Commission Delegated Regulation (EU) 2024/1085 of 13 March 2024 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical standards on the assessment methodology under which competent authorities verify an institution’s compliance with the requirements to use internal models for market risk

• (c) verify whether all the differences between the pricing functions used to compute the end-of-day value and the pricing functions used in the internal risk-measurement model are validated as part of the internal validation referred to in Article 325bj of Regulation (EU) No 575/2013;

• (d) assess, on the basis of the profit and loss attribution results and the back-testing results, whether there are pricing functions that may present deficiencies;

• (e) analyse the conclusions in the most recent reports by the institution’s internal validation referred to in Article 325bj of Regulation (EU) No 575/2013 regarding the accuracy of the internal risk-measurement model;

• (f) analyse the conclusions laid down in the most recent reports about the institution’s internal review of the accuracy of the internal risk-measurement model, as referred to in Article 325bi(1), point (h), of Regulation (EU) No 575/2013;

• (g) verify whether the institution has documented the differences between the internal risk-measurement model and the models that the institution uses for its internal risk management for the same scope of positions, and whether the institution is able to explain those differences;

• (h) analyse the results of the tests performed by the institution as part of its internal validation to verify whether the assumptions made in the internal risk-measurement model are appropriate and do not underestimate or overestimate the risk, as referred to in Article 325bj(3), point (a), of Regulation (EU) No 575/2013, in particular for the trading desks with the highest differences between the own funds requirements calculated in accordance with the alternative standardised approach referred to in Part Three, Title IV, Chapter 1a of Regulation (EU) No 575/2013, and the own funds requirements calculated in accordance with the internal risk-measurement model.

For the purposes of point (d), competent authorities may, where appropriate, require the institution to calculate, on a set of instruments and commodities for which the competent authority wants to test the accuracy of the pricing functions, the risk-theoretical changes referred to in Chapter 2, Section 2, of Commission Delegated Regulation (EU) 2022/2059 [^ntr10-L_202401085EN.000101-E0010] and the hypothetical changes referred to in Chapter 1, Section 2, of that Delegated Regulation, and require the institution to justify differences in outcome between the two measures.

• (a) the actual, hypothetical, and risk theoretical changes over 60 business days in the trading desk portfolio’s value, without any hedges with the entity of the group being considered;

• (b) the value-at-risk numbers at trading desk level as referred to in Article 325bf of Regulation (EU) No 575/2013 over 60 business days, without any hedges with the entity of the group being considered;

• (c) an assessment of the profit and loss attribution results and back-testing results in light of the changes in the portfolio’s values referred to in point (a) and the value-at-risk numbers referred to in point (b).

Article 21

Assessment of the internal risk-measurement model in relation to additional back-testing programmes

• (a) runs the back-testing programme referred to in paragraph 2 or another internal back-testing programme that enables the institution to identify the contribution of modellable and non-modellable risk factors to the back-testing results;

• (b) applies direct expected shortfall back-testing approaches to its portfolios.

For the purposes of point (b), competent authorities shall verify how the institution motivates the choice of the applied direct expected shortfall back-testing methodology, and analyse whether that methodology is conceptually sound.

The institution may use the back-testing programmes referred to in the first subparagraph as an element to detect and monitor potential deficiencies in the calculation of the excepted shortfall measures. Where a competent authority decides on the permission to use the internal model approach to compute the own funds requirement for market risk in accordance with Article 325az, those back-testing programmes shall not supersede the outcomes of the regulatory back-testing referred to in Article 325bf of Regulation (EU) No 575/2013 and the profit and loss attribution requirements referred to in Article 325bg of that Regulation.

• (a) an overshooting is identified as a one-day change in HPL MRF or in

• (b) APL MRF that exceeds the value-at-risk number referred to in Article 325bf(6), point (a), of Regulation (EU) No 575/2013;

• (c) HPL MRF and APL MRF are calculated as follows:

Image omitted; see official source

Image omitted; see official source

Where:

• — HPL are the hypothetical changes in the portfolio’s value;

• — APL are the actual changes in the portfolio’s value;

• — RTPL are the risk-theoretical changes in the institution’s portfolio’s value;

• — RTPL MRF are the risk-theoretical changes in the institution’s portfolio’s value considering only changes to modellable risk factors;

• (d) the institution identifies potential weaknesses in its risk-measurement model by counting the overshootings, as identified in accordance with point (a), that occurred over the last 250 business days, and by comparing the amount of the identified overshootings against the thresholds referred to in Article 325bf(3), points (a) and (b), of Regulation (EU) No 575/2013.

CHAPTER 3 ASSESSMENT OF THE INTERNAL RISK-MEASUREMENT MODEL USED TO COMPUTE THE EXPECTED SHORTFALL RISK MEASURE AND THE STRESS SCENARIO RISK MEASURE

SECTION 1 Overview of the assessment

Article 22

Introduction to the assessment of the internal risk-measurement model used to compute the expected shortfall measure and the stress scenario risk measure

When assessing an institution’s compliance with the requirements applicable to the internal risk-measurement model used to compute the expected shortfall risk measure and the stress scenario risk measure, competent authorities shall assess whether the institution complies with:

• (a) Section 2 of this Chapter, which contains requirements on risk factors, including the modellability assessment and the mapping to the appropriate liquidity horizon;

• (b) Section 3 of this Chapter, which contains requirements on data quality and the proxy approaches used in the calculation of:

• (i) the expected shortfall measure referred to in Article 325bb of Regulation (EU) No 575/2013;

• (ii) the stress scenario risk measure referred to in Article 325bk of Regulation (EU) No 575/2013;

• (c) Section 4 of this Chapter, which contains requirements on back-testing and profit and loss attribution;

• (d) Section 5 of this Chapter, which contains requirements on the treatment of foreign exchange risk and commodity risk in the non-trading book;

• (e) Section 6 of this Chapter, which contains requirements on the expected shortfall measure and the stress scenario risk measure calculations.

SECTION 2 Assessment of the internal risk measurement model’s risk factors set-up and properties

Subsection 1 Assessment of the internal risk measurement model’s risk factors set-up

Article 23

Assessment of the internal risk-measurement model’s coverage of the risk

• (a) the institution documents whether there are risk factors used in the standardised approaches that are not included in the internal risk-measurement model;

• (b) the institution highlights all of the following aspects:

• (i) whether there are currencies for which general interest rate risk, including inflation risk or cross-currency basis risk, are not modelled;

• (ii) whether there are issuer’s credit spreads that are not modelled;

• (iii) whether there are equity spot prices and equity repo rates that are not modelled;

• (iv) whether there are commodity spot prices that are not modelled;

• (v) whether there are spot exchange rates that are not modelled;

• (vi) whether there are cases where the implied volatility in instruments with optionality is not modelled;

• (c) where there are risk factors used in the alternative standardised approach that are not included in the internal risk-measurement model, the institution, in addition to providing information on the impact of the exclusion of those risk factors on the profit and loss attribution results as required by Article 325bh(1), point (a), of Regulation (EU) No 575/2013:

• (i) provides an appropriate rationale for not including those risk factors in the internal risk-measurement model and, where such exclusion is due to a lack of representative prices for those risk factors, the rationale for not capturing those risk factors in the calculation of the stress scenario risk measure referred to in Article 325bk of Regulation (EU) No 575/2013, and documents such a rationale;

• (ii) calculates and monitors the impact on the own funds requirements resulting from excluding those risk factors from the internal risk-measurement model.

• (a) require the institution to provide an overview of the factors used in the calculation of the end-of-day value of the portfolio, including, where appropriate, a list of aggregates of factors used in the calculation of the end-of-day value, which specifies, for each aggregate, all of the following:

• (i) the number of factors per aggregate;

• (ii) the broad category of risk factors and broad sub-category of risk factors, as referred to in Table 2 of Article 325bd of Regulation (EU) No 575/2013, to which the factors in the aggregate can be mapped;

• (iii) a gross and net sensitivity of the institution portfolio to the factors that are part of the aggregate;

• (iv) whether the factors are included or not in the internal risk-measurement model, and:

• (1) where included, whether each factor is directly modelled as a risk factor in the internal-risk measurement model without any proxy being used, or whether other techniques are used;

• (2) where not included, the rationale for that choice.

• (b) based on the overview referred to in point (a):

• (i) verify that there are no material factors that are not modelled, and that the rationales supporting the exclusions of non-modelled factors are appropriate;

• (ii) assess how the institution, for factors that are not modelled directly as risk factors in the risk-measurement model referred to in point (a)(iv), ensures that all material risks, including material basis risks, are captured.

For the purposes of point (a), institutions shall aggregate factors so that each aggregate shares the same attributes in relation to point (ii), point (iv)(1), and point (iv)(2).

For the purposes of point (b)(i), competent authorities shall apply the assessment method referred to in paragraph 3, and may complement that method by the assessment method referred to in paragraph 4.

For the assessment referred to in paragraph 2, point (b)(i), competent authorities shall identify trading desks or hypothetical portfolios used by the institution for the internal validation referred to in Article 325bj(3), point (c), of Regulation (EU) No 575/2013 whose values depend on factors that are not included in the internal risk-measurement model. Competent authorities shall verify for those trading desks whether the results of the back-testing referred to in Article 325bf of Regulation (EU) No 575/2013 or of the own internal model validation tests referred to in Article 325bj(3), point (b), of Regulation (EU) No 575/2013 indicate weaknesses in the internal risk-measurement model.

• (a) require the institution to calculate:

• (i) the hypothetical changes in a trading desk portfolio’s value or in the hypothetical portfolio’s value calculated in accordance with Article 3 of Delegated Regulation (EU) 2022/2059;

• (ii) the hypothetical changes in the trading desk portfolio’s value or in the hypothetical portfolio’s value calculated in accordance with Article 3 of Delegated Regulation (EU) 2022/2059, while keeping unchanged the factors that are not included as risk factors in the internal risk-measurement model;

• (iii) the risk-theoretical changes in the trading desk portfolio’s value or in the hypothetical portfolio’s value calculated in accordance with Article 12 of Delegated Regulation (EU) 2022/2059.

• (b) require the institution to explain deviations in the changes in the portfolio’s values calculated in accordance with points (a)(i), (ii), and (iii).

Article 24

Assessment of general interest rates risk factors

• (a) require the institution to provide a list of all the currencies towards which the institution’s portfolio is sensitive and, for each of those currencies, all the yield curves towards which the institution’s portfolio is sensitive;

• (b) require the institution, for each of the yield curves referred to in point (a), to specify whether a curve is modelled in its entirety directly, or whether it is modelled as a sum of a base curve and a basis curve;

• (c) require the institution to provide a sensitivity analysis of its portfolio towards each of the yield curves referred to in point (a);

• (d) verify, by using the information referred to in points (a), (b) and (c), that the basis risk between any two given yield curves is either implicitly captured by the fact that two yield curves are modelled directly, or by the fact that a basis yield curve representing the difference between those two yield curves is included in the internal-risk measurement model;

• (e) perform, in relation to yield curves where risk factors are points in the curve, an additional assessment in accordance with Article 29 of this Regulation and, where buckets are established by the institution in accordance with Article 5(4) of Commission Delegated Regulation (EU) 2022/2060 [^ntr11-L_202401085EN.000101-E0011], verify whether the institution uses at least six risk factors where both of the following conditions are met:

• (i) the exposure to the yield curve is material;

• (ii) the exposure is in a most liquid currency as referred to in Annex I to Commission Delegated Regulation (EU) 2022/2058 [^ntr12-L_202401085EN.000101-E0012];

• (f) perform, in relation to curves that have been modelled by means of function parameters as referred to in Article 6 of Delegated Regulation (EU) 2022/2060, an additional assessment of compliance in accordance with Article 29 of this Regulation;

• (g) assess whether vega risk related to interest rate risk is duly captured as required by Article 30 of this Regulation.

Article 25

Assessment of equity risk factors

• (a) require the institution to provide a list of all equity names and equity indices towards which the institution’s portfolio is sensitive, and the risk factors used to model the associated risk;

• (b) require the institution to provide a sensitivity analysis of its portfolio towards each of the equity names and equity indices referred to in point (a);

• (c) verify that, where the risk in an equity name is modelled as a sum of a systematic risk factor as referred to in Article 3(3) of Delegated Regulation (EU) 2022/2060 and idiosyncratic risk factor, the volatility generated by shocking those factors reflects the volatility observed for that equity name;

• (d) verify that the basis risk between two different equity names is captured by either modelling the two equity names directly or by means of a basis risk factor;

• (e) assess whether the risk in changes in equity curves is duly captured in accordance with Article 29 of this Regulation;

• (f) assess whether vega risk related to equity risk is duly captured in accordance with Article 30 of this Regulation.

For the purposes of point (c), the competent authority may, where appropriate, compare the volatility of the shocks applied to the issuer equity name, as resulting from the systematic and idiosyncratic risk factors, with the volatility observed for that equity name.

Article 26

Assessment of credit spread risk factors

• (a) require the institution to provide a list of all issuers’ credit spreads curves and credit indices towards which the institution’s portfolio is sensitive, and the risk factors used to model the associated risk;

• (b) require the institution to provide a sensitivity analysis of its portfolio towards each of the issuers’ credit spreads curves and credit indices referred to in point (a);

• (c) verify whether, where the risk in an issuer credit spread is modelled as a sum of a systematic risk factor as referred to in Article 3(3) of Delegated Regulation (EU) 2022/2060 and an idiosyncratic risk factor, the volatility generated by shocking those factors reflects the volatility observed for that issuer credit spread;

• (d) verify whether the basis risk between issuers is captured by either modelling the issuers’ credit spreads directly or by means of a basis risk factor, and whether the basis between different positions referencing to the same issuer is monitored and, when material, included in the internal risk-measurement model;

• (e) assess whether the risk in changes in credit spread curves is duly captured as required by Article 29 of this Regulation;

• (f) assess whether vega risk related to credit spread risk is duly captured as required by Article 30 of this Regulation.

For the purposes of point (c), competent authorities may, where appropriate, compare the volatility of the shocks applied to the issuer credit spread, as resulting from the systematic and idiosyncratic risk factors, with the volatility observed for that issuer credit spread.

Article 27

Assessment of foreign exchange risk factors

• (a) require the institution to provide a list of all the currency pairs towards which the institution’s portfolio is sensitive and, for each of those currency pairs, to clarify whether that currency pair is subject to the spot exchange rate only, or other risk factors, including implied volatilities;

• (b) require the institution to provide a sensitivity analysis of its portfolio towards each currency pair referred to in point (a);

• (c) based on the information referred to in points (a) and (b), verify whether the basis risk between any couple of currency pairs is implicitly captured by either of the following:

• (i) the fact that the two currency pairs are modelled directly;

• (ii) the fact that a basis representing the difference between those two currencies pairs is included in the internal-risk measurement model;

• (d) assess the extent to which the institution considers the risk linked to unpegging events for non-free floating currency pairs, and where such risk is material, how it is monitored;

• (e) assess whether the risk in changes in foreign-exchange curves is duly captured as required by Article 29 of this Regulation;

• (f) assess whether vega risk related to foreign-exchange risk is duly captured as required by Article 30 of this Regulation.

Article 28

Assessment of commodity risk factors

• (a) require the institution:

• (i) to provide a list of all the types of commodities towards which the institution’s portfolio is sensitive;

• (ii) for each of the commodity type referred to in point (i), to clarify whether that commodity type is subject to the spot price of the commodity only, or other risk factors, including implied volatilities;

• (iii) to provide a sensitivity analysis of its portfolio towards each of the commodity types referred to in point (a);

• (b) verify whether the institution’s internal policies identify metrics that are appropriate to assess the materiality of a commodity market as referred to in Article 325bh(1), point (f), of Regulation (EU) No 575/2013 and whether, for commodity markets identified as material, each different commodity is specifically modelled in the institution’s internal risk-measurement model;

• (c) verify whether the basis risk between similar but not identical commodities towards which the institution has material exposure is captured, including the basis risk stemming from a different place of delivery and from maturity mismatches;

• (d) assess whether the risk in changes in commodity curves is duly captured as required by Article 29 of this Regulation;

• (e) assess whether vega risk related to commodity risk is duly captured as required by Article 30 of this Regulation.

For the purposes of point (c), competent authorities shall verify whether the institution models two different commodities directly or captures the basis by means of a basis risk factor.

Article 29

Assessment of curves

• (a) where required to assess curves whose points are risk factors as referred to in Article 4 of Delegated Regulation (EU) 2022/2060, paragraph 2 of this Article;

• (b) where required to assess curves that have been modelled by means of function parameters as referred to in Article 6 of Delegated Regulation (EU) 2022/2060, paragraph 4 of this Article.

For the purposes of points (a) and (b), competent authorities shall assess the interpolation and extrapolation techniques used by the institution in accordance with paragraph 6.

• (a) the institution’s internal policies have established criteria to decide on the numbers of risk factors to be used to model a curve, and that such criteria are based on the liquidity and materiality of the positions with exposure to that curve;

• (b) the criteria referred to in point (a) are accompanied by an analysis showing that the number of risk factors used allows for the volatility across different tenors to be captured.

For the purposes of point (b), where the competent authority considers that the number of risk factors used to model a curve are not appropriate, competent authorities may complement their assessment using the assessment method referred to in paragraph 3.

• (a) require the institution to apply scenarios of future shocks to the curve’s risk factors as made in the internal risk-measurement model;

• (b) require the institution to derive the volatility of a point in the curve that is not a risk factor;

• (c) require the institution to obtain the observed volatility of the point in the curve referred to in point (b);

• (d) compare the volatility obtained in accordance with point (b) with the observed volatility obtained in accordance with point (c).

For the assessment referred to in paragraph 2, point (b), competent authorities shall base themselves on both the period referred to in Article 325bc(4), point (c), of Regulation (EU) No 575/2013 and the period of financial stress referred to in Article 325bc(2), point (c), of that Regulation.

• (a) require the institution to apply scenarios of future shocks to the function parameters as made in the internal risk-measurement model;

• (b) require the institution to derive the volatility of a point in the curve;

• (c) require the institution to obtain the volatility of the point in the curve referred to in point (b);

• (d) compare the volatility obtained in accordance with point (b) with the observed volatility obtained in accordance with point (c).

For that assessment, competent authorities shall base themselves on both the period referred to in Article 325bc(4), point (c), of Regulation (EU) No 575/2013 and the period of financial stress referred to in Article 325bc(2), point (c), of that Regulation.

Article 30

Assessment of implied volatility surfaces

• (a) require the institution to provide a list of all the volatility surfaces towards which the institution’s portfolio is sensitive;

• (b) require the institution to provide a sensitivity analysis of its portfolio towards each of the surfaces referred to in point (a);

• (c) verify, based on the information referred to in points (a) and (b), whether any material basis risk between any two given surfaces is either implicitly captured by the fact that two surfaces are modelled directly, or by the fact that a basis surface representing the difference between those two curves is modelled;

• (d) verify, in relation to volatility surfaces whose points are risk factors as referred to in Article 4 of Delegated Regulation (EU) 2022/2060, whether:

• (i) the institution’s internal policies have established criteria to decide on the numbers of risk factors to be used to model a surface, and whether such criteria are based on the liquidity and materiality of the positions exposed to that surface;

• (ii) the criteria referred to in point (i) are accompanied by an analysis showing that the number of risk factors used allows for a comprehensive representation of the risk across the surface;

• (e) verify, in relation to surfaces that have been modelled by means of function parameters as referred to in Article 6 of Delegated Regulation (EU) 2022/2060, whether the institution’s internal policies include an analysis showing that shocking functions parameters allow for a comprehensive representation of the risk across the surface;

• (f) assess whether interpolation and extrapolation techniques used by the institution to build a surface are sound and where part of the surface is derived by extrapolating its two outer points, verify whether the volatility of the returns observed in the market for the extrapolated part of the surface does not significantly differ from that resulting from the extrapolation.

For the purposes of point (a), the institution shall for each of the surfaces referred in that point specify whether it is modelled in its entirety directly, or whether it is modelled as a sum of a base surface and a basis surface.

For the purposes of point (d)(ii), competent authorities may, where appropriate, complement their assessment by using the assessment method referred to in paragraph 2.

For the purposes of point (e), competent authorities may, where appropriate, complement their assessment by using the assessment method referred to in paragraph 3.

For the purposes of point (f), competent authorities may apply the assessment method referred to in paragraphs 2 and 3 by picking a point in the surface obtained via extrapolation when applying points (b) of those paragraphs.

• (a) require the institution to apply scenarios of future shocks to the surface’s risk factors as made in the internal risk-measurement model;

• (b) require the institution to derive the volatility of a point of the surface that is not a risk factor;

• (c) require the institution to obtain the observed volatility of the point in the surface referred to in point (b);

• (d) compare the volatility obtained in accordance with point (b) with the observed volatility obtained in accordance with point (c).

For the assessment referred to in paragraph 1, point (d)(ii), competent authorities shall base themselves on both the period referred to in Article 325bc(4), point (c), of Regulation (EU) No 575/2013 and the period of financial stress referred to in Article 325bc(2), point (c), of that Regulation.

• (a) require the institution to apply scenarios of future shocks to the function parameters as made in the internal risk-measurement model;

• (b) require the institution to derive the volatility of a point of the surface;

• (c) require the institution to obtain the observed volatility of the point in the surface referred to in point (b);

• (d) compare the volatility obtained in accordance with point (b) with the observed volatility obtained in accordance with point (c).

For the assessment referred to in paragraph 1, point (e), competent authorities shall base themselves on both the period referred to in Article 325bc(4), point (c), of Regulation (EU) No 575/2013 and the period of financial stress referred to in Article 325bc(2), point (c), of that Regulation.

Article 31

Assessment of correlation risk factors

When assessing whether an institution’s internal risk-measurement model captures correlation risk as required by Article 325bh(1), point (b), of Regulation (EU) No 575/2013, competent authorities shall verify that, for multi-underlying options and any other products whose end-of-day value is determined via an implied correlation parameter, a risk factor capturing the risk of changes in the correlation parameter is included in the internal risk-measurement model.

The competent authority may identify options and products relying on an implied correlation parameter by using the information reported in accordance with Article 23 of this Regulation, and by identifying those factors that are correlation parameters.

Subsection 2 Assessment of the risk factors properties

Article 32

Assessment of the modellability of risk factors

• (a) the internal policies cover the aspects referred to in Article 7 of Delegated Regulation (EU) 2022/2060 for all documentation;

• (b) the internal policies require the production of an up-to-date inventory which specifies for each risk factor the following:

• (i) a description of the risk factor;

• (ii) whether the risk factor is modellable following the modellability assessment referred to in Article 325be of Regulation (EU) No 575/2013, and whether the risk factor has ever changed its modellability status in the previous year;

• (iii) the 12 month-period used for the modellability assessment;

• (iv) whether the risk factor is a systematic credit or equity risk factor, as referred to in Article 3(3) of Delegated Regulation (EU) 2022/2060;

• (v) whether the risk factor is a point of a curve, a surface, or a cube, as referred to in Article 4(1) of Delegated Regulation (EU) 2022/2060, the bucket used for assessing the modellability of that risk factor, and the results of the modellability assessment of that bucket;

• (vi) whether the risk factor is a function parameter used to represent a curve, a surface, or a cube, as referred to in Article 6(1) of Delegated Regulation (EU) 2022/2060, and:

• (1) the set of points of the curve, surface or cube that have been used to calibrate the parametric function as referred to in Article 6(1) of Delegated Regulation (EU) 2022/2060;

• (2) the set of buckets, and their modellability, as resulting from the application of the steps referred to in Article 6(1), points (b) and (c), of Delegated Regulation (EU) 2022/2060;

• (3) the set of points of the curve, surface or cube that have been used to calibrate the function parameter as referred to in Article 6(2) of Delegated Regulation (EU) 2022/2060;

• (vii) the number of verifiable prices that are representative for the risk factor over the period considered for the modellability assessment;

• (viii) whether there are 90-day periods with less than four verifiable and representative prices;

• (c) the internal policies set out:

• (i) criteria to identify risk factors for which the institution applies the shifted period referred to in Article 1(2) and Article 4(3) of Delegated Regulation (EU) 2022/2060;

• (ii) criteria to establish whether risk factors are to be considered to be of the same type, as referred to in Article 1(2), point (a), of that Regulation;

• (d) the internal policies set out criteria to determine whether the modellability assessment of a curve, surface, or cube is performed by using standard, pre-defined buckets as referred to in Article 5(2) of Delegated Regulation (EU) 2022/2060, or by using the institution’s own establishment of buckets as referred to in Article 5(4) of that Delegated Regulation;

• (e) the internal policies set out the rationale of the choice, where the standard pre-defined buckets referred to in Article 5(2) of Delegated Regulation (EU) 2022/2060 are subdivided into smaller buckets in accordance with Article 5(3) of that Regulation.

For the purposes of points (b)(vii) and (viii), where the institution performs the modellability assessment for a risk factor by assessing the modellability of a set of buckets first, competent authorities shall verify whether the number of verifiable and representative prices are specified at the level of each of those buckets.

• (a) verify, in relation to the results of the modellability assessment:

• (i) by using the inventory referred to in paragraph 1, point (b), that those risk factors meet any of the two criteria referred to in Article 1(1), points (a) and (b) of Delegated Regulation (EU) 2022/2060;

• (ii) where applicable, by using the inventory referred to in paragraph 1, point (b), that the period used for the modellability assessment complies with Article 1(2) of Delegated Regulation (EU) 2022/2060;

• (b) in relation to the requirements for considering a price verifiable as referred to in Article 2 of Delegated Regulation (EU) 2022/2060:

• (i) verify whether:

• (1) the institution’s internal systems and policies, and its contractual agreements with third-party vendors, ensure that the conditions referred to in Article 2(1) of Delegated Regulation (EU) 2022/2060 are met;

• (2) there are any prices that meet the conditions referred to in Article 2(2) of Delegated Regulation (EU) 2022/2060 that are considered verifiable;

• (ii) by reviewing the audit reports, verify whether the independent audit referred to in Article 2(6) of Delegated Regulation (EU) 2022/2060 is robust and covers all the aspects referred to in that paragraph;

• (iii) where applicable, review the contractual arrangements referred to in Article 2(7) of Delegated Regulation (EU) 2022/2060;

• (c) in relation to the requirements for considering a verifiable price as representative of a risk factor as referred to in Article 3 of Delegated Regulation (EU) 2022/2060, verify whether the mapping process and the criteria used to determine the representativeness of a price for a risk factor as referred to in Article 7(1), point (d), of that Delegated Regulation are sound.

For the purposes of point (a)(ii), competent authorities shall verify whether the criteria referred to in paragraph 1, point (c) to identify whether risk factors are of the same type are sound and, by using the inventory referred to in paragraph 1, point (b), verify whether those criteria are applied correctly.

For the purposes of point (b)(i), competent authorities shall apply the assessment method referred to in paragraph 5.

For the purposes of point (c), competent authorities shall apply the assessment method referred to in paragraph 6.

• (a) in relation to the results of the modellability assessment:

• (i) by using the inventory referred to in paragraph 1, point (b), verify whether the bucketing of curves, surfaces and cubes complies with the conditions referred to in Article 5(2) or Article 5(4) of Delegated Regulation (EU) 2022/2060, and that the institution correctly applies the criteria referred to in paragraph 1, point (d), of this Article to select the bucketing approach;

• (ii) where the institution uses the set of standard pre-defined buckets referred to in Article 5(2), point (d), of Delegated Regulation (EU) 2022/2060, verify whether any conversion of buckets into a different market-standard convention is appropriate;

• (iii) by using the inventory referred to in paragraph 1, point (b), verify whether the buckets that are assessed as modellable meet any of the two conditions referred to in Article 4(2), points (a) and (b), of Delegated Regulation (EU) 2022/2060;

• (iv) by using the inventory referred to in paragraph 1, point (b), verify whether the period used for the modellability assessment is the same for all buckets of a given curve, surface or cube;

• (b) in relation to the requirements for considering a price verifiable as referred to in Article 2 of Delegated Regulation (EU) 2022/2060:

• (i) by reviewing the institution’s internal systems and policies, and its contractual agreements with third-party vendors, ensure that:

• (1) the conditions referred to in Article 2(1) of Delegated Regulation (EU) 2022/2060 are met;

• (2) that no prices that meet the conditions referred to in Article 2(2) of that Delegated Regulation are considered verifiable;

• (ii) by reviewing the audit reports, verify whether the independent audit to which third-party vendors are subject is robust and covers all the aspects referred to Article 2(6) of Delegated Regulation (EU) 2022/2060;

• (iii) where applicable, review the contractual arrangements between the institution and the third-party vendors referred to in Article 2(7) of Delegated Regulation (EU) 2022/2060;

• (c) in relation to the requirements for allocating a verifiable price to a bucket as referred to in Article 4(4) of Delegated Regulation (EU) 2022/2060, verify whether the mapping process and the criteria referred to in Article 7(1), point (d), of that Regulation used to determine that a price is representative for a point in the bucket are sound;

• (d) in relation to the possibility of reallocating a verifiable price of a bucket to an adjacent bucket in accordance with Article 5(5) of Delegated Regulation (EU) 2022/2060, verify:

• (i) whether the approach documented in accordance with Article 7(1), point (f), of that Regulation used by the institution to perform such reallocation is appropriate;

• (ii) how the institution ensures that the conditions under which reallocation is allowed in accordance with Article 5(5) of Delegated Regulation (EU) 2022/2060 are fulfilled.

For the purposes of point (b)(i), competent authorities shall apply the assessment method referred to in paragraph 5.

For the purposes of point (c), competent authorities shall apply the assessment method referred to in paragraph 7.

• (a) in relation to the results of the modellability assessment:

• (i) by using the inventory referred to in paragraph 1, point (b), verify whether the buckets of the curve, surface or cube modelled through a parametric function that are assessed as modellable meet any of the two conditions referred to in Article 4(2), points (a) and (b), of Delegated Regulation (EU) 2022/2060;

• (ii) by using the inventory referred to in paragraph 1, point (b), verify whether:

• (1) the institution uses the bucketing approach set out in Article 5(2) of Delegated Regulation (EU) 2022/2060;

• (2) any conversion of buckets into a different market-standard convention in accordance with Article 5(2), point (d), of that Regulation is appropriate;

• (iii) by using the inventory referred to in paragraph 1, point (b), verify whether the institution assesses the function parameter as modellable only where all points in the curve, surface or cube that are used to calibrate that function parameter belong to buckets that are modellable;

• (b) in relation to the requirements for considering a price verifiable as referred to in Article 2 of Delegated Regulation (EU) 2022/2060:

• (i) verify whether:

• (1) the institution’s internal systems and policies, and its contractual arrangements with third-party vendors, ensure that the conditions referred to in Article 2(1) of Delegated Regulation (EU) 2022/2060 are met;

• (2) there are no prices that meet the conditions referred to in Article 2(2) of Delegated Regulation (EU) 2022/2060 that are considered verifiable;

• (ii) by reviewing the audit reports, verify whether the independent audit to which third-party vendors are subject is robust and covers all aspects referred to in Article 2(6) of Delegated Regulation (EU) 2022/2060;

• (iii) where applicable, review the contractual arrangements between the institution and the third-party vendors referred to in Article 2(7) of Delegated Regulation (EU) 2022/2060;

• (c) in relation to the requirements for allocating a verifiable price to a bucket as referred to in Article 4(4) of Delegated Regulation (EU) 2022/2060, verify whether the mapping process and the criteria referred to in Article 7(1), point (d), of that Regulation used to determine that a price is representative for a point in the bucket are sound;

• (d) in relation to the possibility of reallocating a verifiable price of a bucket to an adjacent bucket in accordance with Article 5(5) of Delegated Regulation (EU) 2022/2060, verify:

• (i) whether the approach documented in accordance with Article 7(1), point (f), of that Regulation used by the institution in performing such reallocation is appropriate;

• (ii) how the institution ensures that the conditions under which reallocation is allowed in accordance with Article 5(5) of Delegated Regulation (EU) 2022/2060 are fulfilled.

For the purposes of point (b)(i), competent authorities shall apply the assessment method referred to in paragraph 5.

For the purposes of point (c), competent authorities shall apply the assessment method referred to in paragraph 7.

• (a) require the institution to provide a sample of risk factors and buckets, with the corresponding verifiable and representative prices, including:

• (i) risk factors and buckets that narrowly met the conditions for being assessed as modellable;

• (ii) risk factors and buckets that changed their modellability status over the previous year;

• (iii) where applicable, risk factors and buckets for which verifiable prices are obtained solely by the institution, solely by third-party vendors, and by both the institution and third-party vendors;

• (b) require the institution to justify for the prices referred to in point (a), of this paragraph which of the conditions referred to in Article 2(1) of Delegated Regulation (EU) 2022/2060 are met, and verify the following:

• (i) where the condition referred to in Article 2(1), point (a), of Delegated Regulation (EU) 2022/2060 is met, how the institution assessed that the transaction was entered at arm’s length;

• (ii) where the condition referred to in Article 2(1), point (b), of Delegated Regulation (EU) 2022/2060 is met, how the institution or the third-party vendor assessed that the transaction was entered at arm’s length;

• (iii) where the condition referred to in Article 2(1), point (c), of Delegated Regulation (EU) 2022/2060 is met, how the institution or the third-party vendor identified both bid and offer quotations;

• (c) for the verifiable prices referred to in point (a), competent authorities shall verify:

• (i) whether the price is not a transaction or bid and offer quotation between two entities of the same group as referred to in Article 2(2), point (a), of Delegated Regulation (EU) 2022/2060, and whether the approach that the institution or the third-party vendor used to conclude that the two entities do not belong to the same group is sound;

• (ii) how the institution or the third-party vendor concluded that the volume of the transaction or committed quote associated with the verifiable price is non-negligible as referred to in Article 2(2), point (b), of Delegated Regulation (EU) 2022/2060, and whether the metrics employed to evaluate the negligibility are sound;

• (iii) where the verifiable price relates to committed quotes as referred to in Article 2(1), point (c), of Delegated Regulation (EU) 2022/2060:

• (1) how the institution or the third-party vendor concluded that the bid-offer spread does not deviate substantially from applicable market conditions as referred to in Article 2(2), point (c), of that Regulation;

• (2) whether the metrics employed to evaluate such potential deviation are sound;

• (iv) whether among those prices some may be considered to meet the conditions referred to in Article 2(2), point (b) or Article 2(2), point (c), of Delegated Regulation (EU) 2022/2060 because they are characterised by an unusually low volume or by an unusually large bid-offer spread;

• (v) whether the institution or the third-party vendor identified a time zone that is used consistently across all data sources to identify the observation date of the verifiable price as required by Article 2(3) of Delegated Regulation (EU) 2022/2060.

For the purposes of this paragraph, competent authorities shall require institutions or third-party vendors as applicable to provide them with all information that they need to perform that assessment comprehensively, in accordance with Article 2(5), point (b), of Delegated Regulation (EU) 2022/2060.

• (a) require an institution to provide a sample of risk factors, and the corresponding verifiable and representative prices used to assess the conditions referred to in Article 1 of Delegated Regulation (EU) 2022/2060;

• (b) verify whether, where for the risk factor there are multiple verifiable prices on a given observation date, only one is considered when assessing whether the conditions referred to in Article 1 of Delegated Regulation (EU) 2022/2060 are met;

• (c) for those risk factors in the sample referred to in point (a) that are not systematic credit or equity risk factors capturing market-wide movements as referred to in Article 3(3) of Delegated Regulation (EU) 2022/2060, verify whether:

• (i) the risk factor is a strong driver of the price considered representative

• (ii) whether the method used by the institution to conclude that there is a close relationship between the risk factor and that price is sound;

• (iii) the methodology employed by the institution to extract the value of the risk factor from that price is sound;

• (d) for those risk factors in the sample referred to in point (a) that are systematic credit or equity risk factors capturing market-wide movements as referred to in Article 3(3) of Delegated Regulation (EU) 2022/2060, verify whether the verifiable prices used are representative of attributes of the systematic risk factors.

For the purposes of point (a), the sample of risk factors shall include, among others, risk factors that narrowly met the conditions for being assessed modellable and risk factors that changed their modellability status over the previous year. Where applicable, that sample shall contain risk factors for which verifiable prices are obtained solely by the institution, solely by third-party vendors, and by both the institution and third-party vendors.

• (a) require the institution to provide a sample of buckets relating to a set of curves, surfaces or cubes, and the corresponding verifiable and representative prices;

• (b) for the verifiable prices referred to in point (a), verify, for the buckets for which there are multiple verifiable prices on a given observation date, that only one verifiable price per each date is considered when assessing whether the conditions referred to in Article 1 of Delegated Regulation (EU) 2022/2060 are met;

• (c) for the verifiable prices referred to in point (a), assess that the methodology employed by the institution to map a verifiable price to a given bucket is appropriate.

For the purposes of point (a), the sample of buckets shall include, among others, buckets that narrowly met the conditions for being assessed modellable and buckets that changed their modellability status over the previous year. Where applicable, that sample shall include buckets for which verifiable prices are obtained solely by the institution, solely by third-party vendors, and by both the institution and third-party vendors.

For the purposes of point (c), the competent authority shall verify whether:

• (a) the points in a bucket are a strong driver of the price considered representative,

• (b) the method used by the institution to conclude that there is a close relationship between any point in the bucket and that price is sound,

• (c) the methodology employed by the institution to extract the value of that point in the bucket from that price is sound.

Article 33

Assessment of the risk factors’ liquidity horizon

• (a) a description of the risk factor;

• (b) whether the risk factor is modellable following the assessment of the modellability referred to in Article 325be of Regulation (EU) No 575/2013 and, where the risk factor is modellable, whether that risk factor is included in the subset of modellable risk factors referred to in Article 325bc(2), point (a), of that Regulation;

• (c) a simple description of the data inputs used to mark the risk factor;

• (d) the liquidity horizon assigned to the risk factor as required by Article 325bd(2) of Regulation (EU) No 575/2013;

• (e) whether the nature of the risk factor does not correspond to any broad category of risk factors as required by Article 1(2) of Delegated Regulation (EU) 2022/2058;

• (f) whether the nature of the risk captured by the risk factor and the data inputs used for that risk factor correspond to risk factors that could fall under more than one broad category of risk factors or broad sub-category of risk factors as required by Article 1(3) of Delegated Regulation (EU) 2022/2058;

• (g) where used to model a homogenous index, whether the methodology referred to in Article 1 of Delegated Regulation (EU) 2022/2058 or the methodology referred to in Article 2 of that Regulation has been used to map the risk factor to the appropriate broad category and sub-category of risk factors of Table 2 of Article 325bd of Regulation (EU) No 575/2013.

• (a) by using the elements referred to in paragraph 1 of this Article:

• (i) there is consistency between the nature of the risk factors, the data inputs used for the risk factors, and the broad category and sub-category of risk factors of Table 2 of Article 325bd, of Regulation (EU) No 575/2013;

• (ii) equity and credit risk factors that reflect a systematic component have been subject to the treatment referred to in Article 1(3) of Delegated Regulation (EU) 2022/2058, when those risk factors are calibrated using data inputs related to different broad categories or sub-categories of risk factors;

• (iii) basis risk factors representing the difference between two risk factors that if modelled directly by the institution, instead of the basis, would be assigned to two different sub-categories, are subject to the treatment referred to in Article 1(3) of Delegated Regulation (EU) 2022/2058;

• (iv) where a risk factor is not among risk factors referred to in Articles 3 and 4 of Delegated Regulation (EU) 2022/2058 and that risk factor does not unambiguously relate to one of the broad sub-categories of risks of Table 2 of Article 325bd of Regulation (EU) No 575/2013, that risk factor is mapped to the sub-category ‘other’ of the appropriate category;

• (v) equity risk factors recognised as equity with large market capitalisation meet one of the conditions referred to in Article 7(1) of Delegated Regulation (EU) 2022/2058;

• (b) the institution has in place objective criteria for identifying when a credit spread risk factor refers to an investment grade or a high yield position;

• (c) where the institution applies the derogation set out in Article 325bd(3) of Regulation (EU) No 575/2013 regarding the use of longer liquidity horizons in calculating the expected shortfall risk measure referred to in Article 325bb of that Regulation and the stress scenario risk measure referred to in Article 325bk of that Regulation, the institution distinguishes between positions belonging to trading desks for which the derogation is used from those trading desks for which the derogation is not used;

• (d) as part of the monthly verification referred to in Article 325bd(6) of Regulation (EU) No 575/2013, the institution verifies whether:

• (i) due to a change in the equity capitalisation or in the components of indices referred to in Article 7(1), point (b), of Delegated Regulation (EU) 2022/2058, there has been a change in the appropriate sub-category for an equity risk factor;

• (ii) due to migration or other credit quality events, there has been a change in the appropriate sub-category for a credit spread risk factor;

• (e) only one currency is considered domestic for the purpose of mapping a risk factor to the broad category ‘Interest rate’ and sub-category ‘Most liquid currencies and domestic currency’ of Article 325bd, Table 2, of Regulation (EU) No 575/2013.

For the purposes of point (c), competent authorities shall focus on risk factors belonging to the sub-category subject to the derogation and that are present both in trading desks for which the derogation is used and in trading desks for which the derogation is not used.

SECTION 3 Assessment of proxies and data quality

Article 34

Assessment of proxies

• (a) the institution has established, as part of the internal policies referred to in Article 325bi(1), point (e), of Regulation (EU) No 575/2013, criteria outlining:

• (i) when a risk factor is proxied;

• (ii) how a risk factor would be proxied if subject to a proxy approach.

• (b) the internal policies referred to in Article 325bi(1), point (e), of Regulation (EU) No 575/2013 cover all proxy approaches employed by the institution, including, where used:

• (i) factor models;

• (ii) beta approximations;

• (iii) mapping of risk factors to benchmarks, including names representative of the sector and region or indices;

• (c) for non-modellable risk factors, there is a clear rationale for using a proxy approach, even though the number of returns N in the time series for the risk factor resulting from Article 7 of Delegated Regulation (EU) 2024/397 would allow for using the historical method or the asymmetrical sigma method referred to, respectively, in Articles 8 and 9 of that Delegated Regulation;

• (d) the approach used to proxy the risk factor is appropriate and ensures, as required by Article 325bh(1), point (g), of Regulation (EU) No 575/2013, a conservative calibration of the scenarios of future shocks for modellable risk factors and of the extreme scenarios of future shock for non-modellable risk factors;

• (e) for risk factors for which proxy data are used only for specific periods in the time series, there are no anomalous jumps between the parts of the time series that are proxied and the parts of the time series that are not proxied.

• (a) the proxy approach used for those risk factors is the approach described in the internal policies as referred to in paragraph 1, point (a), and the proxy used is economically meaningful;

• (b) the basis risk between that risk factor as proxied and other risk factors is duly captured, including where different risk factors are proxied by mapping them to the same risk factor;

• (c) there are no cases where, as a result of the proxy, the specific risk is not duly captured.

When applying that assessment method, competent authorities shall choose a sample of risk factors reflecting a variety of proxy approaches, including, where used, factor models, beta approximations, and mapping of risk factors to benchmarks, including names representative of the sector and region or indices.

• (a) require the institution to provide the time series of the proxied risk factors as used in the internal risk-measurement model and the time series of the corresponding pricing factors as used in the end-of-day valuation process;

• (b) verify that the volatilities of the two time series referred to in point (a) do not substantially diverge;

• (c) verify that the two time series are highly correlated.

When applying that assessment method, competent authorities shall choose a sample of risk factors reflecting a variety of proxy approaches, including, where used, factor models, beta approximations, and mapping of risk factors to benchmarks, including names representative of a given sector and region or indices.

• (a) require the institution to provide the time series of a sample of risk factors that are not proxied and that, if proxied, would follow the proxy approach being assessed;

• (b) require the institution to provide the time series that would be used by applying the proxy approach being assessed to the risk factors’ time series referred to in point (a);

• (c) for both time series, obtain the volatilities of the risk factors in the stress period and in the last 12-month period, and verify that the volatility resulting from the proxy time series referred to in point (b) does not underestimate the volatility resulting from the time series referred to in point (a).

When applying that assessment method, competent authorities shall choose a sample of risk factors reflecting a variety of proxy approaches, including, where used, factor models, beta approximations, and mapping of risk factors to benchmarks, including names representative of a given sector and region or indices.

• (a) require the institution to provide the original time series for the risk factors before any proxy approach has been used;

• (b) require the institution to provide the time series used for the proxied risk factors;

• (c) compare the upward and downward calibrated shocks as resulting from the application of Article 8 and 9 of Delegated Regulation (EU) 2024/397 to the time series referred to in points (a) and (b) of this paragraph, and verify that shocks resulting from the proxied time series are not systematically less conservative than the shocks obtained by using the original time series.

When applying that assessment method, competent authorities shall choose a sample of risk factors reflecting a variety of proxy approaches, including, where used, factor models, beta approximations, and mapping of risk factors to benchmarks, including names representative of the sector and region or indices.

Article 35

Assessment of the data quality

• (a) the institution documents, as part of its internal policies, any methodology used to fill in time series with missing data points, and whether such documentation contains sound analysis showing that those methodologies do not affect the risk factors’ volatilities and correlations;

• (b) the institution has established objective criteria setting out which methodology to fill in time series is used, where more than one methodology is available, and has documented those criteria in its internal policies;

• (c) the institution has established, as part of its internal policies, the process to be followed whenever the values in a time series are changed, and whether such process includes the documentation of the performed changes;

• (d) the institution does not perform filtering of data, including flooring, capping and exclusions of outliers, unless the institution is able to demonstrate that the excluded data point relates to erroneous or stale data, and the institution documents such an exclusion;

• (e) the institution performs periodic quality checks on the time series used for the computation of the expected shortfall risk measure, and documents those checks and the corresponding results are documented;

• (f) the institution analyses, as part of the checks referred to in point (e), the effect that missing or replaced data and the methodology used to obtain the time series have on the risk factors’ volatilities and correlations;