EBA欧洲银行-Revised-Guidelines-on-SREP-28EBA-GL-2018-0329_MT_79页_1mb

Summary of EBA/GL/2018/03

Core Content

EBA/GL/2018/03 is an updated version of the EBA/GL/2014/13 guidelines, which provide common procedures and methodologies for the Supervisory Review and Evaluation Process (SREP) and Supervisory Stress Testing. These guidelines are in line with Article 16 of Regulation (EU) No 1093/2010, and are applicable from 01.01.2019. The guidelines define key terms, set out reporting requirements, and outline the implementation process for supervisory evaluation and stress testing across the European Union.

Main Requirements for Reporting

• Competent authorities must notify the EBA whether they comply with these guidelines or not, including any non-conformities, by 01.04.2019.
• Notifications must be sent to compliance@eba.europa.eu with the reference "EBA/GL/2018/03".
• Notifications should be submitted by the competent authority that has the supervisory role, and any changes in compliance status must be reported to the EBA.
• Notifications will be published on the EBA website in accordance with Article 16(3) of Regulation (EU) No 1093/2010.

Key Updates and Amendments

1. The title of the guidelines now includes "and supervisory stress testing".
2. A new sentence is added to Paragraph 1, emphasizing that the guidelines provide common methodologies for competent authorities to use when conducting supervisory stress tests.
3. A new sentence is added to Paragraph 2, explaining that the guidelines do not establish methodologies for stress tests conducted by the EBA in cooperation with competent authorities, but instead describe the framework for future supervisory stress tests.
4. A new sentence is added to Paragraph 3, defining "institutional capital" as an institution that is subject to prudential requirements under the consolidated basis as per Part 1, Title 2, Chapter 2 of Regulation (EU) No 575/2013.
5. The definition of "ICT risk" is updated to include risks related to the confidentiality, integrity, availability, and capacity of IT systems and data.
6. In Paragraph 26, the term "general SREP score" is introduced, indicating the supervisory perspective on the institution's overall resilience.
7. Paragraphs 26a to 26d provide detailed descriptions of how competent authorities should assign scores for risk and resilience, based on the evaluation of different categories and elements of SREP.
8. The first sentence of Paragraph 28 is replaced with a new one that describes the use of risk and resilience scores for the evaluation of individual elements within SREP.
9. A new subheading "2.2.2. Resilience Scores" is added after Paragraph 31.
10. Paragraph 31 is updated to explain how risk and resilience scores are used to indicate the likelihood that an institution may need supervisory measures and to support the prioritization of supervisory resources.
11. A new subheading "2.2.3 General SREP Scores" is added after Paragraph 31.
12. Paragraph 32 is replaced to detail the use of general SREP scores for evaluating the institution's overall resilience, and for indicating the likelihood of needing supervisory measures.

Key Definitions

• "General SREP score": Represents the supervisory perspective on the institution's overall resilience, based on the aggregated assessment of the five SREP elements.
• "Risk score": A numerical expression of the supervisory assessment of individual risks affecting capital, liquidity, and funding, reflecting the probability of significant prudential impact.
• "Resilience score": A numerical expression of the supervisory assessment of individual elements of SREP, representing an indicator of the institution's resilience.
• "Institutional capital": An institution that is subject to prudential requirements under the consolidated basis.
• "ICT risk": Risk related to the confidentiality, integrity, availability, and capacity of IT systems and data.

Implementation Scope

The guidelines apply to all competent authorities and financial institutions, and are primarily addressed to institutions. They cover the following areas:

• Risk and Resilience Scoring: Competent authorities must assign scores for risk and resilience based on the evaluation of different categories and elements of SREP.
• Governance and Controls: The internal governance and control framework must be adequate, proportionate, and transparent, consistent with the institution's risk profile, business model, and strategy.
• Organizational Structure and Functioning: The composition and functioning of the management body must be appropriate and transparent, with clear responsibilities and effective succession planning.
• Corporate Culture and Risk Culture: The corporate culture and risk culture must be aligned with the institution's risk profile and strategy, and must be communicated effectively to all relevant parties.
• Remuneration Policies: Remuneration policies must be consistent with the institution's risk profile, strategy, and governance, and must avoid conflicts of interest.
• Internal Control Framework: The internal control framework must be effective, with clear responsibilities, adequate resources, and independence.
• Risk Management Framework: The risk management framework must be robust, with clear governance and control mechanisms, and must include the ICAAP, ILAAP, and NPAP processes.

Key Information

• The guidelines aim to enhance the supervisory process by providing a structured framework for risk and resilience scoring.
• Competent authorities must ensure that the scoring reflects the likelihood of significant prudential impact and the effectiveness of risk management and control processes.
• The updated guidelines include detailed requirements for the governance, internal controls, risk management, and remuneration policies of financial institutions.
• The EBA encourages the use of different methodologies for the aggregation of risk and resilience scores, while ensuring consistency with the overall SREP framework.