on its external rating and 
recent public information). 

(c)  For the concentration of transactions or of collateral in one counterparty: 

(i) 

(ii) 

for derivative transactions, the sensitivity to main risk factors (as defined by 
the institution), or the notional amount or mark-to-market value, whichever 
is more appropriate for the type of transaction; 

for a security that is part of an SFT or received variation margin, the 
notional amount or mark-to-market value of the security posted to the 
institution should be compared with the same security’s trading volume in 
the market; 

(iii) 

items (i) and (ii) should also take into account cases where the 
concentrated transaction or collateral might be hard to replace or illiquid 
under stressed market conditions. 

27. 

For the purpose of potential MPOR extensions, the illiquid collateral and hard-to-
replace transactions need to be identified under normal market conditions and under 
stressed market conditions. In order to derive conditions that characterise stressed 
market conditions as defined in Article 285(3) second sub-paragraph of the CRR, the 
ECB sees benefit in establishing processes and methodologies that: 

(a)  analyse the available market data history on a regular basis in order to identify 
historical events leading to conditions where the market for a certain derivative 
or collateral cannot be considered as continuously active; 

(b)  where relevant28, alternatively or additionally consider potential future situations 

that could affect the replaceability of transactions and/or the liquidity of 
collateral, in order to anticipate potentially reduced market depth and/or liquidity 
under future extreme but plausible economic scenarios based on justified 
expert opinions. 

28. 

For the purpose of paragraph 27 of this chapter, the ECB sees benefit in defining 
and determining conditions under which: 

(a)  no prices for collateral or the relevant transactions can be obtained; 

(b)  prices are unchanged (stale) for a number of consecutive days in markets 

where prices normally change more frequently; 

(c)  smaller (local) but usually active markets – where the institution has no chance 
to “sidestep” to another market – could be subject to market-specific stress 

27    The term “market price” refers to the price of an executed security transaction or a binding quote. 
28    This may refer in particular to situations where the historic evidence is scarce, missing or not sufficient 

to account for potential future situations or new markets. 

ECB guide to internal models – Counterparty credit risk 

316 

 
 
events that affect the replaceability of transactions and/or the liquidity of 
collateral traded on these markets. 

29. 

The ECB sees benefit in developing documented methodologies, including filter 
criteria, detailed identification of algorithms, etc., on the following: 

(a)  how to use the features and attributes mentioned in paragraph 26 of this 

chapter, in particular for assessing market liquidity and potential concentrations 
regarding transactions and collateral with a given counterparty; 

(b)  how historical events of market stress or reduced liquidity as mentioned in 

paragraph 27(a) of this chapter are identified to the extent historical analysis is 
used; 

(c)  how stressed market conditions can be anticipated from future extreme but 

plausible economic scenarios as mentioned in paragraph 27(b) of this chapter, 
using expert opinions; 

(d)  how available data (e.g. bid-offer spread, volatilities, sensitivities, traded market 
volumes, etc., including from external data sources) are taken into account, 
potentially complemented by expert judgement29, if necessary. 

In order to derive sound qualitative and quantitative criteria to determine hard-to-
replace transactions and illiquid collateral under stressed and non-stressed market 
conditions, these methodologies, as well as the list of features and attributes to be 
monitored to identify these transactions and collateral (which may go beyond those 
set out in paragraph 26 above) should be subject to internal validation. 

30. 

Finally, and independently from the issue of a potential MPOR extension, the ECB 
sees benefit in monitoring on an ongoing basis, from the overall institution’s portfolio 
perspective: 

(a) 

the size of hard-to-replace transactions and illiquid collateral; 

(b) 

the size of concentration in a single counterparty as set out in paragraph 26(c) 
above. 

4 

Collateral modelling 

31. 

This section deals with the modelling of cash and non-cash margin collateral, that is, 
its potential value changes from the time when the last margin call at the beginning 
of the MPOR is settled up to the end of the MPOR. Initial margin (IM) modelling is 
addressed in Section 5 of this chapter. 

29    For example, based on past experience or where no opinion from the trading desks is available. 

ECB guide to internal models – Counterparty credit risk 

317 

 
 
4.1 

Relevant regulatory references 

Table 42 

Legal background 

Date of issue 

Article 

Paragraph/Point 

CRR 

26/06/2013 

223, 224, 225, 226, 227 

285   

292 

(1), (6), (7) 

(1) 

32. 

The regulatory provisions relating to the topic addressed in this section that require 
further guidance are the following. 

(a)  Article 292(1) of the CRR requires an institution to ensure the integrity of its 
modelling process by reflecting, among other things, transaction terms and 
specifications, which also include margining arrangements. 

(b)  Article 285(1), (6) and (7) of the CRR clarifies the modelling options under 

which the effects of margining can be directly recognised in the exposure value 
calculation. 

(i)  Article 285(6) provides that if the internal model includes the effect of 

margining on changes in the market value of the netting set, an institution 
must model collateral, other than cash of the same currency as the 
exposure itself, jointly with the exposure in its exposure value calculations 
for OTC derivatives and securities-financing transactions. 

(ii)  The wording of Article 285(7)30  of the CRR leads to the conclusion that this 

article provides an exemption to Article 285(6) of the CRR in cases where 
an institution is not able to model collateral jointly with the exposure. In this 
case, and in accordance with Article 285(7) of the CRR, the institution is 
allowed to use volatility adjustments to recognise the effects of margining 
in the exposure calculation directly such that the institution does not have 
to apply one of the EEPE calculation measures presented in 
Article 285(1)(a) or (b) of the CRR. 

(c)  Article 285(7) of the CRR refers to the standards of the Financial Collateral 

Comprehensive Method (as set out in Article 223 of the CRR, which refers to 
Articles 224 to 227 of the CRR) in cases where an institution wants to make use 
of volatility adjustments to recognise the effect of margining directly in its 
exposure calculation. 

(d)  Article 223(1) third sub-paragraph of the CRR requires institutions to apply a 

volatility adjustment to reflect mismatches between the collateral currency and 

30    “If an institution is not able to model collateral jointly with the exposure [in accordance with 

Article 285(6) of the CRR] it shall not recognise […] the effect of collateral […], unless it uses […] 
volatility adjustments […].” 

ECB guide to internal models – Counterparty credit risk 

318 

 
 
 
 
 
 
 
 
the settlement currency for OTC derivative transactions covered by recognised 
netting agreements. 

4.2 

Principles for ECB Banking Supervision 

33. 

The ECB sees as a best practice that non-cash margin collateral is treated in a 
manner that is consistent with the modelling of securities underlying OTC or SFT 
transactions, provided that these transactions are within the scope of the IMM. For 
example, if a certain type of security is fully simulated (or if a volatility adjustment is 
applied) in the security leg of an SFT, then it should also be fully simulated (or a 
volatility adjustment should also be applied) if it occurs as margin collateral within the 
IMM. In the case of inconsistent treatment, the ECB sees it as beneficial that the 
institution is able to justify this choice and to demonstrate that (i) its approach does 
not systematically underestimate exposures and (ii) the quantitative impact on the 
final EEPE is not material. 

34. 

In order to comply with the requirements laid down by Article 292(1)(a) and (b) of the 
CRR with respect to the terms of margining and netting arrangements, the ECB is of 
the view that the future composition of the collateral pool over the lifetime of the 
netting set should reflect one or more of the following: 

(a) 

the contractual arrangements in terms of eligible margin collateral; 

(b) 

the institution’s policy as regards posted collateral types31  being eligible; 

(c) 

the composition observed historically32; 

(d)  at least the current composition of the margin collateral pool. 

This holds for the same or similar characteristics of these collateral types. 

35.  When a contractual margin agreement contains transactions treated under both the 

IMM and a non-IMM method and therefore the contractual netting set is split into 
different synthetic netting sets, and if collateral modelling uses the actual collateral 
balance at  𝑡0, the ECB considers that the actual margin collateral should be 
assigned to the synthetic netting sets. This should be done in a way that also reflects 
their respective current exposures, as defined in Article 272(17) of the CRR, and 
does not lead to double-counting of collateral. If the institution chooses a different 
approach (e.g. a full assignment of collateral to only one synthetic netting set), it 
should be able to justify this choice and demonstrate that its methodology does not 
systematically underestimate the resulting exposure values. 

31    This requires the institution to have a clear and well-documented policy further limiting the contractually 

eligible collateral to certain types of posted collateral. 

32    This includes the use of a historically observed composition of collateral for counterparties with a 

comparable behaviour in the case of new agreements, i.e. agreements with new counterparties without 
their own history in the institution. 

ECB guide to internal models – Counterparty credit risk 

319 

 
 
36. 

The ECB considers the use of the “model-estimated collateral balance at  𝑡0”33  to be 
compliant with Article 292(1)(b) of the CRR, if the resulting modelled collateral 
balance is regularly benchmarked against the actual collateral balance at  𝑡0  in 
accordance with Article 292(1)(g) of the CRR. In this case, validated but still relevant 
differences between model-estimated and actual  𝑡0  collateral balances should be 
taken into account in the modelling of  𝑡0  so that the exposure value is not 
systematically underestimated. Transactions that are potentially carved out from the 
IMM as well as collateral potentially not yet settled at  𝑡0  should also be taken into 
account. 

37. 

It can be inferred from Article 285(6) in conjunction with Article 285(7) of the CRR 
that, in order to directly capture the effects of margining in the calculation of 
exposure values, an institution can use either of the following: 

(a) 

the option of joint modelling (Article 285(6) of the CRR) for the modelling of all 
collateral; 

(b) 

the volatility adjustment option (Article 285(7) of the CRR) for the modelling of 
all collateral. 

38. 

The ECB is of the view that using both options at the same time would only be 
compliant with the above CRR articles if volatility adjustments for non-cash collateral 
were used and the joint modelling for the treatment of FX risk were applied in the 
collateral modelling only. In this context, the ECB considers it best practice that the 
above combination can only be made by using jointly modelled FX rates for all 
currencies that are simulated for the exposure calculation under the IMM. In other 
words, the ECB would not consider a partial application of FX volatility adjustments 
alongside jointly modelled FX rates for the purpose of collateral modelling as being 
consistent. 

39. 

In the context of Article 285(6) of the CRR, the ECB understands the provision “an 
institution shall model collateral … jointly with the exposure in its exposure value 
calculation” as requiring model integrity in accordance with Article 292(1)(a) and (b) 
of the CRR. This means in particular that: 

(a) 

the collateral value changes over time and during the MPOR are determined by 
using the same model as for the calculation of the transactions’ value changes; 

(b) 

the use of the same model refers to the IMM’s general modelling features 
(including simulated and non-simulated risk factors, the dependency structure, 
pricing functions, etc.), which should be used for both the calculation of the 
transactions’ value changes and the calculation of collateral value changes 
applying the same generated scenarios; 

(c) 

if some risk factors are not required for the calculation of the transactions’ value 
changes and are only used for the collateral modelling, these risk factors should 

33    That is, when the  𝑡0  collateral balance is estimated as a function of the calculated netting set value as 
of  𝑡0 – using IMM pricing functions and modelled features of the margin agreement – and is not set as 
being equal to the actual collateral balance. 

ECB guide to internal models – Counterparty credit risk 

320 

 
 
be modelled consistently with those for derivatives and SFTs within the scope of 
the IMM, also regarding the dependency structure. 

40.  Article 285(7) of the CRR provides that, if an institution is not able to model collateral 
jointly with the exposure, it may use volatility adjustments to recognise the effects of 
margining on the exposure itself, provided the institution complies with the 
requirements of the Financial Collateral Comprehensive Method as per Article 223 of 
the CRR. If an institution needs to apply volatility adjustments to recognise the 
effects of margining on the exposure itself, these adjustments must be applied to 
reflect currency mismatches in accordance with Article 223(1) third sub-paragraph of 
the CRR. In light of Article 220(2)(d) of the CRR, the ECB sees the identification of 
the currency that is potentially different from the collateral currency as described 
below as best practice: 

(a)  when Article 223(1) second sub-paragraph of the CRR uses the term “the 

currency in which the underlying exposure of the netting set is denominated”, 
and when Article 223(1) third sub-paragraph of the CRR (for OTC derivative 
transactions only) uses the term “settlement currency”, it is the currency as 
determined in (b); 

(b) 

it is the currency: 

(i)  agreed in the individual derivative contract if no netting has been agreed 

upon; or 

(ii)  of the relevant governing master netting agreement if agreed without a 

credit support annex; or 

(iii)  of the relevant credit support annex, if agreed; or 

(iv)  of the close-out amount if more than one credit support annex has been 

defined for one master netting agreement. 

41. 

The ECB recommends that, in order to comply with Article 292(1)(a) and (b) of the 
CRR for unmargined cases, and with Article 292(1)(a) and (b) in conjunction with 
Article 285(6) and (7) for margined cases, institutions take into account the potential 
FX risk arising from currency mismatches. The potential mismatches are between 
(i) any of the various currencies of the exposure components (e.g. various 
transactions with different currencies, collateral types with different currencies) and 
(ii) the currency in which the netting set’s total exposure is determined in the 
simulation (e.g. the currency of the governing master agreement as explained in 
paragraph 40 of this chapter). The ECB considers that potential FX risk is treated in 
compliance with Article 292(1)(a) and (b) of the CRR if either of the following is 
applied: 

(a)  simulation of FX rates for all exposure components at all relevant points in time; 

(b)  FX volatility adjustments in accordance with Article 223(1) of the CRR when 

making use of Article 285(7) of the CRR. 

ECB guide to internal models – Counterparty credit risk 

321 

 
42. 

It is the understanding of the ECB that any potentially remaining FX risk that arises 
from currency mismatches between (i) the currency in which the netting set’s 
exposure is determined in the simulation and (ii) the reporting currency should be 
taken into account in the institutions’ modelling process. The ECB considers the 
treatment of this potentially remaining FX risk to be compliant with Article 292(1)(a) 
and (b) of the CRR if institutions apply the simulated FX rates at the end of the 
MPOR.34 

5 

Modelling of initial margin 

43. 

IM is already applied in central clearing and currently carries over to bilateral OTC 
agreements. The modelling issue with respect to CCR is that the IM depends on the 
risk profile of the future netting set in terms of the levels and volatility of simulated 
market risk factors and on transactions still alive, i.e. it is a variable agreement 
parameter. 

To be clear, it should be specified that “IM modelling” refers here to the modelling of 
IM under the IMM and not, for example, to the implementation of European Market 
Infrastructure Regulation (EMIR)35  requirements in the institutions’ collateral 
management in terms of calculating an appropriate level of IM. 

5.1 

Relevant regulatory references 

Table 43 

Legal background 

Date of issue 

Article 

Paragraph/Point 

CRR 

26/06/2013 

292 

293 

(1)(b) and (g) 

(1)(b) 

44. 

The regulatory provisions relating to the topic addressed in this section that require 
further guidance are the following: 

(a)  Article 292(1)(b) of the CRR, which requires institutions to include, among other 

transaction terms, margining and netting arrangements in the model; 
Article 292(1)(g) of the CRR, which requires processes for formal reconciliation 
between the model and source data systems; 

(b)  Article 293(1)(b) of the CRR, which notably requires the comparison of risk 

measures generated by the model with realised risk measures. 

34    The additional use of simulated FX rates applies in particular to those cases where the currency as per 
Article 223(1) of the CRR differs from the reporting currency, but also to cases of joint modelling where, 
for example, the netting set’s currency and the collateral currency are different from each other and 
from the reporting currency. 

35    Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC 

derivatives, central counterparties and trade repositories. 

ECB guide to internal models – Counterparty credit risk 

322 

 
 
 
 
 
 
 
5.2 

Principles for ECB Banking Supervision 

45. 

46. 

In relation to the requirements set out in Article 292(1)(b) of the CRR, and for 
agreements subject to IM where both the transaction exposures and IM are within 
the scope of the IMM, the ECB considers it best practice that institutions have an IM 
modelling that adequately reflects contractual arrangements for the respective 
netting set.36  In particular, if contractual arrangements provide that the IM should 
reflect forward variability and maturing transactions37  inside netting set value 
changes relevant for the contractual IM method, the IMM modelling of the IM should 
take this feature into account unless the institution demonstrates that its choice for 
IM modelling inside the IMM does not systematically underestimate exposures. 

The ECB considers that, in order to avoid the risk of non-compliance with 
Articles 292(1)(b) and 293(1)(b) of the CRR, the level of the modelled IM at  𝑡0 
should be benchmarked on a regular basis against the respective real margin at  𝑡0 
in accordance with Article 292(1)(g) of the CRR. Validated but still relevant 
differences should be taken into account in the modelling (e.g. by using some 
corrective exposure level add-on if the modelling is not risk sensitive and/or may lead 
to non-conservative exposures). 

6 

Maturity 

47. 

48. 

This section refers to the estimation of the parameter M used in the calculation of the 
risk weight for counterparties, towards which the institution has an IMM exposure 
and for which the institution uses the IRB approach. 

The section also refers to the treatment of contingent transaction maturities, 
especially where there are early termination clauses (ETCs, also called break 
clauses) for derivatives and SFTs, and to different CRR interpretations. 

Note that transaction maturities (and their changes) affect (i) the M parameter of 
Article 162 of the CRR, (ii) the shape of the EE(t) time profile, and (iii) the maximum 
transaction maturity relevant for Article 284(6) of the CRR, where (i) affects the 
calculation of risk-weighted assets (RWAs) for IRB institutions and (ii) and (iii) affect 
the calculation of the EEPE and then (via the exposure value) also RWAs. 

36    In cases where IM agreements include discretionary or undisclosed elements, institutions are still 

expected to consider all contractual arrangements to the extent possible when modelling the IM within 
the IMM, potentially also taking the history of observed IMs into account. This includes potential 
information and assumptions for past IM amounts. 

37    A contractual IM specification includes IM changes resulting from newly contracted transactions, 

whereas the IMM modelling starts with the portfolio at  𝑡0  and then has a “melting down” portfolio, since 
the effect of new trades is modelled only through the EEPE. 

ECB guide to internal models – Counterparty credit risk 

323 

 
 
6.1 

Relevant regulatory references 

Table 44 

Legal background 

Date of issue 

Article 

Paragraph/Point 

CRR 

26/06/2013 

162 

284 

(4), (6) 

49. 

The regulatory provisions relating to the topic addressed in this section that require 
further guidance are the following: 

(a)  Article 162 (defining the maturity parameter M) and Article 284(4)38  and (6) 

(defining the remaining transaction maturity) of the CRR. Contingent transaction 
maturities and contractual arrangements for early termination are not mentioned 
in these articles. 

(b)  Paragraph 2(c) of Article 162 of the CRR (with provisions on fully or nearly-fully 

collateralised derivatives and margin lending transactions). 

(c)  Paragraph 3 of Article 162 of the CRR (with provisions on fully or nearly-fully 
collateralised derivatives and margin lending transactions and with provisions 
on SFTs). 

6.2 

Principles for ECB Banking Supervision 

50.  Article 162 of the CRR will be understood as outlined below for the exclusive 

purpose of applying the IMM as specified by Part Three, Title II, Chapter 6, Section 6 
of the CRR. In the ECB’s understanding, the paragraphs of this article should apply 
in the following way: 

(a) 

If the longest-dated contract in the netting set has a maturity of less than or 
equal to one year (i.e. paragraph (2)(g) does not apply): 

(i)  Paragraph (2)(a) should apply for those IMM transactions not in scope of 

paragraph (2), points (b) to (i), e.g. unmargined derivatives or SFTs not 
subject to a master netting agreement; 

(ii)  paragraph (2)(b) should apply to unmargined derivatives subject to a 
master netting agreement where M results in exactly 1y for IMM 
transactions; 

(iii)  paragraph (2)(c) should apply to fully or nearly fully collateralised 

derivatives or fully or nearly fully collateralised margin lending transactions 
subject to a master netting agreement, where the ECB regards notional 

38    Article 284(4) of the CRR stipulates: “The model shall estimate EE at a series of future dates t1, t2, t3, 

etc.” 

ECB guide to internal models – Counterparty credit risk 

324 

 
 
 
 
 
 
 
 
weighting as for paragraph (2), points (b), (d), (da) and (db) of the same 
article as best practice; 

(iv)  paragraph (2)(d) should apply to unmargined and margined SFTs 

(excluding margin lending transactions) subject to a master netting 
agreement; 

(v)  paragraph (2)(da) should apply to SFTs subject to a master netting 

agreement if they fall under Article 192(2) of the CRR regarding their 
margin frequency; 

(vi)  paragraph (2)(db) should apply to netting sets containing more than one of 
the transaction types referred to in paragraphs (2)(c), (2)(d) and (2)(da) of 
the same article, i.e. being mixed regarding these transaction types but all 
being subject to a common master netting agreement. 

(b) 

If the maturity of the transaction or the longest-dated contract within the netting 
set is greater than one year, paragraph (2)(g) should apply to all transactions in 
scope of the IMM, unless the conditions for applying paragraph (2)(i) are 
satisfied, then resulting in M equal to one year; 

(c) 

In the understanding of the ECB, for transactions for which the provisions of 
paragraph (3) of this article apply, M should be calculated in the following way: 

(i) 

(ii) 

If the longest-dated contract in the netting set has a maturity of one year or 
less, the weighting methodologies of paragraph (2) should be used to 
calculate the weighted average maturity of transactions of the netting set 
falling under any of its points (c), (d), (da), or (db), where, however, the 
one-day floor value of paragraph (3) of this article applies; 

If the maturity of the transaction or the longest-dated contract within the 
netting set is greater than one year, the weighting formula of 
paragraph (2)(g) will continue to apply, including the five-year cap, and the 
one-year cap value of paragraph (2)(i) will continue to apply if the 
conditions for applying point (i) are fulfilled, thus resulting in M equal to one 
year. 

51. 

The CRR is silent on the transaction maturity that should be considered for both the 
calculation of the EEPE and the calculation of the M parameter in the case of open 
term repos or, in general, SFTs without an explicitly fixed maturity. 

(a) 

If the institution has the right to terminate the transaction, in the ECB’s view the 
transaction maturity should be set at the higher of: 

(i) 

the contractually agreed first date on which the transaction can be 
terminated; 

(ii) 

the applicable MPOR. 

(b) 

If the institution does not have the right to terminate the transaction, the ECB 
considers that the transaction maturity should be given by the longest past 

ECB guide to internal models – Counterparty credit risk 

325 

 
lifetime of transactions with the same or comparable counterparties, subject to a 
five-year cap. 

52. 

For derivatives with ETCs: 

(a) 

it is seen by the ECB as best practice that non-mandatory ETCs are not used 
for the calculation of EE as used in Article 284(4) and (6) of the CRR, and of M, 
as provided for in Article 162(2) of the CRR (this article aims to deal only with a 
non-contingent maturity), unless the institution can demonstrate that non-
mandatory ETCs are regularly exercised based on an assessment of past 
exercise events. This can be the case: 

(i)  generally, i.e. it is possible to calibrate an expected exercise likelihood for 

non-mandatory ETCs jointly across all paths; or 

(ii)  subject to specific, pre-defined market conditions, which allow expected 

exercise events to be identified along a particular scenario path. 

(b) 

the ECB also considers it as compliant with Article 162(2) and (3) of the CRR to 
use mandatory ETCs for the calculation of EE and M instead of the contractual 
maturity, because there cannot be any positive exposure after that date due to 
the provisions of Article 284(4) of the CRR. However, the ECB would expect 
institutions to provide a legal opinion confirming the enforceability of the 
respective legal clauses. In particular, mandatory ETCs are part of the 
transaction terms that must be reflected in the model as required by 
Article 292(1)(a) and (b) of the CRR. 

53. 

Internal analyses by the institutions should be able to justify, as the case may be, 
choices of M values shorter than: 

• 

• 

five business days for netting sets consisting only of SFTs; 

ten business days for all other netting sets, including the derivative instruments 
listed in Annex II of the CRR. 

In accordance with Article 162(3) of the CRR, provisions for prompt liquidation need 
to be in place in order to use short M values. If these provisions are different for the 
M parameter referred to in Article 162 of the CRR than in the IMM exposure 
modelling of margined trading, the appropriateness of shorter close-out periods 
would also have to be demonstrated. 

54. 

The ECB sees it as best practice when the estimation of the maturity of physically 
settled options on derivatives (e.g. swaptions, used for the purpose of calculating the 
parameter M and for the calculation of the EEPE) is made on the basis of the 
maturity date of the underlying derivatives (e.g. the swap underlying the swaption), 
unless the institution is able to justify the use of a different maturity for specific 
products.39 

39    One example is when an underlying swap becomes subject to central clearing and thus the 

counterparty changes. 

ECB guide to internal models – Counterparty credit risk 

326 

 
 
7 

Granularity, number of time steps and scenarios 

55. 

This section refers to the chosen time grid for the future exposure calculation and the 
number of scenarios generated. More specifically: 

(a) 

the number and density of time grid points have an impact on the accuracy of 
EE profiles and thus also on the accuracy of the EEPE; 

(b) 

the number of scenarios and the type of random number generator determine 
the numerical accuracy of the calculations and thus the statistical error of 
expected exposures. 

7.1 

Relevant regulatory references 

Table 45 

Legal background 

Date of issue 

Article 

Paragraph/Point 

CRR 

26/06/2013 

284   

292 

293 

294 

368 

(4), (5), (6) 

(1)(a), (b) 

(1)(a), (c) 

(1) 

(1)(f) 

56. 

The regulatory provisions relating to the topic addressed in this section that require 
further guidance are the following. 

(a) 

In accordance with Article 292(1)(a) of the CRR, an institution must ensure that 
the model reflects transaction terms and specifications in a timely, complete and 
conservative fashion. Article 292(1)(b) of the CRR specifies that these terms 
must include at least the contract notional amounts, maturity, reference assets, 
margining arrangements and netting arrangements. However, it stays silent on 
the number of grid points necessary to take CFs resulting from these terms into 
account. 

(b) 

In accordance with Article 284(4) of the CRR, EE must be calculated for time 
grid points  𝑡𝑖 = 1, 2, 3, …  The output,  𝐸𝐸(𝑡𝑖), is used in the EEPE calculations 
(Article 284(5) and (6) of the CRR). 

(c)  Article 293(1)(c) of the CRR requires an institution to carry out initial and 

ongoing validation of its CCR exposure model. 

(d)  Article 294(1) states the requirements that need to be met by the institution’s 

validation programme. 

(e)  Article 368(1)(f) of the CRR (which is included in the reference to Part Three, 
Title IV, Chapter 5 of the CRR made by Article 293(1)(a) of the CRR) requires 

ECB guide to internal models – Counterparty credit risk 

327 

 
 
 
 
 
 
the internal model to have a proven track record of “reasonable accuracy” in 
measuring risks. 

7.2 

Principles for ECB Banking Supervision 

57.  Since the modelling process has to reflect transaction terms, as required by 

Article 292(1)(a) and (b) of the CRR, in the understanding of the ECB the density 
and location of grid points as defined in Article 284(4) of the CRR should capture 
intermediate and final trade-related CFs depending on notional amounts, maturities, 
etc. that influence the shape of the exposure profile. The ECB also considers that, if 
the EEPE calculated with a very dense time grid40  is more than 5% above41  the 
EEPE as calculated by the institution using its standard set of grid points under the 
standard configuration of the IMM for the whole portfolio, then the ECB can increase 
the alpha parameter following the process described in Section 12 of this chapter.42 
Institutions can conduct this impact assessment on representative sub-portfolios as 
defined in the Counterparty credit risk abbreviations. 

58. 

The ECB considers that the inclusion of the estimation and monitoring of the 
numerical error of the EEPE due to the number of scenarios in the regular validation 
programme mentioned in Articles 293(1)(c) and 294(1)(d) of the CRR complies with 
Article 368(1)(f) of the CRR requirements. If the numerical error43  is more than 5% of 
the EEPE for the whole portfolio, the ECB can increase the alpha parameter 
following the process described in Section 12 of this chapter.44  Institutions can 
conduct this impact assessment on representative sub-portfolios as defined in the 
Counterparty credit risk abbreviations. 

8 

Calibration frequency and stress calibration 

59. 

The calibration frequency is relevant both for regulatory reporting and for internal risk 
management (line consumption, etc.) as part of the use test requirements set by 
Article 289 of the CRR: 

(a) 

for Pillar 1 purposes, Article 292(2) of the CRR requires that the minimum 
quarterly frequency is increased to reflect (important) changes in market 
conditions; 

40    The expression “very dense time grid” means here a daily grid, unless the institution can show that all 

CFs are captured with a coarser time grid. 

41    However, the impact of any numerical error (see paragraph 58 of this chapter) could also be 
considered in order to avoid potential double counting if the institution can demonstrate a 
corresponding overlap. 

42    For example, if the difference is more than 5%, the alpha parameter could be increased by at least 

0.05, etc. 

43    See the Annex for a description of how to derive the statistical error at a 95% confidence level. 
44    For example, if the error is more than 5%, the alpha parameter could be increased by at least 0.05, etc. 

ECB guide to internal models – Counterparty credit risk 

328 

 
 
(b) 

for internal risk management purposes, the calibration frequency also affects 
the quality of exposure numbers used for the institution’s day-to-day risk 
management process. 

60. 

To compute own funds requirements for CCR, Article 284(3) of the CRR requires that 
institutions use two different calibrations: one based on current market data, and one 
based on a stress period. 

8.1 

Relevant regulatory references 

Table 46 

Legal background 

Date of issue 

Article 

Paragraph/Point 

CRR 

26/06/2013 

284 

289 

292 

(3)(b) 

(1), (4), (5) 

(2), (3), (4) 

61. 

The regulatory provisions relating to the topic addressed in this section that require 
further guidance are the following. 

(a)  Article 289(1) of the CRR requires among other things “that the distribution of 

exposures generated by the model used to calculate EEPE is closely integrated 
into the day-to-day CCR management process of the institution”,   

(b)  Article 289(4) of the CRR requires that institutions measure and manage 

current exposures;   

(c)  Article 289(5) requires institutions to have system capabilities to estimate EE 
daily if necessary, unless they can demonstrate to the satisfaction of their 
competent authorities that their exposures to CCR warrant less frequent 
calculation. 

(d) 

In accordance with Article 284(3)(b) of the CRR, institutions must compute the 
EEPE using a stress calibration. This provision should be read in the light of 
Article 292(2) of the CRR, which sets out the requirements of the stress 
calibration, and Article 292(3) of the CRR, which sets out the requirements for 
the stress period determination. 

(e) 

In accordance with Article 292(4) of the CRR, the EPE model must use data – 
implied or historical – that include the data from the stressed credit period and 
must use such data in a manner consistent with the method used for the 
calibration of the EPE model to current data.. 

ECB guide to internal models – Counterparty credit risk 

329 

 
 
 
 
 
 
8.2 

Principles for ECB Banking Supervision 

62. 

The ECB considers that Article 289(1) of the CRR should be understood as implying 
that the exposure distribution used for internal risk measurement in the day-to-day 
CCR management process is sufficiently up to date for daily line consumption 
calculations. Accordingly, the revaluation of current exposure45  for internal risk 
management purposes should also be performed on a daily basis in compliance with 
Article 289(4) and (5) of the CRR. The ECB regards a monthly or higher frequency 
for the recalibration of the parameters of the underlying stochastic processes (such 
as drift, volatility and correlation) for internal risk management as best practice to 
minimise the risk of non-compliance with Article 292(2) and Article 289(5) of the 
CRR, since an outdated calibration may no longer reflect market conditions or 
adequately reflect the exposure profile. 

63. 

The ECB considers the following to be compliant with Article 292(2) and (4) of the 
CRR: 

(a)  The ECB considers it best practice that parameters underlying the stochastic 

processes of the EPE model are calibrated with the data from the identified 
stress period (i.e. with the exact three years of data defining the stress period in 
the case of historical data) using the same estimation method that is applied for 
the current calibration. This comprises, in particular, the parameters needed for 
the simulation of market risk factors, the pricing of transactions and collateral 
valuation. It is expected that the adequacy of expert-set parameters for the 
identified stress period is assessed and, if applicable, their values are adjusted 
accordingly. 

(b)  The ECB would accept an alternative stress calibration method for parameters 

other than volatilities and correlations if the institution is able to demonstrate 
that its approach is consistent with its current calibration (for example, regarding 
the length of the calibration window or boundary conditions that need to be 
satisfied) and does not systematically underestimate exposures. 

9 

Use test 

64. 

This section refers to implementations of the IMM as used by internal risk 
management and calculation of the internal line consumption. 

45    Current exposure is the starting point at  𝑡0  for every EE time profile. 

ECB guide to internal models – Counterparty credit risk 

330 

 
 
9.1 

Relevant regulatory references 

Table 47 

Legal background 

Date of issue 

Article 

Paragraph/Point 

CRR 

26/06/2013 

289 

286 

(2) and (3) 

(4) to (6) 

65. 

The regulatory provisions relating to the topic addressed in this section that require 
further guidance are as follows. 

(a)  Article 289 of the CRR includes the following provisions. 

(i)  Paragraph (2) of this article requires that institutions demonstrate to the 

satisfaction of the competent authorities that they have been using a model 
to calculate the distribution of exposures upon which the EPE calculation is 
based that broadly meets the requirements set out in Section 6 of the CRR 
for at least one year prior to permission to use the IMM being granted by 
the competent authorities in accordance with Article 283 of the CRR. 

(ii)  Paragraph (3) of this article requires, among other things, that the model 

used to generate a distribution of exposures to CCR is part of the CCR 
management framework required by Article 286 of the CRR. 

(b)  Article 286 of the CRR includes the following provisions. 

(i)  Paragraph (4) of this article requires, among other things, that an 

institution’s management body and senior management are actively 
involved in, and ensure that adequate resources are allocated to, the 
management of CCR. It also requires that senior management is aware of 
the limitations and assumptions of the model used and the impact those 
limitations and assumptions can have on the reliability of the output 
through a formal process. 

(ii)  Paragraph (5) of this article requires that the daily reports prepared on an 
institution’s exposures to CCR in accordance with Article 287(2)(b) are 
reviewed by a level of management with sufficient seniority and authority to 
enforce both reductions in positions taken by individual credit managers or 
traders and reductions in the institution’s overall CCR exposure. 

(iii)  Paragraph (6) of this article requires, among other things, that an 

institution’s CCR management framework is used in conjunction with 
internal credit and trading limits, which need to be related to the 
institution’s risk measurement model in a manner that is consistent over 
time and that is well understood by credit managers, traders and senior 
management. 

66.  Articles 289(2) and 283(2) of the CRR are not explicit as to whether the same use 

test requirements that need to be applied for model approval should also be applied 

ECB guide to internal models – Counterparty credit risk 

331 

 
 
 
 
 
 
to model changes and extensions. It is the ECB’s understanding that the early 
implementation of these requirements would provide benefits in terms of model use 
and supervision, and that their implementation would be consistent with the rationale 
behind these articles. 

9.2 

Principles for ECB Banking Supervision 

67. 

In accordance with the aim of Article 289(2) of the CRR regarding the upfront use of 
a new model, the ECB considers it best practice for an institution to start by applying 
the envisaged model changes or extensions for internal risk management purposes 
to acquire sufficient experience with the change or extension before it is fully 
implemented. This would apply in cases where the change or extension needs to be 
investigated as set out in the ECB Guide on materiality assessment (EGMA).46  The 
institution should determine the most appropriate upfront use of the model changes 
or extensions in order to acquire sufficient experience, taking into consideration its 
situation and the nature of the extension or change. The ECB has identified the 
following possible ways for an institution to make appropriate upfront use of the 
model changes and extensions and also to test Pillar 1 own funds requirements: 

(a) 

implement the extension in the live production environment47  used to calculate 
limit utilisation for internal risk management on a daily basis; or 

(b) 

implement the change or extension in a non-live production environment48, 
where weekly49  test runs are recommended in the cases (a)-(d) identified in 
paragraph 68 of this chapter and during the period between implementation and 
the sending of the application letter, as well as for the time between the 
notification of the internal model investigation starting date and the end of the 
onsite phase of the investigation. Within both periods, the test runs should in 
general be performed without interruption. It is further recommended that the 
institution: 

(i)  uses the test results to calibrate and document limits that might need an 

update; 

(ii) 

identifies and plans the necessary steps for the updated limits to become 
effective as soon as the supervisory approval envisaged in the EGMA for 
the planned change or extension is obtained; 

(iii)  plans all other processes and controls outlined in Article 289 of the CRR 
that are to be applied after the permission, in particular ensuring IT 
performance regarding the calculation frequency. 

46    ECB Guide on materiality assessment (EGMA) – Materiality assessment for IMM and ACVA model 

extensions and changes. 

47    See paragraph 121 of the chapter on credit risk. 
48    As defined in paragraph 121 of the chapter on credit risk. 
49    A higher run frequency than weekly is not excluded. 

ECB guide to internal models – Counterparty credit risk 

332 

 
 
The implementation should be done in such a way that the institution gains sufficient 
understanding of the intended changes or extensions to its model and its outputs, for 
instance by providing relevant figures for information purposes in addition to the 
relevant figures from the model in production for Pillar 1 own fund requirements. 

68. 

The practices set out in paragraph 67 above are recommended for all model 
extensions. In the event of model changes, they are only recommended in the 
following cases: 

(a)  changes in exposure levels (e.g. due to changes in risk factor forecasting, 

capturing of margining effects or collateral modelling); 

(b)  changes of data management/supply (e.g. due to changes of input data or data 
sources including the use of additional data/data sources or changes of the 
data quality control processes); 

(c)  significant IT system changes (including software changes); 

(d)  changes in regular quantitative validation that have a quantitative impact on 

how the institution assesses the integrity of the IMM. 

If an extension or a change affecting any of the above items (a) to (d) is classified as 
“to be investigated” by the EGMA, this upfront implementation should be completed 
within a sufficient time (recommended to be at least three months or two months if 
more than one test run is carried out per week) before the date of the application 
letter. 

Where the institution notifies ex ante an extension or a change affecting any of the 
above items (a) to (d), the ECB recommends that the institution completes the 
upfront implementation at least one month before the date of the notification letter if 
there is a considerable impact on limit utilisation for certain transactions, netting sets 
or counterparties that are particularly affected by the change or extension owing to 
its nature. 

It is noted that institutions may choose different time periods for an upfront 
implementation, provided that the institution is able to reliably demonstrate that such 
periods (if shorter) being still significantly ahead of sending the application or 
notification letter will not limit the validity of the results of the upfront implementation, 
especially in terms of calibrating limits; if institutions wish to do this, it is 
recommended that they discuss the matter with the JST. 

Article 286(4) to (6) of the CRR (to which Article 289(3) refers) requires in general 
that the institution’s management and senior management are actively involved in 
the management of the CCR model. The ECB considers that as well as being 
involved in the upfront use of a changed or extended model, the management and 
senior management should also be involved in approving any limit change resulting 
from the prior implementation of an IMM model change or extension in the live 
production environment as envisaged in paragraph 67(a) above, or any limit change 
or extension expected to result from the tests in the non-live production environment 
as envisaged in paragraph 67(b) above. 

ECB guide to internal models – Counterparty credit risk 

333 

 
10 

Validation 

69. 

This section refers to the validation framework set up by institutions to assess the 
performance of the CCR exposure model, in particular back-testing methodologies, 
the validation of pricing functions and further checks on key modelling assumptions. 

10.1 

Relevant regulatory references 

Table 48 

Legal background 

Date of issue 

Article 

Paragraph/Point 

CRR 

26/06/2013 

287 

292   

293   

294 

(2) 

(1)(a), (b), (g), (6)(a) 

(1)(b), (c), (4) 

(1)(c), (d), (e), (g), (h), (i), (j), (l), (o) 

70. 

The regulatory provisions relating to the topic addressed in this section that require 
further guidance are as follows. 

(a)  Article 287(2) of the CRR states that the risk control unit is expected to be 

responsible for the initial and ongoing validation of the model. Furthermore, 
Article 293(1)(c) of the CRR provides that the validation and review must be 
conducted independently of model development, which needs to be reconciled 
with Article 287(2) of the CRR given that model development is usually also 
done within the risk control unit. 

(b)  Article 293(4) of the CRR requires, among other things, that institutions 

“maintain a written policy that describes the process by which unacceptable 
performance will be identified and remedied”. 

(c)  According to Article 292(6)(a) of the CRR, “an institution shall subject the model 
to a validation process that specifies the kind of testing needed to ensure model 
integrity and identify conditions under which the assumptions underlying the 
model are inappropriate and therefore result in an understatement of EPE”. 

(d)  Article 293(1)(b) of the CRR requires institutions to conduct “a regular 

programme of back-testing”. 

(e)  Regarding the requirements laid out with respect to back-testing levels50  and 
methodologies, Article 294(1)(c) of the CRR provides that “an institution shall 
back-test the performance of its CCR exposure model and the model’s relevant 
risk measures as well as market risk factor predictions”. Article 294(1)(h) of the 
CRR requires the model validation process to “include static, historical back-
testing on representative counterparty portfolios that are actual or hypothetical”. 

50    Back-testing levels refer to the risk factor level, the transaction level, and the actual and/or hypothetical 

portfolio level. 

ECB guide to internal models – Counterparty credit risk 

334 

 
 
 
 
 
 
 
According to Article 294(1)(i) and (j) of the CRR, “back-testing shall be designed 
to test the relevant risk measures” and furthermore “be appropriate and capable 
of identifying poor performance in an EPE model’s risk measure”. 

(f)  Article 294(1)(g) of the CRR states that “as part of the initial and ongoing 

validation of its CCR exposure model and its risk measures, an institution shall 
ensure that the CCR exposure model includes transaction-specific information 
to capture the effects of margining”. 

(g)  Article 292(1)(a) of the CRR requires that the model reflect transaction terms 
and specifications in a timely, complete and conservative fashion (also 
regarding pricing and the market data to be used). Article 292(1)(b) of the CRR 
specifies that those terms include, at least, notional amounts, maturity, 
reference assets, margining arrangements and netting arrangements. 
Article 292(1)(g) of the CRR requires ongoing processes for reconciliation 
between the model and source data, which verify that transaction terms and 
specifications are reflected correctly or at least conservatively. 

(h)  Article 294(1)(e) of the CRR provides that, as part of the initial and ongoing 

validation process, an institution “shall test the pricing models used to calculate 
CCR exposure for a given scenario of future shocks to market risk factors”, as 
well as regularly testing these pricing models against appropriate independent 
benchmarks in accordance with Article 294(1)(l) of the CRR. 

(i)  As outlined in Article 294(1)(o) of the CRR, “the initial and ongoing validation of 

CCR exposure models shall assess whether or not the counterparty level and 
netting set exposure calculations of exposure are appropriate”. Article 294(1)(d) 
of the CRR provides that “if the model validation indicates that EEPE is 
underestimated, the institution shall take the action necessary to address the 
inaccuracy of the model”. Both requirements are set out in a general way and 
therefore need further guidance. 

(j)  Article 292(1)(a) of the CRR requires the model to reflect transaction terms 

which must be ensured by formal reconciliation processes between the model 
and source data in accordance with point (g) of the same article. 

10.2 

Principles for ECB Banking Supervision 

71. 

In accordance with Article 293(1)(c) of the CRR, model validation/review and model 
development must be conducted independently, that is, the validation function as 
defined in the abbreviations must be effectively separated from model development. 
Hence, the ECB considers that for cases where certain parts of the validation 
framework, e.g. back-testing or the benchmarking of IMM pricing functions, are 
conducted by staff also responsible for model design and development, the above-
mentioned requirement could still be observed with the implementation of the 
following practices: 

ECB guide to internal models – Counterparty credit risk 

335 

 
(a)  a regular, independent and effective challenging of the underlying 

methodological aspects of the respective validation task comprising at least 
scope, data samples, tools/statistical tests (including, if applicable, test statistics 
and thresholds51  in use) is performed by the validation function; 

(b) 

the assessment of the outcomes of the analysis (e.g. the evaluation of back-
testing traffic lights or pricing deficiencies detected in the benchmarking) and 
the judgement regarding the respective remediation measures are reviewed by 
the validation function, which may require further analyses and/or changes to 
the actions concerned. 

Moreover, the ECB considers that the organisational requirements of the risk control 
unit (see Article 287(2) of the CRR) should be regarded as fulfilled when (part of) the 
initial or ongoing validation of the model is conducted by staff not belonging directly 
to the risk control unit, but for instance to a separate validation unit.52 

As part of the process by which unacceptable performance will be identified and 
remedied in accordance with Article 293(4) of the CRR, the ECB considers it best 
practice that a comprehensive view of all the findings, problems, weaknesses and 
limits of the exposure model, identified by all staff contributing to the validation and 
review of the exposure model, is ensured. 

72. 

The validation framework is expected to cover the kind of testing needed to ensure 
model integrity and the appropriateness of assumptions underlying the model in 
accordance with Article 292(6)(a) of the CRR. The ECB considers it best practice to 
include various types of analyses on the key modelling assumptions in a regular 
validation schedule. In particular, it is the ECB’s understanding that the key 
modelling assumptions contain: 

(a) 

the grid point setting; 

(b) 

the chosen stochastic processes53; 

(c) 

the Monte Carlo error of the EEPE (see paragraph 58 of this chapter); 

(d)  expert-set parameters and boundaries in use (such as caps and floors for risk 

factor paths); 

(e)  all pricing functions used in the IMM; 

(f)  modelling features regarding margining, i.e. the MPOR setting, agreement-

dependent variation margin and IM mechanisms and the modelling of collateral 
value changes during the MPOR. 

51    This refers, for example, to thresholds used for back-testing traffic lights or for the benchmarking of 

pricing functions. 

52    Please refer to Section 7 of the chapter on overarching principles for internal models regarding the 

principle that the internal audit function should not be responsible for validation. 

53    At least in the event of poor back-testing results, the chosen stochastic processes should be thoroughly 

challenged. 

ECB guide to internal models – Counterparty credit risk 

336 

 
 
73. 

74. 

In order to comply with Article 293(1)(b) of the CRR, the ECB sees it as best practice 
if back-testing is performed and reported on at least once a year. 

In accordance with Article 294(1)(c) of the CRR, back-testing at risk factor level is 
mandatory. In the ECB’s view, not all key assumptions of the CCR exposure model 
(mentioned in Article 294(1)(i) of the CRR) can be captured when back-testing is only 
conducted on hypothetical portfolios, in particular when considering non-plain vanilla 
transactions or margined netting sets. Hence, in the light of Article 294(1)(h) of the 
CRR, the ECB regards back-testing at both actual and hypothetical portfolio level as 
best practice. 

75. 

In order to support the analysis of portfolio back-testing and mitigate the risk of 
breaching Article 294(1)(e) and (i) of the CRR, it is recommended and seen as best 
practice to include back-testing at single transaction level in the regular framework. 

76.  According to Article 294(1)(h) of the CRR, back-testing samples54  must be 

representative and chosen on the basis of their sensitivity to material risk factors as 
well as their combinations. As stated in point (j) of the same paragraph in Article 294, 
the institution’s back-testing programme must be capable of identifying poor 
performance of an EPE model’s risk measures. As a result, the ECB considers that 
back-testing samples should allow for a meaningful assessment of the CCR 
exposure model and that institutions should ensure a comprehensive coverage of 
their back-testing framework by calculating back-testing coverage ratios (i.e. shares 
of back-tested risk factors or portfolios), at least at risk factor and, if applicable, at 
actual portfolio level. In particular: 

(a)  next to a simple number-based55  approach, institutions should take into 

account different weighting schemes like sensitivities and exposure metrics; 

(b)  at risk factor level, in addition to the full risk factor set56, coverage ratios should 

also be calculated by asset class57; 

(c) 

institutions should be able to provide an explanation justifying the level of the 
respective coverage ratio. 

Such coverage ratios should form part of the back-testing reports to ensure that the 
scope of the back-testing is transparent. 

Furthermore, it is the ECB’s understanding that, if SFTs are within the IMM scope, 
their inclusion in the back-testing samples is compliant with the representativeness 
requirements stated in Article 294(1)(h) of the CRR. 

54    This refers to samples comprising the subset of risk factors, transactions or portfolios, including margin 

agreements used for the purpose of back-testing. 

55    This means, for example, the number of risk factors, the number of portfolios that are covered, etc. 
56    Note that the set of risk factors should include all underlying risk factors/drivers that are integrated into 
the IMM exposure model (not differentiating between whether risk factors are directly or implicitly 
diffused). 

57    It should be noted that for a sensitivity-based approach, coverage ratios by asset class only (such as 

interest rate, foreign exchange, equity, etc.) are sufficient. 

ECB guide to internal models – Counterparty credit risk 

337 

 
 
77. 

The ECB considers that statistical tests used for back-testing should be adapted 
when back-testing samples contain forecasts over fully or partially overlapping time 
periods58  (compared with standard versions of statistical tools applicable for the 
case of non-overlapping forecasts) to account for dependencies in the sample and 
therefore serve as a proper indicator of the model performance. In the view of the 
ECB, this practice would avoid the risk of being in breach of Article 294(1)(j) of the 
CRR. 

78.  Where back-testing relies only on IMM pricing functions for both predictions and 

realisations (i.e. realised prices derived from benchmarking systems are not taken 
into account), the attention given to the assessment of the adequacy of IMM pricing 
functions (as provided for by Article 294(1)(e) and (l) of the CRR) is seen to be even 
more important. Consequently, in the view of the ECB, institutions should strengthen 
their validation/review of IMM pricing functions accordingly. 

79. 

80. 

In order to ensure appropriate back-testing practices as required by Article 294(1)(j) 
of the CRR, the ECB sees it as best practice to pay special attention to the 
consistency of predictions and realisations in the case of actual portfolio back-
testing; in other words, changes of the portfolio composition during the observation 
period (e.g. due to new or closed-out transactions) should be handled accordingly. 

In accordance with Article 294(1)(c), (e) and (g) of the CRR as understood by the 
ECB in paragraphs 74 and 75 of this chapter, the ECB sees benefit in back-testing 
different relevant risk measures, including the market value59  at transaction level, the 
market value of netting sets60  as well as the exposure61  at netting set level. 

(a)  Market value corrections resulting from the application of paragraph 14 of this 
chapter are considered to be part of the IMM and should hence be reflected in 
the back-testing framework. Therefore, such corrections should be taken into 
account when performing back-testing both on the level of predictions and on 
the level of realisations, if the latter are calculated using the IMM pricing 
functions. Regarding predictions, the ECB considers it best practice for an 
institution to complement this approach with an additional back-testing run that 
does not take into account the market value corrections in the predictions. 
Regarding realisations, either the market value with correction or the market 
value coming directly from a benchmarking system can be used. In cases 
where the comparison of these back-testing runs shows significantly different 
results, the institution should investigate the root cause of these differences to 
support the validation of the market value corrections. 

(b) 

If direct back-testing of the exposure of margined netting sets is not feasible, 
institutions should have a separate validation of the margining process, of 

58    For instance, distinct variables over the same forecasting period are tested simultaneously or tests are 

built on a single variable and different successive but overlapping observation periods. 

59    Market values can be either positive or negative. 
60    This means the sum of all transaction market values within that netting set. This sum can be positive or 

negative. 

61    Exposure should always take into account the collateral balance and the margin mechanism. In the 

case of unmargined netting sets, the collateral is zero. Combining the provisions of Article 272(14) and 
(17) of the CRR, exposure is understood as an inherently non-negative value. 

ECB guide to internal models – Counterparty credit risk 

338 

 
 
collateral value changes and of netting set market value changes over the 
relevant time horizons. 

81. 

In order to reduce the risk of breaching Article 292(1)(a) and (g) of the CRR and 
based on the requirements of Article 294(1)(l) of the CRR, institutions should 
compare the values of pricing functions used for revaluation under the IMM with 
values from a benchmarking system on a regular basis. 

(a)  The ECB understands Article 294(1)(o) of the CRR as requiring a validation of 
the identification process for significant price differences (see paragraph 12 of 
this chapter) as well as a corresponding full analysis of these differences and 
their root causes. 

(b)  The action taken to address the inaccuracy of the model in accordance with 

Article 294(1)(d) of the CRR, including price corrections also for future grid 
points in accordance with paragraph 14, should be validated.62 

82. 

The ECB considers it compliant with Article 292(1)(b) and (g) of the CRR when the 
following benchmark comparisons are conducted: 

(a)  The model-estimated collateral balance at  𝑡0  is benchmarked against the 

actual collateral balance at  𝑡0, if applicable (see paragraph 36 of this chapter). 

(b) 

Institutions benchmark the IM (see paragraph 46 of this chapter). 

A full analysis of the differences detected, their root causes and the action taken to 
address the inaccuracy of the model should be conducted regularly in order to 
reduce the risk of breaching Article 294(1)(d) and (o) of the CRR. 

83. 

For the purposes of Article 294(1)(e), (l) and (o) of the CRR, in accordance with the 
understanding of the ECB described in paragraph 17 and in addition to paragraph 81 
of this chapter, the ECB considers it best practice that institutions assess the 
following within their validation framework. 

(a)  Whether deviations from a full simulation63  are documented and justified. 

(b)  Whether the effect of using approximated pricing functions instead of those 

from any reliable benchmarking system is not significant. 

(c)  Whether, for all approximated pricing functions, the value changes due to risk 

factor changes occurring in IMM simulated paths are reliable compared with 
value changes from non-approximated pricing functions (from any reliable 
benchmarking system) for the same transaction type. 

(d) 

If any alternative way to calculate exposures is used, the ECB considers that 
the items mentioned in paragraph 17(b) of this chapter should also be met. 
Furthermore, validation should ensure that the respective methods are applied 
in a way that does not lead to a systematic underestimation of exposures 

62    The validation for future grid points may consider market data scenarios deviating significantly from  𝑡0 

and potential changes in sign and absolute value of the detected price difference. 

63    As described in paragraph 5 of this chapter. 

ECB guide to internal models – Counterparty credit risk 

339 

 
 
compared with the full simulation (as described in paragraph 5 of this chapter) 
for the transactions affected. 

In the ECB’s understanding, transactions treated with alternative exposure 
calculation methods should also be included in the back-testing framework. In 
order to fulfil the requirements of Article 294(1)(o) of the CRR, the ECB sees it 
as beneficial to also analyse affected transactions separately rather than mixing 
effects when back-testing is only conducted at actual portfolio level. 

In addition, the netting benefits (numerical impact) when using any type of 
alternative method to calculate exposures in the IMM should be assessed by 
comparing the resulting exposure with those obtained after: 

(i) 

splitting the transactions into synthetic netting sets differentiating between 
transactions treated using the “standard” IMM calculation and those where 
exposures are calculated in an alternative way; 

(ii)  carving-out the affected transactions into a standardised method. 

11 

Effective expected positive exposure 

84. 

This section refers to the normalisation of the weights  ∆𝑡𝑘  that are used in the 
calculation formula for the EEPE. 

11.1 

Relevant regulatory references 

Table 49 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

26/06/201364 

284 

(6) 

85. 

86. 

The regulatory provision relating to the topic addressed in this section that requires 
further guidance is the calculation formula for the EEPE, which appears in 
Article 284(6) of the CRR. 

The corrigendum of 25 January 2017 amends the formula in Article 284(6) of the 
CRR by dividing the weighted sum of the Effective EEs by the applicable time 
horizon (1 year or the maturity of the longest-dated transaction belonging to a netting 
set if this is below 1 year): 

𝐸𝑓𝑓𝑒𝑐𝑡𝑖𝑣𝑒 𝐸𝑃𝐸 =

1
𝑚𝑖𝑛{1 𝑦𝑒𝑎𝑟, 𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦}

∙

𝑚𝑖𝑛{1 𝑦𝑒𝑎𝑟,𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦}

∑

𝑘=1

𝐸𝑓𝑓𝑒𝑐𝑡𝑖𝑣𝑒 𝐸𝐸𝑡𝑘∆𝑡𝑘

64    See corrigendum to the CRR of 25 January 2017. 

ECB guide to internal models – Counterparty credit risk 

340 

 
 
 
 
 
 
  
 
However, the units of the weights  ∆𝑡𝑘  and  𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦  still need to be defined. 

11.2 

Principles for ECB Banking Supervision 

87. 

In the understanding of the ECB, Article 284(6) of the CRR should be understood as 
requiring that the weights  ∆𝑡𝑘  and the parameter  𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦  are expressed in units of 
one year. 

12 

Alpha parameter 

88. 

The alpha multiplier affects all netting sets and thus all counterparties and should be 
considered as intending to capture extra risk arising, for example, from the fact that 
exposures are correlated with credit drivers (e.g. PD, LGD) and to address general 
deficiencies in the IMM framework. Alpha is the only parameter besides capital 
buffers that can be increased explicitly to account for such deficiencies. 

12.1 

Relevant regulatory references 

Table 50 

Legal background 

Date of issue 

Article 

Paragraph/Point 

CRR 

26/06/2013 

284 

293 

(4) 

(1), (2) 

89. 

The regulatory provisions relating to the topic addressed in this section that require 
further guidance are the following: 

(a)  Article 284(4) of the CRR defines the exposure value as the product of alpha 

and the EEPE with “α = 1.4, unless competent authorities require a higher α or 
permit institutions to use their own estimates in accordance with paragraph 9 [of 
Article 284 of the CRR]”; 

(b)  Article 293(2) of the CRR, based on Article 284(4) of the CRR, links the level65 
of the supervisory alpha setting to the degree with which the institution meets 
the requirements for the risk management system as set out in Article 293(1) of 
the CRR; 

(c)  Article 293(1) of the CRR refers in particular to overall validation, adequate 

processes, integration into the day-to-day risk management process and limit 
utilisation (use test), documentation and independent reviews. 

65    This refers to levels higher than the floor value of 1.4 for the non-modelled and 1.2 for the modelled 

alpha parameter in accordance with Article 284(4) and (9) of the CRR. 

ECB guide to internal models – Counterparty credit risk 

341 

 
 
 
 
 
 
 
12.2 

Supervisory actions 

90. 

In accordance with Article 284(4) of the CRR, the ECB can increase the alpha 
parameter in a proportionate and appropriate way for either an interim or an 
undefined period to address model, risk management or governance deficiencies 
identified by the ECB. In particular, targeted deficiencies may include (i) model 
deficiencies, which lead or may lead to an underestimation of the EEPE as defined in 
Article 284(5) and (6) of the CRR and Article 285 of the CRR for margined trading, or 
(ii) deficiencies in the validation framework. 

It should be noted that: 

(a)  both supervisory alpha increases related to an interim period and those related 

to an undefined period require explicit supervisory decisions; 

(b) 

if alpha is increased for an interim period, the decision will specify the length of 
the interim period or the condition when it ends. 

91. 

The ECB can base the amount of a potential alpha increase above the floor values 
to the extent possible on an available impact analysis. 

(a)  The analysis assesses66  the impact on the EEPE as calculated without the 

identified model deficiency. 

(b)  As this deficiency is obviously related to the standard configuration of the IMM, 
which contains this deficiency, an impact calculation based only on a subset of 
the relevant portfolio could be accepted for this purpose. This calculation can be 
performed in a well-defined developer area for representative sub-portfolios (as 
defined in the Counterparty credit risk abbreviations). 

(c)  Some non-exhaustive examples of how identified model deficiencies can 

increase alpha are discussed in this document (see for example paragraphs 21, 
57 and 58 of this chapter), where the general alpha increase (applied to all 
netting sets) reflects whether the identified deficiencies possibly affect only a 
part of the netting sets (e.g. only the margined ones). 

(d)  The ECB considers that increases should be in multiples of half a decimal point. 
For example, if alpha = 1.4, alpha becomes at least 1.45 if an increase is 
deemed necessary. 

If no impact calculations are available, the ECB may estimate the amount of the 
alpha increase in a conservative way using all other available information. 

13 

Risks not in effective expected positive exposure 

92.  Depending on the set-up of the IMM and the nature of the transactions, some 

quantifiable risks may not be captured, or may not be adequately captured, by the 

66    This assessment can also include less precise estimations, where needed. 

ECB guide to internal models – Counterparty credit risk 

342 

 
 
IMM. This section refers to processes for identifying, monitoring and capitalising 
such risks. 

13.1 

Relevant regulatory references 

Table 51 

Legal background 

CRR 

Date of issue 

Article 

Paragraph/Point 

26/06/2013 

92 

(3)(f) 

430(1) 

284 

287 

288 

290 

292 

293 

294 

368 

5 

(1)(a), (3), (4), (5), (6), (8) 

(2) 

(1)(a), (b), (g), (2)-(5), (6), (7) 

(1)(a), (b), (c) 

(1)(d), (g), (k), (m), (n), (o) 

(1)(e), (f), (h), (2)(d) 

(1) 

Commission Implementing Regulation (EU) No 2021/451   
(with regard to supervisory reporting of institutions) 

17/12/2020 

93. 

The regulatory provisions relating to the topic addressed in this section that require 
further guidance are the following. 

(a)  Article 92(3)(f) of the CRR specifies the types of transactions and agreements 
to be included in the calculation of the risk-weighted exposure amounts for the 
CCR. 

(b)  Article 430(1) of the CRR, in conjunction with Article 5(1) of Commission 

Implementing Regulation (EU) 2021/451 (with regard to supervisory reporting of 
institutions), requires institutions to report the information relating to own funds 
requirements with a quarterly frequency. 

(c)  Article 284(1)(a) of the CRR requires that the model used by the institution 

specify the forecasting distribution for changes in the market value of the netting 
set attributable to joint changes in relevant market variables such as interest 
rates and foreign exchange rates. 

(d)  Article 284(3) of the CRR requires the own funds requirement for CCR 

exposures under the IMM to be the higher of (a) the own funds requirement for 
those exposures calculated on the basis of EEPE using current market data, 
and (b) the own funds requirement for those exposures calculated on the basis 
of EEPE using a single consistent stress calibration for all CCR exposures to 
which the IMM is applied. 

(e)  Article 284(4) to (6) of the CRR describes the way the exposure value is 

calculated based on EEPE. 

ECB guide to internal models – Counterparty credit risk 

343 

 
 
 
 
 
 
 
 
 
(f)  Article 284(8) of the CRR allows institutions to use a measure of the distribution 

calculated by the IMM that is more conservative than  multiplied by EEPE as 
calculated in accordance with the equation in Article 284(4) for every 
counterparty. 

(g) 

In accordance with Article 287(2) of the CRR, the independent risk control unit 
is responsible for the design and implementation of its CCR management, 
including the initial and ongoing validation of the model. Specifically, under 
Article 287(2)(c) of the same regulation, the independent risk control must 
control input data integrity and produce and analyse reports on the output of the 
institution’s risk measurement model, including an evaluation of the relationship 
between measures of risk exposure and credit and trading limits. 

(h) 

In accordance with Article 288 of the CRR, an independent review of the CCR 
management system should be conducted regularly through an internal auditing 
process encompassing both the activities of the control and collateral 
management units as required by Article 287 of the CRR. 

(i)  Article 290 of the CRR describes the requirements for the stress testing 

programme. Specifically, Article 290(9) of the same regulation requires the 
results of the stress testing to be regularly reported to senior management, at 
least on a quarterly basis. The reports and analysis of the results must cover 
the largest counterparty-level impacts across the portfolio, material 
concentrations within segments of the portfolio (within the same industry or 
region), and relevant portfolio and counterparty specific trends. 

(j) 

(k) 

In accordance with Article 292(1)(a) and (b) of the CRR, institutions must 
ensure the integrity of the modelling process by adopting at least the following 
measures: (a) the model must reflect transaction terms and specifications in a 
timely, complete and conservative fashion; (b) those terms must include at least 
contract notional amounts, maturity, reference assets, margining arrangements 
and netting arrangements. 

In accordance with Article 292(1)(g) of the CRR, institutions must ensure the 
integrity of the modelling process by adopting a certain number of measures 
including processes for formal reconciliation between the model and source 
data systems to verify on an ongoing basis that transaction terms and 
specifications are being reflected in EPE correctly or at least conservatively. 

(l)  Article 292(2) to (5) of the CRR describes requirements for the calibration of the 

IMM using current and stressed market data. 

(m)  In accordance with Article 292(6) of the CRR, institutions must subject the 
model to a validation process that is clearly formulated in their policies and 
procedures. 

(n) 

In accordance with Article 292(7) of the CRR, institutions must monitor relevant 
risks such as their exposures to specific wrong-way risk and general wrong-way 
risk, their exposures with a rising risk profile after one year and their exposures 
with a residual maturity below one year. 

ECB guide to internal models – Counterparty credit risk 

344 

 
(o) 

(p) 

In accordance with Article 293(1)(a) of the CRR, institutions must meet the 
qualitative requirements set out in Part Three, Title IV, Chapter 5 of the CRR, 
including the qualitative requirements set in Article 368 of the CRR for the use 
of internal models for market risk. 

In accordance with Article 293(1)(b) and (c) of the CRR, institutions must 
conduct a regular programme of back-testing and carry out an initial validation 
and ongoing periodic reviews of their CCR exposure models and the risk 
measures generated by them. 

(q) 

In accordance with Article 294(1)(d) of the CRR, if the model validation 
indicates that EEPE is underestimated, institutions must take the action 
necessary to address the inaccuracy of the model. 

(r)  Article 294(1)(g) of the CRR requires institutions to validate that the CCR 

exposure model includes transaction-specific information to capture the effects 
of margining and that it accounts for the nature of margin agreements. 

(s)  Article 294(1)(k) of the CRR requires institutions to validate their CCR exposure 
models and all risk measures out to time horizons commensurate with the 
maturity of trades. 

(t)  Article 294(1)(m) of the CRR requires that the validation of an institution’s CCR 

exposure model and its relevant risk measures include an assessment of the 
adequacy of the recent performance. 

(u)  Article 294(1)(n) of the CRR requires institutions to assess the frequency with 

which the parameters of an CCR exposure model are updated as part of the 
initial and ongoing validation process. 

(v)  Article 294(1)(o) of the CRR requires that the initial and ongoing validation of 

CCR exposure models assess whether or not the counterparty level and netting 
set exposure calculations of exposure are appropriate. 

(w) 

(x) 

In accordance with Article 287(2)(d) and (f) of the CRR, institutions must have a 
risk control unit that is independent from units responsible for originating, 
renewing or trading exposures and that reports directly to senior management. 
The unit must conduct the initial and ongoing validation, being responsible for 
designing and implementing the CCR management system. 

In accordance with Article 293(1)(a) of the CRR referring to Part Three, Title IV, 
Chapter 5 and more particularly to Article 368(1)(b) of the CRR, institutions 
must have a risk control unit that is independent from business trading units and 
reports directly to senior management, being responsible for designing and 
implementing any internal model. The unit must conduct the initial and ongoing 
validation, being responsible for the overall risk management system. 

(y) 

In accordance with Article 368(1)(e) of the CRR, institutions must have in place 
established procedures for monitoring and ensuring compliance with a 

ECB guide to internal models – Counterparty credit risk 

345 

 
documented set of internal policies and controls concerning the overall 
operation of its internal models. 

(z) 

In accordance with Article 368(1)(f) of the CRR, any internal must have a 
proven track record of reasonable accuracy in measuring risks. 

(aa)  In accordance with Article 368(1)(h) of the CRR, institutions must conduct an 

independent review of their internal models as part of their regular internal 
auditing process. 

(bb)  In accordance with Article 368(2)(d) of the CRR, the review mentioned in 

Article 368(1)(h) of the CRR must be conducted at least once a year and must 
consider various elements, including the scope of risks captured by the risk 
measurement model. 

13.2 

Principles for ECB Banking Supervision 

13.2.1 

Framework 

94. 

“Risks not in effective expected positive exposure” (RNIEPE) are those risks inside 
the IMM which are not yet part of the EEPE or not adequately captured in EEPE and 
hence are not included in the IMM exposure value defined in Article 284(4) of the 
CRR. 

The ECB has identified two possible ways of treating these risks: 

(a)  The RNIEPE framework is applied as described in this section, which may 
include using voluntary RNIEPE add-ons for substantial RNIEPE as further 
described in paragraphs 105 and 117 of this chapter. 

(b)  Alternatively, institutions intend including such risks directly in the exposure 

value as defined in Article 284(4) of the CRR. 

(i)  Such inclusion could always be done immediately, or 

(ii)  Such inclusion could be deferred as long as institutions ensure that the 

exposure value is sufficiently conservative in the sense of Article 292(1)(a) 
and (b) of the CRR and that relevant market variables are modelled in 
accordance with Article 284(1) of the CRR. 

For the purpose of point (b), if institutions identify these risks as described in 
sub-section 13.2.2 of this chapter, the ECB would then consider the calculation 
of the exposure value to be complete and sufficiently conservative in the sense 
of Article 284(1) and Article 292(1)(a) and (b) of the CRR. 

Based on the provisions referred to above and in view of sub-paragraphs (a) and (b) 
above, the ECB considers that the processes, methods and governance set out in 
this section for RNIEPE are an integral part of the overall processes and general 

ECB guide to internal models – Counterparty credit risk 

346 

 
internal governance of the IMM for CCR. Therefore, the ECB considers it best 
practice for institutions to have policies and controls relating to RNIEPE (hereinafter 
referred to as the “RNIEPE framework”). The elements of the RNIEPE framework 
are set out in detail in the following paragraphs. 

95. 

The RNIEPE framework should comprise guidance for identification and 
quantification, which may also include capitalisation of certain RNIEPE, monitoring, 
management and reporting of RNIEPE, and all related governance arrangements. 

96.  An “RNIEPE add-on” is part of the RNIEPE framework and is understood as a 

temporary risk analogue to an exposure amount67  until the corresponding RNIEPE is 
incorporated into the EEPE in a manner compliant with the regulatory requirements 
of the IMM as provided for in Article 284(6) of the CRR.68  As such, the ECB 
considers that RNIEPE add-ons are not part of the EEPE itself and are therefore not 
included in the exposure value calculated in accordance with Article 284(4) of the 
CRR.69  The ECB expects these RNIEPE add-ons to result in risk exposure 
amounts70  in line with paragraph 105 of this chapter.71 

In the view of the ECB, the RNIEPE framework should not be understood as 
covering elements for which separate provisions are provided in the regulatory 
framework for CCR, such as – but not limited to – the aspects mentioned in 
Article 292(7)(b) of the CRR. 

97.  As the RNIEPE framework is considered to be a part of the processes and modelling 
related to the IMM, it covers the same scope in terms of transactions as that 
permitted under Article 283 of the CRR and the same risk factors as relevant for 
Article 284(1)(a) of the CRR. 

98. 

99. 

In accordance with Article 287(2) of the CRR, the risk control unit is responsible for 
the design and implementation of the institution’s CCR management. Because the 
RNIEPE framework is seen as an integral part of the IMM, the ECB considers that 
the risk control unit is also responsible for the overall RNIEPE framework. 

In accordance with Article 287(2) of the CRR, the RNIEPE framework and 
methodologies should be subject to validation and independent review, as set out in 
further detail in Article 294(1)(d), (g), (k), (m), (n) and (o) of the CRR and Article 288 

67    The precise meaning of “temporary” in this context needs to be agreed with the supervisor and 
depends on the specific RNIEPE. For the RNIEPE add-on calculated in accordance with 
paragraph 109(b) of this chapter, it refers to the time until EU legislation refines the IMM provisions 
explicitly including the treatment of exposure spikes in margined trading. 

68    The quantification of the RNIEPE requires a flooring at zero. Institutions would need to include the 

underlying risk in the EEPE to benefit from potential exposure offsetting. 

69    If the exposure value is calculated in accordance with Article 284(8) of the CRR, no RNIEPE add-on is 
expected by the ECB, i.e. all modelling components of the IMM, including additional or conservative 
elements, are expected to be part of the exposure metric under Article 284(8) of the CRR. Since the 
RNIEPE framework is seen as an integral part of the overall processes in the IMM, no additional or 
parallel capitalisation is proposed using any of the methods in Sections 3 to 5 of Part Three, Title II, 
Chapter 6 of the CRR. 

70    Risk exposure amounts as defined in Article 92(3) and (4) of the CRR. 
71    To be reported in COREP as “Additional risk exposure amount due to Article 3 CRR” (COREP C02.00 

Row 0760, Column 0010) together with any other own-initiative capital buffers. See also paragraph 105 
of this chapter on using a consistent metric/unit for insertion. 

ECB guide to internal models – Counterparty credit risk 

347 

 
 
of the CRR respectively. In this context and where applicable, back-testing of 
RNIEPE add-ons is seen as beneficial. 

100. 

In order to enable efficient monitoring of RNIEPE for the purpose of internal 
modelling as referred to in Article 368(1)(e) of the CRR, the ECB considers that the 
policies of the RNIEPE framework should be documented and should include: 

(a)  descriptions of each RNIEPE with a justification as to why any identified 

RNIEPE is not directly included in the EEPE calculation; 

(b) 

the different tasks and responsibilities, and the frequency of their execution. 

13.2.2 

Identification 

101.  A single identified RNIEPE refers to a distinct risk not accurately captured in or fully 

omitted from the calculation of EEPE. This can refer, for example, to one specific risk 
factor or a set of risk factors (e.g. related to a yield curve), or to an element missing 
from the margining mechanism or other model assumptions. 

The ECB considers that RNIEPE can emerge as a result of specific circumstances, 
including the following. 

(a)  A single risk factor, a set of risk factors or the dependency structure 

(correlations) of a subset of risk factors that cannot be modelled precisely 
enough to allow for the modelling of the joint distribution under Article 284(1)(a) 
of the CRR, for instance because of: 

(i)  a different stochastic dynamic (e.g. due a partially effective pegging 

mechanism for a subset of FX rates); 

(ii) 

in the case of historical calibration, the underlying time series containing 
too many proxies; 

(iii) 

the occurrence of risk factor jumps that are not frequent enough to allow 
for an appropriate calibration; 

(iv) 

insufficient observations of basis risks. 

(b)  Processes in place that do not allow the modelling of a margin arrangement to 

reflect correctly or conservatively enough all the relevant terms and 
specifications required by Article 292(1)(g) of the CRR. 

(c)  Cash flows that would be paid to a defaulting counterparty in margined trading 
and that are not, or not fully, reflected in exposures underlying the EEPE owing 
to the DMP or owing to the legal requirements of the contract. 

102.  The ECB considers that the following shortcomings should be treated in EEPE rather 

than in RNIEPE, unless duly justified: 

ECB guide to internal models – Counterparty credit risk 

348 

 
(a) 

treatment of synthetic netting sets arising from the application of paragraph 10 
of this chapter; 

(b)  deficiencies in pricing models at transaction level for which paragraphs 12 to 16 

of this chapter apply; 

(c)  corrected transaction values arising from the application of paragraph 14 of this 

chapter; 

(d)  all cases where a full simulation is missing, as listed in paragraph 17 of this 

chapter. 

The concept of RNIEPE should not affect potentially existing approaches to 
modelling specific parameters or modelling features that use a sufficient degree of 
conservatism72  in dealing with uncertainty in the EEPE. Therefore, the ECB does not 
see a need to separate the effects of such parameters and modelling features from 
EEPE and include them in RNIEPE. However, the ECB expects such parameters or 
modelling features affecting EEPE to be clearly documented, monitored and reported 
as part of the processes of the IMM. 

103. 

In order to properly monitor each RNIEPE, the ECB considers that institutions should 
explain in their documentation how each RNIEPE is identified and defined. In order 
to properly assess materiality, the ECB considers that the current portfolio 
composition and trading strategy of the institution should be taken into account when 
assessing each RNIEPE. 

The ECB considers it best practice for an RNIEPE that is substantial in the current 
portfolio to be subject to an RNIEPE add-on, even if this RNIEPE might cease to be 
substantial at a later point in time. 

104.  The ECB considers that in order to ensure an accurate capture of risks, institutions 

should strive to identify and monitor73  RNIEPE on a regular basis as part of the 
overall risk management framework. The ECB considers it best practice to use 
existing processes efficiently to identify RNIEPE. 

As part of such best practice, and in order to maximise efficiency, institutions should, 
as a minimum74, use the following processes to identify RNIEPE: 

(a) 

initial and ongoing internal validation of the IMM, as referred to in 
Articles 287(2), 292(6), 293(1)(b) and (c), and 294 of the CRR; 

(b)  back-testing as referred to in Article 294 of the CRR; 

(c)  controls of input data integrity as referred to in Article 287(2)(c) of the CRR; 

72    This refers for example to diffusion parameters leading to greater variation in simulated risk factors than 

would be observed from historical data, or simplifications of margin arrangements that do not lead to a 
systematic underestimation of exposures. 

73    Monitoring should be applied in particular to frequently or permanently occurring RNIEPE in line with 

paragraphs 100 and 115 of this chapter. 

74    Using all the processes (a) to(e) does not imply that all concrete RNIEPE are sensitive to all these 

processes or could be detected by all of them. 

ECB guide to internal models – Counterparty credit risk 

349 

 
 
(d)  with regard to the approval of new products, analysing whether the 

characteristics inherent in the new products can be adequately captured by the 
IMM in order to ensure that these new products are fully compatible with the 
comprehensive risk control and validation by the risk control unit, as required by 
Article 368(1)(b) of the CRR; 

(e)  stress testing as referred to in Article 290 of the CRR. 

In accordance with Article 368(2)(d) of the CRR, the annual review of an institution’s 
overall risk management process must consider the scope of risks captured by the 
risk measurement model. Therefore, the ECB considers that a review and, if 
necessary, an update of the RNIEPE inventory should be carried out at least once a 
year. 

13.2.3 

Quantifications 

105.  As identified RNIEPE are considered to be part of the IMM, the quantification of each 
RNIEPE should (to the extent possible) be methodologically similar to the respective 
exposure quantification in the IMM, reflecting either an expected exposure averaged 
over one year or an increment to an EEPE, taking relevant stress calibrations (as set 
out in Articles 284(3)(b) and 292(2) to (5) of the CRR) into account where applicable. 
This would imply that two quantifications are not necessary in cases where the 
expected RNIEPE exposures (EREs) according to the current calibration and the 
stress calibration are very similar. 

The quantification of EREs is set out in further detail in the paragraphs below. Each 
individual ERE should be floored at zero. 

It is the ECB’s understanding that for each RNIEPE add-on75, the corresponding risk 
exposure amount should be calculated as 

𝑅𝑊𝐴𝑅𝑁𝐼𝐸𝑃𝐸 = 𝑅𝑊 ∙ 𝛼 ∙ 𝐸𝑅𝐸, 

where  𝑅𝑊  denotes the risk weight as defined in Part III, Title 2, Chapter 2, 
Sections 2 and 3 of the CRR for SA and Part III, Title 2, Chapter 3, Sections 2 to 4 of 
the CRR for IRB and  𝛼  corresponds to the alpha parameter under Article 284(4) of 
the CRR, including potential increases as outlined in paragraph 90 of this chapter. 
Note that the RNIEPE add-on equals  𝑅𝑊 ∙ 𝛼 ∙ 𝐸𝑅𝐸  in cases where the ERE is 
substantial (as defined in paragraph 117 of this chapter). 

106.  The value of the risk weight referred to in paragraph 105 of this chapter may depend 

on how many counterparties are affected by a given RNIEPE. 

(a) 

If the ERE related to a given RNIEPE can be calculated per netting set, the risk 
weight(s)76  applied should be the same as that taken for the exposure value for 

75    As set out in paragraph 96 of this chapter, a substantial RNIEPE add-on constitutes an additional 

exposure that should be capitalised in accordance with Article 3 of the CRR. 

76    The A-IRB risk weights depend in general on netting sets and may even depend on a single netting set 

for one counterparty owing to the maturity adjustment. 

ECB guide to internal models – Counterparty credit risk 

350 

 
 
the respective netting set as referred to in Article 284(4) of the CRR, regardless 
of whether a standardised risk weight or an IRB approach is applied for the 
calculation of own funds requirements according to Article 92(3)(f) of the CRR. 
Thus, the risk exposure amount should be calculated as 

𝑅𝑊𝐴𝑅𝑁𝐼𝐸𝑃𝐸 = ∑ 𝑅𝑊𝑛 ∙ 𝛼 ∙ 𝐸𝑅𝐸𝑛
𝑛

 , 

where  𝑅𝑊𝑛  denotes the risk weight corresponding to the n-th netting set 
affected by RNIEPE, and  𝐸𝑅𝐸𝑛  the corresponding expected RNIEPE exposure. 

(b)  Alternatively, if the ERE is calculated simultaneously across several netting sets 

(i.e. no calculation of a single  𝐸𝑅𝐸𝑛 is possible), it is recommended that 
institutions follow one of the following two approaches: 

(i)  apply one risk weight to all affected counterparties or nettings sets being 
as high as the highest risk weight of the set of affected counterparties or 
netting sets: 

𝑅𝑊𝐴𝑅𝑁𝐼𝐸𝑃𝐸 = 𝑅𝑊 ∙ 𝛼 ∙ 𝐸𝑅𝐸, 

where  𝑅𝑊 = max

𝑛

{𝑅𝑊𝑛 for affected counterparties 𝑛 = 1, … , 𝑁}; 

(ii)  apply an average risk weight to all affected counterparties or netting sets, 

which takes the relative materiality of exposures into account and does not 
systematically underestimate risk weights, provided the methodology of 
averaging is justified and internally validated. 

107. 

In accordance with Article 368(1)(e) and (f) of the CRR, the ECB considers it best 
practice that institutions quantify RNIEPE in an appropriate way and document and 
duly justify the methodology applied, in order to assess the need to incorporate the 
RNIEPE into EEPE. 

Because the quantification of the impact should allow the different RNIEPE to be 
assessed individually, no diversification effect should be applied between different 
RNIEPE when quantifying an individual RNIEPE. 

108.  The ECB considers it best practice that for each RNIEPE identified, the quantification 
of the ERE is estimated based on the resulting exposure when the RNIEPE is 
incorporated into EEPE as follows. 

(a)  The baseline is the EEPE based on the same transactions and netting sets as 

used in production (without any RNIEPE add-ons). 

(b)  Where the RNIEPE does not depend on the stress calibration and is 

incorporated into one EEPE according to (a) above, either the difference 
between that EEPE and the current EEPE, or the difference between that EEPE 
and the stressed EEPE, whichever is higher, should be used. Alternatively, two 
incremental measures can be calculated, one stressed, one current, in line with 
paragraph 105 of this chapter, and the higher of the two should be taken into 
account. 

ECB guide to internal models – Counterparty credit risk 

351 

 
(c)  The incremental exposure can be any positive or negative number. The 

calculation of the incremental exposure may result in a negative number if the 
incorporation of the RNIEPE has a risk-reducing effect. In that case, and in line 
with paragraph 105 of this chapter, the incremental exposure is set to zero for 
the respective netting set. 

(d)  The quantification of the impact should be as accurate as possible using 

reasonable effort. Therefore, the ECB understands that the impact estimation 
methodology can use appropriate approximations, assumptions, expert 
judgement or a stress methodology. Any such approximations, assumptions or 
expert judgement should be duly justified and documented. 

109.  The ECB considers that a prudent impact quantification differing from that described 

in paragraph 108 above could be used where this is duly justified. Where using an 
RNIEPE is justified but an appropriate impact quantification using an incremental 
exposure cannot be performed for this RNIEPE, the ECB considers it a prudent 
approach to perform an estimation of the impact of a RNIEPE based on an exposure 
calculation outside the EEPE where the RNIEPE is the only source of risks. 

(a)  For this stand-alone impact estimation of ERE, the institution should 

demonstrate that it does not systematically underestimate the incremental 
exposure or that the calculation of the incremental exposure is misleading. 

(b)  Where trade-related cash flows may be missing from the EEPE calculation as 
discussed in the case of margined trading in paragraph 20 of this chapter, the 
ECB expects the following method to be applied to account for such cash flows 
when calculating ERE in the RNIEPE add-on: 

(i)  The ERE for one netting set is given by the formula: 

𝐸𝑅𝐸𝑠𝑝𝑖𝑘𝑒 =

1
𝑚𝑖𝑛{1 𝑦𝑒𝑎𝑟, 𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦}

∙

𝑚𝑖𝑛{1 𝑦𝑒𝑎𝑟,𝑚𝑎𝑡𝑢𝑟𝑖𝑡𝑦}

∑

𝑘=1

𝐸𝑆𝐸𝑡𝑘 ∙ ∆𝑡𝑘

 . 

(ii)  The term  𝐸𝑆𝐸𝑡𝑘, the expected spike exposure, is calculated as the 

expected exposure increase due to trade-related cash flow payments from 
the institution to the defaulting counterparty during the MPOR between 
time grid points  𝑡𝑘  and  𝑡𝑘−1  attached to the time grid point  𝑡𝑘, which are 
not included in the EEPE, and which are possible due to: 

(ii.a) 

(ii.b) 

(ii.c) 

contractual provisions (e.g. grace periods) as outlined in 
paragraph 20(b)(ii) of this chapter; 

the default notification and management processes of the 
institution as outlined in paragraphs 20(b)(i) and 20(c) of this 
chapter; 

applicable netting rules for such cash flows as mentioned in 
paragraph 20(d) of this chapter, which can also include variation 
margin payments if contractually agreed. 

ECB guide to internal models – Counterparty credit risk 

352 

 
(iii)  The term  ∆𝑡𝑘 = 𝑡𝑘 − 𝑡𝑘−1  is expressed in units of a year and has the same 
meaning as the  ∆𝑡𝑘  in Article 284(6) of the CRR, where for the purpose of 
calculating  𝐸𝑆𝐸𝑡𝑘, time grid points  𝑡𝑘may be used that do not belong to the 
standard time grid of the IMM as used for Article 284(6) of the CRR. 

110.  The ECB considers that in order to ensure that the quantification of RNIEPE is 

appropriately accurate in accordance with Article 368(1)(f) of the CRR, the 
quantification should, where possible, make use of objective market data. Where the 
quality of the data used is insufficient, the institution should be aware of the effect 
this might have on the quantification of the respective RNIEPE and, if necessary, 
take measures to mitigate the effect. This should also be part of the documentation 
of the respective RNIEPE. 

111. 

In order to ensure alignment with the EEPE, when quantifying an RNIEPE the 
calibration methodology for the ERE should be based on the same methodology as 
used for the EEPE. For example, it should be based on the same observation period 
if the EEPE is based on historical calibration. Any differences should be duly 
justified. If scarce data are used for calibration, they should be used in a way that 
avoids a systematic underestimation of exposure. This may involve relying to some 
extent on expert judgement, which should be well documented and explained. 

13.2.4 

Management of RNIEPE 

112.  As mentioned previously, the identification, quantification and management of the 

RNIEPE should be integrated into the CCR management framework. The ECB 
therefore considers that in order to ensure that ongoing risk measurement is 
accurate according to Article 368(1)(f) of the CRR, the risk control unit should carry 
out regular impact quantification and monitoring of all RNIEPE. The outcome should 
be reported to the relevant stakeholders in line with the processes set out in the 
institution’s RNIEPE framework. 

113. 

In accordance with Article 430 of the CRR in conjunction with Article 5(1) of the 
Commission Implementing Regulation on supervisory reporting, institutions must 
submit the information relating to own funds requirements with a quarterly frequency. 
Therefore, the ECB considers that in order to assess the adequacy of own funds, 
institutions should quantify and monitor the RNIEPE add-ons and adjust their scope 
at least quarterly. 

114.  More particularly, regarding the requirement under Article 368(1)(f) of the CRR that 
internal models should have a proven track record of reasonable accuracy in 
measuring risk, the ECB considers it a good practice for institutions to determine 
thresholds for treating individual and combined RNIEPE as part of their RNIEPE 
management. Such thresholds are based on the ratio of the ERE as defined in 
paragraph 105 of this chapter over the EEPE, in which regard no RNIEPE are to be 
included in the denominators of the following ratios. 

ECB guide to internal models – Counterparty credit risk 

353 

 
(a)  For a single  𝐸𝑅𝐸𝑖  of type  𝑖  as described in paragraphs 108 and 109 of this 
chapter relating to one netting set, the ratio used for determining whether an 
RNIEPE is substantial is calculated as follows: 

𝑟𝑎𝑡𝑖𝑜𝑖 =

𝐸𝑅𝐸𝑖
𝐸𝐸𝑃𝐸

 . 

(b) 

If one  𝐸𝑅𝐸𝑖  relates, for example, to a non-modelled risk factor in the IMM that 
affects a number of netting sets or counterparties (overall  𝑁  netting sets), the 
ratio used for determining whether an RNIEPE is substantial is calculated as 
follows: 

𝑟𝑎𝑡𝑖𝑜𝑖

𝑚𝑢𝑙𝑡 =

𝑁
∑
𝑛=1
𝑁
∑
𝑛=1

𝑛
𝐸𝑅𝐸𝑖
𝐸𝐸𝑃𝐸𝑛

 . 

(c)  Regarding all  𝐸𝑅𝐸𝑖, except the ERE on exposure spikes, the ratio used to 

determine if RNIEPE should be included in EEPE for overall  𝑁  netting sets 
affected by RNIEPE type  𝑖  and  𝑀  netting sets in the overall IMM scope should 
be: 

𝑟𝑎𝑡𝑖𝑜 =

𝐼
∑ ∑
𝑖=1
𝑀
∑
𝑚=1

𝑛
𝑁
𝐸𝑅𝐸𝑖
𝑛=1
𝐸𝐸𝑃𝐸𝑚

 , 

where  𝐼  denotes the overall number of RNIEPE types different from the 
RNIEPE related to spikes. 

(d)  For the ERE associated with exposures spikes in a netting set  𝑛  as described 

in paragraph 109(b) above, the ratio used to determine whether this RNIEPE 
should be included in EEPE is given (using the notation of the above point (c)) 
by: 

𝑟𝑎𝑡𝑖𝑜𝑠𝑝𝑖𝑘𝑒 =

∑

𝑁
𝑛=1
𝑀
𝑚=1

𝑛
𝐸𝑅𝐸𝑠𝑝𝑖𝑘𝑒
𝐸𝐸𝑃𝐸𝑚

∑

 . 

115.  Regarding RNIEPE that are identified as not being substantial according to one of 

the processes described in paragraph 104 of this chapter, the ECB recommends that 
institutions either define quantitative thresholds using the above or similar metrics or 
define qualitative methodological criteria to identify RNIEPE that are not substantial 
but require at least the monitoring described in paragraph 100 of this chapter. 

116.  The thresholds on the ratios (a) to (d) described in paragraph 114 above should 

include at least: 

(a)  a threshold on the ratios (a) and (b) above which individual RNIEPE are 
considered as substantial and capitalised with RNIEPE add-ons as 
recommended in paragraph 105 of this chapter; 

(b)  a (higher) threshold on ratios (a) and (b) above which individual RNIEPE are to 
be included in the EEPE calculation in accordance with Article 284(6) of the 
CRR, in which regard additional qualitative criteria possibly defined by the 
institution could also lead to an inclusion in EEPE, even if the quantitative 
threshold is not breached; 

ECB guide to internal models – Counterparty credit risk 

354 

 
(c)  a threshold on ratio (c) above which one or more RNIEPE are to be included in 

the EEPE calculation in accordance with Article 284(6) of the CRR so that the 
sum of the remaining RNIEPE leads to a ratio (c) below this threshold77; 

(d)  a threshold on ratio (d) above which the RNIEPE related to the exposure spikes 
need to be included into the EEPE calculation in accordance with Article 284(6) 
of the CRR. 

117. 

Institutions should determine at their own discretion thresholds for assessing the 
impact of individual RNIEPE above which an individual RNIEPE is considered a 
substantial RNIEPE in the sense of paragraph 116(a) or (b) of this chapter. 

However, the ECB considers that if a single RNIEPE already has a 5% impact, the 
EEPE might not capture accurately all relevant risks. Therefore, the ECB considers it 
best practice for a single RNIEPE to be considered substantial if the impact 
quantification according to paragraph 114(a) or (b) of this chapter corresponds to 
more than 5% of the amount given by the EEPE. 

118. 

Institutions should determine, at their own discretion, a threshold on the ratio defined 
in paragraph 114(c) above which RNIEPE are incorporated into EEPE. 

However, the ECB considers that if the cumulative RNIEPE impact across all 
RNIEPE types corresponds to more than 10% without the impact due to exposure 
spikes calculated as defined in paragraph 109(b) of this chapter, of the amount given 
by EEPE of the IMM using the ratio set out in paragraph 114(c) of this chapter for 
two consecutive quarters, the EEPE might not capture accurately all material risks, 
because in accordance with Article 7a(1)(c)(ii) of the Commission Delegated 
Regulation on materiality of extensions and changes of the IMA, a change of 10% or 
more of a relevant market risk number is to be considered a material change to the 
IMA. Therefore, and in the absence of RTS for CCR, the ECB considers, by analogy 
and also using this threshold for the IMM, that if the cumulative RNIEPE impact 
corresponds to more than 10% of the amount computed using EEPE, this indicates 
that the EEPE might not capture accurately all material risks.78 

This implies that some (or all) of the RNIEPE contributing to the numerator of the 
ratio in paragraph 114(c) of this chapter would need to be included in the EEPE in 
accordance with Article 284(6) of the CRR, such that this ratio falls below 10%. 

119. 

Institutions should determine, at their own discretion, a threshold on the ratio defined 
in paragraph 114(d) above which the RNIEPE associated with the exposure spikes 

77    This also takes the scheduling into account as discussed in footnote 67 on how long a RNIEPE might 

stay outside EEPE. 

78    The foreword of this guide discusses a possible change in legislation when the existing market risk IMA 
is substituted by the FRTB IMA. It is expected that Commission Delegated Regulation 2015/964 on 
materiality of extensions and changes of the IMA will no longer be valid when the FRTB legislation 
becomes binding. In that case, the second sub-paragraph within paragraph 118 of this chapter (starting 
with “However …”) will be substituted by: 
“However, the ECB considers that if the cumulative RNIEPE impact across all RNIEPE types 
corresponds to more than 10% without the impact due to exposure spikes calculated as defined in 
paragraph 109(b) of this chapter, of the amount given by EEPE of the IMM using the ratio set out in 
paragraph 114(c) of this chapter for two consecutive quarters, the EEPE might not adequately capture 
all material risks.” 

ECB guide to internal models – Counterparty credit risk 

355 

 
 
as defined in paragraph 109(b) of this chapter for two consecutive quarters is 
incorporated into the EEPE in accordance with Article 284(6) of the CRR. 

However, the ECB considers that if the impact of this RNIEPE relative to all netting 
sets in scope of the IMM corresponds to more than 10%, the risk related to exposure 
spikes should be incorporated into the EEPE. 

120.  The ECB considers it a prudent approach that RNIEPE that are to be incorporated 
into the EEPE in accordance with paragraphs 118 and 119 of this chapter are 
capitalised with RNIEPE add-ons – if this is not already the case – as part of the 
implementation plan, until they are incorporated into EEPE. If the institution deems it 
convenient, the remaining RNIEPE, even if not substantial, may also be capitalised 
with RNIEPE add-ons. 

121. 

In order to enable monitoring of RNIEPE add-ons, the ECB can, on the basis of 
Article 10 of the SSM Regulation, require an institution to provide an overview of 
RNIEPE add-ons in a suitable format chosen by the institution. 

122.  Because the RNIEPE framework is an integral part of the overall IMM processes, a 
change to the RNIEPE framework – and in particular a change relating to the 
RNIEPE identification methodology, the impact quantification methodology or the 
RNIEPE add-on methodology – should be considered as an IMM model change. The 
ECB considers that the EGMA could provide appropriate guidance on assessing 
these changes.79 

(a)  The ECB considers that changes to the RNIEPE framework should in general 

be notified ex ante to the ECB. 

(b)  However, changes within the existing RNIEPE framework which do not need 

new methodologies or processes to be implemented may be notified to the ECB 
through ex post notifications only. 

123. 

In the view of the ECB, ceasing to capitalise an RNIEPE because ratios under 
paragraph 114(a) and 114(b) of this chapter are below the thresholds set out in 
paragraph 117 of this chapter, or starting to capitalise an RNIEPE with an RNIEPE 
add-on according to the thresholds of the RNIEPE framework, would not constitute a 
model change and does not need to be separately notified as a model change, 
provided that it is based on the approved methodology of the RNIEPE framework. 

124.  The incorporation of an individual RNIEPE into EEPE, irrespective of whether it was 
previously treated as an RNIEPE add-on, and irrespective of whether it is a 
previously identified or newly identified RNIEPE, constitutes an IMM model change 
and should therefore be assessed using the EGMA. 

(a) 

If a change or extension of the RNIEPE framework or the incorporation of an 
individual RNIEPE into the EEPE receives the classification “ex ante” but is very 

79    It is possible that a future version of the EGMA might contain refinements regarding changes and 

extensions that are affected by the RNIEPE framework. 

ECB guide to internal models – Counterparty credit risk 

356 

 
 
close to the classification “to be investigated”, the individual RNIEPE or those 
RNIEPE that contribute to that materiality should be integrated into the EEPE. 

(b)  When calculating the impacts of incorporating an RNIEPE into EEPE, the 

calculation should not take into account impacts with the opposite sign inside 
the RNIEPE framework. 

125.  Because the RNIEPE add-ons are not included in EEPE, they should not be taken 

into account when back-testing the EEPE in accordance with Article 294 of the CRR. 

ECB guide to internal models – Counterparty credit risk 

357 

 
 
Annex 

This annex outlines two examples of a technique for assessing the confidence 
interval of the estimated EEPE referred to in paragraph 58 of the chapter on 
counterparty credit risk, assuming that the EEPE is calculated using a Monte Carlo 
method and a pseudo random number generator. 

In the examples, the MC error on the EEPE is defined as an aggregation of the MC 
error on the different netting sets. At netting set level, the MC error on the EEPE is 
defined as half the length of the 95% two-sided confidence interval centred around 
the sample estimated EEPE. 

Two methods are proposed for the calculation performed at the netting set level. 
These are described in the “Method 1” and “Method 2” sections. How the MC error 
should be inferred for a whole portfolio consisting of several netting sets is detailed 
below in the “Aggregation” section. 

Note that the methods below apply to banks that use a pseudo Monte Carlo 
simulation method and not to banks that apply a quasi Monte Carlo simulation 
method. In this context, a pseudo Monte Carlo simulation method is defined as a 
method that utilises a random number generator based on an algorithm creating a 
sequence of desired length N of numbers that mimic independent samples drawn 
from a uniform distribution. A quasi Monte Carlo simulation method is defined as a 
method that utilises a low-discrepancy sequence of numbers, which is 
deterministically uniformly distributed (e.g. Sobol). 

Irrespective of the numerical method implemented for its estimation of the EEPE 
(e.g. types of random number generators), the institution should provide an analysis 
as part of its validation framework demonstrating that its approach has a reasonable 
accuracy as required by Article 368(1)(f) of the CRR (as referenced by 
Article 293(1)(a) of the CRR). This analysis should include an assessment of 
convergence and an error estimation. 

In the following, “MC run” refers to a pseudo Monte Carlo simulation with N 
scenarios calculated with one particular set of random numbers. 

A.1 

Method 1 

Let  𝐸𝐸𝑃𝐸𝑁(𝛼̂ )  denote the estimator of the EEPE for one given netting set  𝛼 
obtained from one MC run with  𝑁  simulations (e.g. 𝑁 = 2000). 

The institution can estimate an MC error on  𝐸𝐸𝑃𝐸𝑁(𝛼̂ ), on the basis of a 95% 
confidence level, by using a set of several MC runs. In what follows, notations are 
simplified:  𝐸𝐸𝑃𝐸𝑁(𝛼̂ )  is replaced by  𝐸𝐸𝑃𝐸̂ ;  𝛼  and  𝑁  are dropped, since the 
calculations detailed below are performed on the same netting set  𝛼  and with the 
same number of simulations per MC run,  𝑁. 

ECB guide to internal models – Annex 

358 

 
Furthermore, let 𝑚  denote the size of the set of MC runs (e.g. 𝑚 = 50). The different 
MC runs are obtained by running the MC simulation with different random numbers 
(e.g. by using different seeds). 

The MC error on  𝐸𝐸𝑃𝐸̂   calculated with method 1 is defined as: 

𝑒𝑟𝑟𝑜𝑟𝑀1̂ (𝐸𝐸𝑃𝐸̂ ) ≔ 𝛷−1(0.975)   ∙  𝑐𝑜𝑛𝑣𝐴𝑑𝑗(𝑚) ∙ √𝑣𝑎𝑟𝑀1̂ (𝐸𝐸𝑃𝐸̂ )

≃ 1.96 ∙  𝑐𝑜𝑛𝑣𝐴𝑑𝑗(𝑚) ∙ √𝑣𝑎𝑟𝑀1̂ (𝐸𝐸𝑃𝐸̂ ) , 

with 

𝑣𝑎𝑟𝑀1̂ (𝐸𝐸𝑃𝐸̂ ) ≔

1

𝑚−1

∑

𝑚
𝑘=1

(𝐸𝐸𝑃𝐸𝑘̂ −

∑ 𝐸𝐸𝑃𝐸𝑙̂𝑚

𝑙=1

)

2

; 

1

𝑚

• 

• 

𝐸𝐸𝑃𝐸𝑘̂   denoting the estimation of  𝐸𝐸𝑃𝐸  using the k-th run of the MC run set; 

𝛷−1  standing for the inverse cumulative function of a standard normal 
distribution. 

By using  𝛷−1(0.975) ≈ 1.96, we arrive at the following error formula: 

𝑒𝑟𝑟𝑜𝑟𝑀1̂ (𝐸𝐸𝑃𝐸̂ ) ≔ 1.96  ∙  𝑐𝑜𝑛𝑣𝐴𝑑𝑗(𝑚) ∙ √

1
𝑚 − 1

𝑚

∑ (𝐸𝐸𝑃𝐸𝑘̂ −

𝑘=1

1
𝑚

𝑚

∑ 𝐸𝐸𝑃𝐸𝑙̂

2
)

𝑙=1

The rationale of this formula is as follows. 

If we assume that  𝑬𝑬𝑷𝑬̂   follows a normal distribution,  𝑒𝑟𝑟𝑜𝑟𝑀1̂ (𝐸𝐸𝑃𝐸̂ )  can be 
interpreted as half of the length of the 95% two-sided confidence interval centred 
around 𝐸𝐸𝑃𝐸̂ . More precisely, it is estimated through a three-step approach: 

• 

𝛷−1(0.975)√𝑣𝑎𝑟(𝐸𝐸𝑃𝐸̂ )  is half of the length of the 95% two-sided confidence 

interval centred around 𝐸𝐸𝑃𝐸̂ , since we have: 

𝑃 (𝐸𝐸𝑃𝐸 ∈ [𝐸𝐸𝑃𝐸̂ − 𝛷−1(0.975)√𝑣𝑎𝑟(𝐸𝐸𝑃𝐸̂ ), 

𝐸𝐸𝑃𝐸̂ + 𝛷−1(0.975)√𝑣𝑎𝑟(𝐸𝐸𝑃𝐸̂ )]) = 95% . 

• 

√𝑣𝑎𝑟(𝐸𝐸𝑃𝐸̂ )  being unknown, it is approximated by  √𝑣𝑎𝑟𝑀1̂ (𝐸𝐸𝑃𝐸̂ ). The length 

of the two-sided 95% confidence interval,  𝛷−1(0.975)√𝑣𝑎𝑟(𝐸𝐸𝑃𝐸̂ ), is then 

approximated by  𝛷−1(0.975)√𝑣𝑎𝑟𝑀1̂ (𝐸𝐸𝑃𝐸̂ ). 

• 

However, one must take into account that whenever  𝑚  is too small (e.g. 𝑚 <
50),  𝑣𝑎𝑟𝑀1̂ (𝐸𝐸𝑃𝐸̂ )  may not have properly converged to  𝑣𝑎𝑟(𝐸𝐸𝑃𝐸̂ ). Finally, 

𝛷−1(0.975)√𝑣𝑎𝑟(𝐸𝐸𝑃𝐸̂ )  is estimated by 

𝛷−1(0.975)   ∙  𝑐𝑜𝑛𝑣𝐴𝑑𝑗(𝑚) ∙ √𝑣𝑎𝑟𝑀1̂ (𝐸𝐸𝑃𝐸̂ ),   

ECB guide to internal models – Annex 

359 

 
 
where∙  𝑐𝑜𝑛𝑣𝐴𝑑𝑗(𝑚)  takes into account the fact that  𝑣𝑎𝑟𝑀1̂ (𝐸𝐸𝑃𝐸̂ )  may not 
have properly converged to  𝑣𝑎𝑟(𝐸𝐸𝑃𝐸̂ ). 

Details of  𝑐𝑜𝑛𝑣𝐴𝑑𝑗(𝑚): 

The parameter  𝑐𝑜𝑛𝑣𝐴𝑑𝑗(𝑚)  is chosen such that 

𝑃 (√𝑣𝑎𝑟(𝐸𝐸𝑃𝐸̂ ) < 𝑐𝑜𝑛𝑣𝐴𝑑𝑗(𝑚) √𝑣𝑎𝑟𝑀1̂ (𝐸𝐸𝑃𝐸̂ )) = 95% 

holds. More precisely, still under the assumption that  𝐸𝐸𝑃𝐸̂   has a normal 
distribution, one can write: 

𝑚 − 1
𝑣𝑎𝑟(𝐸𝐸𝑃𝐸̂ )

𝑣𝑎𝑟𝑀1̂ (𝐸𝐸𝑃𝐸̂ ) ~ 𝜒𝑚−1

2

(1) 

2

where  𝜒𝑚−1
freedom. 

  denotes a standard chi-squared distribution with  𝑚 − 1  degrees of 

From (1), we get  𝑃 (𝑣𝑎𝑟(𝐸𝐸𝑃𝐸̂ ) < 𝑐𝑜𝑛𝑣𝐴𝑑𝑗(𝑚)2 𝑣𝑎𝑟𝑀1̂ (𝐸𝐸𝑃𝐸̂ )) = 95%  with 

• 

• 

𝑐𝑜𝑛𝑣𝐴𝑑𝑗(𝑚) = √

𝑚−1

  , 

𝑞(𝑚−1;97.5%)

𝑞(𝑚 − 1; 97.5%)  is such that  𝑃(𝑞(𝑚 − 1; 97.5%) ≤ 𝑍) = 97.5%  with  𝑍~𝜒𝑚−1

2

. 

A.2 

Method 2 

As in the previous section, we denote  𝐸𝐸𝑃𝐸𝑁(𝛼̂ )  as the estimator of the EEPE for 
one given netting set  𝛼  obtained from one MC run with N simulations 
(e.g. N = 2000) and, as in the previous section, we simplify the notation  𝐸𝐸𝑃𝐸𝑁(𝛼̂ ) 
as  𝐸𝐸𝑃𝐸̂ . 

The second method to estimate the error on  𝐸𝐸𝑃𝐸̂   is a method where only one MC 
run is needed (contrary to method 1 where a set of  𝑚  MC runs was needed). 

Before presenting the method for the estimation of the MC error, let us detail some 
definitions and notations. For any time point  𝑡𝑘  of the time grid used for exposure 
calculations, we denote  𝐸(𝑡𝑘)  as the netting set exposure at time  𝑡𝑘  and 𝐸𝐸(𝑡𝑘)  as 
its expected value. Let  𝐸𝐸̂ (𝑡𝑘)  be the estimator of  𝐸𝐸(𝑡𝑘)  based on the MC run, i.e. 

𝐸𝐸̂ (𝑡𝑘) =

1
𝑁

𝑁

∑ 𝐸𝑗(𝑡𝑘),

𝑗=1

where  𝐸𝑗(𝑡𝑘)  stands for the netting set exposure level at time  𝑡𝑘  for scenario j. 

The following equations holds if the EEPE is not dominated by the current 
exposure 𝐸(𝑡0), meaning there is at least one  𝑡𝑘 below one year with   
𝐸(𝑡0) <   𝐸𝐸̂ (𝑡𝑘), otherwise the numerical error of the EEPE is in any case zero. For 
the sake of simplicity, it is also assumed that  𝐸𝐸(𝑡0) <   𝐸𝐸̂ (𝑡1). 

ECB guide to internal models – Annex 

360 

 
 
 
The effective reference dates are the subset of dates  𝑡𝑘  among the simulation dates 
(𝑡ℎ)ℎ>0  such that 

𝐸𝐸(𝑡𝑘) > 𝑚𝑎𝑥
0≤ℎ<𝑘

𝐸𝐸(𝑡ℎ) . 

Let us denote  (𝑠𝑢)𝑢 these effective reference dates with 

𝑠1 < 𝑠2 < ⋯ < 𝑠𝑢 < ⋯ < 𝑠𝑝 ≤ 𝑡1𝑦 , 

i.e. p dates. 

For the given MC run, the estimated effective reference dates are the subset of 
dates  𝑡𝑘  among the simulation dates  (𝑡ℎ)ℎ>0  such that: 

𝐸𝐸̂ (𝑡𝑘) > 𝑚𝑎𝑥
0≤ℎ<𝑘

𝐸𝐸̂ (𝑡ℎ) 

Let us denote  (𝑠𝑢̂ )𝑢 these estimated (i.e. as resulting from an MC simulation) 
effective reference dates with: 

𝑠1̂ < 𝑠2̂ < ⋯ < 𝑠𝑢̂ < ⋯ < 𝑠𝑝̂̂ ≤ 𝑡1𝑦 

i.e. 𝑝̂ dates. 

𝐸𝐸𝑃𝐸̂   depends only on the  (𝐸𝐸̂ (𝑠𝑢̂ ))
defined in Article 284(5) of the CRR. More precisely, it is fully determined by  𝐸𝐸̂ (𝑠𝑢̂ ), 
as can be seen by the following schematic graph: 

  and the time profile of effective EE values as 

𝑢

Chart A1 
Estimate of EEPE 

The method below relies on the assumption, which should be checked by the 
institution when applying the method, that N is large enough such that all  𝐸𝐸̂ (𝑡𝑘)  are 
“sufficiently close” to their true values  𝐸𝐸(𝑡𝑘)  and that, as a consequence, the 
effective reference dates are properly identified, i.e. (𝑠𝑢̂ )𝑢 = (𝑠𝑢)𝑢. 

ECB guide to internal models – Annex 

361 

t0t1t2t3t5t4time Effective EE (implied from CRR)  == 1yEE ==application period of𝐸𝐸̂𝑡𝑘𝑠1̂𝑠2̂𝑠3̂𝐸𝐸̂𝑠2̂ 
 
 
Under the complementary assumptions that  𝑠𝑝 ≠ 𝑡1𝑦, and considering, as previously 
mentioned, that  (𝑠𝑢̂ )𝑢 = (𝑠𝑢)𝑢,  𝐸𝐸𝑃𝐸̂   is given by:1 

𝑝−1

𝐸𝐸𝑃𝐸̂ = ∑(𝑣𝑢 − 𝑣𝑢−1)𝐸𝐸̂ (𝑠𝑢) + (𝑡1𝑦 − 𝑣𝑝−1)𝐸𝐸̂ (𝑠𝑝)

       =

1
𝑁

𝑝−1

𝑢=1
𝑁
∑ [∑(𝑣𝑢 − 𝑣𝑢−1)𝐸𝑗(𝑠𝑢) + (𝑡1𝑦 − 𝑣𝑝−1)𝐸𝑗(𝑠𝑝)
𝑗=1

𝑢=1

]
 . 

Where  (𝑣𝑢)𝑢  are the “application period dates”: they are such that  [ 𝑣𝑢−1,  𝑣𝑢  ]  is the 
period  𝐸𝐸̂ (𝑠𝑢)  is applied to. For instance, for the case illustrated in the graph above, 
𝐸𝐸̂ (𝑠2)  is applied on  [𝑡1 ,  𝑡3], and thus  𝑣1  = 𝑡1   and  𝑣2  = 𝑡3 . 

Let us define, for each scenario  𝑗  from 1 to  𝑁: 

𝑝−1

𝐷𝑗 ≔ ∑(𝑣𝑢 − 𝑣𝑢−1)𝐸𝑗(𝑠𝑢) + (𝑡1𝑦 − 𝑣𝑝−1)𝐸𝑗(𝑠𝑝)

𝑢=1

By definition of  𝐷𝑗, we have  𝐸𝐸𝑃𝐸̂ =

1

𝑁

𝑁
∑ 𝐷𝑗
𝑗=1

. 

𝑝−1
For  𝐷: = ∑ (𝑣𝑢 − 𝑣𝑢−1)𝐸(𝑠𝑢) + (𝑡1𝑦 − 𝑣𝑝−1)𝐸(𝑠𝑝)
𝑢=1
estimated by: 

, the variance of  𝐷  can be 

𝑣𝑎𝑟̂ (𝐷) =

1
𝑁 − 1

𝑁

∑ (𝐷𝑗 −

𝑗=1

1
𝑁

𝑁
∑ 𝐷𝑘
𝑘=1

2
)

=

1
𝑁 − 1

∑ (𝐷𝑗 − 𝐸𝐸𝑃𝐸̂ )

𝑁

𝑗=1

2

 . 

Note: cases where  𝐸(𝑡0) ≥   𝐸𝐸̂ (𝑡1)  and/or  𝑠𝑝 = 𝑡1𝑦  are not derived in this annex. 
However similar equations can be obtained. 

An estimator of the variance of  𝐸𝐸𝑃𝐸̂   is then given by: 

𝑣𝑎𝑟𝑀2̂ (𝐸𝐸𝑃𝐸̂ ) =

1
𝑁

𝑣𝑎𝑟̂ (𝐷) =

1
𝑁(𝑁 − 1)

∑ (𝐷𝑗 − 𝐸𝐸𝑃𝐸̂ )

𝑁

𝑗=1

2

 . 

As mentioned in the first footnote of paragraph 58 of the chapter on counterparty 
credit risk requiring a statistical error at a 95% confidence level, the estimation of the 
MC error on  𝐸𝐸𝑃𝐸̂   should be calculated according to the following formula: 

𝑒𝑟𝑟𝑜𝑟̂ 𝑀2(𝐸𝐸𝑃𝐸̂ ) ∶= 𝛷−1(0.975)√𝑣𝑎𝑟𝑀2̂ (𝐸𝐸𝑃𝐸̂ ) 

                 ≃ 1.96 ∙ √

1
𝑁(𝑁 − 1)

∑ (𝐷𝑗 − 𝐸𝐸𝑃𝐸̂ )

𝑁

𝑗=1

2

 . 

The rationale of the formula is the same as that outlined in method 1, with a different 
estimator of the variance of  𝐸𝐸𝑃𝐸̂   and without a convergence adjustment. If we 
assume that  𝐸𝐸𝑃𝐸̂   follows a normal distribution, then  𝑒𝑟𝑟𝑜𝑟̂ 𝑀2(𝐸𝐸𝑃𝐸̂ )  can be 
interpreted as half of the length of the 95% two-sided confidence interval centred 

1    This assumes the longest-lasting transaction in the netting set has a maturity equal to or higher than 

one year and all time differences in the above formulas are expressed in units of a year (not dividing by 
the minimum between 1y and the netting set maturity for simplicity) – otherwise the normalised 
weighting as described in paragraph 86 of the chapter on counterparty credit risk needs to be applied. 

ECB guide to internal models – Annex 

362 

 
 
 
 
around 𝐸𝐸𝑃𝐸̂ . No adjustment (similar to  𝑐𝑜𝑛𝑣𝐴𝑑𝑗(. )  in the first method) is needed, 
since for usual values of  𝑁, we have  𝑐𝑜𝑛𝑣𝐴𝑑𝑗(𝑁)  close to 1, e.g. 𝑐𝑜𝑛𝑣𝐴𝑑𝑗(500) ≃
1.067  and  𝑐𝑜𝑛𝑣𝐴𝑑𝑗(1000) ≃ 1.046. 

A.3 

Aggregation across netting sets 

a) When risk factors are simulated all together (no “silo”), the MC error of the 
estimator of the EEPE for the full scope should be calculated in a similar way to that 
described for a single netting set, except that  𝐸𝐸𝑃𝐸̂ 𝑁  should be understood as the 
sum of the estimators of the EEPE related to all netting sets belonging to the 
institution’s portfolio. Assume that a set of n netting sets  𝐴 = {𝛼1, … , 𝛼𝑛}  is available 
for the MC error analysis. 

This means for method 1 that 

𝑣𝑎𝑟𝑀1̂ (𝐸𝐸𝑃𝐸𝑁̂ ) =

1
𝑚 − 1

𝑚

∑ (∑ 𝐸𝐸𝑃𝐸̂ 𝑁

𝑘(𝛼𝑖)

𝑘=1

𝛼𝑖∈𝐴

−

1
𝑚

𝑚

⬚
∑ ∑ 𝐸𝐸𝑃𝐸̂ 𝑁
𝑙
𝛼𝑖∈𝐴

𝑙=1

2
)

(𝛼𝑖)

should be inserted into the equation for  𝑒𝑟𝑟𝑜𝑟̂ 𝑀1(𝐸𝐸𝑃𝐸̂ ). 

For method 2, the addition needs to happen at the netting set-specific D term. 

𝐷𝑗 = ∑ 𝐷𝑗(𝛼𝑖)
𝛼𝑖∈𝐴

should be inserted into the equation for  𝑣𝑎𝑟𝑀2̂ (𝐸𝐸𝑃𝐸̂ 𝑁)  to calculate the variance, 
then this should be inserted into the equation for  𝑒𝑟𝑟𝑜𝑟𝑀2̂ (𝐸𝐸𝑃𝐸̂ 𝑁). 

b) When risk factors are not simulated all together (in cases where exposures are 
estimated through “silos”, e.g. one per asset class), the MC error should be derived 
from the MC errors of  𝐸𝐸𝑃𝐸̂ 𝑁  per silo. Using either method 1 or 2 for computing the 
MC error per silo as explained immediately above (item a), the error on the total 
portfolio is then given by: 

 (𝐸𝐸𝑃𝐸̂ 𝑁 𝑜𝑓 𝑡𝑜𝑡𝑎𝑙 𝑝𝑜𝑟𝑡𝑓𝑜𝑙𝑖𝑜 ) = √∑ (𝑒𝑟𝑟𝑜𝑟𝑀1
𝑀2

2
̂ (𝐸𝐸𝑃𝐸̂ 𝑁 𝑜𝑓 𝑠𝑖𝑙𝑜𝑖 ))

 , 

𝑆

𝑖=1

𝑒𝑟𝑟𝑜𝑟̂ 𝑀1
𝑀2

where 

• 

• 

𝑆  is the total number of silos, 

𝑠𝑖𝑙𝑜𝑖  is a sub-portfolio of the institution’s total portfolio corresponding to all the 
netting sets simulated in silo 𝑖. 

ECB guide to internal models – Annex 

363 

 
 
 
Abbreviations1 

Overarching principles for internal models 

Basel Committee on Banking Supervision (BCBS) 239 
Basel Committee on Banking Supervision “Principles for effective risk data aggregation and risk reporting”. 

Commission Delegated Regulation (EU) No 529/2014 
Commission Delegated Regulation (EU) No 529/2014 of 12 March 2014 supplementing Regulation (EU) No 575/2013 of the 
European Parliament and of the Council with regard to regulatory technical standards for assessing the materiality of extensions and 
changes of the Internal Ratings Based Approach and the Advanced Measurement Approach (OJ L 148, 20.5.2014, p. 36). 

Commission Delegated Regulation (EU) No 2015/942 
Commission Delegated Regulation (EU) 2015/942 of 4 March 2015 amending Delegated Regulation (EU) No 529/2014 
supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council as regards regulatory technical 
standards for assessing the materiality of extensions and changes of internal approaches when calculating own funds requirements 
for market risk (OJ L 154, 19.6.2015, p. 1), referred to in this guide as “Commission Delegated Regulation (EU) 2015/942”. 

Commission Delegated Regulation (EU) No 2022/439 
Commission Delegated Regulation (EU) 2022/439 of October 2021 supplementing Regulation (EU) No 575/2013 of the European 
Parliament and of the Council with regard to regulatory technical standards for the specification of the assessment methodology 
competent authorities are to follow when assessing the compliance of credit institutions and investment firms with the requirements 
to use the Internal Ratings Based Approach (OJ L 90, 18.3.2022, p. 1). 

Digital Operational Resilience Act 
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for 
the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and 
(EU) 2016/1011, referred to in this guide as the “Digital Operational Resilience Act”. 

EBA Guidelines on internal governance 
EBA Guidelines on internal governance (EBA/GL/2017/11). 

EBA Guidelines on Outsourcing 
EBA Guidelines on outsourcing (EBA/GL/2019/02). 

EBA Guidelines on SREP 
EBA Guidelines on common procedures and methodologies for the supervisory review and evaluation process (SREP) and 
supervisory stress testing under Directive 2013/36/EU (EBA/GL/2022/03). 

EBA Supervisory handbook on validation 
EBA Supervisory handbook on validation (EBA/REP/2023/09). 

ECB Guide on climate-related and environmental risks 
ECB Guide on climate-related and environmental risks (November 2020). 

ECB Guide on effective risk data aggregation and risk reporting 
ECB Guide on effective risk data aggregation and risk reporting (May 2024). 

ECB Guide on Materiality Assessment (EGMA) 
ECB Guide on Materiality Assessment (EGMA) (September 2017). 

ECB Guide on the supervisory approach to consolidation in the banking sector 
ECB Guide on the supervisory approach to consolidation in the banking sector (January 2021). 

ECB Guide on options and discretions available in Union law 
ECB Guide on options and discretions available in Union law (March 2022). 

EU 
European Union 

Final draft RTS on assessment methodology for IMA and significant share 
Final draft Regulatory Technical Standards on the specification of the assessment methodology for competent authorities regarding 
compliance of an institution with the requirements to use internal models for market risk and assessment of significant share under 
points (b) and (c) of Article 363(4) of Regulation (EU) No 575/2013 (EBA/RTS/2016/07). 

KPI 
Key performance indicator 

IT 
Information technology 

PPU 
Permanent partial use 

RDS 
Reference dataset 

RWEA 
Risk weighted exposure amount 

SLA 
Service level agreement 

1  Further commonly used abbreviations are available in the SSM glossary. 

ECB guide to internal models – Abbreviations 

364 

 
 
 
Credit risk 

Basel Committee on Banking Supervision (BCBS) 328 
Basel Committee on Banking Supervision “Guidelines: Corporate governance principles for banks”. 

Basel Committee on Banking Supervision (BCBS) – Newsletter No. 4 
Basel Committee Newsletter No. 4 (January 2005), “Update on work of the Accord Implementation Group related to validation under 
the Basel II Framework”. 

Basel Committee on Banking Supervision (BCBS) – Newsletter No. 9 
Basel Committee Newsletter No. 9 (September 2006), “The IRB Use Test: Background and Implementation”. 

Basel Committee on Banking Supervision (BCBS) – Regulatory consistency assessment programme (RCAP) 
Basel Committee on Banking Supervision “Regulatory Consistency Assessment Programme (RCAP) – Analysis of risk-weighted 
assets for credit risk in the banking book”. 

CCF 
Credit conversion factor 

CF 
Cash flow 

Commission Delegated Regulation (EU) No 2021/930 
Commission Delegated Regulation (EU) 2021/930 of 1 March 2021 supplementing the CRR with regard to regulatory technical 
standards specifying the nature, severity and duration of an economic downturn referred to in Article 181(1), point (b), and Article 
182(1), point (b), of that Regulation (OJ L 204, 10.6.2021, p. 1). 

Commission Implementing Regulation (EU) No 2021/451 (with regard to supervisory reporting of institutions) 
Commission Implementing Regulation (EU) 2021/451 of 17 December 2020 laying down implementing technical standards for the 
application of Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to supervisory reporting of 
institutions and repealing Implementing Regulation (EU) No 680/2014 (OJ L 97, 19.3.2021, p. 1–1955). 

Corrigendum to the ECB Regulation on discretion on materiality threshold 
Corrigendum to Regulation (EU) 2018/1845 of the European Central Bank of 21 November 2018 on the exercise of the discretion 
under Article 178(2)(d) of Regulation (EU) No 575/2013 in relation to the threshold for assessing the materiality of credit obligations 
past due (ECB/2018/26) (Official Journal of the European Union L 299 of 26 November 2018) (OJ L 217 08.07.2020, p. 8). 

CRCU 
Credit risk control unit 

CRM 
Credit risk mitigation 

EBA Guidelines on DoD 
EBA Guidelines on the application of the definition of default under Article 178 of Regulation (EU) No 575/2013 (EBA/GL/2016/07). 

EBA Guidelines on downturn LGD 
EBA Guidelines for the estimation of LGD appropriate for an economic downturn (“Downturn LGD estimation”) (EBA/GL/2019/03). 

EBA Guidelines on PD and LGD 
EBA Guidelines on PD estimation, LGD estimation and the treatment of defaulted exposures (EBA/GL/2017/16). 

EBA Guidelines on SRT 
EBA Guidelines on Significant Credit Risk Transfer relating to Articles 243 and Article 244 of Regulation 575/2013 
(EBA/GL/2014/05). 

ECB Regulation on discretion on materiality threshold 
Regulation (EU) 2018/1845 of the European Central Bank of 21 November 2018 on the exercise of the discretion under Article 
178(2)(d) of Regulation (EU) No 575/2013 in relation to the threshold for assessing the materiality of credit obligations past due 
(ECB/2018/26) (OJ L 299, 26.11.2018, pp. 55-57). 

EL 
Expected loss 

IRB-CCF 
Own estimates of credit conversion factor 

LRA 
Long-run average 

M 
Maturity 

MoC 
Margin of conservatism 

NACE 
Nomenclature statistique des activités économiques dans la Communauté Européenne 

NUTS 
Nomenclature of territorial units for statistics 

RR 
Recovery rate 

ECB guide to internal models – Abbreviations 

365 

 
 
 
SA 
Standardised approach 

SSCA 
Supervisory slotting criteria approach 

Regulation (EU) No 1093/2010 
Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European 
Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 
2009/78/EC (OJ L 331, 15.12.2010, p. 12), referred to in this guide as the “EBA Regulation”. 

Market risk – CRR2 

Actual P&L 
The daily actual changes in the portfolio’s value, as defined in Article 366(3) of the CRR. 

AVA 
Additional valuation adjustment 

CRM 
Comprehensive risk measure 

DVA 
Debit valuation adjustment 

Economic P&L 
The daily changes in the portfolio’s value (or profit and loss, P&L) calculated on the basis of end-of-day mark-to-market or mark-to-
model (depending on the instruments) values of the books and records of the institution, taking into account the independent price 
verification (IPV) process. It is generally calculated using front-office systems (position data, pricing models, valuation methods, 
pricing parameters, end-of-day market data, etc.). 

FX 
Foreign exchange 

Fundamental review of the trading book (FRTB) 
The document entitled “Minimum capital requirements for market risk” issued by the Basel Committee on Banking Supervision 
(BCBS) in January 2019. 

Hypothetical P&L 
The daily hypothetical changes in the portfolio’s value, as defined in Article 366(3) of the CRR. 

Position 
Understood to be a risk position. A risk position is a non-identically-zero sensitivity to a risk factor. Holding securities or entering into 
transaction contracts entails having a position. When defining a position, neither hedging nor netting should be considered. 

Top-of-the-house level 
Both (i) the legal entity for which an approval for the IMA approach has been granted, and (ii) (within the scope of the IMA) the 
highest level of the portfolio structure. 

RNIME 
Risk(s) not-in-the-model engines, as set out in detail in Section 7 of this chapter. In this document, the abbreviation “RNIME” may be 
singular or plural depending on whether it refers to a single risk, several risks, or collectively all risks not captured in the model 
engines. 

Market risk – CRR3 

Actual P&L 
The daily actual change in the portfolio’s value, as defined in Article 325bf(4)(b) of the CRR and Articles 1 and 2 of Commission 
Delegated Regulation (EU) No 2022/2059 (on back-testing requirements and P&L attribution requirements). 

BB 
Banking book; also referred to as non-trading book. 

Commission Delegated Regulation (EU) No 2022/2059 (on back-testing requirements and P&L attribution requirements) 
Commission Delegated Regulation (EU) 2022/2059 of 14 June 2022 supplementing Regulation (EU) No 575/2013 of the European 
Parliament and of the Council with regard to regulatory technical standards specifying the technical details of back-testing and profit 
and loss attribution requirements under Articles 325bf and 325bg of Regulation (EU) No 575/2013. 

Commission Delegated Regulation (EU) No 2022/2060 specifying the criteria (on assessing the modellability of risk factors 
under the internal model approach) 
Commission Delegated Regulation (EU) 2022/2060 of 14 June 2022 supplementing Regulation (EU) No 575/2013 of the European 
Parliament and of the Council with regard to regulatory technical standards specifying the criteria for assessing the modellability of 
risk factors under the internal model approach (IMA) and specifying the frequency of that assessment under Article 325be(3) of that 
Regulation. 

ECB guide to internal models – Abbreviations 

366 

 
 
 
 
Commission Delegated Regulation (EU) No 2023/1577 
Commission Delegated Regulation (EU) 2023/1577 of 20 April 2023 supplementing Regulation (EU) No 575/2013 of the European 
Parliament and of the Council with regard to regulatory technical standards on the calculation of the own funds requirements for 
market risk for non-trading book positions subject to foreign exchange risk or commodity risk and the treatment of those positions for 
the purposes of the regulatory back-testing requirements and the profit and loss attribution requirement under the alternative internal 
model approach (OJ L 193, 1.8.2023, p. 1–6). 

Commission Delegated Regulation (EU) No 2024/397 (on the calculation of the stress scenario risk measure) 
Commission Delegated Regulation (EU) 2024/397 of 20 October 2023 supplementing Regulation (EU) No 575/2013 of the 
European Parliament and of the Council with regard to regulatory technical standards on the calculation of the stress scenario risk 
measure. 

Commission Delegated Regulation (EU) No 2024/1085 (on the assessment methodology to use internal models for market 
risk) 
Commission Delegated Regulation (EU) 2024/1085 of 13 March 2024 supplementing Regulation (EU) No 575/2013 of the European 
Parliament and of the Council with regard to regulatory technical standards on the assessment methodology under which competent 
authorities verify an institution’s compliance with the requirements to use internal models for market risk. 

DRC 
Default risk charge under the IMA, as outlined in Article 325ba(2)(a) of the CRR. 

Economic P&L 
The daily changes in the portfolio’s value (or profit and loss, P&L) calculated on the basis of the end-of-day mark-to-market or mark-
to-model (depending on the instruments) values of the books and records of an institution, taking into account the independent price 
verification (IPV) process. It is generally calculated using front-office systems (position data, pricing models, valuation methods, 
pricing parameters, end-of-day market data, etc.). The term “end-of-day valuation process P&L” is used synonymously with 
“economic P&L”. 

ES 
Expected shortfall 

GIRR 
General interest rate risk 

Hypothetical P&L 
The daily hypothetical change in the portfolio’s value, as defined in Article 325bf(4)(a) of the CRR and Articles 3 and 4 of 
Commission Delegated Regulation (EU) No 2022/2059 (on back-testing requirements and P&L attribution requirements). 

IMA 
The alternative internal model approach for the calculation of own funds requirements for market risk. The term “FTRB IMA” is used 
synonymously in the foreword. 

IRT 
An internal risk transfer is an internal written record of a transfer of risk within the banking book, between the banking and the 
trading book, or within the trading book (between different desks). 

NMRF 
Non-modellable risk factor 

OFR 
Own fund requirements 

PES 
Partial expected shortfall measures as defined in Article 325bc of the CRR. 

PLA 
Profit and loss attribution 

Proxy/Proxies 
For the purposes of the chapter on market risk, the term “proxy/proxies” refers to data and is used solely where time series data 
needed for a risk factor in the IMA (for generating 10-business-day returns in the ES or SSRM model to calculate MR OFR) are do 
not relate directly to the data of the risk factor that has been subject to the RFMA. Differences between risk factors in the IMA and 
pricing factors in the end-of-day valuation process (in the frontoffice systems) are not regarded as proxies in the chapter on market 
risk. 

RFMA 
Risk factor modellability assessment. Basel regulation uses the term RFET (risk factor eligibility test) instead 

Top-of-the-house level 
Portfolio of all positions assigned to the trading desks for which a legal entity has been granted permission to use the IMA, as 
referred to in Article 325az(2) of the CRR. 

Risk-theoretical P&L 
Daily theoretical change in the portfolio’s value, as defined in Article 325bg(2) of the CRR and Article 12 of Commission Delegated 
Regulation (EU) No 2022/2059 (on back-testing requirements and P&L attribution requirements). 

SSRM 
Stress scenario risk measure 

ECB guide to internal models – Abbreviations 

367 

 
 
 
 
 
Counterparty credit risk 

Benchmarking system 
In the context of pricing functions mentioned in the guide, this means the respective front-office pricing functions, pricing functions of 
accounting systems or other benchmarks with which front-office prices are frequently compared (at least quarterly, as for CCR 
purposes). Values taken from such benchmarking systems are values after independent price verification (see Article 4(70) of the 
CRR) without any valuation adjustments beyond the default-free value (such as the credit valuation adjustment). 

DMP 
Default management process 

EEPE 
Effective expected positive exposure 

ETC 
Early termination clause 

IM 
Initial margin 

MPOR 
Margin period of risk 

OTC derivative 
Over the counter derivative 

Pricing function   
A dedicated implementation of a pricing model taking into account: 

• 

• 

• 

the input data used in this particular implementation (e.g. the input market data needed, day-count conventions, etc.); 

the parametrisation of the implemented pricing model including the method for its calibration; 

the numerical method used (e.g. binomial tree, finite difference, Monte Carlo, etc.). 

Pricing model 
The quantitative, mathematical model (e.g. a Black 76 swaption) that is used to determine the market value of a transaction for a 
given (current or future) date and specified market conditions/scenarios. 

Representative sub-portfolios   
A subset of all counterparties or netting sets that is representative of the full set at least in terms of: 

• 

transaction types and their “moneyness”; 

•  underlying risk factors; 

• 

the ratio of the value of short positions to the value of long positions; 

•  margin agreement types; 

• 

the ratio of margined to unmargined netting sets; 

and for which the institution is able to demonstrate to supervisors that the chosen sub-portfolios are sufficiently representative in 
terms of the above criteria and meaningful regarding the purpose for which the portfolio has been selected. 

RNIEPE 
Risk(s) not in effective expected positive exposure, as set out in detail in Section 13 of this chapter. In this document, the 
abbreviation “RNIEPE” may be singular or plural depending on whether it refers to a single risk, several risks, or collectively all risks 
inside the IMM which are not yet part of the EEPE or are not adequately captured in EEPE. 

𝒕𝟎 
The first date of the simulation time grid in the IMM and the reporting date for which the EEPE is calculated. It is thus equal to the 
“current date” referred to in Article 284(5) of the CRR. 

Systematically underestimated exposures 
This expression means a progressive, aggressive or non-conservative modelling of exposures in almost all cases compared with a 
precise treatment without approximations, which may refer to almost all cases of: 

•  simulated scenarios; 

•  portfolio configurations; 

•  market conditions at  t0; 

•  market conditions during the period used for calibration. 

This holds to the extent that “almost all cases” can be anticipated from past experience or historic time series. Otherwise, this 
expression refers to an a priori estimation, for example resulting from a mathematical consideration. Example: A model 
implementation approximates the true value of a bought vanilla call option inside a netting set by its intrinsic value (the value if 
exercised). Since the true value is always more than the intrinsic value before exercising the option, this modelling would lead to too 
low a transaction value and thus to too low a netting set value; hence, in this specific example, “almost all cases” changes even to 
“always”. 

If the expression is used in the context of the netting set value, it means that modelling/pricing leads in almost all cases to too low an 
overall netting set value, i.e. after applying the netting rules. If it is used in the context of single transaction values, it means that 
transactions with a positive value have in almost all cases too low a value and that transactions with a negative value (if they are 
also inside a netting set) have, in almost all cases, too high an absolute value compared with a precise treatment. 

Validation function 
This expression denotes the staff responsible for performing tasks and setting up processes relevant for the independent initial and 
ongoing model validation, including ongoing reviews of the CCR exposure model and its risk measures. In particular, the term refers 
to both qualitative and quantitative validation, with the latter also including back-testing of the CCR exposure model. 

ECB guide to internal models – Abbreviations 

368 

 
 
 
© European Central Bank, 2025 

Postal address 
Telephone 
Website 

60640 Frankfurt am Main, Germany 
+49 69 1344 0 
www.bankingsupervision.europa.eu 

All rights reserved. Reproduction for educational and non-commercial purposes is permitted provided that the source is acknowledged. 

For specific terminology please refer to the SSM glossary (available in English only). 

PDF 

ISBN 978-92-899-7291-8, doi:10.2866/7084473, QB-01-25-146-EN-N