Assessment of BMA robustness and identification of vulnerabilities
Competent authorities should perform an analysis of quantitative features of the institution’s current business model to assess its ability to generate acceptable profits in the short, medium and long term, given the institution’s risk appetite and its funding and capital structures. Areas for analysis by competent authorities should include:
drivers of profitability, including trends, by assessing the underlying elements of the institution’s earning capacity, after exception items and one-offs, breakdown of income streams, breakdown of costs and costs allocation, impairment provisions and key ratios (e.g. net interest margin, cost/income, loan impairment, and cost of risk). This assessment may be complemented by the analysis of the relevant risk-adjusted profitability metrics (e.g. Return On Allocated Capital – ROAC, or the Risk-Adjusted Return on Capital Return - RAROC), where these are available and deemed reliable;
the balance sheet, including trends, by assessing the asset and liability mix, funding structure, change in the TREA and own funds, and key ratios (e.g. return on equity/assets, Core Tier 1, funding gap), as well as concentrations in the P&L and balance sheet related to customers, sectors and geographies;
risk appetite and tolerance levels, by assessing the formal limits put in place by the institution by risk type and its adherence to them to understand the risks that the institution is willing to take to drive its financial performance and to ensure operational resilience. This should also cover the impact tolerance for ICT disruptions.
Competent authorities should perform an analysis of qualitative features of the institution’s current business model to understand its success drivers and key dependencies. Areas for analysis by competent authorities should include:
the business environment, by assessing the forward-looking environment in which the institution operates based on its main or material geographic and business exposures. As part of this assessment, competent authorities should develop an understanding of the key macroeconomic variables, market trends, the competitive landscape and other relevant developments (such as regulatory and legal changes);
key internal and external dependencies, by assessing main exogenous and endogenous factors that may influence the success of the business model, considering associated governance and internal control arrangements;
franchise and areas of competitive advantage, by assessing the reputation of the institution and the strength of relationships with customers, suppliers and partners, as well as whether there are areas in which the institution has a competitive advantage over its peers;
ICT support, by assessing the level and adequacy of alignment between the ICT and the business in terms of strategy, objectives, activities, resources and functions, and by considering whether any ICT-related concerns could impact the institution’s business strategy and objectives.
Competent authorities should complement the analysis by carrying out a forward-looking analysis (both quantitative and qualitative) of the institution’s financial projections and strategic plan to understand the underlying assumptions and dependencies, plausibility and riskiness of its business strategy. Areas for analysis by competent authorities should include:
overall strategy and success drivers, by assessing the main quantitative and qualitative management objectives and the gap between the envisaged business model – post execution
and the current model;
projected financial performance, by assessing the plausibility and consistency of the assumptions made by the institution that drive its strategy and forecasts;
execution capabilities, by assessing management’s track record on delivering previous strategies and forecasts, as well as the overall ability of the institution to make use of competitive advantages and success drivers in carrying out its business and to generate returns in an effective way. As part of this assessment, competent authorities should consider:
the adequacy of the cost allocation framework - in terms of adequacy to reflect the profitability of business lines/units;
the fund transfer pricing framework – in terms of adequate determination of the net income component for each business line/unit, product and customer;
the loan pricing framework – in terms of adequate governance of the loan pricing process, pricing methodology, appropriate consideration of all the loan pricing components, and ex post profitability monitoring and reporting of product pricing decisions;
the revenue sharing framework between institutions established in the Union that are part of third-country groups and other entities of that group established outside the Union and not consolidated by the EU parent undertaking – in terms of fair sharing of P&L between entities or business lines taking part in the life cycle of transactions, and of the adequate governance.
In the analysis, competent authorities should consider any indications that the business model and activities give rise to increased ML/TF risks, including crypto-asset activities or deposit-taking or establishment or use of legal entities in high-risk third countries, as identified in accordance with Article 9 (opens EUR-Lex in a new tab) of Directive (EU) 2015/849 (opens EUR-Lex in a new tab). Where present, these indications should be complemented by quantitative analysis, as appropriate, focusing in particular on the materiality of the revenues and the income from operations run in such high-risk third countries, the concentrations of exposures to customers for which the institution apply enhanced customer due diligence as set out in Chapter II, Section 3 (opens EUR-Lex in a new tab) of Directive 2015/849 (opens EUR-Lex in a new tab). Competent authorities should exchange information with the AML/CFT supervisor on these indications as laid out in paragraph 5963.