The ECB guide to internal models provides guiding principles for the use of internal models in assessing credit risk, counterparty credit risk, and market risk. It compiles chapters on general topics and risk-type-specific issues, incorporating feedback from financial institutions. This document is now outdated, and the latest version can be found on the ECB's banking supervision website.
The document is the "ECB Guide to internal models - consolidated version, October 2019", published by the European Central Bank (ECB) - Banking Supervision (SSM) in 2019. It is a 230-page guide, of which only the first 74 pages are provided here. The guide covers principles, requirements and best practices for the use and supervision of internal models in European banks, notably for calculating prudential capital requirements for credit, market and counterparty risks. The scope includes general themes, internal governance, validation, internal audit, model usage, the progressive deployment of the IRB approach, and regulatory requirements applicable within the European Union, particularly under the CRR and CRD IV framework, as well as draft regulatory technical standards (RTS) under adoption.
The ECB guide on internal models aims to clarify the interpretation and application of European regulatory requirements (CRR, CRD IV) related to the use of internal models for calculating banks' capital requirements. This topic is crucial as internal models directly influence risk measurement and the determination of regulatory capital, impacting financial stability and institutions' competitiveness. The main findings are:
- The need for robust governance, with clear responsibilities within management bodies and comprehensive model documentation (p. 6-10).
- The importance of a model risk management framework, including a model register, independent validation and internal audit policies (p. 9, 12).
- The requirement for initial and annual model validation, with precise quantitative and qualitative methods, alert thresholds, and regular reporting to governing bodies (p. 23-32).
- Careful supervision of the progressive deployment of the IRB approach, with a minimum coverage threshold of 50% of exposures in terms of EAD and RWEA, and an approved and controlled deployment plan (p. 13-17).
- Effective use of models in risk management, credit approval, pricing and monitoring, with formalized policies (p. 35-39).
The conclusions emphasize the need for consistent and integrated application of principles across banking groups, strong independence of validation and audit functions, and active involvement of governance bodies. Recommendations focus on implementing clear policies, maintaining up-to-date documentation and registers, conducting rigorous validations, and transparent communication with supervisory authorities. This guide serves to harmonize practices and strengthen confidence in internal models used in the European banking sector.
This guide was developed by the ECB within its role as the Single Supervisory Mechanism (SSM) to clarify its understanding of European regulatory requirements related to internal models used by financial institutions. The issue is to ensure a homogeneous, transparent and rigorous application of CRR and CRD IV rules, notably regarding approval, validation, governance and use of internal models for calculating capital requirements. The stakes are high as these models directly impact the measurement of credit, market and counterparty risks, and thus financial stability. The guide aims to provide a common framework for supervisory teams and institutions by specifying expectations, best practices and procedures, while respecting the existing legal framework. It takes into account draft regulatory technical standards (RTS) under adoption, without replacing them. The scope covers internal models for credit, market and counterparty risks, as well as governance, validation, audit, progressive deployment (roll-out) and model usage aspects. Limitations relate to the non-inclusion of parts of the document not provided (beyond page 74) and the non-final adoption of RTS at the time of publication.
Internal governance:
- Institutions must clearly define management and governance bodies' roles and responsibilities concerning internal models, with precise documentation (p. 9-11).
- Designated committees must have a clear mandate, be chaired by a management member, and ensure approval of material model aspects (p. 11).
- The Credit Risk Control Unit (CRCU) must be independent from commercial functions and report directly to management (p. 22).
Model risk management:
- A model risk management framework must be in place, including a written policy, a model register, qualitative and quantitative assessment methodologies, and communication procedures (p. 9).
Model documentation and register:
- All models must be documented to allow independent understanding, including methodology, data, usage instructions, validation results, and versioning (p. 7-9).
Progressive deployment of the IRB approach:
- IRB must be deployed on at least 50% of exposures in EAD and RWEA at consolidated level, with an approved deployment plan and a maximum duration of 5 years (p. 13-16).
- Any plan modification must be approved by the supervisory authority, with justification (p. 16).
- Use of the standardized approach for certain portfolios requires explicit authorization (p. 14-17).
Internal validation:
- Initial and annual validation is mandatory, with organizational separation between validation and development (p. 10-12, 23-32).
- Quantitative and qualitative validation covering discriminatory power, data representativeness, stability, override analysis, benchmarking, data quality, specification review, and code quality assurance (p. 24-31).
- Quantitative thresholds trigger investigations and corrective measures (p. 27, 31).
- Reporting results to governing bodies with follow-up on corrective actions (p. 31-32).
Internal audit:
- Annual audit of rating systems and operations, with an audit plan based on risk assessment (p. 32-34).
- In-depth audits (deep dives) for high-risk areas, at least every 3 years for others (p. 33).
- Independent audit of validation and CRCU, with reporting to management (p. 12, 33).
Model usage:
- IRB parameters must be used in risk management, credit approval, pricing, and monitoring (p. 35-39).
- Internal policies must formalize this usage and include user training (p. 36-38).
- Usage may be adjusted or indirect, provided it is justified and documented (p. 36).
Materiality of rating systems:
- Classification according to quantitative criteria (share of EAD and RWEA) and qualitative criteria (risk, complexity, strategic importance) (p. 18).
- Material systems are subject to enhanced validation and reporting requirements (p. 18-19).
Internal reporting:
- Regular reports adapted to the recipient (management or board) and materiality, including performance, limits, validation, stress tests (p. 19-21).
- Higher frequency for the board, at least annual for management (p. 20).
Governance understanding of models:
- Management must have a general understanding, the board a deep understanding of models (p. 21).
- Training, workshops and exchanges are recommended to maintain this knowledge (p. 21-22).
- Debates and challenges must be documented in minutes (p. 21).
Findings:
- The ECB provides a detailed interpretation of European regulatory requirements for internal models, based on CRR, CRD IV and draft RTS (p. 5-7).
- Institutions must reach a minimum threshold of 50% IRB coverage in EAD and RWEA, with an approved deployment plan (p. 13-16).
- Internal validation is mandatory, initial and annual, with precise quantitative and qualitative methods, and reporting to governing bodies (p. 23-32).
- Internal audit must conduct an annual review of models, with a plan based on risk assessment (p. 32-34).
- Models must be used in risk management, credit approval, pricing and monitoring, with formalized policies (p. 35-39).
Assumptions:
- Organizational independence between validation and development can take several forms, depending on institution size and complexity (p. 10-11).
- Quantitative thresholds for validation tests are defined by the institution, with mandatory action in case of exceedance (p. 27).
Interpretations:
- Strong governance and comprehensive documentation are essential to ensure model reliability and transparency (p. 6-11).
- Consistency in applying principles within banking groups is crucial to avoid risks related to divergent implementations (p. 7-8).
- Active involvement of management and the board in model approval and monitoring is good practice (p. 11, 19-21).
Uncertainties:
- Some parts of the guide rely on draft RTS not yet adopted, which may lead to future modifications (p. 6).
- The guide does not cover parts beyond page 74, limiting full visibility on certain specific aspects of market and counterparty risks.
The author concludes that institutions must establish a robust and coherent framework for internal model management, including:
- Clear governance with defined responsibilities at management and control body levels.
- Complete and up-to-date model documentation, accessible and verifiable.
- A formalized model risk management framework, with policies, a model register and assessment methodologies.
- Independent internal validation, initial and annual, with rigorous quantitative and qualitative methods, and transparent reporting.
- Regular and thorough internal audit, based on risk assessment, ensuring compliance with regulatory requirements.
- Progressive deployment of the IRB approach respecting minimum thresholds and approved by authorities.
- Effective use of models in risk management, decision-making and pricing, formalized in internal policies.
- Regular and adapted communication to governing bodies on model performance, limits and developments.
The guide also recommends continuous monitoring of deployment plans and usages, as well as rapid adaptation to regulatory changes. Finally, it highlights the importance of harmonized coordination within banking groups to ensure consistency of practices.
Synthesis note written from the full document by DataSAI Academy. This note comes from the scientific library of the DataSAI Academy, open to all.