IRRBB
6.5.2.1Assessment of inherent IRRBB
Through the assessment of the inherent level of IRRBB, competent authorities should determine the main drivers of the institution’s IRRBB exposure and evaluate the potential prudential impact of this risk on the institution.
Preliminary assessment
To determine the scope of the IRRBB assessment, competent authorities should first identify the sources of IRRBB to which the institution is or might be exposed and if there have been any significant changes. To do so, competent authorities should leverage the knowledge gained from ICAAP and ILAAP information collected for SREP purposes, from reporting established on IRRBB, from the assessment of other SREP elements, from the comparison of the institution’s position with those of its peers and from any other supervisory activities. As part of this, competent authorities should consider the institution’s governance of interest rate risk, including its main IRRBB strategy and its risk appetite in relation to IRRBB, and the level of internal capital the institution has allocated to IRRBB.
Nature and composition of the institution’s interest rate risk profile
Competent authorities should form a clear view on how changes in interest rates can have an adverse impact on an institution’s net interest income (and, where relevant, its earnings) and economic value (the present value of expected cash flows) to gain both a short-term and a longer-term view on the possible threat to capital adequacy.
For this purpose, competent authorities should analyse and form a clear view on the structure and features of the institution’s assets, liabilities, and off-balance-sheet exposures, including their sensitivities to changes in interest rates, maturities and repricing dates, and the proportion of products and positions with uncertain maturities (e.g. with embedded options or prepayment features) and any associated behavioural assumptions.
In addition, competent authorities should review the institution’s hedging strategy and the extent to which a natural hedge may apply (considering also the robustness of modelling of repricing maturities for items with an undefined maturity), the amount of derivatives used for hedging purposes and whether the derivatives may mitigate sensitivity in EVE, NII or other metrics used by the institution internally.
Competent authorities should also pay attention to any concentrations (e.g. in the loan or bond portfolios) in terms of repricing maturity or in products with automatic or behavioural optionality, non-performing exposures, and the nature of IRRBB embedded in fair value instruments, including less liquid instruments such as level 3 assets and liabilities.
When analysing the impact on the institution’s earnings, competent authorities should be aware of how much the institution’s returns depend on interest rate-sensitive positions, and they should determine how different changes in interest rates would affect the institution’s net interest income, as well as determining the effects of changes in the market value of instruments – depending on accounting treatment – either shown in the profit and loss (P&L) account or directly in equity (e.g. via other comprehensive income).
When analysing the impact on the institution’s economic value and earnings, competent authorities should first consider the results of the supervisory outlier tests stipulated in Article 98(5) of Directive 2013/36/EU and further specified in Delegated Regulation (EU) 2024/856, to get an initial benchmark against which to compare how interest rate changes would affect the institution. For this assessment, competent authorities should pay particular attention to the sensitivity of cash flows to repricing, in terms of both their timing and amount and to changes in the underlying key assumptions (particularly for customer accounts without specific repricing dates, customer accounts with embedded customer optionality and/or equity capital).
Where the institution is identified as an outlier by the supervisory outlier test on net interest income, competent authorities should consider analysing additional dimensions to complement the assessment, when deemed appropriate (e.g. given the institution’s the business model). Additional dimensions to consider may include market value changes of fair value instruments, the evaluation of the worst NII projections versus current realised NII and versus administrative expenses/overhead cost and net commissions/fees for capturing embedded losses/gains due to observed changes in the interest rates and in the market conditions.
Competent authorities should pay attention to the sensitivity of cash flows to changes in the valuation of fair value instruments in the non-trading book, including interest rate derivatives used for the hedging of non-trading book instruments (e.g. impact of mark-to- market changes in fair value instruments on P&L, hedge account effectiveness).
In addition to using the supervisory outlier test stipulated in Article 98(5) of Directive 2013/36/EU and further specified in Delegated Regulation (EU) 2024/856, competent authorities may require institutions to take into account other interest rate shock scenarios.
In their quantitative assessment, competent authorities should also consider the results of the institution’s internal or standardised methodologies for measuring IRRBB, among which competent authorities should also assess, for those institutions operating in different currencies, the impact for the economic value and earnings measures coming from different currencies and, where an internal methodology is applied, the approaches that the institutions use for the aggregation across these currencies. Through the analysis of these methodologies, competent authorities should gain a deeper understanding of the main risk factors underlying the institution’s IRRBB profile.
When analysing the results of both the impact of the supervisory outlier tests, and the institution’s internal or standardised methodologies, competent authorities should consider ‘point in time’ figures as well as historical trends. These rates should be compared to peers and considered in the context of the global market situation.
Shock Scenarios and stress testing
Competent authorities should assess and take into account the results of the interest rate shock scenarios for ongoing management as well as the IRRBB stress tests performed by the institution as part of its ongoing internal management process. In this context, competent authorities should be aware of the main sources of the institution’s IRRBB and in particular of the effect of changes in behavioural assumptions such as on NMD.
If, when the outcome of the institution’s shock scenarios and stress tests is reviewed, particular accumulations of repricing/maturity at different points on the curve are revealed or suspected, competent authorities may need to carry out additional analyses.
6.5.2.2Assessment of IRRBB management and control framework
To achieve a comprehensive understanding of the institution’s interest rate risk profile in the non-trading book, competent authorities should review the governance and framework underlying its interest rate exposures.
IRRBB strategy and appetite
Competent authorities should assess whether the institution has a sound, clearly formulated and documented IRRBB strategy and appetite, approved by the management body. For this assessment, among other factors, competent authorities should take into account the role of the management body in setting, approving and reviewing the IRRBB strategy and appetite, the proper implementation of this strategy by senior management as well as its appropriateness for the institution given its business model, its market environment and role in the financial system, and capital adequacy.
Organisational and internal control framework
Competent authorities should assess whether the institution has an appropriate organisational framework and clearly assigned responsibilities for IRRBB management, measurement, monitoring and control functions with sufficient human and technical resources. For this assessment, competent authorities should take into account the adequacy of the lines of responsibility for the overall management of IRRBB, and for taking, monitoring, controlling and reporting IRRBB, including the independence of the IRRBB control area.
Competent authorities should assess whether the institution has clearly defined policies and procedures for the management of IRRBB that are consistent with its IRRBB strategy and appetite, approved and reviewed regularly by the management body. The policies should be clearly formalised and communicated and applied consistently across the institution, as well as across banking groups. Competent authorities should verify that policies define the procedures for new product development, major hedging or risk management initiatives, ensuring that these are subject to adequate procedures and controls before they are undertaken and the institution has undertaken an analysis of their possible impact in its overall risk profile.
Competent authorities should assess whether the institution has an appropriate framework for identifying, evaluating, managing and mitigating IRRBB, in line with the level, complexity and riskiness of non-trading book positions and the institution’s size and complexity. The assessment should encompass internal models, such as those related to customer behaviour (e.g. models of deposit stability and loan early repayment). In this assessment competent authorities should evaluate whether the risk managers and the institution’s senior management understand the assumptions underlying the measurement systems and they are aware of the degree of model risk that prevails in the institution’s risk measurement techniques.
In addition, they should consider whether the information systems and measurement techniques enable management to measure the inherent IRRBB in all its material on- and off-balance- sheet exposures (where relevant at group level), including internal hedges, in concentrations in maturities and counterparties, in the non-trading book portfolio. The IRRBB framework should be subject to regular reviews and evaluations of the effectiveness of the framework. Competent authorities should compare internal reviews and evaluations with information from COREP.
Competent authorities should assess the institution’s approach to modelling the behaviour of non-maturity deposits (NMDs), including whether this takes account of relevant risk factors impacting NMD repricing behaviour. Competent authorities should use appropriate analytical tools for this assessment, taking into account the institution’s business model. Approaches that may be relevant include evaluation of how the institution segments NMDs using risk factors related to the customer, institution or market profile and benchmarking with peers that have a similar risk profile. In addition, competent authorities should consider how the institution balances historical data with forward looking approaches and expert judgment, and review the impact on NII and EVE if behavioural assumptions were adjusted.
Competent authorities should consider whether the institution’s internal measurement systems (IMS) take into account all material forms of interest rate risk to which the institution is exposed (e.g. gap risk, basis risk and option risk). The IMS should be properly calibrated, independently validated, back-tested and reviewed at an appropriate frequency. Competent authorities should take into account whether the IMS is supported by documentation considering the nature, scale and complexity of the IRRBB inherent in the business model and the institution’s activities.
Competent authorities should assess whether the institution has an appropriate monitoring and internal reporting framework for IRRBB that ensures there is prompt action at the appropriate level of the institution’s senior management or management body, where necessary. The monitoring system should include specific indicators and relevant triggers to provide effective early warning alerts (e.g. for breaches of IRRBB limits). Competent authorities should take into account whether the management and control area reports the results of the monitoring regularly to the management body and senior management, with an appropriate frequency depending on the scale, complexity and level of IRRBB exposures.
Competent authorities should assess whether the institution has a strong and comprehensive control framework and sound safeguards to mitigate its exposures to IRRBB in line with its risk management strategy and risk appetite, including an appropriate limit system on both IRRBB measures. The internal control function should include all consolidated entities, all geographical locations and all financial activities. Competent authorities should assess the functionality of the internal audit function, including whether its reviews are conducted sufficiently frequently and cover the main elements of the IRRBB framework.