Notice: Reports and guidance documents; availability, etc.: Risk-based capital; internal ratings-based systems for credit risk, advanced measurement approaches for operational risk, etc.; supervisory guidance

Wednesday,
February 28, 2007
Part II
Department of the
Treasury
Office of the Comptroller of the
Currency
Office of Thrift Supervision
Federal Reserve
System
Federal Deposit
Insurance
Corporation
Proposed Supervisory Guidance for
Internal Ratings-Based Systems for Credit
Risk, Advanced Measurement Approaches
for Operational Risk, and the Supervisory
Review Process (Pillar 2) Related to Basel
II Implementation; Notice
sroberts on PROD1PC70 with NOTICES
VerDate Aug<31>2005 16:25 Feb 27, 2007 Jkt 211001 PO 00000 Frm 00001 Fmt 4737 Sfmt 4737 E:\FR\FM\28FEN2.SGM 28FEN2
9084 Federal Register / Vol. 72, No. 39 / Wednesday, February 28, 2007 / Notices
DEPARTMENT OF THE TREASURY help banks satisfy the qualification • Fax: (202) 452–3819 or (202) 452–
requirements in the NPR. 3102.
Office of the Comptroller of the DATES: Comments on the three proposed • Mail: Jennifer J. Johnson, Secretary,
Currency supervisory guidance documents must Board of Governors of the Federal
be submitted on or before May 29, 2007. Reserve System, 20th Street and
[Docket No. OCC–2007–0004] Constitution Avenue, NW., Washington,
ADDRESSES:
OCC: You must include OCC and DC 20551.
FEDERAL RESERVE SYSTEM
Docket Number OCC–2007–0004 in All public comments are available
[Docket No. OP–1277] your comment. You may submit from the Board’s Web site at http://
comments by any of the following www.federalreserve.gov/generalinfo/
FEDERAL DEPOSIT INSURANCE methods: foia/ProposedRegs.cfm as submitted,
CORPORATION • Agency Web site: http:// unless modified for technical reasons.
www.occ.treas.gov. Click on ‘‘Contact Accordingly, your comments will not be
DEPARTMENT OF THE TREASURY the OCC,’’ scroll down and click on edited to remove any identifying or
‘‘Comments on Proposed Regulations.’’ contact information. Public comments
Office of Thrift Supervision • E-mail address: also may be viewed electronically or in
regs.comments@occ.treas.gov. paper form in Room MP–500 of the
[No. 2007–06] Board’s Martin Building (20th and C
• Fax: (202) 874–4448.
• Mail: Office of the Comptroller of Streets, NW.) between 9 a.m. and 5 p.m.
Proposed Supervisory Guidance for on weekdays.
Internal Ratings-Based Systems for the Currency, 250 E Street, SW., Mail
Stop 1–5, Washington, DC 20219. FDIC: You may submit comments by
Credit Risk, Advanced Measurement any of the following methods:
Approaches for Operational Risk, and • Hand Delivery/Courier: 250 E
Street, SW., Attn: Public Information • Agency Web Site: http://
the Supervisory Review Process (Pillar www.fdic.gov/regulations/laws/federal.
2) Related to Basel II Implementation Room, Maila Stop 1–5, Washington, DC
20219. Follow instructions for submitting
AGENCIES: Office of the Comptroller of Instructions: All submissions received comments on the Agency Web Site.
the Currency, Treasury (OCC); Board of must include the agency name (OCC) • E-mail: Comments@FDIC.gov.
Governors of the Federal Reserve and docket number for this proposed Include ‘‘Basel II Supervisory
System (Board); Federal Deposit notice. In general, OCC will enter all Guidance’’ in the subject line of the
Insurance Corporation (FDIC); and comments received into the docket message.
Office of Thrift Supervision, Treasury without change, including any business • Mail: Robert E. Feldman, Executive
(OTS) (collectively, the Agencies). or personal information that you Secretary, Attention: Comments, Federal
ACTION: Proposed supervisory guidance provide. Deposit Insurance Corporation, 550 17th
with request for public comment. You may review comments and other Street, NW., Washington, DC 20429.
related materials by any of the following • Hand Delivery/Courier: Guard
SUMMARY: The Agencies are publishing methods: station at the rear of the 550 17th Street
for comment three documents that set • Viewing Comments Personally: You Building (located on F Street) on
forth proposed supervisory guidance for may personally inspect and photocopy business days between 7 a.m. and 5 p.m.
implementing proposed revisions to the comments at the OCC’s Public (EST).
risk-based capital standards in the Information Room, 250 E Street, SW., • Federal eRulemaking Portal: http://
United States (New Advanced Capital Washington, DC. You can make an www.regulations.gov. Follow the
Adequacy Framework or proposed appointment to inspect comments by instructions for submitting comments.
framework). These proposed revisions, calling (202) 874–5043. Public Inspection: All comments
which would implement the • Viewing Comments Electronically: received will be posted without change
‘‘International Convergence of Capital You may request e-mail or CD–ROM to http://www.fdic.gov/regulations/laws/
Measurement and Capital Standards: A copies of comments that the OCC has federal including any personal
Revised Framework,’’ published in June received by contacting the OCC’s Public information provided. Comments may
2004 by the Basel Committee on Information Room at: be inspected and photocopied in the
Banking Supervision (Basel II), in the regs.comments@occ.treas.gov. FDIC Public Information Center, 3501
United States, were published in the • Docket: You may also request North Fairfax Drive, Room E–1002,
Federal Register on September 25, 2006 available background documents and Arlington, VA 22226, between 9 a.m.
as a notice of proposed rulemaking project summaries using the methods and 5 p.m. (EST) on business days.
(NPR or proposed rule). The proposed described above. Paper copies of public comments may
framework outlined in the NPR would Board: You may submit comments, be ordered from the Public Information
require some and permit other identified by Docket No. OP–1277, by Center by telephone at (877) 275–3342
qualifying banks to calculate their any of the following methods: or (703) 562–2200.
regulatory risk-based capital • Agency Web site: http:// OTS: You may submit comments,
requirements using an internal ratings- www.federalreserve.gov. Follow the identified by No. 2007–06 by any of the
based (IRB) approach for credit risk and instructions for submitting comments at following methods:
the advanced measurement approaches http://www.federalreserve.gov/ • Federal eRulemaking Portal: http://
(AMA) for operational risk (together, the generalinfo/foia/ProposedRegs.cfm. www.regulations.gov. Follow the
advanced approaches); it also provides • Federal eRulemaking Portal: http:// instructions for submitting comments.
guidelines for the supervisory review www.regulations.gov. Follow the • E-mail: regs.comments@
process (Pillar 2). The proposed instructions for submitting comments. ots.treas.gov. Please include No. 2007–
supervisory guidance documents • E-mail: regs.comments@ 06 in the subject line of the message,
provide additional detail for the federalreserve.gov. Include the docket and include your name and telephone
advanced approaches and the number in the subject line of the number in the message.
supervisory review process that should message. • Fax: (202) 906–6518.
Federal Register / Vol. 72, No. 39 / Wednesday, February 28, 2007 / Notices 9085
• Mail: Regulation Comments, Chief FDIC: IRB guidance: Pete Hirsch, requires a process for the supervisory
Counsel’s Office, Office of Thrift Chief, Large Bank Supervision (202– review of capital adequacy under Pillar
Supervision, 1700 G Street, NW., 898–6751 or phirsch@fdic.gov), Curtis 2, and outlines requirements for
Washington, DC 20552, Attention: No. Wong, Senior Examination Specialist, enhanced public disclosures under
2007–06. Planning and Program Development Pillar 3.5 The NPR describes the
• Hand Delivery/Courier: Guard’s Section (202–898–7327 or qualification process and provides
Desk, East Lobby Entrance, 1700 G cwong@fdic.gov); AMA guidance: Mark qualification requirements for obtaining
Street, NW., from 9 a.m. to 4 p.m. on S. Schmidt, Regional Director (678–916– supervisory approval for use of the
business days, Attention: Regulation 2189 or maschmidt@fdic.gov), Alfred advanced approaches.6 The
Comments, Chief Counsel’s Office, Seivold, Senior Examination Specialist, qualification requirements are written
Attention: No. 2007–06. Large Bank Supervision (415–808–8248 broadly to accommodate the many ways
Instructions: All submissions received or aseivold@fdic.gov); or guidance on a bank may design and implement
must include the agency name and supervisory review: Bobby Bean, Chief, robust credit and operational risk
document number. All comments Capital Markets Policy Section (202– measurement and management systems,
received will be posted without change 898–3575 or bbean@fdic.gov), Gloria and to permit industry practice to
to http://www.ots.treas.gov/ Ikosi, Senior Quantitative Risk Analyst, evolve.
pagehtml.cfm?catNumber=67&an=1, Capital Markets Policy Section (202– The proposed supervisory guidance
including any personal information 898–3997 or gikosi@fdic.gov); Federal documents are companion guidance to
provided. Deposit Insurance Corporation, 550 17th the September 2006 NPR and, as such,
Docket: For access to the docket to Street, NW., Washington, DC 20429. are designed to be consistent with the
read background documents or proposed rule and do not address any
comments received, go to http:// OTS: IRB guidance: David Tate,
Manager, Examination Quality Review public comments since the NPR was
www.ots.treas.gov/ issued. They provide additional detail
pagehtml.cfm?catNumber=67&an=1. In (202–906–5717); AMA guidance: Eric
Hirschhorn, Senior Financial that should help banks satisfy the
addition, you may inspect comments at qualification requirements in the NPR.
the Public Reading Room, 1700 G Street, Economist, Credit Policy (202–906–
However, the publication of these
NW., by appointment. To make an 7350); or guidance on supervisory
guidance documents for comment does
appointment for access, call (202) 906– review: Sonja White, Senior Project
not imply that the outcome of the NPR
5922, send an e-mail to Manager, Capital Policy (202–906–
has already been determined. As part of
public.info@ots.treas.gov, or send a 7857); Office of Thrift Supervision, 1700
the regulatory rulemaking process, the
facsimile transmission to (202) 906– G Street, NW., Washington, DC 20552.
proposed guidance documents are
7755. (Prior notice identifying the SUPPLEMENTARY INFORMATION: The subject to change as needed based on,
materials you will be requesting will Agencies issued an NPR on September among other things, the public
assist us in serving you.) We schedule 25, 2006, 1 which seeks comment on comments on the guidance and the
appointments on business days between the New Advanced Capital Adequacy Agencies’ decisions regarding any final
10 a.m. and 4 p.m. In most cases, Framework that revises the existing rule.
appointments will be available the next general risk-based capital standards as The Agencies believe that the
business day following the date we applied to large, internationally active proposed supervisory guidance
receive a request. U.S. banks.2 The public comment documents are necessary to supplement
FOR FURTHER INFORMATION CONTACT: period on the NPR closes on March 26, the proposed framework with standards
OCC: IRB guidance: Fred Finke, 2007.3 The proposed framework would to promote safety and soundness and
Senior Basel Policy Liaison (202–874– implement Basel II in the United States. encourage comparability across banks.
4468 or fred.finke@occ.treas.gov); AMA As described in the NPR, Basel II sets A bank’s primary Federal supervisor
guidance: Mark O’Dell, Deputy forth a three-pillar framework will review the bank’s framework
Comptroller for Operational Risk (202– encompassing regulatory risk-based relative to the qualification
874–4316 or mark.odell@occ.treas.gov); capital requirements (Pillar 1); requirements in the NPR to determine
or guidance on supervisory review: supervisory review of capital adequacy whether the bank may apply the
Akhtarur Siddique, Lead Expert (202– (Pillar 2); and market discipline through advanced approaches and has complied
874–4665 or enhanced public disclosures (Pillar 3). with the proposed rule in determining
akhtarur.siddique@occ.treas.gov); Office The proposed framework outlined in the its regulatory capital requirements.
of the Comptroller of the Currency, 250 NPR for Pillar 1 would require some and In August 2003, the Agencies issued
E Street, SW., Washington, DC 20219. permit other qualifying banks to an advance notice of proposed
Board: IRB guidance: Sabeth calculate their regulatory risk-based rulemaking (ANPR), which described
Siddique, Assistant Director, Credit Risk capital requirements using the IRB the proposed revisions to the existing
Section (202–452–3861); AMA approach for credit risk and the AMA risk-based capital framework in general
guidance: Stacy Coleman, Assistant for operational risk.4 The NPR also terms and sought public comment.7 The
Director, Operational Risk Section (202– content of the ANPR was based, in large
452–2934) or Connie Horsley, Senior 1 See 71 FR 55830 (Sept. 25, 2006). part, on the April 2003 version of the
Supervisory Financial Analyst, 2 For simplicity, and unless otherwise noted, the Basel II framework.8
Operational Risk Section (202–452– term ‘‘banks’’ is used here to refer to banks, savings Contemporaneously with the ANPR, the
5239); or guidance on supervisory associations, and bank holding companies. The Agencies also issued for public
terms ‘‘bank holding company’’ and ‘‘BHC’’ refer
review: David Palmer, Senior only to bank holding companies regulated by the
Supervisory Financial Analyst, Credit Board and do not include savings and loan holding approaches are proposed for implementation in the
Risk Section (202–452–2904); Board of companies regulated by the OTS. For a detailed United States.
5 Supervisory expectations pertaining to a bank’s

Governors of the Federal Reserve description of the institutions covered by this
notice, refer to part I, section 1, of the NPR. public disclosures are not part of this notice.
System, 20th Street and Constitution 3 See 71 FR 77518 (Dec. 26, 2006). 6 See part III, section 22 of the NPR.
Avenue, NW., Washington, DC 20551. 4 While Basel II provides several approaches for 7 See 68 FR 45900 (Aug. 4, 2003).
Users of Telecommunication Device for calculating regulatory risk-based capital 8 See The New Basel Capital Accord (April 2003)
Deaf (TTD) only, call (202) 263–4869. requirements under Pillara1, only the advanced (available at http://www.bis.org).
comment two proposed supervisory and 2004. Those guidance documents its operational risk exposure to generate
guidance documents relating to the contained four chapters covering its regulatory risk-based capital
proposed framework.9 The first corporate ratings and retail requirement for operational risk. The
proposed 2003 guidance document segmentation systems, quantification, AMA Guidance provides additional
described supervisory views on the data management and maintenance, and context and detail to help a bank meet
credit risk measurement and controls, with discussion of validation the qualification requirements outlined
management systems that should be and stress testing contained within the in the NPR relevant to operational risk.
implemented by banks that adopt the rating and segmentation and Some of the specific revisions to the
IRB approach for computing risk-based quantification chapters. The structure of AMA Guidance include: (1) Clarifying
capital requirements for corporate credit the IRB Guidance generally follows the the roles of a bank’s board of directors
risk exposures. The second proposed key components of a bank’s advanced and management in developing and
2003 guidance document provided systems for credit risk outlined in the overseeing the implementation of the
supervisory views on the operational NPR. Chapter 1 provides guidance on bank’s AMA framework; (2) expanding
risk measurement and management governance of a bank’s overall advanced standard 5 to address the integration of
systems that should be implemented by systems for credit risk. Chapters 2 the bank’s operational risk management,
banks that adopt the AMA for through 5 cover the components of a data and assessment, and quantification
computing risk-based capital bank’s IRB systems for wholesale and processes into the bank’s existing risk
requirements for operational risk, retail exposures. Chapters 6 and 7 management decision-making processes;
including their operational risk provide guidance on data management (3) expanding and clarifying operational
management, data elements, and and maintenance and the control and risk quantification standards both to
quantification processes. In October validation framework. Chapter 8 reflect the evolution of industry
2004, the Agencies also issued for provides guidance on stress testing. practices, as well as to address
public comment proposed supervisory Chapters 9 through 11 provide guidance supervisory concerns; (4) clarifying
guidance on IRB systems for retail credit on the other systems a bank may need supervisory expectations regarding the
risk exposures.10 to differentiate risk in certain use of scenario analysis, the key
The first guidance document transactions subject to counterparty elements used to support operational
presented in this notice sets forth credit risk, equity exposures, and risk management and measurement, and
proposed supervisory guidance on IRB securitization exposures. eligible operational risk offsets (see
systems for credit risk covering the The IRB Guidance supplements the standards 20, 24, and 26, respectively);
wholesale and retail exposure NPR and provides additional context (5) adding standard 25 that discusses
categories, as well as guidance on the and detail to help banks meet the how frequently a bank must recalculate
equity and securitization exposure qualification requirements in the NPR its estimate of operational risk exposure
categories (IRB Guidance). Under the relevant to a bank’s systems and and its risk-based capital requirement
IRB framework, banks would use processes for credit risk. Thus, the for operational risk; (6) adding standard
internal estimates of certain risk guidance should be read alongside the 27 that a bank must employ a unit of
components as key inputs in the NPR to obtain a full perspective of the measure that is appropriate for its range
determination of their regulatory risk- underlying requirements in the of business activities and the variety of
based capital requirement for credit risk. proposed rule. The guidance does not operational loss events to which it is
As mentioned above, the Agencies contain additional proposed exposed; (7) expanding the discussion
previously published proposed requirements that are not in the NPR. on dependence modeling in standard
supervisory guidance on a bank’s IRB Chapters 5, 9, 10, and 11, are being 28; and (8) adding a section that
systems for corporate and retail issued for the first time and supplement discusses a bank’s use, in certain
exposures in 2003 and 2004, the detailed discussion of those topics limited circumstances, of an alternative
respectively. Since the release of those in the NPR. Similar to the previously quantification system to estimate its
documents, the Agencies have proposed corporate and retail guidance, operational risk exposure.
continued to refine the proposals based the IRB Guidance contains supervisory The Agencies recognize that a bank
on insights gained from public comment standards (designated with an ‘‘S’’) that required to adopt an AMA framework
and the collective efforts of the highlight important elements of a bank’s may have developed an implementation
interagency IRB working groups. The advanced systems for credit risk. The plan using the proposed supervisory
IRB Guidance updates and consolidates supervisory standards contained in the standards in the 2003 proposed AMA
the previously proposed supervisory previously proposed corporate and Guidance to assess its status in meeting
guidance on corporate and retail retail guidance documents have been the requirements proposed in the ANPR
exposures. It also provides new consolidated and updated and new and to determine additional work
guidance on systems a bank may need supervisory standards are proposed. needed to comply with those
to differentiate the risk of other credit The second guidance document in requirements. The table below maps the
exposure types, such as equity and this notice sets forth proposed current proposed supervisory standards
securitization exposures, as well as to supervisory guidance on the AMA for to those in the 2003 proposed AMA
recognize the benefits of financial operational risk (AMA Guidance), Guidance.
collateral in mitigating counterparty updating the proposed AMA Guidance
credit risk in certain transactions or to published in 2003. Since the issuance of COMPARISON OF CURRENT PROPOSED
use the double default treatment for that proposed AMA Guidance, the
Agencies have revised the guidance to
AMA SUPERVISORY STANDARDS TO
certain wholesale exposures. THE 2003 PROPOSED AMA SUPER-
The IRB Guidance is structured clarify issues and simplify, wherever
possible, supervisory standards. The VISORY STANDARDS
somewhat differently from the proposed

supervisory guidance issued in 2003 revisions are based on insights gained
from public comment and the collective 2003 Pro-
Current Proposed Standard posed Stand-
efforts of the interagency AMA working Number
9 See 68 FR 45949 (Aug. 4, 2003). ard Number
10 See 69 FR 62748 (Oct. 27, 2004), and 70 FR 423 group. Under the AMA framework, a
(Jan. 4, 2005) (correction). bank would rely on internal estimates of 1 ............................................ 1
COMPARISON OF CURRENT PROPOSED of its internal capital adequacy Comments should be addressed to:
AMA SUPERVISORY STANDARDS TO assessment process (ICAAP), and OCC: Communications Division,
THE 2003 PROPOSED AMA SUPER- supervisory assessment of its risk Office of the Comptroller of the
VISORY STANDARDS—Continued
management processes, control Currency, Public Information Room,
structure, and other relevant Mail stop 1–5, Attention: 1557–NEW,
2003 Pro- information relating to its risk profile 250 E Street, SW., Washington, DC
Current Proposed Standard and capital position. The ICAAP (while 20219. In addition, comments may be
posed Stand-
Number ard Number not mandating the determination of sent by fax to (202) 874–4448, or by
economic capital) should, to the extent electronic mail to
2 ............................................ 8 possible, identify and measure material regs.comments@occ.treas.gov. You can
3 ............................................ 11
risks, which may include (but should inspect and photocopy the comments at
4 ............................................ 2
5 ............................................ 3 not necessarily be limited to) credit risk, the OCC’s Public Information Room, 250
6 ............................................ 4 market risk, operational risk, interest E Street, SW., Washington, DC 20219.
7 ............................................ 5 rate risk, and liquidity risk, and account You can make an appointment to
8 ............................................ 6 for concentrations within and among inspect the comments by calling (202)
9 ............................................ 7 risk types. 874–5043.
10 .......................................... 9, 10 The Agencies solicit comment on all Board: You may submit comments,
11 .......................................... 12 aspects of the supervisory guidance
12 .......................................... 13, 14
identified by FR 4199, by any of the
documents. In addition, the Agencies following methods:
13 .......................................... 15 believe an important goal for any
14 .......................................... 16 • Agency Web Site: http://
15 .......................................... 17
regulatory capital system is to achieve a www.federalreserve.gov. Follow the
16 .......................................... 18 measure of consistency in the capital instructions for submitting comments at
17 .......................................... 19 requirements assigned to exposures http://www.federalreserve.gov/
18 .......................................... 20 with similar risk profiles held by generalinfo/foia/ProposedRegs.cfm.
19 .......................................... 21 different banks. The Agencies seek • Federal eRulemaking Portal: http://
20 .......................................... 24 comment on the extent to which this www.regulations.gov. Follow the
21 .......................................... 22 proposed supervisory guidance will
22 .......................................... 23 instructions for submitting comments.
promote that objective. • E-mail:
23 .......................................... 25
24 .......................................... 27 Paperwork Reduction Act regs.comments@ federalreserve.gov.
25 .......................................... New • Fax: (202) 452–3819 or (202) 452–
26 .......................................... 28 A. Request for Comment on Proposed
3102.
27 .......................................... New Information Collection
• Mail: Jennifer J. Johnson, Secretary,
28 .......................................... 29 In accordance with the requirements Board of Governors of the Federal
29 .......................................... 30 of the Paperwork Reduction Act of 1995,
30 .......................................... 26 Reserve System, 20th Street and
the Agencies may not conduct or Constitution Avenue, NW., Washington,
31 .......................................... 31
32 .......................................... 32, 33 sponsor, and the respondent is not DC 20551.
required to respond to, an information All public comments are available
The third document sets forth collection unless it displays a currently from the Board’s Web site at http://
proposed supervisory guidance on the valid Office of Management and Budget www.federalreserve.gov/generalinfo/
supervisory review process (Pillar 2) in (OMB) control number. The Agencies foia/ProposedRegs.cfm as submitted,
the New Advanced Capital Adequacy are requesting comment on a proposed except as necessary for technical
Framework. The process of supervisory information collection. The Agencies reasons. Accordingly, your comments
review described in this proposed are also giving notice that the proposed will not be edited to remove any
guidance document reflects a collection of information has been identifying or contact information.
continuation of the longstanding submitted to OMB for review and Public comments may also be viewed
approach employed by the Agencies in approval. electronically or in paper form in Room
their supervision of banks. However, Comments are invited on: MP–500 of the Board’s Martin Building
(a) Whether the collection of
new methods for calculating regulatory (20th and C Streets, NW.) between 9
information is necessary for the proper
risk-based capital requirements—such a.m. and 5 p.m. on weekdays.
performance of the Agencies’ functions,
as those in the proposed framework— FDIC: You may submit comments by
including whether the information has
and development of improved risk practical utility; any of the following methods:
monitoring and management tools (b) The accuracy of the estimates of • Agency Web Site: http://
within the industry often bring changes the burden of the information www.fdic.gov/regulations/laws/federal.
in the relative emphasis placed on the collection, including the validity of the Follow instructions for submitting
various aspects of supervisory review. methodology and assumptions used; comments on the Agency Web Site.
This proposed guidance document (c) Ways to enhance the quality, • E-mail: Comments@FDIC.gov.
highlights aspects of existing utility, and clarity of the information to Include ‘‘Basel II Supervisory
supervisory review that are being be collected; Guidance’’ in the subject line of the
augmented or more clearly defined to (d) Ways to minimize the burden of message.
support the proposed framework. Under the information collection on • Mail: Robert E. Feldman, Executive
the framework, in determining the respondents, including through the use Secretary, Attention: Comments, Federal
extent to which banks should hold of automated collection techniques or Deposit Insurance Corporation, 550 17th
capital in excess of regulatory other forms of information technology; Street, NW., Washington, DC 20429.
minimums, supervisors would consider and • Hand Delivery/Courier: Guard

the combined implications of a bank’s (e) Estimates of capital or start up station at the rear of the 550 17th Street
compliance with qualification costs and costs of operation, Building (located on F Street) on
requirements for regulatory risk-based maintenance, and purchase of services business days between 7 a.m. and 5 p.m.
capital standards, the quality and results to provide information. (EST).
• Federal eRulemaking Portal: http:// Advanced Capital Adequacy Estimated Burden per Respondent:
www.regulations.gov. Follow the Framework). The proposed guidance 420 hours.
instructions for submitting comments. documents concern (1) the internal Total Estimated Annual Burden:
Public Inspection: All comments ratings-based systems for credit risk 1,680 hours.
received will be posted without change (IRB), (2) the advanced measurement The proposed supervisory guidance
to http://www.fdic.gov/regulations/laws/ approaches for operational risk (AMA), documents follow:
federal including any personal and (3) the supervisory review process Proposed Supervisory Guidance on
information provided. Comments may (Pillar II). Internal Ratings-Based Systems for
be inspected and photocopied in the The Agencies believe that the Credit Risk
FDIC Public Information Center, 3501 documentation, prior approvals, and
North Fairfax Drive, Room E–1002, disclosures included in the proposed Table of Contents
Arlington, VA 22226, between 9 a.m. IRB and AMA guidance are directly Introduction
and 5 p.m. (EST) on business days. related to the information collection I. Purpose
Paper copies of public comments may requirements found in the Basel II II. Scope of Guidance
be ordered from the Public Information notice of proposed rulemaking (NPR)
Center by telephone at (877) 275–3342 published in the Federal Register on Chapter 1: Advanced Systems for Credit
or (703) 562–2200. September 25, 2006 (71 FR 55830). More Risk
A copy of the comments may also be specifically, the information collection Rule Requirements
submitted to the OMB desk officer for aspects of the proposed IRB and AMA I. Overview
the Agencies: By mail to U.S. Office of guidance tie to the following sections of II. Governance of Advanced Systems
Management and Budget, 725 17th the NPR: 21, 22, 44, 53, and 71. The Chapter 2: Wholesale Risk Rating Systems
Street, NW., #10235, Washington, DC Agencies believe that the burden
20503 or by facsimile to 202–395–6974, Rule Requirements
estimates developed for the NPR
Attention: Federal Banking Agency Desk adequately cover the additional I. Overview
Officer. specificity contained in the proposed II. Credit Rating Assignment Techniques
OTS: Information Collection A. Expert Judgment
IRB and AMA guidance. B. Models
Comments, Chief Counsel’s Office, For the proposed Pillar II portion of C. Constrained Judgment
Office of Thrift Supervision, 1700 G the guidance, the Agencies believe that D. Rating Overrides
Street, NW., Washington, DC 20552; paragraphs 25, 31, 35, 37, and 42 III. Definition of Default
send a facsimile transmission to (202) impose new information collection IV. Independence of the Wholesale Risk
906–6518; or send an e-mail to requirements that were beyond the Rating Process
infocollection.comments@ots.treas.gov. scope of the burden estimates developed V. IRB Risk Rating System Architecture
OTS will post comments and the related for the NPR. The agencies burden A. Two-Dimensional Risk-Rating System
index on the OTS Internet site at estimates for these additional B. Other Considerations
http://www.ots.treas.gov. In addition, information collection requirements are Chapter 3: Retail Segmentation Systems
interested persons may inspect the summarized below. Note that the Rule Requirements
comments at the Public Reading Room, estimated number of respondents listed
1700 G Street, NW., by appointment. To I. Overview
below include both institutions for II. Definition of Default
make an appointment, call (202) 906– which the Basel II risk-based capital III. Retail Segmentation Architecture
5922, send an e-mail to requirements are mandatory and A. Criteria for Retail Segmentation
public.info@ots.treas.gov, or send a institutions that may be considering B. Assignment of Exposures to Retail
facsimile transmission to (202) 906– opting-in to Basel II (despite the lack of Segments
7755. any formal commitment by most of Chapter 4: Quantification
B. Proposed Information Collection these latter institutions).
Estimated Burden: Rule Requirements
Title of Information Collection: I. Overview
Proposed Basel II Interagency OCC A. Stages of the Quantification Process
Supervisory Guidance for IRB, AMA, Number of Respondents: 52. B. General Standards for Sound
and the Supervisory Review Process. Estimated Burden per Respondent: Quantification
Frequency of Response: Event- II. Probability of Default (PD)
140 hours.
generated. A. Data
Total Estimated Annual Burden: B. Estimation
Affected Public: 7,280 hours. C. Mapping
OCC: National banks.
Board D. Application
Board: State member banks, bank III. Expected Loss Given Default (ELGD) and
holding companies, affiliates and Number of Respondents: 15. Loss Given Default (LGD)
certain non-bank subsidiaries of bank Estimated Burden per Respondent: A. Data
holding companies, commercial lending 420 hours. B. Estimation
companies owned or controlled by Total Estimated Annual Burden: C. Mapping
foreign banks, and Edge and agreement 6,300 hours. D. Application
corporations. IV. Exposure at Default (EAD)
FDIC: Insured nonmember banks and FDIC A. Data
certain subsidiaries of these entities. Number of Respondents: 19. B. Estimation
OTS: Savings associations and certain C. Mapping
Estimated Burden per Respondent: D. Application
of their subsidiaries. 420 hours.
V. Maturity (M)
Abstract: The notice sets forth three Total Estimated Annual Burden: VI. Special Cases and Applications
proposed supervisory guidance 7,980 hours. A. Loan Sales
documents for implementing proposed B. Multiple Legal Entities
revisions to the risk-based capital OTS
Appendix A: Illustrations of the
standards in the United States (New Number of Respondents: 4. Quantification Process for Wholesale
Portfolios II. Definition of Banking Book Equities 2006.2 The NPR proposes a regulatory
Appendix B: Illustrations of the III. Applying the Framework framework within which all banks
Quantification Process for Retail IV. Using Internal Models for Equity subject to the proposed rule must
Portfolios Exposures
develop their IRB systems. The NPR
V. Quantification of Equity Exposures
Chapter 5: Wholesale Credit Risk Protection
A. Reference Data contains qualification requirements that
Rule Requirements B. External Data each bank subject to the proposed rule
C. Estimation must meet to the satisfaction of its
Chapter 6: Data Management and
VI. Validation of Internal Models for Equity primary Federal supervisor before using
Maintenance
Exposures its IRB systems to calculate risk-based
Rule Requirements VII. Consistency Between Internal Models capital requirements. As stated in the
I. Overview Used for Equity Exposures and Risk preamble to the NPR, the qualification
II. General Data Requirements Management Processes requirements for these systems are
A. Life Cycle Tracking for Wholesale written in broad terms to accommodate
Chapter 11: Securitizations
Exposures
B. Rating Assignment Data for Wholesale Rule Requirements the many ways a bank may design and
Exposures implement a robust internal risk
I. Overview
C. Segmentation Data for Retail Exposures II. Scope of Application measurement and management system
D. Outsourced Activities III. General Principles of the Securitization and to permit industry practice to
E. Asset Sales Framework evolve. As a supplement to the NPR,
III. Data Applications A. Risk Transference this guidance provides supervisory
A. Validation and Refinement B. Implicit Support standards and additional detail on
B. Applying IRB System Improvements C. Servicer Cash Advances credit risk measurement and
Historically D. Clean-up Calls management systems that will assist
C. Calculating Risk-Based Capital Ratios E. Maximum Capital Requirements for
and Reporting to the Public banks in satisfying the requirements in
Securitization Exposures the NPR.
D. Supporting Risk Management IV. Hierarchy of Approaches
IV. Managing Data Quality and Integrity V. IRB Approaches for Securitization II. Scope of Guidance
A. Documentation and Definitions Exposures
B. Electronic Storage and Access A. Ratings-Based Approach
3. The focus of this guidance is on
Appendix A: Data Elements for Wholesale B. Internal Assessment Approach wholesale, retail, equity, and
and Retail Exposures VI. Internal Credit Assessment Process in the securitization exposures. A bank subject
A. Examples of Data Elements for IAA to the IRB framework for credit risk in
Wholesale Exposures VII. Validation of IAA the NPR is required to have systems for
B. Examples of Data Elements for Retail A. Supervisory Formula Approach determining risk-based capital
Exposures VIII. Early Amortization Provisions
Appendix B: Applying Risk Rating System
requirements for its wholesale and retail
IX. Data Management Requirements exposures. The wholesale category
Improvements Historically A. Data Elements includes corporate exposures (for
Chapter 7: Controls and Validation Appendix A: Description of the Supervisory example, exposures to companies and
Rule Requirements Formula Approach (SFA).
Appendix B: Examples of Data Elements for
banks, as well as commercial real estate
I. Overview Securitization Exposures exposures and other types of specialized
II. Reviews of the IRB System Attachment A: The NPR Qualification lending), sovereign exposures, and other
III. Consistency Between IRB Systems and Requirements Related to the IRB non-retail exposures. The retail category
Risk Management Processes Framework includes residential mortgage
IV. Internal Audit Attachment B: Supervisory Standards exposures, qualifying revolving
V. Validation Activities Attachment C: Acronym List exposures (QRE), and other retail
A. General Validation Requirements
B. Validation Activities Introduction exposures.
C. Minimum Frequency of Validation 4. A bank may also need systems to
I. Purpose differentiate the risk of other exposure
Chapter 8: Stress Testing of Risk-Based types, such as equity and securitization
1. This proposed guidance
Capital Requirements exposures, as well as to recognize the
(‘‘guidance’’), published jointly by the
Rule Requirements U.S. Federal banking agencies 1 provides benefits of financial collateral in
Chapter 9: Counterparty Credit Risk supervisory guidance for U.S. banks, mitigating counterparty credit risk in
Exposure thrifts, and bank holding companies certain transactions or to use double
Rule Requirements (‘‘banks’’) that adopt the Advanced default treatment for certain wholesale
Internal Ratings-Based Approach (‘‘IRB’’ exposures.
I. Overview 5. In aggregation, the IRB systems and
II. Transactions with Counterparty Credit or ‘‘IRB framework’’) for calculating
Risk minimum regulatory risk-based capital other systems for differentiating credit
III. Definitions (‘‘risk-based capital’’) requirements for risk are defined in the NPR and in this
IV. Netting credit risk under the Basel II capital guidance as a bank’s ‘‘advanced
V. Determination of Eligibility for EAD regulation. systems.’’ This guidance covers
Adjustment 2. This guidance supplements the advanced systems for all of a bank’s
VI. Methods for Determining EAD notice of proposed rulemaking (‘‘NPR’’ credit-related exposure types. A bank’s
A. Methodologies for Repo-style advanced systems also include its
Transactions and Eligible Margin Loans
or ‘‘proposed rule’’) published in the
Federal Register on September 25, systems for determining risk-based
B. EAD for OTC Derivative Contracts
C. Internal Models Methodology capital requirements for its operational
risk exposures under the proposed
1 The Federal banking agencies are: The Board of

VII. Defaulted Counterparties
Governors of the Federal Reserve System; the Advanced Measurement Approaches
Chapter 10: Risk-Weighted Assets for Equity Federal Deposit Insurance Corporation; the Office of (‘‘AMA’’) framework, which is the
Exposures the Comptroller of the Currency; and the Office of
Thrift Supervision; and will collectively be referred subject of a separate supervisory
Rule Requirements to as ‘‘the Agencies,’’ ‘‘supervisors,’’ or ‘‘regulators’’
I. Overview in this guidance. 2 71 FR 55830 (Sept. 25, 2006).
guidance document. Certain banks superseding the safety and soundness context. However, readers must look to
subject to the proposed rule may also be principles articulated in the Agencies’’ the NPR for the exact proposed rule
required to calculate risk-based capital existing statutes, regulations, or requirements.
requirements for their market risk guidance. The standards are contained 13. What follows is a brief description
exposures. within each chapter with a full of each chapter:
6. As described in separate guidance compilation of the standards provided
relating to supervisory review (Pillar 2), Chapter 1: Advanced Systems for Credit
in Attachment B.
in addition to meeting qualification 9. Supervisors will consider this Risk
requirements for regulatory risk-based guidance in evaluating banks’ advanced The chapter provides a discussion of
capital standards, a bank must have a systems for credit risk. This guidance the governance and system and process
rigorous process for assessing its overall assumes that readers are familiar with requirements for a bank’s advanced
capital adequacy in relation to its risk the proposed framework for calculating systems for credit risk. It also outlines
profile and a comprehensive strategy for risk-based capital requirements for the key components of a bank’s
maintaining an appropriate level of credit risk articulated in the NPR. advanced systems for credit risk.
capital. This process (while not 10. The conceptual framework
outlined in this guidance is not Chapter 2: Wholesale Risk Rating
mandating the determination of
intended to dictate the precise manner Systems
economic capital) should, to the extent
possible, identify and measure material by which banks should meet the A key component of an IRB system for
risks, which may include (but should qualification and other requirements in wholesale exposures is the risk rating
not necessarily be limited to) credit risk, the NPR. Supervisors will determine system. This chapter describes the
market risk, operational risk, interest compliance with the qualification design and operation of wholesale risk
rate risk, and liquidity risk, and account requirements by evaluating, on an rating systems. Banks should use the
for concentrations within and among individual bank basis, the extent to principles outlined in this chapter when
risk types. One of the main objectives of which banks meet the substance and designing and operating wholesale risk
the internal capital adequacy spirit of those requirements as they rating systems.
assessment process is to identify the relate to each of the components of a
Chapter 3: Retail Segmentation Systems
extent to which banks need to hold bank’s advanced systems for credit risk.
capital above regulatory minimums, in However, evaluating each qualification A key component of an IRB system for
order to address risks not adequately requirement individually is not retail credit exposures is the
captured by minimum regulatory capital sufficient to determine a bank’s overall segmentation system, which groups
requirements. compliance. The components of a retail exposures into segments according
7. A primary objective of the IRB bank’s advanced systems for credit risk to risk characteristics. This
framework is to make the risk-based should complement and reinforce one segmentation is the retail portfolio
capital requirements more sensitive to another to ensure the accuracy of risk analogue of assigning ratings to
credit risk. In general, the IRB measurements. As part of the exposures in wholesale portfolios. This
framework incorporates recent supervisory review of a bank’s advanced chapter describes the design and
developments in risk management and systems, supervisors will analyze the operation of an IRB segmentation
banking supervision. Under this extent to which a bank’s advanced system. The retail framework provides
framework, banks use their own internal systems incorporate the substance and banks with substantial flexibility to use
risk rating and segmentation systems, as spirit of the standards outlined in this the retail segmentation that is most
well as their quantification processes, to guidance. appropriate for their activities.
generate estimates of risk parameters 11. The structure of this guidance
that are inputs to the calculation of the generally follows the key components of Chapter 4: Quantification
risk-based capital requirements. Data the advanced systems for credit risk. Another key component of an IRB
that support accurate and reliable credit Chapter 1 provides guidance on system is a quantification process that
risk measurements, as well as rigorous governance of a bank’s overall advanced assigns numerical values to the key risk
management oversight and controls, systems. Chapters 2 through 7 cover the parameters that are used as inputs to the
including continuous monitoring and components of a bank’s IRB systems for IRB risk-based capital formulas. This
validation, are crucial to the prudent wholesale and retail exposures. Chapter chapter provides guidance on the
application of the IRB framework. 8 provides guidance on stress testing. quantification process for wholesale and
8. This guidance, which is written for Chapters 9 through 11 provide guidance retail exposures. These risk parameters
supervisors and bankers, describes the on the other systems a bank may need are probability of default (‘‘PD’’),
important elements and characteristics to differentiate risk for certain expected loss given default (‘‘ELGD’’),
of a bank’s advanced systems for credit transactions subject to counterparty loss given default (‘‘LGD’’), and
risk. Toward this end, this guidance credit risk, equity exposures, and exposure at default (‘‘EAD’’), and for
designates certain of those elements as securitization exposures and wholesale exposures only, the effective
supervisory standards denoted by the supplements the detailed discussion of remaining maturity (‘‘M’’). The
prefix ‘‘S.’’ These supervisory standards these exposure types in the NPR. The quantification of these risk parameters
generally implement or clarify the data standards and control framework should be the result of a disciplined
requirements in the NPR and, whenever provided in Chapters 6 and 7, process as described in this chapter. The
possible, are principle-based to provide respectively, of this guidance generally chapter also includes specific examples
banks with flexibility in implementing apply to these other systems as well. for both wholesale rating systems and
the framework. However, when 12. To aid the reader, the applicable retail segmentation systems in the two
prudential concerns or the need for NPR qualification requirements are appendices.
standardization outweigh the benefits of listed at the front of each chapter, as

flexibility, the supervisory standards are well as listed together in Attachment A. Chapter 5: Wholesale Credit Risk
specified in greater detail. Furthermore, Also, certain NPR requirements, such as Protection
nothing in this guidance should be definitions, are either repeated in this This chapter supplements the detailed
interpreted as weakening, modifying, or guidance or paraphrased to provide discussion of credit risk mitigation in
the NPR by providing guidance on how providing information to aid banks in and approve, the bank’s advanced
banks may recognize contractual choosing among the alternative methods systems.
arrangements for exposure-level credit to calculate EAD for these transactions, Part III, Section 22(k): Documentation.
protection (eligible guarantees and and providing some descriptions and The bank must adequately document all
eligible credit derivatives) that transfer illustrative examples of acceptable material aspects of its advanced
risk to one or more third parties. Each modeling practices for the estimation of systems.
of these forms of credit protection must EAD under the alternative methods. I. Overview
meet certain specific standards of
Chapter 10: Risk-Weighted Assets for 1. This chapter provides a discussion
eligibility, as articulated in the NPR, for
Equity Exposures of the governance and system and
recognition of the associated risk
mitigation. This chapter supplements the detailed process requirements for a bank’s
discussion of equity exposures provided advanced systems for credit risk. Board
Chapter 6: Data Management and in the NPR. It provides guidance on of directors and senior management
Maintenance determining risk-based capital oversight is critical to ensure that the
A bank must have advanced data requirements for equity exposures held design and function of the advanced
management and maintenance systems in the banking book for banks subject to systems are appropriate. Regardless of
that support credible and reliable risk the Market Risk Rule and for all equity the specifics of a bank’s advanced
parameter estimates. This chapter exposures for banks not subject to the systems for credit risk, a bank should
describes how a bank should collect, Market Risk Rule. have a rigorous credit risk management
maintain, and manage the data needed infrastructure that complements these
to support the other IRB system Chapter 11: Securitization Exposures systems.
components for wholesale and retail A securitization exposure is any 2. A bank subject to the framework for
exposures (e.g., risk rating and exposure whose credit risk reflects the credit risk in the NPR is required to
segmentation systems, the tranching of risk of one or more have an internal ratings-based system
quantification process, and validation underlying exposures. This chapter (‘‘IRB system’’) for determining risk-
and other control processes), as well as describes the concepts, eligibility, and based capital requirements for its
the bank’s broader risk management and mechanics associated with applying the wholesale and retail exposures.
reporting needs. three approaches for calculating risk- S 1–1 An IRB system must have five
based capital requirements for interdependent components that enable
Chapter 7: Controls and Validation an accurate measurement of credit risk
securitization exposures.
A bank must have a system of controls and risk-based capital requirements.
that ensures that the components of the Chapter 1: Advanced Systems for Credit 3. The components of an IRB system
IRB system are functioning effectively. Risk are:
This chapter provides guidance on the Rule Requirements • A risk rating and segmentation
important elements of an effective system that differentiates risk by
control environment, including Part III, Section 22(a)(2): The systems assigning ratings to individual
independent review processes, a and processes used by a bank for risk- wholesale obligors and exposures and
comprehensive validation process based capital purposes [in the NPR] individual retail exposures to segments;
(evaluation of developmental evidence, must be consistent with the bank’s • A quantification process that
ongoing monitoring, and outcomes internal risk management processes and translates the risk characteristics of
analysis), and an internal audit review management information reporting wholesale obligors and exposures and
and reporting process. systems. segments of retail exposures into
Part III, Section 22(a)(3): Each bank numerical risk parameters that are used
Chapter 8: Stress Testing of Risk-Based must have an appropriate infrastructure as inputs to the IRB risk-based capital
Capital Requirements with risk measurement and management formulas. These risk parameters are
Banks must conduct stress testing processes that meet the qualification probability of default (‘‘PD’’), expected
analysis of their advanced systems for requirements [in the NPR] and are loss given default (‘‘ELGD’’), loss given
credit risk as part of the risk-based appropriate given the bank’s size and default (‘‘LGD’’), and exposure at default
capital management process. Stress level of complexity. Regardless of (‘‘EAD’’), and for certain wholesale
testing analysis is a means of whether the systems and models that exposures only, the effective remaining
understanding how economic generate the risk parameters necessary maturity (‘‘M’’);
downturns, as described by stress for calculating a bank’s risk-based • A data management and
scenarios, cause migration across ratings capital requirements are located at any maintenance system that supports the
or segments and the concomitant change affiliate of the bank, the bank itself must IRB system;
in required risk-based capital. This ensure that the risk parameters and • Oversight and control mechanisms
chapter discusses considerations for reference data used to determine its that ensure the IRB system is
conducting stress testing analyses. risk-based capital requirements are functioning effectively and producing
representative of its own credit risk and accurate results; and
Chapter 9: Counterparty Credit Risk operational risk exposures. • An ongoing process that validates
Exposure Part III, Section 22(j)(1): The bank’s the accuracy of the risk rating
For certain transactions subject to senior management must ensure that all assignments, segmentations, and the
counterparty credit risk, banks may be components of the bank’s advanced risk parameters.
allowed to recognize the risk mitigating systems function effectively and comply 4. If applicable, a bank will also need
effect of financial collateral through an with the qualification requirements [in systems to differentiate risk for other
adjustment to EAD. This chapter the NPR]. credit exposure types, such as for equity
supplements the detailed discussion of Part III, Section 22(j)(2): The bank’s and securitization exposures, as well as
counterparty credit risk in the NPR by board of directors (or a designated to recognize the benefits of financial
describing some of the elements of committee of the board) must at least collateral in mitigating counterparty
counterparty credit risk mitigation, annually evaluate the effectiveness of, credit risk in certain transactions or to
use double default treatment for certain appropriate processes and controls in S 1–5 Banks should establish
wholesale exposures. place that support effective advanced specific accountability for the overall
5. In aggregation, the IRB system and systems for credit risk. The board performance of their advanced systems
other systems for differentiating credit should be provided with information for credit risk.
risk are defined in the NPR and in this that will enable it to conclude, with 12. An individual or group of
guidance as a bank’s ‘‘advanced reasonable assurance, that management individuals should be responsible for
systems’’ for credit risk. Chapters 2 has appropriate processes and controls the design and operation of the overall
through 7 of this guidance provide in place that support effective advanced advanced systems. This accountability
supplemental guidance on IRB systems systems for credit risk. To allow for includes oversight for all of the
for wholesale and retail exposures. ongoing monitoring, the board should components of the advanced systems for
Chapter 8 provides banks with guidance be provided with reports summarizing credit risk, regardless of which
on conducting stress testing analyses of the design and performance of the organizational units perform those
their advanced systems for credit risk. advanced systems. The board’s strategic processes. Authority and key
Chapters 9 through 11 cover additional direction and oversight is essential to responsibilities should be thoroughly
systems a bank may need to have for effective advanced systems. documented and responsible
other credit exposure types. S 1–4 Each bank (including each individuals should be held accountable
depository institution) must ensure that for the performance of the advanced
II. Governance of Advanced Systems the risk parameters and reference data systems.
S 1–2 Senior management must used to determine its risk-based capital S 1–6 A bank’s advanced systems
ensure that all of the components of the requirements are representative of its should be transparent.
bank’s advanced systems for credit risk own credit risk. 13. Banks must adequately document
function effectively and comply with 9. Each bank must have an all material aspects of their advanced
the qualification requirements in the appropriate infrastructure with risk systems. Adequate documentation will
NPR. measurement and management ensure transparency of a bank’s
6. Senior management should provide processes that meet the qualification advanced systems. A bank demonstrates
ongoing, active oversight of the requirements in the NPR. Each bank’s the transparency of its advanced
advanced systems outlined in this advanced systems for credit risk should systems by comprehensively
supervisory guidance, and articulate the also incorporate the supervisory documenting all the systems’’
expectations for the technical and standards in this guidance. This components. Transparency through
operational performance of the infrastructure must be appropriate given documentation is important so that
advanced systems, including the control the bank’s size and level of complexity. third parties, such as a bank’s
framework. To provide effective Regardless of whether the systems and supervisors and auditors, are able to
oversight of the advanced systems, models that generate the risk parameters understand, evaluate, and assess the
senior management should have necessary for calculating a bank’s risk- effectiveness of the bank’s advanced
extensive knowledge of the advanced based capital requirements are located systems.
systems’ policies, underwriting at any affiliate of the bank, the bank 14. Documentation should
standards, lending practices, account must ensure that the risk parameters encompass, but is not limited to, the
management activities, and collection and reference data used to determine its internal risk rating and segmentation
and recovery practices. Senior risk-based capital requirements are systems, risk parameter quantification
management should understand how representative of the bank’s credit risk processes, data collection and
these factors affect all of the profile. maintenance processes, and model
components of the advanced systems. 10. While some organizations may
design, assumptions, and validation
7. The scope and depth of risk conduct rating, segmentation,
results. The guiding principle governing
management reports should be quantification, and validation activities
documentation is that it should support
sufficient for senior management to on a consolidated basis, each bank
the requirements for the quantification,
monitor the performance of the subject to the capital requirements for
validation, and control and oversight
components of the advanced systems. advanced systems must determine its
mechanisms as well as the bank’s
Detailed reports should include, but are risk-based capital requirements for
broader credit risk management and
not limited to, the following topics: credit risk on a stand-alone basis and
hold its own separate risk-based capital reporting needs. Documentation is
• Risk profile by rating for wholesale critical to the supervisory oversight
exposures and by segment for retail in proportion to the risk exposure of its
portfolios. Specifically, the PD, ELGD, process.
exposures;
• Migration across ratings and LGD, and EAD estimates used to Chapter 2: Wholesale Risk Rating
segments with emphasis on unexpected determine risk-based capital levels must Systems
results; be applied to exposures at the exposure
or segment level, and risk-based capital Rule Requirements
• Updates to the quantification
performance results; requirements for each relevant bank Part III, Section 22(b)(1): A bank must
• Validation results; should be based on the proportionate have an internal risk rating and
• Comparative analysis of risk-based share of each exposure or segment segmentation system that accurately and
and internal capital assessments; and owned by such bank. reliably differentiates among degrees of
• Control process assessments. 11. The board of directors should credit risk for the bank’s wholesale and
S 1–3 The board of directors or its ensure that senior management at each retail exposures.
designated committee must at least bank confirm, through periodic Part III, Section 22(b)(2): For
annually evaluate the effectiveness of, evaluations, that risk parameters wholesale exposures, a bank must have
and approve, the bank’s advanced assigned to its credit exposures are an internal risk rating system that
systems. appropriate on a stand-alone basis, and accurately and reliably assigns each
8. The board of directors or its that the control and validation obligor to a single rating grade
designated committee should at least standards in Chapter 7 of this guidance (reflecting the obligor’s likelihood of
annually ensure that management has are met. default). The bank’s wholesale obligor
rating system must have at least seven II. Credit Rating Assignment the expert should decide how much
discrete rating grades for non-defaulted Techniques weight to give to each of these criteria
obligors and at least one rating grade for 2. In general, a credit rating is a in assigning a risk rating grade to an
defaulted obligors. Unless the bank has summary indicator of the relative risk of obligor.
chosen to directly assign ELGD and LGD 7. The flexibility possible in the
a credit exposure. Credit ratings can
estimates to each wholesale exposure, assignment of judgmental ratings has
take many forms. Regardless of the form,
the bank must have an internal risk implications for how the accuracy of the
meaningful credit ratings share two
rating system that accurately and ratings is reviewed. One goal of the
characteristics:
reliably assigns each wholesale ratings review validation process is to
• They group exposures to
exposure to loss severity rating grades confirm that raters followed policy.
discriminate among possible outcomes.
(reflecting the bank’s estimate of the However, two individuals exercising
• They rank the perceived level of
ELGD and LGD of the exposure). A bank judgment can use the same information
credit risk.
employing loss severity rating grades to support different ratings. Thus,
3. Banks have used credit ratings of
must have a sufficiently granular loss individuals reviewing an expert
various types for a variety of purposes.
severity grading system to avoid judgment rating system should have
Some ratings are intended to rank sufficient credit expertise and a
grouping together exposures with obligors by risk of default and some are
widely ranging ELGDs or LGDs. thorough knowledge of how the bank’s
intended to rank wholesale exposures rating methodology and policies should
Part III, Section 22(b)(4): The bank’s by expected loss, which incorporates be applied.
internal risk rating policy for wholesale risk of default and loss severity. Only
exposures must describe the bank’s risk rating systems that distinguish B. Models
rating philosophy (that is, must describe probability of default from loss given 8. In recent years, models have been
how wholesale obligor rating default meet the two-dimensional developed to assign ratings to wholesale
assignments are affected by the bank’s requirements for the IRB framework. exposures. In a model-based approach,
choice of the range of economic, 4. Banks use different techniques, inputs are numeric and provide
business, and industry conditions that such as expert judgment and models, to quantitative and qualitative information
are considered in the obligor rating assign credit risk ratings. How ratings about an obligor. The inputs are
process). are assigned is important because combined using mathematical equations
Part III, Section 22(b)(5): The bank’s different techniques will require to produce a number that is translated
internal risk rating system for wholesale different validation processes and into a categorical rating. An important
exposures must provide for the review control mechanisms to ensure the feature of models is that the rating is
and update (as appropriate) of each integrity of the rating system. Validation perfectly replicable by another party,
obligor rating and (if applicable) each and controls are discussed in Chapter 7 given the same inputs.
loss severity rating whenever the bank of this guidance. Some rating 9. Models to assign wholesale ratings
receives new material information, but assignment techniques are described typically are statistically derived or
no less frequently than annually. below; any of these techniques—expert based on expert-judgment techniques.
judgment, models, constrained 10. Some models are the result of
I. Overview judgment, or a combination thereof— statistical optimization, in which well-
could be acceptable in an IRB system, defined mathematical criteria are used
1. This chapter describes the design provided the bank meets the to choose the model that has the closest
and operation of IRB risk rating systems qualification requirements in the NPR fit to the observed data. Numerous
for wholesale exposures. Banks will and the substance and spirit of the techniques can be used to build
have latitude in designing and operating standards outlined in this guidance. statistical models; regression is one
wholesale risk rating systems, subject to widely recognized example. Such
four broad principles: A. Expert Judgment
models are often referred to as scoring
Two-dimensional risk rating system— 5. Historically, banks have used models or scorecards, because they
Banks must be able to make meaningful expert judgment to assign ratings to produce a single number, or ‘‘score,’’ as
and consistent differentiations among wholesale exposures. With this an output that may be related, for
credit exposures along two technique, an individual weighs example, to the estimated probability of
dimensions—obligor default risk and relevant information and reaches a default of each individual obligor in a
loss severity in the event of a default. conclusion about the appropriate risk portfolio. Regardless of the specific
Rank order risks—Banks must rank rating. The rater makes informed statistical technique used, a
obligors by their likelihood of default, judgments based on knowledge gained knowledgeable independent reviewer
and wholesale exposures (e.g., loans, through experience and training. should exercise judgment in evaluating
facilities) by the loss severity expected 6. The key feature of expert-judgment the reasonableness of a model’s
in the event of default. systems is flexibility. The prevalence of development, including its underlying
judgmental rating systems reflects the logic, and the methods used to handle
Quantification—The risk rating view that the determinants of default are the data.
system must be designed to facilitate too complicated to be captured by a 11. In other cases, banks have built
quantification of obligor ratings in terms single quantitative model. The quality of rating models by asking their experts to
of PD and loss severity in terms of ELGD management is often cited as an decide what weights to assign to critical
and LGD. example of a risk determinant that is variables in the models. Drawing on
Accuracy—The risk rating system difficult to assess using a quantitative their experience, the experts first
must be designed to ensure that ratings model. In order to foster internal identify the observable variables that
are accurate, so that obligors within a consistency, banks employing expert affect the likelihood of default. They
rating grade have similar default risk judgment rating systems should provide then reach agreement on the weights to
and wholesale exposures within a loss narrative guidelines that set out specific be assigned to each of the variables.
severity rating grade have similar risk of quantitative and qualitative rating Unlike statistical optimization, the
loss in the event of default. criteria for each rating grade. However, experts are not necessarily using clear,
consistent criteria to select the weights raise many of the same issues presented (other than exposures that have been
attached to the variables. Indeed, expert- separately by pure judgment and model- fully written-down or charged-off).
judgment model building is often a based systems. If overrides are rare, the
IV. Independence of the Wholesale Risk
practical choice when there is not system can be evaluated largely as if it
Rating Process
enough data to support a statistical is a model-based system. If, however,
model building. Despite its dependence overrides are prevalent, the system will S 2–2 Banks should demonstrate
on expert judgment, this method can be be evaluated more like a judgmental that their wholesale risk rating
called model-based as long as the system. processes are sufficiently independent
resulting equation, most likely with to produce objective ratings.
linear weights, is used to rate the D. Rating Overrides 17. Independence in the rating
credits. Once the equation is set, the 13. Regardless of the rating process helps to ensure the integrity of
model can be replicated, a feature assignment technique in use, banks ratings. Banks can promote more
shared with statistically derived models. should define, within their IRB rating independence by implementing a
However, while some banks refer to system documentation, what constitutes variety of controls and reporting
these types of expert-derived models as a ratings override. A judgmental structures. For example, a bank could
‘‘scorecards,’’ they are not scoring override occurs when judgment is used structure its organizational reporting
models in the conventional use of the to reject a rating suggested by an lines so that the credit approval and the
term. The term scoring model or objective rating process, such as a model rating assignment decisions are separate
scorecard is customarily reserved for a or scorecard. A policy override occurs from each other. Banks that separate the
rating model derived using strictly whenever a rating is assigned in a credit approval process from the rating
statistical techniques, as described in manner that deviates from the bank’s assignment/review functions are often
the preceding paragraph. Generally, approved rating policy and procedures. better able to manage the conflicts that
independent credit experts use Overrides should be specifically arise between loan volume and credit
judgment to evaluate the reasonableness identified, monitored, and analyzed to quality goals. Banks should be aware of
of the development of these expert- evaluate their impact on the bank’s IRB the full range of potential conflicts and
derived models. rating system. should develop effective controls to
C. Constrained Judgment mitigate any conflicts that might arise.
III. Definition of Default 18. However, banks that choose to
12. The alternatives described above S 2–1 Banks must identify obligor maintain less separation in
present the extremes; in practice, banks defaults in accordance with the IRB organizational reporting lines between
use risk rating systems that combine definition of default. credit approval and rating assignment
models with judgment. Two approaches 14. The consistent identification of should strengthen controls and consider
are common. defaults is fundamental to any IRB risk conducting a post-closing review
Judgmental systems with quantitative process. A post-closing review provides
rating system. For IRB purposes, a
guidelines or model results as inputs. an independent review of a rating that
bank’s wholesale obligor is in default if,
Individuals exercise judgment about has been assigned by those who are not
for any wholesale exposure of the bank
risks subject to policy guidelines fully independent of the approval
containing quantitative criteria such as to the obligor, the bank has:
minimum values for particular financial • Placed the exposure on non-accrual process. Any post-closing review, which
status consistent with the Call Report serves to ensure that the initial rating is
ratios. Banks develop quantitative
Instructions or the Thrift Financial appropriate, should be conducted
criteria to guide individuals in assigning
Report (‘‘TFR’’) and the TFR Instruction shortly after a credit is originated. The
ratings, but the criteria may need to be
Manual; less independent the rating process is,
augmented with additional information.
One version of this constrained • Taken a full or partial charge-off or the more rigorous the post-closing
judgment approach features a model write-down on the exposure due to the review should be.
distressed financial condition of the 19. Whether ratings integrity is
output as one among several criteria that
obligor; or achieved by creating structural
an individual may consider when
• Incurred a credit-related loss of 5 independence in reporting lines or
assigning ratings. The individual
percent or more of the exposure’s initial through a combination of other control
assigning the rating is responsible for
carrying value in connection with the processes, a bank should demonstrate
prioritizing the criteria, reconciling
sale of the exposure or the transfer of that its rating processes ensure integrity
conflicts between criteria, and, if
the exposure to the held-for-sale, in ratings throughout the economic
warranted, overriding some criteria.
available-for-sale, trading account, or cycle.
Even if individuals incorporate model
results as one of the factors in their other reporting category. V. IRB Risk Rating System Architecture
ratings, they will exercise judgment in 15. Partial charge-offs or write-downs
for reasons not related to the distressed A. Two-Dimensional Risk-Rating System
deciding what weight to attach to the
model result. The appeal of this financial condition of the obligor do not S 2–3 IRB risk rating systems must
approach is that the model combines trigger the default definition. For have two dimensions obligor default
many pieces of information into a single example, taking a write-down or charge- and loss severity corresponding to PD
output, which simplifies analysis, while off to reflect forgiveness of a minor fee (obligor default), and ELGD and LGD
the rater retains flexibility regarding the for relationship purposes unrelated to (loss severity).
use of the model output. financial distress does not trigger the 20. Regardless of the type of rating
Model-based ratings with judgmental default definition. system(s) used by a bank, the IRB
overrides. When banks use rating 16. An obligor in default remains in framework imposes some specific
models, individuals are permitted to default until the bank has reasonable requirements. The first requirement is
override the results under certain assurance of repayment and that an IRB risk rating system must be
conditions and within tolerance levels performance for all contractual two-dimensional. Banks will assign
for frequency. Credit-rating systems in principal and interest payments on all obligor ratings, which will be associated
which individuals can override models exposures of the bank to the obligor with a PD. They will also assign either
a loss severity rating(s), which will be rating grade associated with all of its practice, it appears that most banks have
associated with ELGD and LGD exposures to that bank will be the adopted a rating philosophy where an
estimates, or ELGD and LGD estimates default rating grade—even for those obligor’s rating would have some
directly to each wholesale exposure. exposures of the obligor that have not sensitivity to changes in economic
21. The process of assigning the triggered any element of the definition conditions. Regardless of the approach
obligor rating and either loss severity of default. taken, banks should document their
ratings or ELGD/LGD values—hereafter choice of economic, business, and
Ratings Philosophy and Expected
referred to as the rating system—is industry conditions considered in each
Ratings Migration
discussed below, and the process of risk rating system and the expected
quantifying the PD, ELGD and LGD risk S 2–7 A bank’s rating policy must frequency of rating changes over
parameters is discussed in Chapter 4. describe its ratings philosophy and how economic cycles. Such differences have
quickly obligors are expected to migrate important implications for validation
Obligor Ratings from one rating grade to another in and other aspects of the operation of
S 2–4 Banks must assign discrete response to economic cycles. rating systems, and therefore should be
obligor rating grades. S 2–8 In assigning an obligor to a clearly articulated and well understood.
22. While banks may use models to rating grade, a bank should assess the A bank should also understand the
estimate probabilities of default for risk of obligor default over a period of effects of ratings migration on its risk-
individual obligors, the IRB framework at least one year taking into account the based capital requirements and ensure
requires banks to group the obligors into possibility of adverse economic that sufficient capital is maintained
discrete rating grades. Each obligor conditions. during all phases of the economic cycle.
rating grade, in turn, must be associated 26. The term rating philosophy is 30. A bank’s ratings philosophy can
with a single PD. used to describe how obligor rating be empirically demonstrated through an
S 2–5 The obligor rating system assignments are affected by a bank’s analysis of how its obligors migrate
must rank obligors by likelihood of choice of the range of economic, across rating grades as economic and
default. business, and industry conditions that industry conditions change. While
23. For example, if a bank uses a are considered in the rating process. It individual obligor ratings may change
rating system based on a 10-point scale, establishes the bank’s philosophy on the due to changes in obligor-specific risk
with 1 representing obligors of highest manner in which it rates credits and the characteristics, the average migration
financial strength and 10 representing scenarios under which ratings would be observed through time is likely to reveal
defaulted obligors, rating grades 2 expected to change. In assigning an how sensitive rating assignments are to
through 9 should represent groups of obligor rating grade, banks must systematic risk changes. Rating systems
ever-increasing risk. In a rating system consider both the current risk in which obligor ratings are more
in which risk increases with the rating characteristics of the obligor and the closely linked at a given point in time
grade, an obligor with a rating grade 4 impact that adverse economic, business, to particular economic conditions are
is riskier than an obligor with a rating and industry conditions could have on more likely to be associated with higher
grade 2, but need not be twice as risky. the obligor’s ability to repay; however, overall average rates of rating migration
S 2–6 Banks must assign an obligor nothing in this guidance requires any than are other systems. Ratings that
to only one rating grade. specific rating philosophy be employed. respond primarily to obligor-specific
24. As noted above, the IRB 27. Rating grades should group (idiosyncratic) changes may be less
framework requires that the obligor obligors that are expected to share sensitive to changes in economic and
rating be distinct from the loss severity similar default frequencies. The rating industry conditions, and be more stable
rating, which is assigned to the assignment for an obligor may be based throughout the economic cycle.
wholesale exposure. The obligor rating upon a combination of obligor-specific
should focus on the obligor’s ability and (idiosyncratic) risk characteristics and Obligor-Rating Granularity
willingness to service any obligation the general economic, business, and S 2–9 Banks must have at least
and to follow through on any industry (systematic) risk characteristics seven discrete obligor rating grades for
commitments it has with the bank to or conditions that obligors in the rating non-defaulted obligors and at least one
avoid default. For example, in a 1-to-10 may experience. rating grade for defaulted obligors.
rating system, where risk increases with 28. The time horizon used for the 31. A risk rating system’s grades
the number rating grade, an otherwise assignment of obligors to rating grades should be sufficiently numerous to
defaulted obligor with a fully cash- should be one year or longer. The ensure that management can
secured transaction should be rated obligor rating should reflect the meaningfully differentiate risk in the
10—defaulted—regardless of the remote obligor’s ability as evidenced by its portfolio, without being so numerous
expectation of loss on a specific financial capacity, as well as its that they limit the system’s practical
exposure. Conversely, a nondefaulted willingness to service any obligation use. To determine the appropriate
obligor whose financial condition and to follow through on any number of rating grades beyond the
warrants the highest investment grade commitments it has with the bank to minimum seven non-default rating
rating should be rated 1, even if the avoid default. The time horizon chosen grades, each bank should perform its
bank’s transactions are subordinate to for the rating assignment process should own internal analysis.
other creditors and unsecured. Since the be appropriate to the business line or S 2–10 Banks should justify the
obligor rating is assigned to the obligor geography for which the respective number of obligor rating grades used in
and not to its individual exposures, the obligor rating system will be used. its risk rating system and the
bank must ensure that all the exposures 29. That general description, however, distribution of obligors across those
to the same obligor bear the obligor’s still leaves open different possible grades.
rating grade. implementations, depending upon what 32. Some portfolios may have a
25. At the bottom of any IRB rating range of future systematic risk majority of obligors assigned to only a
scale is at least one default rating grade. conditions the bank considers when few of the available rating grades. The
Once an obligor is in default on any making a rating assignment and the mere existence of a concentration of
exposure to the subject bank, the obligor weight given to those conditions. In exposures in a rating grade (or rating
grades) does not, by itself, reflect • The implied support provider is assign loss severity estimates (ELGD
weakness in a rating system. For rated investment grade by an NRSRO; and LGD) to each wholesale exposure.
example, banks focused on a particular • The implied support is a factor only 36. The term loss severity rating
type of lending, such as asset-based in assigning an obligor rating, not a loss system refers to the method by which a
lending, may lend to obligors having severity rating; bank assigns loss severity estimates to
similar default risk. Banks with focused • The final rating assigned to the wholesale exposures. This assignment
lending activities may use the minimum obligor reflects greater credit risk than can be accomplished through a loss
number of obligor rating grades, while the rating assigned to the implied severity rating process or via direct
banks with a broad range of lending support provider (the parent corporation assignment to each wholesale exposure.
activities should have more rating or sovereign); A wholesale exposure’s ELGD and LGD
grades. However, banks with a high • The bank has considered the estimates are expressed as a percentage
concentration of obligors in a particular magnitude of the rating benefit accorded of the estimated EAD of the exposure.
rating grade should perform a thorough from the recognition of implied support Both the ELGD and the LGD are
analysis that supports such a and the bank has performed and required inputs into the IRB risk-based
concentration. documented comprehensive due capital formulas.
33. A concentration of obligors in a diligence to assess the parent S 2–13 Banks should have empirical
rating grade is inappropriate when the corporation or sovereign’s willingness support for their loss severity rating
financial strength of those obligors and capacity to support the obligor. To system and the rating system should be
varies considerably. If such is the case, assess the willingness to support the capable of supporting the quantification
the following questions should be obligor, a bank may consider prior of ELGD estimates (and LGD estimates
answered: situations where the support provider if approved for internal estimates).
• Are the criteria for each rating grade has supported the obligor or other 37. ELGD and LGD analysis is in the
clear? Are rating criteria too vague to obligors under similar circumstances, early stages of development compared
allow raters to make clear distinctions? extended credit to the obligor at to default risk modeling. Over time,
Ambiguity may be an issue throughout beneficial rates, or made large scale banks’ methodologies are expected to
the rating scale or it may be limited to investments of cash or resources in the evolve. Longstanding banking
the most commonly used ratings. obligor. To assess capacity, a bank experience and existing research on
• How diverse are the obligors? Is the should conduct a thorough analysis of ELGD and LGD, while preliminary,
bank targeting a narrow segment of the financial position of the support suggests that type of collateral (in terms
obligors with homogeneous risk provider and its ability to provide of liquidity and marketability),
characteristics? support including during periods of collateral values, seniority, industry
• Are the bank’s internal rating financial stress; position and whether an exposure is
categories considerably broader than • There is broad market recognition
secured or unsecured are the most
those of other lenders? of the implied support. This can be
commonly used predictors of loss
Recognition of Implied Support evidenced through a number of market
severity.
indicators including situations where
S 2–11 Banks may recognize 38. Whether a bank assigns ELGD and
the external ratings of the parent
implied support as a rating criterion LGD values directly or, alternatively,
corporation and subsidiary are closely
subject to specific supervisory rates wholesale exposures and then
linked or the ratings of the parent or
considerations; however, banks should quantifies ELGD and LGD for the rating
sovereign reflect an expectation of
not rely upon the possibility of U.S. grades, the bank should conscientiously
support. It could also include evidence
government financial assistance, except identify characteristics that influence
derived from traded credit spreads of
for the financial assistance that the U.S. ELGD and LGD. Each of the loss severity
the parent and subsidiary;
government has legally committed to • For a bank whose rating system rating categories should be associated
provide. design incorporates external ratings as a with empirically supported ELGD and
34. Implied support is support from a tool in assigning an internal rating, the LGD estimates. (Even though the
third party that is less than a legally internal rating does not additionally grouped exposures have common
enforceable guarantee. Banks that use incorporate implied support when there characteristics and a common expected
implied support as a ratings criterion is evidence that the external rating has ELGD and LGD, realized loss severity
typically rely on a wide range of already benefited from the assumption for individual exposures may vary).
policies and procedures for its use. As of support; Loss Severity Rating/LGD Granularity
the impact of implied support • The bank has established a stand-
arrangements has typically been alone rating for the obligor and S 2–14 Banks must have a
difficult to quantify, the circumstances continues to monitor the stand-alone sufficiently granular loss severity rating
under which banks use such rating throughout the term of the system to group exposures with similar
arrangements as a ratings criterion exposure; estimated loss severities or a process
should be limited. • The bank’s internal tracking that assigns estimated ELGDs and LGDs
35. Supervisors will assess the processes monitor the dollar volume of to individual exposures.
appropriateness of a bank’s usage of credit exposures where implied support 39. While there is no stated minimum
implied support as a ratings criterion. A is a material consideration in the rating number of loss severity ratings, the
bank should recognize implied support assignment; and systems that provide ELGD and LGD
only if the following are true: • The provision of significant implied estimates must be granular enough to
• The support is from a parent support to a subsidiary or subsidiaries is separate wholesale exposures with
corporation or sovereign; however, significantly varying estimated LGDs.
incorporated into the parent

banks should not rely upon the corporation’s obligor rating. For example, a bank using a loss
possibility of U.S. government financial severity rating-scale approach that has
assistance, except for the financial Loss Severity Ratings credit products with a variety of
assistance that the U.S. government has S 2–12 Banks must have a loss collateral packages or financing
legally committed to provide; severity rating system that is able to structures should have more ELGD and
LGD rating grades than those banks with • The expected effect of using the that groups exposures into segments
fewer options in their credit products. external rating tool on the migration of with homogeneous risk characteristics
40. Like obligor rating grades, the internal ratings. and assigns accurate and reliable PD,
mere existence of an exposure 43. Sole reliance on external rating ELGD, and LGD estimates for each
concentration in an ELGD or LGD rating tools is not appropriate. Every rating segment on a consistent basis. The
grade (or rating grades) does not, by tool has limitations, and banks should bank’s system must group retail
itself, signify a rating system’s have a process to ensure that accurate exposures into the appropriate retail
weakness. However, banks with a high ratings are assigned despite such exposure subcategory and must group
concentration within ELGD and LGD limitations. How much additional the retail exposures in each retail
rating grades should perform a thorough analysis is required will depend on the exposure subcategory into separate
analysis that supports such a exposure’s rating, relative size and segments. The bank’s system must
concentration. complexity. Banks should maintain data identify all defaulted retail exposures
on the critical factors underpinning an and group them in segments by
B. Other Considerations external rating tool’s obligor or loss subcategories separate from non-
Rating Criteria severity ratings (as the banks would for defaulted retail exposures.
any rating assignment process). Part III, Section 22(b)(5): The bank’s
S 2–15 Rating criteria should be retail exposure segmentation system
written, clear, consistently applied, and Timeliness of Ratings
must provide for the review and update
include the specific qualitative and S 2–16 Risk ratings must be updated (as appropriate) of assignments of retail
quantitative factors used in assigning whenever new material information is exposures to segments whenever the
ratings. received, but in no instance less than bank receives new material information,
41. Each obligor and loss severity annually. but no less frequently than quarterly.
rating (including ratings with modifiers 44. A bank should have a policy that
such as + or ¥) should be defined. The ensures that obligor and loss severity I. Overview
definitions should describe all ratings reflect current information. That 1. This chapter describes the design
significant quantitative and qualitative policy should also specify minimum and operation of an IRB retail
ratings criteria used to promote financial reporting and collateral segmentation system. An IRB retail
consistent application of risk ratings. valuation requirements. When loss segmentation system groups retail
The ratings should be sufficiently severity ratings or estimates depend on exposures into segments with
transparent to allow replication by a collateral values or other factors that homogeneous risk characteristics within
third party. This is particularly change periodically, that policy should each of the three retail exposure
important in expert-judgment rating take into account the need to update subcategories (residential mortgage
systems where establishing the these factors. exposures, qualifying revolving
transparency of rating assignments is 45. Banks’ policies may include an exposures (QRE), other retail
more challenging. Without clearly alternative timetable for updating exposures). Examples of segmentation
defined rating criteria, expert-judgment ratings of exposures below a de minimis techniques include the use of obligor
rating systems are not sufficiently amount that the bank determines has no (such as income and past credit
transparent. A risk rating system with material impact on risk-based capital performance) and exposure (such as
vague criteria or one defined only by levels. For example, some banks use product type and loan-to-value)
PDs, ELGDs, or LGDs is neither triggering events to prompt them to characteristics; or grouping loans by
replicable nor transparent. Transparent update their ratings on de minimis similar estimated default rates and
criteria promote accurate and consistent exposures rather than adhering to a estimated loss severities. The
ratings within and across business lines specific timetable. segmentation system used for IRB will
and geographies, and permit the rating often differ from segmentation used for
Multiple Ratings Systems
process to be refined over time. other purposes, such as for marketing
46. A bank’s complexity and and scorecards. The retail risk
Use of External Rating Tools sophistication, as well as the size and parameter estimates that determine risk-
42. Banks may use results from range of products offered, will affect the based capital requirements are assigned
external rating tools, such as vendor types and number of rating systems at the segment level.
default models or agency ratings, as employed. However, each risk rating 2. The retail IRB framework provides
inputs into their internal rating system should conform to the standards banks substantial flexibility to use the
processes for obligors and wholesale in this guidance, must be validated for retail segmentation that is most
exposures. The validation standards in accuracy and consistency, and should appropriate for their activities, subject
this guidance apply to a bank’s use of be used consistently. Validation to the following broad principles:
external rating tools as well as internal exercises should produce evidence that • Differentiation of risk—
ones. Therefore, banks should apply the the ratings have been applied Segmentation should provide
same level of rigor to their external tools consistently. meaningful differentiation of risk.
as to their internal tools. In addition, Chapter 3: Retail Segmentation Systems Accordingly, in developing the
any external rating tool employed segmentation system, banks should
should be consistent with the Rule Requirements select risk drivers that separate risk
architecture of the bank’s IRB rating Part III, Section 22(b)(1): A bank must distinctly and consistently over time.
systems. To verify this consistency, a have an internal risk rating and • Reliable risk characteristics—
bank should analyze and understand: segmentation system that accurately and Segmentation uses borrower risk
• The predictive ability of the reliably differentiates among degrees of characteristics and loan-related risk
external rating tool; credit risk for the bank’s wholesale and characteristics that reliably differentiate
• The factors and criteria used by the retail exposures. a segment’s risk from that of other
external rating tools to assign ratings; Part III, Section 22(b)(3): For retail segments and that perform consistently
and exposures, a bank must have a system over time.
• Consistency—The risk drivers used affecting the risk characteristics of both system and the distribution of exposures
to segment exposures must be consistent borrowers and loans when determining across segments. (Here, ‘‘granularity’’ is
with the predominant risk segmentation criteria. Statistical how finely the portfolio is segmented.)
characteristics the bank uses to measure modeling, expert judgment, or some 12. Banks have flexibility in
and manage credit risk. combination of the two may determine determining the granularity of their
• Accuracy—The segmentation the most relevant risk drivers. segmentation system. Each bank should
process should generate segments that 8. Examples of acceptable approaches perform internal analysis to determine
separate exposures by realized to segmentation include: how granular segments must be to group
performance. It should be designed so • Segmenting exposures by common homogeneous exposures. For example, a
that actual long-run outcomes closely risk drivers that are relevant and bank using credit score ranges to
approximate the retail risk parameters material in determining the loss segment its portfolio should provide the
estimated by the bank. characteristics of a particular retail rationale for the ranges chosen.
3. Defaulted retail exposures must be product. For example, a bank may 13. A concentration of exposures in a
segmented separately from non- segment mortgage loans by LTV band, segment (or segments) does not, by
defaulted exposures. In addition, retail age from origination, geography, and/or itself, reflect a deficiency in the
segments should not cross national origination channel. segmentation system. For example, a
jurisdictions unless the bank can • Segmenting exposures by common bank may lend within a narrow risk
demonstrate that the exposures in the risk drivers that are relevant and
range and, therefore, have a smaller
different jurisdictions have material in determining the loss
number of segments than a bank that
homogeneous risk characteristics. characteristics of a particular borrower
lends across a wider spectrum of risk.
population. For example, a bank may
II. Definition of Default However, a bank with a high
segment by credit bureau score bands,
concentration of exposures in a
S 3–1 Banks must use the IRB behavior score bands, and/or
particular segment will be expected to
definition of default when identifying delinquency status. In the case of
show that the bank’s segmentation
defaulted retail exposures. mortgage products, more borrower
criteria are carefully delineated and
4. For retail exposures, banks must information may be available and a bank
well-documented. The bank should be
use the following definition of default could include the debt-to-income ratio,
current income, and/or years at present able to demonstrate that there is little
for its IRB system: A retail exposure of risk differentiation among the exposures
a bank is in default if: location.
• Segmenting by grouping exposures within the segment, and that the
• The exposure is 180 days past due, segmentation method produces reliable
in the case of a residential mortgage with similar estimated loss
characteristics, such as expected average estimates for each of the risk
exposure or revolving exposure; parameters. A bank should not
• The exposure is 120 days past due, loss rates, expected default rates, or
expected loss severity rates. Some banks artificially group exposures into
in the case of all other retail exposures; segments specifically to avoid the 10
or have developed models that rank order
default risk or generate an estimated percent LGD floor for mortgage
• The bank has taken a full or partial products. A bank should use consistent
charge-off or write-down of principal on default rate, loss severity, and/or
exposure at default for individual risk drivers to determine its retail
the exposure for credit related reasons. exposure segmentations and not
5. The exposure remains in default exposures. A bank could use such
estimates as criteria in their artificially segment low LGD loans with
until the bank has reasonable assurance higher LGD loans to avoid the floor.
of repayment and performance for all segmentation system.
9. Each retail segment will have an S 3–4 Banks should clearly define
contractual principal and interest and document the criteria for assigning
estimated PD, ELGD, LGD, and EAD. In
payments on the exposure. an exposure to a particular retail
some cases, it may be reasonable to use
6. For retail exposures, the definition segment.
the same risk parameter estimates for
of default is applied to a particular 14. Banks should choose risk drivers
multiple segments. This may occur
exposure rather than to the obligor. That that accurately reflect an exposure’s
more frequently for bank estimates of
is, default by an obligor on one risk. Risk drivers selected must be
ELGD and LGD as banks may have less
obligation would not require a bank to consistent with risk measures used for
robust historical data for estimating
consider all other obligations of the credit risk management.
these IRB risk parameters. In such cases,
same obligor in default. 15. The method of segmentation will
the bank should demonstrate that there
III. Retail Segmentation Architecture are no material differences in ELGD or help determine the risk parameters, as
LGD among those segments. Over time, well as which techniques should be
A. Criteria for Retail Segmentation used for validation and which control
supervisors expect banks to develop
S 3–2 Banks must first place more precise data and methodologies for mechanisms will best ensure the
exposures into one of the three retail determining ELGD and LGD. integrity of the segmentation system.
exposure subcategories (residential 10. Data for certain retail loans are Described below are some techniques
mortgage, QRE, and other retail). Banks sometimes missing or incomplete, such for determining whether the
must then separate exposures into as data for purchased loans or loans segmentation was done appropriately:
segments with homogeneous risk originated with policy exceptions. The • Statistical Models—Banks may
characteristics. overall segmentation system should incorporate results of statistical
S 3–3 A retail segmentation system adequately capture the risk associated underwriting models or scoring models
must produce segments that accurately with these loans based on the data directly into their segmentation process.
and reliably differentiate risk and available. In some cases, missing or For example, a bank may use a custom
produce accurate and reliable estimates incomplete data itself may be a or bureau credit score as a segmenting
of the risk parameters. significant risk factor used for criterion. In that case, the bank should
7. While banks have considerable segmentation purposes. support the choice of the score, and
flexibility in determining retail 11. A bank should substantiate the should demonstrate that it has adequate
segments, they should consider factors degree of granularity in its segmentation controls for the credit scoring system.
• Inputs to Models—Banks may 19. In accordance with industry ELGD and LGD estimates for retail
incorporate the variables from a practices in retail credit risk exposures must be based on at least
statistical model into their segmentation management, a bank should have a well- 5áyears of loss severity data. EAD
processes. For example, a bank that uses documented policy on monitoring and estimates for wholesale exposures must
a statistical model to predict losses for updating information about exposure be based on at least 7 years of exposure
its mortgage portfolio could select some risk characteristics. The policy should amount data, and EAD estimates for
or all of the major inputs to that model, specify the risk characteristics to be retail exposures must be based on at
such as debt-to-income and LTV, as updated and the frequency of updates least 5 years of exposure amount data.
segmentation criteria. As part of its for each product type or sub-portfolio Part III, Section 22(c)(5): Default, loss
validation and controls for the within its retail portfolio. Updating of severity, and exposure amount data
segmentation system, the bank should relevant information on these risk must include periods of economic
provide an appropriate rationale and drivers should be consistent with sound downturn conditions, or the bank must
empirical evidence for its choice of the risk management. adjust its estimates of risk parameters to
particular set of risk drivers from the S 3–6 The bank’s retail exposure compensate for the lack of data from
loss prediction model. segmentation system must provide for periods of economic downturn
• Expert Judgment—Banks may the review and update (as appropriate) conditions.
combine expert judgment with of assignments of retail exposures to Part III, Section 22(c)(6): The bank’s
statistical analysis in determining segments whenever the bank receives PD, ELGD, LGD, and EAD estimates
segmentation criteria. However, expert new material information, but no less must be based on the definition of
judgment must be well-documented and frequently than quarterly. default [in the NPR].
supported by empirical evidence 20. Decisions regarding the frequency Part III, Section 22(c)(7): The bank
demonstrating that the chosen risk of obtaining refreshed information must review and update (as appropriate)
factors are reliable predictors of risk. should reflect the specific risk its risk parameters and its risk
16. A bank should be able to characteristics of individual segments parameter quantification process at least
demonstrate a strong relationship and/or the potential impact on risk- annually.
between IRB risk drivers and based capital levels. The frequency of Part III, Section 22(c)(8): The bank
comparable measures used for credit updates will generally vary for different must at least annually conduct a
risk management. Specifically, a bank risk drivers and for different products. comprehensive review and analysis of
should demonstrate that the The underlying principle is that, in reference data to determine relevance of
segmentation system differentiates every estimation period, retail reference data to bank exposures,
credit risk across the portfolio and exposures are assigned to segments that quality of reference data to support PD,
captures changes in the level and accurately reflect their risk profile and ELGD, LGD, and EAD estimates, and
direction of credit risk using measures produce accurate risk parameters. consistency of reference data to the
that are similar to those used in credit 21. Banks should assess their definition of default contained [in the
risk management. For example, even if approach to updating information and NPR].
a bank uses custom scores for migrating exposures when validating I. Overview
underwriting or account management, the segmentation process.
generic bureau scores may be used for 1. Quantification is the process of
IRB segmentation purposes if the bank Chapter 4: Quantification assigning numerical values to the key
can demonstrate a relationship between risk parameters that are used as inputs
Rule Requirements to the IRB risk-based capital formulas.
these measures.
17. Banks should have clear policies Part III, Section 22(c)(1): The bank This chapter provides guidance on the
to define the criteria for modifying the must have a comprehensive risk quantification process for wholesale and
segmentation system. Changes in the parameter quantification process that retail exposures. For both wholesale and
segmentation system should be produces accurate, timely, and reliable retail portfolios these risk parameters
documented and supported to ensure estimates of the risk parameters for the are the probability of default (‘‘PD’’),
consistency and historically comparable bank’s wholesale and retail exposures. expected loss given default (‘‘ELGD’’),
measurements. Part III, Section 22(c)(2): Data used to loss given default (‘‘LGD’’), and
estimate the risk parameters must be exposure at default (‘‘EAD’’). Wholesale
B. Assignment of Exposures to Retail relevant to the bank’s actual wholesale exposures also require determination of
Segments and retail exposures, and of sufficient the exposure’s maturity (‘‘M’’). Risk
S 3–5 Banks should develop and quality to support the determination of parameters are assigned to each
document their policies to ensure that risk-based capital requirements for the exposure for wholesale portfolios and to
risk-driver information is sufficiently exposures. each segment for retail portfolios.
accurate and timely to track changes in Part III, Section 22(c)(3): The bank’s Specific quantification issues related to
underlying credit quality and that the risk parameter quantification process counterparty credit risk transactions,
updated information is used to assign must produce conservative risk equity exposures, and securitization
exposures to appropriate segments. parameter estimates where the bank has exposures are described in Chapters 9,
18. Under the IRB framework, a bank limited relevant data, and any 10, and 11, respectively.
initially assigns retail exposures to adjustments that are part of the 2. In any discussions of the IRB
segments based on the risk-driver quantification process must not result in system, the risk rating or segmentation
information available at the time of a pattern of bias toward lower risk system design and the quantification
origination or acquisition. The bank parameter estimates. process should be considered together.
should then continue to monitor the risk Part III, Section 22(c)(4): PD estimates This chapter focuses on quantification
characteristics of the exposures and for wholesale and retail exposures must given an existing risk rating or
assign exposures to appropriate be based on at least 5 years of default segmentation system design, as covered
segments based on refreshed data. ELGD and LGD estimates for in Chapters 2 and 3, respectively.
information gathered by the bank as part wholesale exposures must be based on 3. Section I establishes an organizing
of its monitoring process. at least 7 years of loss severity data, and framework for considering
quantification and develops general characterization. For example, risk Application—Fourth, the bank applies
standards that apply to the entire characteristics for wholesale exposures the relationship estimated for the
process. Sections II, III, and IV cover include obligor and exposure reference data to the actual portfolio
specific supervisory standards that characteristics related to the risk data.
apply to PD, ELGD and LGD, and EAD parameters, such as agency debt ratings, The ultimate aim of quantification is
respectively. The maturity risk risk ratings, financial measures, to attribute a PD, ELGD, LGD, and EAD
parameter receives somewhat different geographic regions, and the economic to each exposure within the wholesale
treatment in section V, since it is much environment and industry/sector trends portfolio and to each segment of
less dependent on statistical estimates during the time period of the reference exposures in the retail portfolio. If
from historical data. Special cases and data. Risk characteristics for retail multiple data sets or estimation
applications for quantification are exposures include borrower and loan methods are used, the bank should
covered in section VI. characteristics, such as loan terms, loan- adopt a means of combining the various
A. Stages of the Quantification Process to-value, credit score, income, debt-to- estimates at this stage.
income, or payment history. A bank For wholesale portfolios, this step
4. For each risk parameter, may use more than one reference data
quantification may be broken down into may include adjustments to default rates
set to improve the robustness or or loss rates to ‘‘smooth’’ the final risk
four stages: obtaining historical accuracy of the risk parameter estimates.
reference data; estimating the parameter estimates. If the estimates are
relationship between risk characteristics Estimation—Second, the bank applies applied to individual transactions, the
and the risk parameters in the reference statistical techniques to the reference bank must in some way aggregate the
data; mapping the correspondence data to determine the relationship estimates at the rating level.
between risk characteristics in the between risk characteristics and the For retail portfolios, the bank may
reference data and those in the existing estimated risk parameter. simply apply the risk parameter
portfolio; and applying the relationship estimates derived for each segment to
between risk characteristics and risk The result of this step is a model that the corresponding segment in the
parameters to the existing portfolio. An ties descriptive risk characteristics, or existing portfolio. However the
evaluation of a bank’s quantification drivers, to the risk parameter estimates. application stage could be more
process focuses on the overall adequacy In this context, the term ‘‘model’’ is complex if multiple data sets or
of the bank’s approach, including an used in the most general sense; a model estimation methods were used or if the
understanding of how the bank breaks may be a simple calculation of historical mapping stage required adjustments.
down the quantification process where averages or a more sophisticated 6. The four-stage quantification
applicable into the four stages. approach based on advanced statistical process described above outlines a
5. Banks are not required to separate techniques (e.g., regression). This step framework that a bank may use for
the quantification process into four may include adjustments for differences assigning numerical values to the IRB
stages. The four stages are a conceptual between the IRB definition of default key risk parameters. Whether the
framework, and may serve as a useful and the default definition in the quantification process explicitly
analytical and implementation guide. reference data set, as well as delineates each aspect of the four stages
Readers may find it helpful to refer to adjustments for data limitations. of quantification for PD, ELGD, LGD,
the appendices to this chapter, which More than one estimation technique and EAD, or the quantification process
illustrate how this four-stage framework may be used to generate estimates of the is more integrated, each aspect of the
can be applied to quantification risk parameters, especially if there are quantification process for the key risk
approaches in practice. The four stages multiple sets of reference data or parameters should be justified,
of quantification are described below. multiple sample periods. If multiple documented, and subject to monitoring
estimates are generated, the bank should and follow-up.
Data—First, the bank constructs a 7. A number of examples are given in
reference data set, or source of data, have a clear and consistent policy for
reconciling and combining them into a this chapter to aid exposition and
from which risk parameters can be interpretation of specific quantification
estimated. single estimate at the application stage.
issues. None of the examples is
A ‘‘reference data set’’ consists of a set Mapping—Third, the bank creates a sufficiently detailed to incorporate all of
of exposures and their associated link between its portfolio data and the the considerations discussed in this
identifying information and risk reference data based on corresponding chapter. Moreover, technical progress in
characteristics. Reference data sets may characteristics. the area of quantification is rapid. Thus,
include internal data, external data, or banks should not interpret a specific
pooled data from different internal and Variables or characteristics used in example that is consistent with the
external sources. Internal data refers to the estimation model are mapped, or standard being discussed, and that
any data on exposures held in a bank’s linked, to the variables that are available resembles the bank’s current practice, as
existing or historical portfolios, for the existing portfolio. In order to being a ‘‘safe harbor.’’ Banks should
including data elements or information map effectively, a bank should have consider this guidance in its entirety
provided by third parties (e.g., data from reference data characteristics that allow when determining whether systems and
a credit bureau about one’s own the construction of rating and practices are adequate.
customers would be considered internal segmentation criteria that are consistent
with those used on the bank’s portfolio. B. General Standards for Sound
data). External data refers to information
An important element of mapping is Quantification
on exposures held outside the bank’s
portfolio, including aggregate industry making adjustments for differences 8. Several core principles apply to the
trends or economic data. between reference data sets and the overall quantification process of risk
The reference data is described using bank’s exposures. The bank should map rating and segmentation systems. Those
a set of observed characteristics; each reference data set and each principles and the general standards
consequently, the data set contains combination of risk characteristics used that reflect them are discussed in this
variables that can be used for this in any estimation model. introductory section. Other supervisory
standards specific to particular stages or S 4–2 Risk parameter estimates impact of the credit protection on the
risk parameters are discussed in later must be based on the IRB definition of bank’s existing portfolio. Chapter 5
sections. default. At least annually, a bank must deals with recognized types of
9. The risk parameters should be conduct a comprehensive review and contractual arrangements and
estimated in a manner consistent with analysis of reference data to determine instruments that transfer all or part of an
sound credit risk management practices the relevance of reference data to the exposure’s credit risk from the bank to
and the IRB standards. In addition, a bank’s exposures, quality of reference one or more third parties.
bank should have processes to ensure data to support risk parameter S 4–4 Banks may take into account
that these estimates are independently estimates, and consistency of reference the risk-reducing effects of guarantees
and thoroughly validated and the results data to the IRB definition of default. in support of retail exposures when
reported to senior management. 14. Many different sources of data quantifying the PD, ELGD, and LGD of
10. Supervisory evaluation of the might be appropriately used in an the segment.
quantification process requires estimation model or the quantification 18. A bank may take into account the
consideration of all the standards in this process. Regardless of the data used to risk reducing effects of guarantees in
chapter, both general and specific. derive the risk parameter estimates, support of retail exposures in a segment
Particular practical approaches to such estimates must reflect the IRB when quantifying the PD, ELGD, and
quantification may be highly consistent definition of default. LGD of the segment, but only for
with some standards, and less so with 15. As part of its annual review of its guarantees of individual retail
others. In assessing a bank’s approach, reference data, a bank must assess the exposures, or guarantees covering all or
supervisors will weigh the approach’s consistency of the reference data with a pro rata portion of all contractual
strengths and weaknesses using all the the IRB definition of default. In the early payments due on a group of retail
supervisory standards in this chapter as stages of IRB implementation, a bank’s exposures. (See Example 5 in Appendix
a guide. internal historical reference data might B of this chapter.) Insurance in support
S 4–1 Banks should have a fully not include an element that fully of retail exposures, for example private
specified process covering all aspects of conforms to the IRB definition of mortgage insurance (‘‘PMI’’), generally
quantification (reference data, default. In addition, a bank may change would be considered a guarantee.
estimation, mapping, and application). its policies regarding charge-offs or non- 19. The risk parameters for exposures
The quantification process should be accrual. For any internal or external covered by retail guarantees should be
fully documented. historical data that are not fully based on historical experience of
11. A fully specified quantification consistent with the IRB definition of exposures with similar coverage and the
process should describe how all four default, a bank must still ensure that the expected benefits of the guarantees on
stages (data, estimation, mapping, and derived risk parameter estimates are future performance. Segments benefiting
application) are addressed for each based on the IRB definition of default. from retail guarantees are still subject to
parameter. The linkages between the This will likely entail making applicable regulatory floors, such as the
bank’s quantification and validation conservative adjustments to reflect data 10 percent LGD floor for residential
processes should also be explicit. discrepancies; larger discrepancies mortgages.
12. An important aspect of the require greater conservatism. 20. Retail guarantees may affect PD or
quantification process is the appropriate 16. To support quantification and ELGD and LGD. In most cases, and in
capture and analysis of developmental validation of the risk parameter particular for PMI, banks reflect the
evidence in support of techniques estimates, one of the elements in a effects of retail guarantees primarily
applied by the bank. A few examples of bank’s internal data should conform to through the quantification of ELGD and
such developmental evidence are: the IRB definition of default. The LGD. For retail exposures, banks may
• For reference data—a discussion of collection of internal data is discussed directly reflect the expected benefit of
how the best available data are chosen in Chapter 6 (Data Management and retail guarantees in the risk parameters,
from various sources so that the data Maintenance) of this guidance and in contrast to the two-step process that
include periods of economic downturn validation is discussed in Chapter 7 is required for guarantees of wholesale
conditions and the portfolio in the (Controls and Validation). exposures.
reference data is comparable to the S 4–3 Banks must separately 21. Banks should monitor and assess
existing portfolio; quantify wholesale risk parameter potential counterparty risk for
• For estimation—discussions of why estimates before adjusting the estimates guarantees of retail exposures through
the bank uses various averaging for the impact of eligible guarantees tracking and analyzing the financial
methods on historical data, how it and eligible credit derivatives. strength of each guarantor. When
specifies downturn estimates, or how it 17. As discussed in Chapter 5, the reflecting guarantees of retail exposures
develops predictive models; benefits of wholesale credit risk in PD or ELGD and LGD estimates banks
• For mapping—discussions of how mitigation from eligible guarantees and should take into account the credit
risk characteristics in the reference data eligible credit derivatives are recognized quality of the guarantor. Other things
compare with those in the existing through adjustments to ratings and risk equal, PD or ELGD and LGD estimates
portfolio; and parameter estimates. However, banks should be increased if the credit quality
• For application—a discussion of the must perform the basic quantification of of the guarantor deteriorates. In
combination of multiple estimates, the risk parameters separately from the addition, banks should consider the
aggregations of estimates across process of determining an adjustment to potential for additional counterparty
exposures, or any judgmental an exposure’s risk rating assignment risk during economic downturn
adjustments. resulting from the credit protection or conditions.
13. Major decisions in the design and any adjustments to the risk parameters 22. Banks may also choose to
implementation of the quantification for recognition of the credit protection. incorporate retail guarantee coverage
process should be justified and fully In quantifying the impact of the credit into their segmentation systems. For
documented. Documentation promotes protection, banks may make necessary example, mortgage loans without PMI
consistency and allows third parties to adjustments to the reference data or could be placed into different segments
review and replicate the entire process. mapping process, or may estimate the than those with PMI.
23. Since there are a variety of 27. All material aspects of the significantly increase a risk parameter
programs for retail guarantees that quantification process should be value should prompt increases in the
provide differing types and levels of reviewed annually, with adjustments risk parameter estimates. When changes
coverage, banks incorporating retail and enhancements made as needed. A seem likely to reduce the risk parameter
guarantees into the IRB risk parameters bank should have a well-defined policy value, estimates should be reduced only
should ensure that their systems are for reviewing and updating the after the bank accumulates a significant
sufficient to estimate the expected quantification design. New analytical amount of actual experience under the
benefits based on the actual amount of techniques and evolving industry new policy to support the reductions.
coverage within the existing portfolio, practice should be taken into account in 31. The mappings of the existing
regardless of whether or not they considering changes to quantification portfolio to the reference data used in
segment by coverage. This may require techniques. The review should evaluate estimation should also be reviewed with
exposure-by-exposure tracking over the the judgmental adjustments embedded sufficient frequency to ensure that the
life of the exposure to accurately reflect in the estimates; new data or evolving mappings continue to be appropriate.
the expected benefits for different forms industry practice may suggest a need to Mappings should be reaffirmed at least
of retail guarantees. Banks also should modify those adjustments. Particular annually for both internal and external
develop appropriate reference data sets attention should be given to any reference data, regardless of whether the
that can be used to estimate the effect changes that may have resulted in a risk rating or segmentation systems have
on PDs or ELGDs and LGDs for significant change in the composition of undergone explicit changes during the
exposures that are covered by retail exposures, such as new business lines, period covered by the reference data set,
guarantees. material mergers or acquisitions, and because the relationship between a
S 4–5 Banks may only reflect the material divestitures, loan sales or bank’s existing exposures and the
risk-reducing benefits of tranched securitizations. Such changes, which reference data may change over time.
guarantees of multiple retail exposures raise questions about the For example, in wholesale portfolios the
by meeting the definition and appropriateness of risk ratings, the relationships between internal rating
operational criteria for synthetic segmentation system, and the grades and external agency ratings may
securitizations. quantification process, should trigger a change during the economic cycle
24. Guarantees of multiple retail review and revisions as needed. because of differences in expected rating
exposures that do not cover all or a pro 28. The review process is particularly migration. When significant
rata portion of all contractual payments relevant for the reference data stage characteristics have been changed,
due on the underlying exposures are because new data become available added, or dropped, the characteristics of
considered to be tranched. (See Example frequently. A bank must ensure the existing exposures should be newly
5 in Appendix B of this chapter.) continued applicability of the reference mapped to the characteristics of the
25. A bank may obtain a reduction in data to its existing exposures, and the reference data.
risk-based capital requirements in the reference data should reflect the types of S 4–7 Quantification should be
case of such tranched guarantees of exposures found in the bank’s existing based upon the best available data for
multiple retail exposures, but only portfolio. Reference data must be of the accurate estimation of the risk
through applying the rules for sufficient quality to support PD, ELGD, parameters.
securitization exposures provided in the LGD, and EAD estimates. A well- 32. Banks should always use the best
NPR. To obtain any benefits, tranched defined and documented process should available data when quantifying the risk
guarantees of multiple retail exposures be in place to ensure that the reference parameters. In order to derive accurate
must satisfy all aspects of the definition data are updated as frequently as risk parameter estimates, banks should
of synthetic securitization and comply needed, as fresh data become available incorporate relevant data, whether such
with all requirements for securitization or as portfolio changes make necessary. data are internal or external. One
treatment in the NPR. (Also see Chapter All data sources, characteristics, and the objective of the IRB framework is to
11 (Securitizations) for additional overall processes governing data encourage further development of credit
guidance.) collection should be fully documented, risk quantification techniques.
26. In some cases, the determination and that documentation should be Improving the quality, capture, and
of the risk-based capital benefit for a readily available for review. retention of internal data is an essential
qualifying tranched guarantee will be 29. At a minimum, risk parameter prerequisite for such advances.
relatively straightforward. For example, estimates must be reviewed at least 33. Internal data refers to any data on
the securitization framework provides annually, and the process for doing so exposures existing or historically held
three general approaches for should be documented in the bank’s in a bank’s own portfolio, including
determining risk-weighted assets: The policy. If the review reveals that risk historical exposure and risk
ratings-based approach, the internal parameter estimates should be updated, characteristics as well as exposure
assessment approach, and the the updates should be performed performance—even if some data
supervisory formula approach (‘‘SFA’’). promptly and documented clearly. New components are purchased from outside
A bank can use the RBA if its exposure data should be incorporated into the sources. For example, property
is externally rated or has an inferred risk parameter estimates using a well- appraisals purchased from a third-party
rating. The SFA may be employed when defined process to correctly merge data appraiser for updating the LTVs of a
external or inferred ratings are not sets over time, and the frequency of risk bank’s mortgage exposures are
available for tranching structures. (See parameter updates and the process for considered internal data. However, if a
Chapter 11 for a more detailed doing so should be justified and bank purchases data on risk
discussion of the applicability of the documented in bank policy. characteristics or performance for
various approaches in different 30. The risk parameter estimates may exposures outside of its own portfolio,
circumstances.) be particularly sensitive to changes in these data would be considered

S 4–6 At a minimum, the the way banks manage exposures. When external.
quantification process and the resulting such changes take place, the bank 34. A bank should incorporate
risk parameters must be reviewed should consider them in all steps of the relevant external data for quantifying
annually and updated as appropriate. quantification process. Changes likely to risk parameters if internal data are
insufficient to produce accurate and example, particular MSAs or geographic S 4–11 Judgmental adjustments to
appropriate estimates. For example, the regions) that experienced economic risk parameter estimates, either
use of external data may be necessary downturn periods, or use appropriate upward or downward, may be an
when internal data do not provide external data. However, the bank should appropriate part of the quantification
adequate coverage of economic justify the exclusion of available process, but must not result in an
downturns or when there are significant internal data for portions of its portfolio overall bias toward lower risk
data gaps, either for periods of time or and any inclusion of alternative internal parameter estimates.
for the types of exposures in the bank’s or external data sources, as well as its 43. Judgment will inevitably play a
existing portfolio. Banks should weighting assumptions. role in the quantification process and
demonstrate that all data used to 40. The minimum data requirement may materially affect the estimates.
quantify risk parameters are relevant. may be met using internal data, external Judgmental adjustments to estimates are
35. A bank should have a process for data, or pooled data combining internal often necessary because of some
vetting potential reference data, whether data with similar data from other limitations on available reference data
the data are internal or external. The sources. However, as noted above, the or because of inherent differences
vetting should assess whether the data minimum sample period for reference between the reference data and the
are sufficiently accurate, sufficiently data should not be construed as bank’s existing exposures. The bank
complete, sufficiently representative, generally providing optimum results. A must ensure that adjustments are not
and sufficiently informative of the longer sample period usually fosters biased toward optimistically low risk
bank’s existing exposures. more robust estimation; for example, a parameter estimates. This standard does
36. Furthermore, a bank should have longer sample will include more default not prohibit individual adjustments that
adequate data to estimate risk observations for ELGD, LGD or EAD result in lower estimates of risk, because
parameters for all exposures on the estimation. Banks should consider the both upward and downward
books, even if some are likely to be sold use of additional data when more than adjustments are expected. Individual
or securitized before their long-term the minimum length of historical data is adjustments are less important than
credit performance can be observed. available. However, the potential broad patterns; consistent signs of
S 4–8 The sample period for the judgmental decisions that lower
increase in precision afforded by a
reference data must meet the minimum parameter estimates materially may be
larger sample should be weighed against
length for each risk parameter by evidence of bias. The bank should also
the potential for diminished
portfolio. ensure that large judgmental
S 4–9 The reference data must comparability of older data to the
existing portfolio; striking the correct adjustments are well justified and
include periods of economic downturn infrequent, as frequent large
conditions, or the parameter estimates balance is a matter of judgment.
Reference data must not differ adjustments could indicate a problem
must be adjusted to compensate for the with the rating methodology.
lack of data from such periods. systematically from the existing
44. The reasoning and empirical
37. For PD estimation, a minimum of portfolio in ways that seem likely to be
support for any adjustments, as well as
five years of data are required for all related to default risk, loss severity, or
the mechanics of the process, should be
portfolios. For ELGD, LGD and EAD exposure at default. documented. The bank should conduct
estimation, a minimum of seven years of S 4–10 Banks should clearly sensitivity analysis to demonstrate that
data are required for wholesale document how they adjust for the the adjustment procedure is not biased
portfolios, and five years of data are absence of significant data elements in toward reducing risk-based capital
required for retail portfolios. either the reference data set or the requirements. The analysis should
38. This requirement for a minimum existing portfolio. consider the impact of any judgmental
of five or seven years of data should not 41. Some exposures in the reference adjustments on estimates and risk-based
be taken to imply that reference data data set and the existing portfolio will capital requirements, and should be
sets of this length are optimal. The range have missing data elements, some of fully documented.
of conditions covered by the sample which are important factors for S 4–12 Risk parameter estimates
period may be as important as its length. measuring risk. Banks may use a variety should incorporate a degree of
Specifically, lack of inclusion of periods of statistical methods to impute values conservatism that is appropriate for the
of economic downturn conditions could for the missing factors—provided these overall rigor of the quantification
bias PD, ELGD, LGD, or EAD estimates factors are sufficiently correlated to process.
downward and lead to unjustifiably known information about the exposure. 45. Estimated values of the risk
lower risk-based capital requirements. Expertise is required to judge whether parameters should be as precise and
39. If a bank’s reference data do not such correlations can be established. accurate as possible. However, estimates
include periods of economic downturn Regardless of the approach and level of are inherently subject to uncertainty and
conditions, the bank must adjust its risk sophistication, the bank should have a potential error. Aspects of the
parameter estimates to compensate for clear and well-documented process quantification process that are apt to
the lack of these data. Given the describing how it treats missing data induce uncertainty and error include
particular importance of periods of elements in the estimation and mapping model error, differences in default
economic downturn, a bank may choose stages. definitions, errors in judgment, and data
to augment an existing reference data set 42. For example, in the development deficiencies. A general principle of the
with additional data from such a period of a default model, missing data IRB framework is that the assumptions
without including all of the intervening elements can be imputed and the and adjustments embedded in the
years, if the overall data set satisfies estimates of the missing data elements quantification process should reflect the
required minimums, otherwise covers input to the model. However, if degree of uncertainty or potential error
the appropriate range of economic particular data elements are missing on inherent in the process.
conditions and is appropriate for the significant portions of the population, 46. In practice, a reasonable
bank’s existing portfolio. Alternatively, this may justify the estimation of estimation approach likely will result in
a bank may draw more heavily on sub- separate models where data elements a range of defensible risk parameter
samples of its internal portfolio (for are missing. values. The choices of the particular
assumptions and adjustments that predictive of default, loss or exposure should examine the sensitivity of the
determine the final estimate, within the risk, in part to permit flexibility in early results to alternative combinations.
defensible range, should reflect the years when data may be far from ideal 53. To ensure that the best available
uncertainty in the quantification for some portfolios. Nevertheless, data are used to produce accurate risk
process. That is, the more uncertainty in mapping exercises should aim to estimates a bank might combine data
the process, the more risk-based capital provide the greatest possible assurance from multiple sources and may use
should be required. that it is appropriate to apply the bank’s multiple estimation methods. Banks
47. The degree of conservatism should estimation framework to the existing often combine internal data with
be related to factors such as the portfolio of exposures. In instances external data and use data from different
relevance and depth of the reference where banks rely on a limited set of sample periods. For example, for a
data, the quality of the mapping, the common variables, or where those wholesale portfolio a bank may combine
precision of the statistical estimates, and variables are not clearly identical, banks results from corporate-bond default
the amount of judgment used should compensate by being more databases with results from equity-based
throughout the process. Conservative conservative in other stages of the models of obligor default.
methodologies should also be quantification process. 54. The manner in which the
considered for new products, such as S 4–14 A mapping process should estimates from multiple data sets or
new residential mortgage products. be established for each reference data estimation methods are combined is
Margins of conservatism need not be set and for each estimation model. extremely important, since different
added at each step, as that could 51. Banks should never assume that combinations will produce different risk
produce an excessively conservative the rationale for a mapping is self- parameter estimates. A bank should
result. Instead, the overall margin of evident. Even when reference data are investigate risk parameter estimates’
conservatism should adequately account drawn from internal default and loss sensitivity to different ways of
for all uncertainties and weaknesses. experience, a bank should still link the combining data sets or combining
Improvements in the quantification estimation methods. When results are
characteristics of the reference data with
process (use of better data, estimation highly sensitive to how data or
those of the existing portfolio. The use
techniques, and so on) may allow risk estimates are combined, a bank should
of internal data for reference data
parameter estimates to become less make every effort to understand the
purposes does not eliminate the need
conservative over time. nature (reasons and implications) of the
for a mapping requirement because
S 4–13 Mapping should be based on instability (including use of statistical
changes in bank strategy or external
a comparison of available data tests) and choose among the alternatives
economic forces may alter the risk
elements that are common to the conservatively. A bank should
characteristics or composition of the
existing portfolio and each reference document why it selected the
portfolio over time, even within the
data set. combination techniques it did, and
48. Sound mapping practice uses same wholesale obligor/loss severity these techniques should be subject to
elements that are available in both the ratings or within the same retail appropriate approval and oversight by
existing portfolio and the reference data. segments. management.
If a bank chooses to ignore certain • For example, a wholesale rating S 4–16 The aggregation of risk
variables or to weight some variables system that has been explicitly designed parameter estimates from individual
more heavily than others, those choices to replicate external agency ratings may exposures within rating grades or
should be supported. At least two kinds or may not be effective in producing a segments should be governed by a clear
of mapping challenges may arise: replica; formal mapping would be and well-documented policy.
• First, even if similarly named performed. Indeed, in such a system the 55. Because different methods of
variables are available in the historical kind of analysis involved in mapping aggregation are possible, a bank should
reference data and the existing portfolio may help identify inconsistencies in the have a clear and well-supported policy
data, they may not be directly rating process itself. regarding how aggregation should be
comparable. Hence, a bank should • Similarly for retail portfolios, even accomplished. Banks are required to
ensure that linked variables are truly if the bank uses the same segmentation have a quantification system in which
similar. Although adjustments to system over time, it should verify that the rating grades or segments are
enhance comparability can be the risk factors behind the segmentation homogeneous with regard to risk; in this
appropriate, they should be rigorously capture the same types of borrowers in case, each obligor or exposure within
developed and documented. today’s portfolio as they did in the homogeneous grades or segments would
• Second, levels of aggregation may reference data. For example, a given receive equal emphasis in
vary. The bank’s information systems product offering may attract types of quantification.
for its existing exposures might supply customers that differ over time in ways 56. For wholesale exposures, rating
more detail. For example, to apply the that affect risk but are not fully reflected grade-based mapping naturally
estimates derived from the reference in the risk factors used for segmentation. produces an average risk parameter
data, the portfolio data could be 52. Banks often use multiple reference estimate by rating grade. Conversely,
regrouped to match the coarser data sets, and then combine the obligor-based or loss severity-based
aggregation of the reference data. resulting estimates to get a risk mappings require the aggregation of the
49. Mapping should be consistent parameter estimate for a wholesale individual risk parameter estimates to
with the risk rating and segmentation obligor/loss severity rating or for a retail the rating grade level. The bank should
systems. Levels and ranges of key segment. A bank that does so should document this aggregation and compare
characteristics for each rating or conduct a rigorous mapping process for the results of alternative mappings.
segment of the bank’s existing exposures each data set. These mappings are discussed in the
should approximate the values of S 4–15 Banks that combine relevant PD and ELGD and LGD
similar characteristics for the reference estimates from internal and external sections.
data. data or that use multiple estimation 57. If a bank uses a prediction model
50. The standard allows for use of a methods should have a clear policy for a retail portfolio that assigns a risk
limited set of common variables that are governing the combination process and parameter estimate to each exposure, it
should specify and document the significantly higher than average during 64. Estimation generally should treat
process by which it aggregates the the available data history. Data are data from different time periods
exposure-level risk parameters to assign available from regional recessions in similarly. A bank choosing instead to
segment-level estimates. New England (late 1980s and 1990 place greater relative weight on data
–1995), Texas (1983–1989), and from particular time periods should
II. Probability of Default (PD) empirically demonstrate that doing so
California (1991–1995). The bank
A. Data demonstrates that the drivers of produces a more accurate estimate of
58. For PD quantification, a minimum significantly higher default rates in future default behavior for each
these regional recessions can be wholesale rating grade and retail
of five years of data that include periods
extrapolated to the national portfolio, segment in its existing portfolio. For
of economic downturn conditions is
and the bank justifies and documents example, more recent data might be
required; in the event that such data are
the resulting adjustments that would be given more weight in the estimation
not available, a bank must adjust its PD
necessary in the mapping and process if the bank demonstrates that
estimates to compensate for the lack of
application stages. doing so is more predictive of future
data from periods of economic
default behavior.
downturn conditions. The data for PD B. Estimation 65. For a statistical model to
quantification should include relevant satisfactorily produce long-run PD
characteristics of both defaulted and 61. Estimation of PD is the process by
which risk characteristics of the estimates, the reference data used in the
non-defaulted exposures such as default model must meet the long-run
information on the exposures at reference data are related to default rates
for each wholesale obligor or for each requirement. A model can be used to
different points in time, payment relate risk drivers to the outcome—
history and ultimate disposition. retail segment in the reference portfolio.
The relevant risk characteristics that are default or non-default. Drivers might
59. To estimate PD accurately and include wholesale financial ratios, retail
support the determination of risk-based predictive of the likelihood of default
are referred to as ‘‘drivers of default.’’ borrower credit scores, loan terms,
capital requirements, a bank must have economic conditions or industry
a comprehensive reference data set with Drivers for wholesale obligors might
include financial ratios, management variables. Such a model must be
observations that should be calibrated to capture the default
representative of the bank’s existing expertise and industry. Drivers for retail
segments might include product, loan experience over a reasonable mix of
exposures. For wholesale portfolios the economic conditions. For example, a
reference data should map to obligors, and borrower characteristics such as
loan-to-value, credit line utilization, Merton-style model’s estimate of
and for retail portfolios the reference distance to default must be calibrated to
data should map to segments of the credit score, or delinquency status.
Also, a portfolio separator such as the default rate using long-run
existing portfolio. Clearly, the data set experience. Whether a PD model is
used for estimation should be similar to geographic region, while not a direct
driver of default, might indicate developed internally or by a vendor, a
the portfolio to which such estimates bank should verify that the model’s
will be applied. The same comparability separate relationships of the PD to these
drivers by geographic region. results have been calibrated to a long-
standard applies to both internal and run average PD.
external data sets. S 4–17 PD estimates must be
66. Adjustments that are part of the
60. To ensure ongoing applicability of empirically based and must represent a
PD estimation process must not result in
the reference data, a bank should assess long-run average.
an overall bias toward lower risk
the characteristics of its existing 62. The PD is an estimate of the long-
parameter estimates. The bank should
exposures relative to the characteristics run average of one-year default rates for
rigorously validate, justify, and
of exposures in the reference data. Such wholesale rating grades, for segments of
document such adjustments.
variables might include qualitative and non-defaulted retail exposures where
quantitative information on the seasoning is not material, or for a Example 1
exposure, internal and external segment of non-defaulted retail If the bank’s internal data history does
wholesale ratings and rating dates, exposures in a retail exposure not include any periods of economic
updated retail credit scores, corporate subcategory for which seasoning effects downturn, the bank may use external
lending relationships, retail product are not material. data sources that include an economic
type and loan terms, or geography. A 63. PD estimates should represent downturn period to adjust PD estimates
bank should maintain documentation averages of one-year default rates over a upward. The bank should justify the
that fully describes all explanatory mix of economic conditions (including assumption that the relationship
variables in the data set, including any economic downturn conditions) between the long-run average PD and
changes to those variables over time. A sufficient to provide a reasonable the risk drivers observed in the external
well-defined and documented process estimate of the one-year default rate data applies to its portfolio. This
should be in place to ensure that the over the economic cycle for the rating practice is consistent with this
reference data are updated as frequently grade or retail segment as specified guidance.
as is practical, as fresh data become above. If a bank uses the best available
available or portfolio changes make historical data to estimate PD as the Example 2
necessary. mean of yearly realized default rates A bank uses internal default
over at least five years, and the bank can experience to estimate PDs for its
Example empirically support that this period wholesale portfolio. However, the bank
A bank determines that the aggregate includes economic downturn has historically failed to recognize
national retail mortgage portfolio has conditions, then this is likely to defaults under the IRB default
not experienced downturn conditions adequately represent long-run definition. For example, exposures sold
during the time horizon for which experience. The emphasis should not at a material credit loss were not
internal reference data are available. solely be on time span; the long-run captured as defaults. The realized PD
However, regional sub-portfolios did average concept captures the breadth, as using the IRB definition would be
experience default rates that were well as the length, of experience. higher than that observed by the bank
(and LGD rates might differ as well). If caused by short-term fluctuations in and assigned rating grades; retail
the bank made no adjustment for the market factors (such as interest rates). segment drivers include exposure and
missing defaults, its practice would not Also, banks may incorporate borrower risk characteristics.
be acceptable. discounting of cash flows into their 78. Key drivers of default should be
S 4–18 Effects of seasoning, when estimates of expected remaining life if factored directly into the obligor rating
material, must be considered in the PD they so choose. or segmentation process. But in some
estimates for retail portfolios. 74. Even if the exposures are circumstances, certain effects related to
67. A bank should determine whether potentially subject to material seasoning industry, geography, or other factors are
age since origination is a significant risk effects, a bank may use the definition of not reflected in wholesale obligor risk
factor for its retail exposures on the PD specified in Paragraph 62 of this rating assignments, retail segmentation,
balance sheet. If so, then seasoning may chapter for certain exposures that are or default estimation models. In such
be a material risk factor. originated for sale or securitization, cases, it may be appropriate for banks to
68. Material seasoning effects are provided that: capture the impact of the omissions by
generally indicated when default rates • The bank credibly demonstrates its using different mappings for different
of a segment of retail exposures follow ability and intent to sell or securitize the business lines or types of exposures.
a characteristic age profile, rising for the exposures within a 90-day time frame. Supervisors expect this practice to be
first several periods following It can do so by: transitional, and that banks eventually
origination. Seasoning of this type is —An established historical track will incorporate the omitted effects into
often significant for longer-maturity record of sales or securitizations for the wholesale obligor risk rating, the
consumer products such as residential similar exposures; or retail segmentation system or the PD
mortgages, but may also be important —Commitments in the form of estimation process as they are
for shorter-lived portfolios. forward sales agreements or other uncovered and documented, rather than
69. Additional common indicators of contractual pipeline arrangements that adjusting the mapping.
material seasoning effects are large or provide reasonable assurances that the 79. Banks may use multiple reference
rapidly growing portfolio concentrations exposures will be sold within 90 days. data sets or estimation methods, and
of unseasoned exposures where age is a • The exposures are specifically then combine the resulting estimates to
significant risk factor. Such identified at origination. get an obligor rating grade or segment
concentrations could result from a high • The bank monitors sales or PD. A bank that does so should conduct
growth rate of originations, unusually securitization market indicators, a rigorous mapping process for each
high prepayment or attrition rates, or including an assessment of counterparty data set and estimation method. For
high rates of sales or securitization of risk, to ensure its continuing ability to example, when using data from a
seasoned exposures. sell or securitize these exposures in a number of wholesale rating agencies,
70. Even when age is a significant risk variety of market conditions. the mapping should take into
factor and default rates follow a Exposures that are not sold or consideration differences in the
characteristic age profile, seasoning securitized within 90 days should be agencies’ rating methods by mapping
effects may not be material if a retail assigned to segments that fully reflect each agency’s obligor rating scale
exposure subcategory’s age distribution their risk profile based on their updated separately. Similarly, when combining
is stable and the age distribution of the risk characteristics. the results from internal historical data
75. Banks should note that under the and a default prediction model over a
portfolio is not concentrated in
rules for securitization exposures in the retail portfolio, the bank should map
unseasoned exposures.
71. The operational definition of NPR, a bank may need to quantify the both the historical long-run PD and the
material seasoning effects for a segment IRB risk parameters for some securitized model’s output to the existing portfolio.
of retail exposures is that the annualized exposures. For that quantification
process, a bank must meet the Retail Mapping
cumulative default rate for that segment
quantification requirements for 80. For retail portfolios, mapping
materially exceeds the long-run average
estimating PDs for retail exposures held involves linking segments in the
of one year default rates.
on balance sheet, including the reference data to segments in the
72. If seasoning effects are material for
requirements for estimating PD when existing portfolio. If the bank’s
the retail exposure subcategory, banks
seasoning effects are material. segmentation process has been in place
must use a PD that reflects a longer-run
76. The account age profile may be for a long time, the mapping between
horizon and provides adequate risk-
tracked by using account age as a internal historical data and the existing
based capital to cover potential credit
criterion in the segmentation system for portfolio data may be straightforward.
losses for its unseasoned segments in
the retail exposures or as a predictive However, if the bank’s retail
that subcategory. Specifically, rather
variable in a PD quantification model. segmentation system has varied over
than the best estimate of the long-run
Several methods can be used to account time, the bank should demonstrate a
average of 1-year default rates, the
for seasoning in the PD estimates. See mapping between its existing
higher PD that must be used is defined
example 4 in Appendix B of this segmentation system and the segments
as the estimated annualized cumulative
chapter. in the reference data. In either case, the
default rate of the segment over the
bank should demonstrate that the
expected remaining life of the exposures C. Mapping
mapping is appropriate and conduct
in the segment.3 77. Mapping is establishing a linkage periodic assessments to verify this.
73. Estimates of expected remaining between the bank’s existing exposures
life should reflect a long-run average for and the reference obligor data used in Example
exposures in the segment; banks should the default model. Hence, mapping 2ven if similarly named
avoid undue volatility in their estimates involves identifying how drivers of characteristics are available in the
3 Expected remaining life is the average period
default for the existing exposures reference data and the existing portfolio
from today until an exposure of a particular type
correspond to the reference data’s data, they may not be directly
will prepay, pay in full through normal drivers. Wholesale drivers include comparable. For example, in a retail
amortization, or default. financial and nonfinancial variables, portfolio of auto loans, the particular
types of auto loans (for example, new or rating based on quantitative and 86. In addition to the general
used, direct or indirect) may vary from qualitative characteristics and assigns requirement to compare elements that
one application to another. Hence, a the realized long-run average one-year the reference data and portfolio have in
bank should ensure that linked drivers default rate for that external rating to the common, both obligor and rating grade
are truly similar in PD estimation. internal rating grade in the application mappings should also take into account
Although adjustments to enhance stage. differences in rating philosophy (as
comparability can be appropriate, they commonly revealed through analysis of
should be rigorously developed and Example rating migration) between any ratings
documented. A bank uses rating grade mapping to embedded in the reference data set and
link portfolio obligors to the reference the bank’s own rating regime.
Wholesale Mapping
data set described by agency ratings. D. Application
81. There are two broad approaches to The bank reviews publicly-rated
the mapping process for wholesale portfolio obligors within an internal 87. The application stage produces
portfolios, obligor mapping and rating rating grade to determine the most final PD estimates that will be used in
grade mapping. common agency rating, does the same the determination of risk-based capital
82. In obligor mapping, each existing for all rating grades, and creates a requirements. This stage is expected to
obligor is mapped to the reference data linkage between internal and agency be relatively mechanical for most retail
based on its individual characteristics. ratings. The strength of the linkage is a portfolios, except when the bank uses
For example, if a bank applies a default function of the number of externally multiple reference data sets or multiple
model to estimate an obligor-level rated obligors within each rating grade, estimation methods or significantly
default probability, that model uses the distribution of those agency ratings changes its segmentation system over
certain obligor-level variables as inputs. within each rating grade and the time. Judgmental adjustments to the risk
The values of these variables for each similarity of externally rated obligors in parameter estimates should be rare for
obligor are used as inputs to the obligor- the grade to those not externally rated. retail portfolios.
level default probability estimation This practice is broadly consistent with 88. This stage may be somewhat more
model. sound mapping practices, and, for the
involved for wholesale portfolios. After
the bank applies the PD estimation
Example reasons discussed below, may require
method to its existing exposures using
In estimating rating grade PDs, a bank adjustments and the addition of margins
the mapping process, adjustments to the
relies on observed default rates on of conservatism.
raw results derived from the estimation
bonds in various agency ratings. To map 84. An acceptable quantification
stage may be appropriate to obtain final
its internal rating grades to the agency process could include the use of either
rating grade PD estimates. For example,
ratings, the bank identifies variables that a rating grade mapping or obligor
the bank might aggregate individual
together explain much of the rating mapping approach. However, in the
obligor default probabilities to the rating
variation in the bond sample. The bank absence of other compelling
grade level or otherwise produce a
then conducts a statistical analysis of considerations, banks should use
rating grade PD estimate, or might
those same variables within its portfolio obligor mapping because rating grade
smooth results because a rating grade’s
of obligors, using a multivariate distance mapping has the following drawbacks:
PD estimate was higher than a lower
calculation to assign each portfolio • First, default probabilities are quality grade. The bank should explain
obligor to the external rating whose nonlinear using many estimation and support all such adjustments when
characteristics it matches most closely approaches. As a result, the typical documenting its quantification process.
(for example, assigning obligors to obligor’s default probability using the 89. The bank must ensure that the PD
ratings so that the sum of squared rating grade mapping approach is often applied in the determination of risk-
differences between the external rating lower than the mean of the individual based capital requirements for each
averages and the obligor’s obligor default probabilities using the wholesale exposure or retail segment is
characteristics is minimized). This obligor mapping approach. not less than the regulatory floor of 0.03
practice is broadly consistent with • Second, a hypothetical obligor with percent, except for exposures to or
sound mapping practices. a rating grade’s average characteristics directly and unconditionally guaranteed
83. In rating grade mapping, may not represent well the risks by a sovereign entity, the Bank for
characteristics of the obligors within an presented by the rating grade’s typical International Settlements, the
internal rating grade are averaged or obligor, since different types of obligors International Monetary Fund, the
otherwise summarized to construct a might end up in the same grade. European Commission, the European
‘‘typical’’ or representative obligor for 85. A bank electing to use rating grade Central Bank, or a multi-lateral
each rating grade. Then, the bank maps mapping instead of obligor mapping development bank, to which the bank
that representative obligor to the should be especially careful in choosing assigns a rating grade associated with a
reference data. For example, if the bank a ‘‘typical’’ obligor for each grade. Doing PD of less than 0.03 percent.
uses a model that takes certain variables so generally requires that the bank
as inputs to produce an obligor-level examine the actual distribution of Example
default probability estimate, a obligors within each rating grade, as A bank uses external data to estimate
representative value for each input well as the characteristics of those long-run average PDs for each wholesale
variable would be determined for each obligors. Banks should be aware that rating grade. The resulting PD estimate
internal rating grade, creating in effect a different statistical measures (such as for Grade 2 is slightly higher than the
‘‘typical obligor’’ for a rating grade; the mean, median, or mode) will produce estimate for Grade 3, even though Grade
default probability associated with that different results, and may result in 2 is supposedly of higher credit quality.
typical obligor will serve as the rating materially different PDs for a particular The bank uses statistics to demonstrate
grade PD in the application stage. As an rating grade. The bank should justify its that this anomaly occurred because
alternative example, a bank maps the choice and should have a clear and defaults are rare in the highest quality
typical obligor from each internal rating consistent policy toward the rating grades. The bank judgmentally
grade to a particular external NRSRO calculation. adjusts the PD estimates for Grades 2
and 3 to preserve the expected meaningful ways. Wholesale exposures obligation for many years following
relationship between obligor rating are grouped by characteristics that are default. For practical purposes, banks
grade and PD, but demonstrates that likely to be important in predicting loss relying on actual recovery data may
total risk-weighted assets across both rates—for example, whether an choose to close the period of
rating grades using the adjusted PD exposure is secured and the type and observation before this final resolution
estimates are no less than total risk- coverage of collateral, the seniority of a occurs—that is, at a point in time when
weighted assets based on the unadjusted claim, economic conditions, and the most costs have been incurred and
estimates, using a typical distribution of obligor’s industry. The retail when recoveries are substantially
obligors across the two rating grades. An segmentation system may separate complete. Banks that do so should
adjustment such as given in this exposures by borrower and exposure estimate the additional costs and
example is consistent with this risk characteristics predictive of loss recoveries that would likely occur
guidance. severity or by an ELGD or LGD score— beyond this period and include them in
for example, credit score, business line, ELGD and LGD estimates. A bank
III. Expected Loss Given Default (ELGD)
credit line utilization for unsecured should document its choice of the
and Loss Given Default (LGD)
credit lines, or loan-to-value for period of observation, and how it
90. The ELGD and LGD quantification mortgage loans. estimated additional costs and
process is similar to the PD 94. Although the characteristics recoveries beyond this period.
quantification process. Once a bank identified above have been found to be 98. Reference data sets may contain
identifies and obtains a reference data significant in academic and industry individual loss observations that are less
set of defaulted exposures and relevant studies, a bank’s quantification of ELGD than 0 percent or greater than 100
descriptive characteristics, it selects a and LGD certainly need not be limited percent. However, extra diligence is
technique to estimate the credit-related to these variables. For example, a bank required for loss realizations reported to
economic loss per dollar of EAD for a might examine many other potential be less than 0 percent to ensure that
defaulted wholesale exposure with a drivers of loss severity, including economic loss is being measured.4
given array of characteristics or for all geographic location, exposure type,
defaulted exposures in a reference retail Example 1
tenor of the relationship, wholesale
segment. The reference data should then obligor size, or retail borrower wealth. A bank with internal wholesale data
be mapped to the bank’s existing 95. Second, data must be available to covering the period 1997 through 2003
exposures so that the bank can estimate calculate the realized economic loss of relies primarily on these data for
ELGD and LGD for each wholesale each defaulted exposure. Such data may quantifying its wholesale risk parameter
exposure, loss severity rating, or retail include the market value of the estimates. The bank will continue to
segment, as the case may be. Finally, wholesale exposure at default or the extend this internal data set as time
application adjustments may be made to market value for a pool of charged-off progresses. Its current policy mandates
obtain final risk parameter estimates. retail exposures, which can be used to that credits be resolved within two years
91. The ELGD is an estimate of the proxy a recovery rate. Alternatively, of default, so the data set contains the
default-weighted average economic loss economic loss may be calculated for most recent data available. Although the
(where individual defaults receive equal wholesale exposures and retail segments existing data set satisfies the seven-year
weight), per dollar of EAD, the bank using the EAD (including principal and requirement for ELGD quantification,
expects to incur in the event that the accrued but unpaid interest or fees), the bank is aware that it does not
obligor were to default within a one- losses on the sale of repossessed include appropriate economic downturn
year horizon over a mix of economic collateral, direct workout costs, an conditions for certain portfolios. In
conditions, including economic appropriate allocation of indirect comparing its loss estimates with rates
downturn conditions. LGD estimates workout costs, the timing and amount of published in external studies that cover
reflect the estimate of the economic loss subsequent recoveries, and the discount longer time periods and include
per dollar of EAD that the bank expects rate appropriate to the risk of the economic downturn periods for
to incur if the obligor were to default exposure. similarly stratified data, the bank
within a one-year horizon during 96. Data should be comprehensive. observes that its estimates are
economic downturn conditions. All cash flow data should include dollar systematically lower. To be consistent
Accordingly, ELGD estimates amounts and dates. For example, roll to with the NPR, the bank must reflect
incorporate a mix of economic charge-off or non-accrual, number of economic downturn conditions in its
conditions (including economic days past due, or bankruptcy status ELGD estimates, as such estimates
downturn conditions) while LGD should be captured if these factors are represent the loss the bank expects to
estimates reflect losses that would occur expected to be significant for ELGD and incur in the event that the obligor of the
during economic downturn conditions LGD. Recovery data should include exposure defaults within a one-year
(i.e., conditions in which aggregate direct payments from the obligor/ horizon over a mix of economic
default rates are significantly higher borrower, the sale of the collateral or conditions, including economic
than average). LGD estimates cannot be realized income from the sale of downturn conditions.
less than ELGD estimates for a particular defaulted exposures. Supportable net Example 2
wholesale exposure or retail segment. realizable value of defaulted exposures
and collateral acquired in default that A bank develops evidence that during
A. Data has yet to be disposed of can be the 2001 to 2003 period of highly
92. Unlike reference data sets used for included as part of the reference data.
4 Banks are not required to truncate the loss
PD estimation, data sets for ELGD and Cost data comprise the material direct severity data used to derive ELGD and LGD
LGD estimation contain only exposures and indirect costs associated with
parameter estimates. Nonetheless, final ELGD and

to defaulted obligors. At least two broad workouts and collections. LGD estimates should not be negative or zero.
categories of data are necessary to 97. Ideally, loss severity should be Readers are directed to the discussion of the
application stage for ELGD and LGD in a later
produce ELGD and LGD estimates. measured once all recoveries and costs section of this guidance for elaboration of related
93. First, factors must be available to have been realized. However, a bank supervisory expectations regarding ELGD and LGD
group the defaulted exposures in may not resolve a defaulted wholesale quantification.
elevated mortgage prepayments owing B. Estimation Example 2

to record-low interest rates, losses were A bank groups observed defaults in
likely deferred in mortgage portfolios 100. Estimation of ELGD and LGD is
the process by which characteristics of the reference data according to
because of readily available refinancing geographic region and collateral. One of
the reference data are related to loss
options. The bank also concludes that the pools has too few observations to
severity. Relevant characteristics for
losses on foreclosures during this period produce a reliable estimate. By
wholesale exposures might include
were limited because housing prices variables such as seniority, collateral, augmenting the loss data with data from
generally increased throughout the exposure type, or business line. For similar geographic regions with the
United States despite a recession. retail portfolios, as discussed in Chapter same collateralization, the bank derives
However, the bank notes that a similar 3, a common ELGD or LGD might be an ELGD estimate. Provided the bank
(though not as substantial) drop in applied so long as the estimate is can adequately support the process used
interest rates occurred in the early accurate for each segment and to establish the relevance of the data
1990s, during a recession that was exposures within those segments have from other regions, this approach would
characterized by a sharp drop in homogenous risk characteristics. be consistent with the guidance.
property values in many parts of the 103. Banks should evaluate
101. In estimating ELGD and LGD,
country. Because the recent period may adjustments in the ELGD and LGD
banks should identify drivers of loss.
have been atypical, the bank chooses to estimation process to ensure that they
One estimation approach is to separate
weigh older data (perhaps from external do not result in an overall bias toward
the reference defaults into groups that
sources) more heavily than recent data lower estimates of risk.
do not overlap, for example, by business
for ELGD quantification. Such an line, predominant collateral type, or Example 1
approach to weighting the data would loan-to-value coverage. The ELGD
be consistent with this guidance. A bank is unable to properly discount
estimate for each category could then be a segment’s cash flows because the
99. The following examples illustrate based on the default-weighted average reference data do not include the dates
how definitions of default in the economic loss per dollar of EAD, and of recoveries (and related costs).
reference data that are different from the LGD could be similarly derived using However, the bank has sufficient
IRB definition complicate ELGD data from periods of economic internal data to calculate economic loss
estimation. downturn conditions. In most cases, it for defaulted exposures in another
will not be acceptable to calculate ELGD portfolio segment. The bank can support
Example 1 as the average of annual loss rates the assumption that the timing of cash
For ELGD estimation, a bank includes (where loss severity for each year flows for the two segments is
in its default database only exposures receives equal weight). Years with a comparable. Using the available data
that actually experience a loss and relatively large number of defaults and informed judgment, the bank
excludes exposures for which no loss generally provide richer data for adjusts the estimates for the data-poor
measuring loss severity compared to segment to reflect how much the
was recorded (effectively applying a
years when there are relatively few measured loss without discounting
‘‘loss given loss’’ concept). This practice
defaults. Thus, in general, years with a should be grossed up to account for the
is not consistent with the NPR because
relatively large number of defaults time value of money and the distressed
the bank’s default definition is narrower
contribute more information and should nature of the assets. This practice is
than the IRB definition.
be appropriately weighted when consistent with the guidance.
Example 2 estimating ELGD. In addition, if years of
relatively low default rates typically Example 2
A bank relies on two external data have relatively low loss severity rates, Collateral is one factor used by a bank
sources to estimate ELGD because it then using the average of annual loss to estimate ELGD. Although the
lacks sufficient internal data. Both rates will tend to understate ELGD. available internal and external data
sources use definitions that deviate from 102. A statistical model, for example indicate a higher ELGD, the bank
the IRB definition; one uses a regression model using data on loss judgmentally assigns a loss estimate of
‘‘bankruptcy filing’’ to indicate default severity and some quantitative measures 2 percent for exposures secured by cash
while another uses ‘‘missed principal or of the loss drivers, could be applied to collateral. The bank contends that the
interest payment.’’ Although the estimate ELGD or LGD. Any model must lower estimate is justified because it
different definitions result in meet the requirements for validation expects to do a better job of following
significantly different loss estimates for discussed in Chapter 7. Other methods policies for monitoring cash collateral in
the loss severity ratings defined by the for estimating ELGD or LGD could also the future. Such an adjustment is
bank, the bank simply combines the be appropriate. generally not appropriate because it is
external data sources in deriving its based on projections of future
ELGD estimates. The bank’s practice is Example 1
performance rather than realized
not consistent with the guidance. The To estimate ELGD, a bank uses only experience. This practice generally is
bank should determine the impact on internal data. Although information on not consistent with the guidance.
the parameter estimates of the different security and seniority is lacking, no S 4–19 ELGD and LGD estimates
definitions used in the reference data adjustments for the lack of data are must be empirically based and must
sets. For minor definitional differences, made in the estimation or application reflect the concept of ‘‘economic loss.’’
the bank may be able to make steps. This practice is not consistent 104. ELGD and LGD are based on the
appropriate adjustments during the with the guidance because there is concept of economic loss, which is a
estimation stage. If the differences are ample external evidence that security broader, more inclusive concept than
difficult to quantify, an appropriate and seniority are relevant in estimating accounting measures of loss. Broadly
level of conservatism should be applied ELGD. A bank with such limited speaking, economic loss incorporates
or the bank should seek other sources of internal default data must incorporate the mark-to-market loss of value of a
reference data. external or pooled data. defaulted exposure and collateral,
including material accrued but unpaid premium.5 As such, an appropriate 114. If a bank has not received prior
interest or fees, and all material direct discount rate will reflect the uncertainty written approval from its primary
and indirect costs of workout and of recovery cash flows and the presence Federal supervisor to use internal LGD
collections, net of recoveries. Losses, of undiversifiable risk. estimates, the bank must use the
recoveries, and costs should all be S 4–20 ELGD estimates must reflect supervisory mapping function. The
discounted to the time of default. See the expected default-weighted average supervisory mapping function
the fourth paragraph of the LGD economic loss rate over a mix of calculates LGD by taking 92 percent of
definition in section 2 of the NPR for the economic conditions, including the ELGD and adding eight percentage
definition of economic loss. economic downturn conditions. points to that result.
105. Banks often estimate loss using 110. For wholesale exposures, ELGD 115. The LGD estimate for an
data on costs and recoveries from is the best estimate of the economic loss exposure or segment may never be less
workouts of defaulted exposures; per dollar of EAD that would be than the ELGD assigned to that exposure
however, appropriate estimates may incurred in the event that the obligor (or or segment, and must be higher than
sometimes be developed using market a typical obligor in the applicable loss ELGD if a higher estimate is appropriate
data on defaulted exposures. severity rating) defaults within a one- based on robust analysis of the impact
year horizon. For retail segments, ELGD of economic downturn conditions on
106. The scope of cash flows included
is the best estimate of the economic loss loss severity. The LGD for some
in recoveries and costs is meant to be
per dollar of EAD that would be exposures or segments may be
broad. Material recovery costs that can
incurred on the segment from exposures substantially higher than ELGD, while
be clearly attributed to certain
that default within a one-year horizon. for others it may not.
exposures, plus material indirect cost S 4–22 A bank may use internal
items, must be reflected in the bank’s 111. ELGD estimates should reflect
expected long-run loss severities and estimates of LGD only if supervisors
ELGD and LGD assignments for those have previously determined that the
exposures. Recovery costs include the should represent an estimate of the
default-weighted average economic loss bank has a rigorous and well-
costs of running the bank’s collection documented process for assessing the
and workout departments and the cost as observed over a complete credit
cycle. Similar to PD quantification, loss effects of economic downturn
of outsourced collection services conditions on loss severities and for
directly attributable to recoveries during severity data must include periods of
economic downturn conditions or the producing LGD estimates consistent
a particular time or for a particular with downturn conditions. The process
segment or portfolio, at as granular a bank must adjust its estimates to
compensate for the lack of data from must appropriately identify downturn
level as possible. Recovery costs also conditions, identify the impact of
include an appropriate percentage of economic downturn conditions.
economic downturn conditions on loss
other ongoing costs, such as overhead. Economic Downturn LGD rates, identify any material adverse
107. Recovery costs can be allocated S 4–21 LGD estimates must reflect correlations between drivers of default
using the same principles and expected loss severities for exposures and LGD, and incorporate any
techniques of cost accounting that are that default during economic downturn identified correlations and/or downturn
usually used to determine the profit and conditions, and must be greater than or impact into the quantification of LGD.
loss of activities within any large equal to ELGD estimates. 116. In determining whether to
enterprise. Collection and workout 112. In addition to ELGD, banks must approve a bank’s use of internal
departments, however, may cover quantify LGD in a way that estimates of LGD for a subcategory of
services not 100 percent attributable to appropriately reflects downturn exposure, supervisors will consider
defaulted exposures. For example, the conditions for each wholesale exposure whether the process for generating LGD
same call center may manage reminder and for each retail segment. LGD is an estimates is consistent with the
calls to delinquent retail accounts, many estimate of the percentage of EAD that supervisory standard above and
of which will never default, as well as would be lost in the event of a default produces internal estimates of LGD that
collection calls. The expenses for these during the one-year horizon, if that are reliable and sufficiently reflective of
functions should be differentiated to default were to occur during a period of economic downturn conditions.
allocate only collection expenses economic downturn. Under economic 117. To meet the requirements for
attributable to defaulted exposures. downturn conditions default rates are internal estimates, a bank should satisfy
108. When costs cannot be allocated higher than under more neutral the following conditions:
because of data limitations, the bank conditions, and LGD estimates must • The bank should establish policies
may assign those costs using broad reflect expected loss rates resulting from to govern the process for identifying
averages. For example, the bank could downturn conditions. downturn conditions and generating
allocate costs by outstanding dollar 113. If a bank obtains supervisory LGD estimates. The policy should
amounts of loans, including accrued but approval to use its own estimates of address:
unpaid interest or fees at the time of LGD for an exposure subcategory, it —Criteria for identifying downturn
default, within each rating grade or must use internal estimates of LGD for conditions;
segment. all exposures within that subcategory. —The level of product and geographic
Within retail, the three subcategories are scope to be used for identification of
109. All costs, and recoveries should
residential mortgage, QRE, and other economic downturn conditions;
be discounted to the time of default —Data requirements;
using the time interval between the date retail, while within wholesale credit the —Methods to determine the impact of
of default and the date of the realized two subcategories are high-volatility downturn conditions on loss severities;
loss, incurred cost, or recovery; this commercial real estate (‘‘HVCRE’’) and and
calculation should be on a pooled basis all other wholesale. —Quantification methodologies to

for retail exposures. The discount rate produce LGD estimates.
5 This implies that the appropriate discount rate
should reflect the costs of holding • The bank must have a rigorous
for IRB purposes likely will differ from the interest
defaulted assets over the workout rate required under FAS 114 for accounting quantification process (covering all
period, including an appropriate risk purposes. stages of quantification, including
reference data, estimation, mapping, in HVCRE for the two regions jointly, Estimation of LGD
and application) for estimating LGD. rather than considering each separately. 124. Once relevant downturn
The bank must be able to identify Nonetheless, as is the case with product conditions are identified, a bank must
economic downturns, determine the scope, banks are permitted to further determine the impact of such conditions
impact of downturn conditions on loss subdivide geographically if they choose on loss severities and construct
severities, and appropriately quantify to do so. appropriate estimates of LGD under
LGD. 121. The exception to the ‘‘footprint’’ economic downturn conditions for each
118. In principle, quantification of
scope is that separate countries must be wholesale loss severity rating grade or
LGD is no different from quantification
treated separately. For example, a bank exposure and each retail segment. LGD
of any other IRB risk parameter. The
with residential mortgage exposures in should be the empirically based best
target of the quantification process is
the United States and Japan must estimate of the loss severity as a
different, but the stages of quantification
(data, estimation, mapping, and separately identify the conditions under percentage of exposure if the obligor
application) apply to LGD just as they which residential mortgage default rates were to default during economic
do to other risk parameters such as PD would be significantly higher than downturn conditions. Note that
and ELGD. However, the details average in each national jurisdiction. although estimates are empirically
necessarily differ; the remainder of this 122. Given these requirements for based, the purpose of quantification is
section discusses supervisory standards product and geographic scope, not to measure past patterns and
related to quantification of own- downturn conditions with respect to a dependencies, but to generate
estimates of LGD to reflect economic wholesale exposure or retail segment are predictions of likely future outcomes.
downturn conditions. 125. Banks may choose to focus the
defined as those conditions under
quantification process on LGD directly.
Identifying Economic Downturn which the aggregate default rate for the
However, in many cases it may be more
Conditions exposure’s wholesale or retail exposure
practical to estimate the extent to which
subcategory (or subdivision of such
119. To identify periods of downturn loss rates can be expected to exceed
subcategory selected by the bank)
conditions, the bank should first ELGD under economic downturn
within the related geographic footprint
articulate both product and geographic conditions, through estimation of the
and/or jurisdiction (or finer subdivision
scope, since default rates for different difference (LGD–ELGD) or estimation of
selected by the bank) would be
types of exposures in different areas are the percentage increase in the loss rate,
significantly higher than average.
themselves likely to differ. At the or perhaps through some other
product level, the highest level of 123. It may be useful to distinguish translation of ELGD into LGD. In that
aggregation is a given IRB subcategory of this definition of economic downturn case, the result of one estimation
exposure (i.e., residential mortgage, from other definitions that might seem process—that for ELGD—is used an
QRE, other retail, HVCRE, and all other reasonable. For example, an economic input to the LGD estimation process,
wholesale). Thus, for example, downturn for purposes of LGD and any evaluation of the robustness of
downturn conditions for wholesale estimation is not defined as a period of LGD estimates would have to
exposures other than HVCRE are high loss severity, that is, a period in adequately consider the potential
defined as periods of high default rates which realized losses given default are modeling error and estimation error
for non-HVCRE wholesale exposures in high. Loss severities may be high during introduced by their reliance on ELGD as
general. A bank may choose to use an economic downturn—indeed, that is a key input.
lower levels of aggregation in order to the primary motivation for the separate 126. Identification of the impact of
achieve better measurement of actual estimation of economic downturn economic downturn conditions on LGD,
credit risk and greater risk sensitivity. LGD—but this is not the defining and incorporation of that impact into
For example, a bank with an industry characteristic; high realized loss severity LGD estimates, requires suitable design
concentration in a subcategory of rates do not define a downturn. of all stages of the quantification
exposures (such as corporate exposures Similarly, economic downturns are not process. No single approach is
to technology companies) may find that defined as periods of depressed presumed to be correct, and there are
information relating to a downturn in collateral values, although collateral many alternative approaches that, if
that industry sector may be more values may be low when default rates properly carried out, could satisfy the
relevant for the bank than a general are high. Finally, economic downturn supervisory requirements for use of
downturn affecting many regions or conditions for purposes of LGD internal estimates of LGD. Several
industries. estimation are not defined as periods of examples, while not intended to be
120. The geographic scope for poor economic performance as exhaustive, can serve to illustrate the
identification of economic downturn determined by other measures such as point.
conditions is the geographic ‘‘footprint’’ GDP growth or other traditional
of the bank within an exposure measures of business conditions and Example 1
subcategory, that is, the geographic area economic climate. Traditional measures A bank estimates a relationship
from which exposures of each type are of economic activity may indeed show between loss rates and a set of
drawn (or can be expected to be drawn weakness during periods corresponding independent variables or risk drivers
customarily). This ‘‘footprint’’ need not to ‘‘economic downturn conditions’’ as that is robust over periods covering a
be the same for each subcategory of defined for purposes of LGD estimation, wide range of conditions, including
exposures. Banks are not required to but a period of weak economic activity economic downturns. The bank
further subdivide with regard to does not in and of itself indicate the determines that the main impact of an
geography; for example, if a bank’s existence of economic downturn economic downturn on LGD arises
HVCRE exposures are drawn from two conditions as defined in the NPR. through changes in certain risk drivers
distinct regions such as the Southeast Economic downturn conditions are (such as collateral values) under
and the Northeast, they may define a identified only through reference to economic downturn conditions. The
downturn in HVCRE as a period of default rates for exposure subcategories bank quantifies LGD through a process
significantly above-average default rates within relevant geographic regions. similar to a stress test, with the
identified drivers of loss severity C. Mapping estimation process, no exposure or

stressed to the values they would 127. ELGD and LGD mapping follows rating grade should be assigned an
assume under economic downturn the same general standards as PD ELGD or LGD estimate that is less than
conditions, based on historical mapping. A mapping should be or equal to zero percent for purposes of
observations. plausible and should be based on a risk-based capital calculations.
comparison of loss severity-related data 132. The LGD (i.e., the economic
Example 2
elements common to both the reference downturn loss estimate) for each
A bank conducts rigorous analysis to data and the existing portfolio. The segment of residential mortgage
construct a model linking risk drivers mapping approach is expected to be exposures (other than segments of
for LGD to variables that characterize unbiased, such that the exercise of residential mortgage exposures for
economic downturn conditions, judgment does not consistently lower which all or substantially all of the
including underlying economic ELGD and LGD estimates. The default principal of each exposure is directly
variables and the way those variables definitions in the reference data and the and unconditionally guaranteed by the
tend to change in a downturn. The bank existing portfolio of exposures should full faith and credit of a sovereign
uses that model to directly simulate the be comparable, as should be the entity) may not be less than 10 percent.
impact of downturn conditions on LGD methods of recovery. The mapping IV. Exposure at Default (EAD)
rather than using downturn values for process should be updated regularly,
the variables that tend to determine loss well-documented, and independently 133. As EAD quantification is
severity rates under more normal reviewed. somewhat less advanced than other
conditions. 128. Mapping involves matching areas of quantification, it is addressed in
exposure-specific data elements somewhat less detail in this guidance.
Example 3 Banks should continue to innovate in
available in the existing portfolio to the
factors in the reference data set used to the area of EAD estimation, refining and
A bank determines that the impact of improving practices in EAD
economic downturn conditions on LGD estimate expected loss severity rates.
Examples of factors that influence loss measurement.
arises from a fundamental change in the
rates include collateral type and 134. A bank must provide an estimate
relationship between risk drivers and
coverage, seniority, industry, and of EAD for each exposure in its
LGD during a downturn. That is, the
location. Reference data often do not wholesale portfolio and for each
bank finds that loss severities rise in a
include workout costs and will often segment in its retail portfolio. For fixed
downturn because certain risk drivers or
use different discount rates. Judgmental exposures like term loans, EAD is equal
variables that have an impact on losses,
adjustments for such differences should to the carrying value unless there is an
such as collateral type or seniority, have
be well-documented and empirically allocated transfer risk reserve for the
a different quantitative influence on loss
based to the extent possible. exposure or the exposure is held
severity during a downturn than during
129. Different data sets and different available-for-sale. For variable
other periods. The bank estimates a
approaches to ELGD and LGD exposures such as loan commitments,
relationship between loss severity rates
estimation may be appropriate, revolving exposures and other lines of
and risk driving variables using data
especially for different business credit, EAD for each exposure includes
from periods of economic downturn
segments or product lines. Each the outstanding balance at the point of
conditions.
mapping process must be specified and capital measurement plus an estimate of
The approaches briefly described in documented. net additions to the total balance due,
the examples above also require careful including estimated future additional
consideration of appropriate mapping, D. Application advances of funds, including principal
since use of an estimated relationship 130. At the application stage, banks and accrued but unpaid interest and
between LGD and any other variables or apply the ELGD and LGD estimation fees that are likely to occur before and
risk drivers would require mapping of framework to their existing portfolio of after default assuming that the exposure
currently observed values of those credit exposures. This step might were to default within a one-year
variables for exposures, rating grades, or require banks to aggregate retail horizon. The estimate of net additions
segments to the corresponding values of segment-level ELGD and LGD estimates must reflect what would be expected
those drivers during economic derived from more granular reference during a period of economic downturn
downturn conditions. data into estimates applicable to broader conditions.
Example 4 segments in the existing portfolio, to 135. Refer to Chapter 9 of this
aggregate individual wholesale ELGD guidance and the NPR for guidance on
A bank conducts a rigorous and LGD estimates into discrete loss quantifying EAD for OTC derivative
comparison of average recovery rates severity ratings, or to combine contracts, repo-style transactions, and
with recovery rates observed during estimates. eligible margin loans.
appropriately identified downturn 131. The inherent variability of 136. For retail and wholesale
periods, finding that the impact of recovery, due in part to unanticipated exposures in which only the drawn
economic downturn conditions can be circumstances, demonstrates that no balance has been securitized (e.g., a
characterized as a fixed, across-the- exposure type is risk-free, regardless of typical credit card securitization), the
board reduction in recovery rates. The structure, collateral type, or collateral bank must reflect its share of the
bank is able to provide evidence that coverage. The existence of recovery risk exposures’ undrawn balances in EAD.
this relationship is statistically robust, dictates that the application stage The undrawn balances of exposures for
and superior to other approaches to LGD should result in an ELGD and LGD which the drawn balances have been
quantification. The bank uses the above 0 percent. As was discussed in securitized must be allocated between
implied, empirically based adjustments the data section, a data set may include the seller’s and investors’ interests on a
in the application stage of the LGD observations with negative realized loss pro rata basis, based on the proportions
quantification process to reflect the rates. Although these transactions may of the seller’s and investors’ shares of
impact of economic downturns. be included in the ELGD and LGD the securitized drawn balances.
137. A number of methods can be expected by a bank subsequent to wholesale exposures are computed from
used to estimate EAD. One common realization of a default event should be the average drawdown proportions that
approach is based on loan equivalent factored into the quantification of EAD. occur over the fixed-horizon interval,
exposure (‘‘LEQ’’), which is typically The estimation process should be for whatever combinations of the
expressed as a percentage of the current capable of producing a plausible average driving variables the bank has
total committed but undrawn amount.6 estimate of draws on unused available determined are relevant for explaining
EAD can thus be represented as: credit (e.g., LEQ) to support the EAD and predicting EAD. LEQs estimated for
EAD = current outstanding + LEQ × calculation for each exposure or retail retail segments are computed from the
(total committed ¥ current outstanding) segment. increase in balances that occur over the
fixed-horizon interval for the defaults in
A. Data Example
the segment relative to their credit
138. Like reference data sets used for A bank determines that a business limits. The time interval used for the
ELGD and LGD estimation, EAD data unit forms a homogeneous pool for the fixed-horizon method should be
sets typically contain only exposures to purposes of estimating EAD. That is, sufficiently long to capture the
defaulted obligors, although data on although the exposures in this pool may additional drawdowns generated by
troubled non-defaulted obligors also differ in some respects, the bank exposures that default during the year
could be informative in estimation of determines that the credit lines share a for which the risk parameters are being
these parameters. The same reference similar drawdown experience in estimated. In particular, the appropriate
data are often used for ELGD, LGD and default. The bank should provide fixed interval will be influenced by
EAD quantification. In addition to reasonable support for this pooling charge-off policies. For example, using a
relevant descriptive characteristics through analysis of lending practices six-month time interval for credit card
(referred to as ‘‘drivers’’) that can be and available internal and external data. loans would underestimate EAD.
used in estimation, the reference data 142. Two broad types of estimation
methods are used in practice, the cohort Special Considerations for Retail EAD
must include historical information on
method and the fixed-horizon method. Estimation
the exposure (both drawn and undrawn
amounts) as of some date prior to 143. Under the cohort method, a bank 145. Different methods are used to
default, as well as the drawn exposure groups defaults into discrete calendar estimate EAD for open credit lines. The
at the date of default. periods, such as a year. A bank may use LEQ method outlined in this guidance
139. As discussed below under a longer period if it provides a more is one technique observed in practice.
‘‘Estimation,’’ EAD estimates may be accurate estimate of future gross losses Other methods directly estimate the
developed using either a cohort method arising from undrawn exposures. For defaulted balances for a segment over a
or a fixed-horizon method. The bank’s retail exposures, the bank estimates the one-year window without taking the
reference data set should be structured relationship between the balances for committed line limit into account.
so that it is consistent with the defaulted exposures at the start of the These other methods may be acceptable
estimation method the bank applies. calendar period and at the time at if the bank could show that the size of
Thus, the data should include default. For wholesale exposures, the the line is not relevant given the other
information on the total commitment, bank estimates the relationship between risk factors used in the analysis.
the undrawn amount, and the exposure the drivers as of the start of that 146. EAD for a segment should
drivers for each defaulted exposure, calendar period and LEQ for each accurately estimate the total exposure at
either at fixed calendar dates for the exposure to a defaulter. For each default for the segment. Poor
cohort method or at a fixed interval exposure category or retail segment (that segmentation may result in inaccurate
prior to the default date for the fixed- is, for each combination of exposure EADs. For example, if loans within a
horizon method. drivers identified by the bank), an LEQ segment do not have homogenous risk
140. The reference data should estimate could be based on the mean characteristics because larger exposures
contain variables that enable the bank to additional drawing for exposures in that are more likely to default than smaller
group the exposures to defaulted category or segment as a proportion of exposures, then estimated EADs may be
obligors in meaningful ways. Banks the undrawn lines. One approach to biased downward.
should consider how a wide range of combine results for multiple periods S 4–23 Estimates of additional
obligor and exposure characteristics into a single long-run average would be drawdowns must reflect net additional
affect EAD. Examples include time from weighting the period-by-period means draws expected during economic
origination, time to expiration or by the proportion of defaults occurring downturn periods.
renewal, economic conditions, risk in each period, so that each default 147. Conceptually, banks should
rating changes, or certain types of receives equal weight. approach EAD quantification in a
covenants. Some potential drivers may 144. Under the fixed-horizon method, fashion parallel to LGD quantification
be linked to a bank’s credit risk for each defaulted exposure the bank with respect to the potential for
management skills, while others may be compares additional drawdowns to the volatility over the economic cycle.
external to the bank. gross committed but undrawn amount Specifically, estimates of net additional
that existed at a fixed date prior to the drawdowns should reflect what would
B. Estimation date of the default (the horizon). For be expected during economic downturn
141. To derive EAD estimates for lines example, the bank might base its periods. Certain exposure types may not
of credit and loan commitments, estimates on a reference data set that exhibit cyclical EAD variability; in these
characteristics of the reference data are supplies the actual amount outstanding cases, use of a long-run default-
related to additional drawings on an and any additional extensions along weighted average draw proportion used
with the drawn and undrawn amounts to derive EAD in the IRB risk-based
exposure up to and after the time a

default event is triggered. Estimates of (as well as relevant drivers) at a date a capital calculation is appropriate. But
any additional extensions of credit fixed number of months prior to the for exposure types for which
date of each default, regardless of the drawdowns are expected to be larger
6 This is frequently referred to as the credit actual calendar date on which the when default rates are significantly
conversion factor (CCF). default occurred. Estimates of LEQ for higher than average EAD—estimates
should take into account this cyclical calculation; as such it is not subject to 155. To be conservative, a bank may
variability. In such cases, the estimated the four stages of the quantification set M equal to the maximum number of
draw proportion used to derive the EAD process. years the obligor could take to fully
input to the risk-based capital 152. The data required to calculate M discharge the contractual obligation
calculation should exceed the long-run are the undiscounted amount and (provided that the maximum is not
default-weighted average, and should be timing of each remaining contractual longer than five years, as noted below).
the bank’s estimate of the net additional cash flow, measured in years from the This maximum will often correspond to
drawdown proportion per default date of the calculation. Specifically, M the stated or nominal maturity of the
expected during economic downturn is calculated as the sum of all time- instrument. Banks should make this
conditions. For this purpose, banks may weighted cash flows, where the weights conservative choice (maximum nominal
use averages of EADs observed during are equal to the fraction of the total maturity) if the timing and amounts of
economic downturn periods, forecasts undiscounted cash flow to be received the cash flows on the exposure cannot
based on appropriately conservative at each date. be projected with a reasonable degree of
assumptions, or other similar methods. confidence.
Example 156. For repo-style transactions,
C. Mapping
A bank holds an asset with two eligible margin loans and over-the-
148. If the characteristics that drive remaining contractual cash flows. 33 counter derivatives contracts subject to
EAD in the reference data are the same percent of the total remaining qualifying master netting agreements,
as those used for the risk rating or contractual cash flow is expected at the the bank may compute a single value of
segmentation system of the bank’s end of one year and the other 67 percent M for the transactions as a group by
existing portfolio, mapping may be is expected two years from today. For weighting each individual transaction’s
relatively straightforward. However, if risk-based capital purposes, M for this effective maturity by that transaction’s
the relevant characteristics are not asset could be calculated as: M = (1 × share of the total notional value subject
available in a bank’s existing portfolio, 0.33) + (2 × 0.67) = 1.67; or simply M to the netting agreement, and summing
the bank will encounter the same = 2, applying the nominal remaining the result across all of the transactions.
mapping complexities that it does when contractual maturity. 157. For risk-based capital
mapping PD, ELGD, and LGD in similar 153. The relevant cash flows are the calculations, the value of M for any
circumstances. future payments the bank expects to exposure is subject to certain upper and
D. Application receive from the obligor, regardless of lower limits, regardless of the
form; they may include payments of exposure’s actual effective maturity. The
149. In the application stage, the value of M should never exceed 5 years.
principal, interest, fees, or other types of
estimated relationship between risk If an exposure clearly has a greater
payments depending on the structure of
drivers and EAD is applied to the bank’s effective maturity, the bank may simply
the transaction.
existing portfolio. Multiple reference use a value of M = 5 rather than
154. For exposures with pre-
data sets may be used for EAD calculating the actual effective maturity.
determined cash flow schedules (fixed-
estimation and combined at the 158. For most exposures, the value of
rate loans, for example), the calculation
application stage, subject to the general M should be no less than one year. For
of the weighted-average remaining
standards for using multiple data sets. certain short-term exposures that are not
S 4–24 Estimates of additional maturity is straightforward, using the
scheduled timing and amounts of the part of a bank’s ongoing financing of a
drawdowns prior to default for borrower and that have an original
individual wholesale exposures or individual undiscounted cash flows.
Cash flows associated with other types maturity of less than one year, M must
retail segments must not be negative. be greater than or equal to one day or
150. Analogous to the prior of credit exposures may be less certain.
In such cases, the bank should establish to the nominal or effective remaining
discussion of ELGD and LGD
a method of projecting expected cash maturity.8
quantification, reference data sets used
for estimation of additional drawdowns flows. In general, the method used for VI. Special Cases and Applications
may contain individual negative any exposure should be the same as the
one used by the bank for purposes of A. Loan Sales
drawdown observations and
observations that exceed 100 percent of valuation or risk management. The S 4–25 Quantification of the risk
the undrawn line amount. Regardless, method should be well-documented and parameters should appropriately
final estimates of additional drawdowns subject to independent review and recognize the risk characteristics of
prior to default for individual wholesale approval. A bank should demonstrate exposures that were removed from
exposures or retail segments must not be either that the method used is standard reference data sets through loan sales
negative. industry practice, or that it is widely or securitizations.
used within the bank for purposes other 159. Loan sales and securitizations
V. Maturity (M) than risk-based capital calculations. A can pose substantial difficulties for
151. A bank must assign an effective bank may use its best estimate of future quantification. For example, PDs might
maturity (‘‘M’’) to each wholesale interest rates to compute expected appear disproportionately low if loans
exposure in its portfolio; this measure is contractual interest payments on a are sold before their inherent long-term
also referred to as ‘‘average life.’’ In floating-rate exposure, but it may not
general, M is the weighted-average consider expected but non-contractually 8 Section 31(d)(7) of the NPR defines an exposure
remaining maturity, measured in years, required returns of principal when that is not part of a bank’s ongoing financing of the
estimating M.7 obligor as one where the bank (1) has a legal and
of the cash flows that the bank expects practical ability not to renew or roll over the
under the contractual terms of the
exposure in the event of credit deterioration of the

exposure, using the undiscounted 7 Question 31 in the NPR requests comment on obligor, (2) makes an independent credit decision
amounts of the cash flows as weights. the appropriateness of permitting a bank to consider at the inception of the exposure and at every
prepayments when estimating M, and on the renewal or rollover, and (3) has no substantial
Alternatively, a bank may apply the feasibility and advisability of using discounted commercial incentive to continue its credit
nominal remaining maturity, measured (rather than undiscounted) cash flows as the basis relationship with the obligor in the event of credit
in years, of the exposure. M is a direct for estimating M. deterioration of the obligor.
risk becomes manifest. Upwardly quantification practices. The framework information presented in the example,
adjusting risk parameter estimates to is broadly applicable—for PD, ELGD, this step should be explored further.
account for sales or securitization would LGD or EAD; using internal, external, or Specifically, the bank should justify the
be particularly important for a bank that pooled reference data; for simple or appropriateness of the 75/25 mix.
sells off primarily exposures that are complex estimation methods—although Application—Although the
performing poorly (for example, the issues and concerns that arise at application step is relatively
delinquent loans). each stage depend on a bank’s approach. straightforward in this case, the bank
160. When risk parameter estimates These examples are intended only to does make the adjustment of the Grade
use internal historical data as reference illustrate the logic of the four-stage IRB 4 PD estimate to give it the desired
data sets and the potential bias created quantification framework, and should relationship to the adjacent rating
by loan sales and securitizations is not be taken to endorse the particular grades. This adjustment is part of the
material, the bank should identify, by techniques presented in the examples. application stage because it is made
detailed risk characteristics, the loans after the adjusted agency default rates
sold out of the pool or portfolio. Any Example 1: PD Quantification From are applied to the internal rating grades.
potential bias caused by removing these Bond Data
Example 2: PD Quantification Using a
loans should be corrected. • A bank establishes a Merton-Type Equity-Based Model
161. For banks with a history of correspondence between its internal
regularly selling or securitizing loans of rating grades and external rating agency • A bank obtains a 20-year database
particular types, long-run performance grades; the bank has determined that its of North American firms with publicly-
data may be available from the servicers Grade 4 is equivalent to 3Ba and 1B traded equity, some of which defaulted
or trustees. Alternatively, banks may be on the Moody’s scale. during the 20-year period.
able to estimate the performance of the • The bank regularly obtains • The bank uses the Merton approach
loans sold or securitized by constructing published estimates of mean default to modeling equity in these firms as a
comparable reference data sets with rates for publicly rated Ba and B contingent claim, constructing an
similar risk drivers using internal obligors in North America from 1970 estimate of each firm’s distance-to-
historical data from retained pools or through 2002. default at the start of each year in the
external data. • The Ba and B historical default database.9 The bank then ranks the firm-
rates are weighted 75/25, and the result years within the database by distance-
B. Multiple Legal Entities to-default, divides the ordered
is a preliminary PD for the bank’s
162. Some banks have various internal Grade 4 exposures. observations into 15 equal groups or
portfolios that are centrally managed, • However, the bank then increases buckets, and computes a mean historical
even though the exposures are held by the PD by 10 percent to account for the one-year default rate for each bucket.
multiple legal entities. Certain activities, fact that the Moody’s definition of That default rate is taken as an estimate
including ratings activities, default differs from the IRB definition. of the applicable PD for any obligor
segmentation and quantification, can be • The bank makes a further within the range of distance-to-default
conducted across multiple legal entities. adjustment to ensure that the resulting values represented by each of the 15
However, each bank member of the rating grade PD is greater than the PD buckets.
consolidated group must separately attributed to Grade 3 and less than the • The bank next looks at all obligors
ensure that risk parameters assigned to PD attributed to Grade 5. with publicly-traded shares within each
its credit exposures are appropriate on • The result is the final PD estimate of its internal rating grades, applies the
a standalone basis. For example, if a for Grade 4. same Merton-type model to compute
particular bank within the banking distance-to-default at quarter-end, sorts
Process Analysis for Example 1: these observations into the 15 buckets
group holds exposures with
characteristics not representative of the Data—The reference data set consists from the previous step, and assigns the
broader consolidated organization (such of issuers of publicly rated debt in North corresponding PD estimate.
as credit card loans originated through America over the period 1970 through • For each internal rating grade, the
a specific marketing channel or 2002. The data description is very basic: bank computes the mean of the
mortgage loans in a certain location), the Each issuer in the reference data is individual obligor default probabilities
bank must ensure the quantification described only by its rating (such as and uses that average as the rating grade
process produces PDs, ELGDs, LGDs, Aaa, Aa, A, Baa, and so on). PD.
and EADs that reflect the risk associated Estimation—The bank could have Process Analysis for Example 2
with the exposures within that legal estimated default rates itself using a
database purchased from Moody’s, but Data—The reference data set consists
entity.
since these estimates would just be the of the North American firms with
163. Each bank (including each
mean default rates per year for each publicly-traded equity in the acquired
depository institution) within a banking
rating grade, the bank could just as well database. The reference data are
group that has centrally managed
(and in this example does) use the described in this case by a single
quantification processes should perform
published historical default rates from variable, specifically an identifier of the
periodic evaluations to confirm that its
Moody’s; in essence, the estimation step specific distance-to-default range from
risk-based capital requirements
has been outsourced to Moody’s. The 10 the Merton model (one of the 15
accurately reflect its risk profile.
percent adjustment of PD is part of the possible in this case) into which a firm
Appendix A: Illustrations of the estimation process in this case because falls in any year.
Quantification Process for Wholesale the adjustment was made prior to the Estimation—The estimation step is
Portfolios application of the agency default rates to simple: The average default rate is
This appendix provides examples to the internal portfolio data. calculated for each distance-to-default
show how the logical framework Mapping—The bank’s mapping is an 9 The term ‘‘Merton approach’’ is meant to
described in this guidance, with its four example of a rating grade mapping; include any structural credit risk model that values
stages (data, estimation, mapping, and internal Grade 4 is linked to the 75/25 equity as a contingent claim, as promulgated in the
application), applies when analyzing mix of Ba and B. Based on the limited seminal work of Merton and Black and Scholes.
bucket. Since the data cover 20 years at which the remaining balance is less mean). The bank’s assignment of zero
and a wide range of economic than 5 percent of the EAD. A recovery ELGD for one of the cells merits special
conditions, including downturn percentage is computed, equal to the attention; while the bank represented
conditions, the resulting estimates value of recoveries discounted to the this assignment as conservative, the
satisfy the long-run average date of default, divided by the exposure adjustment does not satisfy the
requirement. at default. supervisory requirement that ELGD
Mapping—The bank maps selected • For each cell (each of the 12 must exceed zero. A larger upward
portfolio obligors to the reference data combinations of collateral type and adjustment is necessary. Finally, the
set using the distance-to-default coverage), the bank computes a simple upward adjustment of the mean
generated by the Merton model. arithmetic mean realized loss severity historical realized loss severity
However, not all obligors can be percentage as the mean of one minus the percentages to account for the relatively
mapped, since not all have traded recovery percentage. One of the small influence of downturn conditions
equity. This introduces an element of categories has a mean realized loss on the realizations may be appropriate
uncertainty into the mapping that severity percentage of less than zero but should be the outcome of a well-
requires additional analysis by the bank: (recoveries have exceeded exposure on documented decision process supported
Were the mapped obligors average), so the bank sets the loss rate by empirical analysis.
representative of other obligors in the at zero.
same rating grade? The bank should • The bank assigns each exposure in Appendix B: Illustrations of the
demonstrate comparability between the the existing portfolio to one of the 12 Quantification Process for Retail
publicly-traded portfolio obligors and cells based on collateral type and Portfolios
those not publicly traded. It may be coverage. As its ELGD, the bank applies Example 1: Quantification of Segment
appropriate for the bank to make the mean historical realized loss PD
conservative adjustments to its ultimate severity percentage for that cell plus an
PD estimates to compensate for the additional five percentage points to A bank that has been making indirect
uncertainty in the mapping. The bank account for the bank’s relatively small installment loans through furniture
also should perform further analysis to number of default observations—in stores for a number of years. Seven years
demonstrate that the implied distance- relation to the total number of defaults of internal data history are available,
to-default for each internal rating grade in the reference data—from years with over a period that includes economic
represented long-run expectations for the largest default rates. downturn conditions. The bank has
obligors assigned to that rating grade; segmented this portfolio over the entire
Process Analysis for Example 3
this could involve computing the period in a consistent manner: By
Merton model for portfolio obligors over Data—The reference data is the bureau score, internal behavioral score
several years of relevant history that collection of defaults and associated and monthly disposable income. In
span a wide range of economic loss amounts from the bank’s historical addition, realized loss severities for this
conditions. portfolio. The reference data are portfolio have demonstrated significant
Application—The final step is described by the two categorical cyclical variability over the period
aggregation of individual obligors to the variables (level of collateral coverage covered by the bank’s data history.
rating grade level through calculation of and type of collateral). It would be
The bank can empirically show that
the mean for each rating grade, and important to determine whether the
the participating furniture retailers,
application of this rating grade PD to all defaults over the past few years are
underwriting criteria, and collection
obligors in the grade. The bank might comparable to defaults from the existing
practices have remained reasonably
also choose to modify PD assignments portfolio. One would also want to ask
stable over the seven-year period, and
further at this stage, combining PD why the bank ignores potentially
the definition of default has been
estimates derived from other sources, valuable information by converting the
consistent with the IRB definition.
introducing an appropriate degree of continuous data on collateral coverage
However, there are frequent changes in
conservatism, or making other into a categorical variable.
Estimation—Conceptually, the bank is the bank’s products and in the
adjustments. borrowing population that affect the risk
using a loss severity model in which 12
Example 3: ELGD Quantification From binary variables—one for each loan characteristics of its loans. Therefore, in
Internal Default Data coverage/type combination—explain the quantifying PD the bank assigns more
• For each wholesale exposure in its percentage loss. The coefficients on the weight to recent data within the seven-
portfolio, a bank records collateral variables are just the arithmetic mean year history. The segment PD is
coverage as a percentage, as well as realized loss figures from the reference calculated as a weighted-average of the
which of four types of collateral applies. data. seven annual realized historical default
• A bank has retained data on all Mapping—Mapping in this case is rates with the assigned weights
defaulted exposures since 1995. For fairly straightforward, since all the progressively lower for the earlier years
each defaulted exposure in the database, relevant characteristics of the reference of the sample.
the bank has a record of the collateral data are also in the data system for the Process Analysis for Example 1
type within the same four broad existing portfolio. However, the bank
categories. However, collateral coverage should determine whether the variables As discussed in the main chapter text,
is only recorded at three levels (low, are being recorded in the same way (for quantification processes need not be
moderate, or high) depending on the example, using the same definitions of explicitly structured as four stages. The
ratio of collateral to EAD. collateral types), otherwise some four-stage structure is a conceptual
• The bank also records the timing adjustment might be appropriate. framework, and an analytical and
and discounted value of recoveries net Application—The bank is able to implementation guide. However, as in
of workout costs for each defaulted apply the loss severity model by simply other wholesale and retail examples,
exposure in the database.Cash flows are plugging in the relevant values for the this bank’s quantification process for PD
tracked from the date of default to a existing portfolio (or what amounts to can be interpreted in terms of the four-
‘‘resolution date,’’ defined as the point the same thing, looking up the cell stage framework:
Data—The bank’s own seven-year historical data from its own portfolio. Example 3A: PD Estimation in Dollar
historical data serve as the reference The reference data consist of fourteen Terms
data. years of internal performance history for The text defines both the historical
Estimation—Estimation consists of loans originated between 1990 and default rate and estimated PD in unit, or
calculating a weighted-average of the 2003. However, only four years of those account, terms. That is, the number of
annual default rates for each segment in internal data cover loans for the region defaults in a segment as a proportion of
the reference data. of the country where the bank currently
Mapping—Mapping consists the number of exposures on the balance
has a substantial mortgage portfolio. The sheet at the beginning of the time period
primarily of ensuring that the
internal data are supplemented by under analysis.
segmentation schemes and the
definition of default are consistent for
external mortgage data over the full • Many banks, however, prefer to, or
fourteen year history (1990–2003). have historically calculated the default
the reference data and the bank’s
existing portfolio. Estimation—The bank builds a set of rate in terms of dollar losses. This
Application—Application is a matter statistical models for different product example shows that it is possible to
of using the PD estimate derived from types in the portfolio (e.g., FRM and derive PDs from dollar loss rates that
the reference data for each segment of ARM). The models estimate segment PD will equal the required unit-or account-
the existing portfolio in the risk-based as a function of the loan-to-value ratio, based default rates. However, a bank
capital formulas. credit score, debt-to-income ratio, loan choosing to derive a default rate or PD
tenor, and measures the volatility of in this manner must segment its
Example 2: Quantification of PD for portfolio properly and in a sufficiently
First-lien Mortgages regional employment and house prices.
granular manner, and must ensure that
The model is estimated on both the
• For the past four years, a mortgage internal and external data.
its estimates of EAD are accurate. A
lender has begun making loans in a credit card bank directly measures its
geographic region that has experienced Mapping—Since the bank shifted a average dollars of economic loss for
relatively lower default rates than the significant amount of its first-lien each segment and uses the percentage of
bank had experienced previously. The mortgage business to a different region dollars defaulted, rather than the
bank has fourteen years of internal data of the country with generally lower percentage of loans defaulted, to derive
history. The bank has analyzed external default rates starting only in 2000, the the estimate of PD. Specifically, the
mortgage data over the same time period bank has only four years of internal ratio employed is the gross dollar loss
and has identified risk characteristics historical data (2000–2003) reflecting divided by the exposure at default
that vary by geographic region (e.g., the performance of its mortgage (EAD) over a one-year time horizon. The
volatility of house prices in a region). business in the new region. Its older bank estimates EAD for a segment as the
Analysis of the internal reference data internal data from 1990 to 1999 current outstanding balances plus the
also indicates the importance of these represent credit performance in higher- expected drawdowns on open lines
geographic risk factors. risk regions. Therefore, the bank does (including accrued but unpaid interest
• The recent four-year period does not have sufficient historical data and fees at the time of default) if all
not include economic downturn representing its current mortgage accounts in the segment default.
conditions, so the bank uses its full business to map directly, segment by • The bank uses the appropriate IRB
fourteen years of data history to reflect segment, to estimate the PDs of the definition of default.
downturn conditions. To estimate the existing portfolio on the basis of the • The bank segments exposures by
PD parameter over a long run of data long-run average of the annual default size of credit line and credit line
history that is also comparable to the rates of the comparable segments in the utilization as well as by credit score.
current portfolio, the bank develops a • The bank regularly validates the
reference data.
statistical model of the PD based on the accuracy of the EAD estimates and the
combined internal and external Instead, the bank has adopted the consistency of the percentage-of-dollars-
performance history. The variables used technique of building default prediction defaulted measure with the account-
as PD predictors include geographic risk statistical models, based on internal and based default rate.
factors such as the volatility of external data from the entire fourteen
year history (before and since the Process Analysis for Example 3A
employment and house prices in the
region. The model also includes change in the regional focus of the Data—The historical reference data
borrower risk characteristics (credit business in 2000) and using as causal, consist of measurements of the
score, debt-to-income ratio) and loan or independent, variables the risk outstanding dollar balances and open
risk characteristics (loan-to-value ratio drivers of mortgage default, including credit lines for each segment at the
and tenor). Models are built for each regional risk factors. beginning of the year. For accounts that
major product type, such as fixed-rate In this framework, mapping consists defaulted over the following year, the
and adjustable-rate mortgages (FRM and of ensuring that the segmentation gross defaulted balances (including
ARM). The model results are robust accrued interest and fees) are also
systems and definition of default for the
according to standard statistical measured. The bank also tracks the
two data historical data sets and the
diagnostic tests, and the models have number of accounts open at the
existing portfolio are all consistently
continued to perform satisfactorily in beginning of the year in each segment
applied in the process of deriving the
validations outside the development and the number that default.
values of the risk drivers used as inputs Estimation—The bank’s PD parameter
sample. to the statistical models for each is estimated as the long-run average of
Process Analysis for Example 2 segment of the existing portfolio. the one-year realized default rates in
Data—The existing portfolio of first- Application—Application consists of dollar terms, that is the gross balances
lien mortgages is segmented by region, using the estimated segment PDs of defaulted loans divided by the
LTV, credit score, tenor, mortgage type produced by the statistical models as estimated EAD.
(fixed-rate or ARM), and debt-to-income inputs into the residential mortgage The following table shows two
ratio. For a given segment, the bank has formula for risk-based capital. segments of card exposures, both with
estimated default rates of 1 percent as segmented by average outstanding the dollar-denominated default rate
measured from a single year of the dollar balance and by average credit line (gross dollar loss / EAD) is equal to the
historical reference data in the required per account. In addition, the EADs were unit-or account-measured PD.
manner in terms of numbers of estimated separately and accurately 10 at
accounts. In this case, the portfolio was the segment level, with the result that
However, banks that attempt to Example 3B: Another Case of Dollar portfolio, including numbers and dollar
estimate default rates or PDs in dollar Estimates of PD balances of accounts at the beginning of
terms from their historical reference Once again, a bank prefers to calculate each year and the number and dollar
data are often not as accurate as the default rates or PDs in dollar terms. balances of defaulted accounts in the
example above, and they arrive at However, this example is based on fixed course of each year. The data include
incorrect values. Most often, this results loans rather than revolving lines of economic downturn conditions.
from insufficiently granular credit such as the credit cards in the Estimation—Because of the
segmentation and consequent previous example. Because of a critical inadequate degree of granularity, the
inaccuracy in the estimation of EADs. segmentation factor, the dollar-based average January 1 dollar balances of
Because of the difficulties often default rates will rarely if ever equal the accounts that ultimately defaulted at
encountered in dollar-denominated correct unit- or account-based rates.
any time within the following year
• Using the cohort method for EAD
default and PD estimates, banks that typically exceeded the beginning
discussed in the main chapter text, a
choose this method should periodically bank calculates default rates or PDs as balances of accounts that did not
demonstrate, as part of the validation of the accumulated gross dollar losses for default. In this case, the dollar-
their PD quantification, that the dollar- each segment over the course of a year denominated PD (gross dollar losses
derived PDs are essentially equal to divided by the total outstanding dollar divided by total beginning outstanding
those derived using an account-based balances of the segment at the beginning balances) consistently overestimated the
definition. of the year.11 correct (unit-based) PD. (See first line of
Mapping—Mapping involves linking • The bank uses the appropriate IRB table below, representing a single year
segments in the reference data to definition of default. in the historical reference data.)
segments in the existing portfolio based • The bank’s segmentation is not Conversely, if the beginning balances of
on the same drivers of default risk and particularly granular and uses few risk accounts that ultimately defaulted were
drawdowns. drivers, such that the average balance smaller than those that did not default
for those accounts defaulting tended to within the following year, an unusual
Application—Application is generally be much greater than those that did not.
a straightforward process, linking the situation, this measure consistently
estimates from segments in the reference Process Analysis for Example 3B underestimated PD. (See second line of
data to segments in the existing Data—The bank has 5 years of table.)
portfolio. internal data history for this particular
Mapping and Application—Since the Example 4: PD Quantification With loan characteristics, and borrower credit
estimation stage using this approach is Adjustments for Seasoning quality at origination.
very likely to be flawed, the • The bank presents analyses
quantification should not proceed to the • Realized default rates for a bank’s
credit card portfolio exhibit a indicating that the seasoning curves can
mapping and application stages. Rather, be reasonably specified by borrower
the bank should revise its estimation to characteristic time profile by age—a
seasoning curve.’’ Using data from the credit quality at origination, and the
employ the required unit-or account- bank regularly analyzes new cohorts to
based methods of calculating historical past five years, including economic
downturn conditions, the bank capture any changes in the curves over
default rates and of estimating PDs changing economic and market
EN28FE07.000</GPH> EN28FE07.001</GPH>
before proceeding to mapping and estimates the shapes of a family of

‘‘seasoning curves for specific products, environments. Systematic changes are
application. incorporated into new seasoning curves.
10 In this example, EADs are estimated by way of text, this is only one method of estimating EAD 11 For simplicity, we assume no amortization of
the LEQ ratio. As discussed in the main chapter currently in use. principal over the course of the year.
• The portfolio is segmented by Example 5: Guarantees for retail exposure amount of $9.5 million
borrower, product, and loan exposures secured by 100 residential properties
characteristics, including account age, each with a value of $100,000, thus an
Guarantees on individual retail
or ‘‘time on books.’’ aggregate value of $10 million. The
exposures
guarantee covers losses on each
Process Analysis for Example 4 The following are examples of retail exposure up to an amount that will
guarantees that would qualify under reduce the LTV on each exposure
Data—The reference data consists of
Standard 4–4: considered separately to 90 percent.
five years of portfolio history, including • Consider an exposure of $85,000
economic downturn conditions. • Other guarantees on multiple retail
secured by property valued at $100,000. exposures qualify under Standard 4–4,
Supplemental data from earlier periods The guarantee covers all losses up to but only if they cover all or a pro rata,
for similar products, borrower credit $85,000. or proportional, share of all payments
quality at origination, and loan type • The guarantee covers a pre- due on the aggregate exposure amount.
permit the estimation of annualized specified dollar amount of losses less —Consider the same multiple-
default rates over the remaining than $85,000, for example a first loss exposure retail pool as before. There are
expected life of the loans. position of $20,000. 100 retail exposures with an aggregate
Estimation—It is necessary to • The guarantee covers a pre- exposure amount of $9.5 million. The
calculate two different PDs for each specified pro rata (or proportional) share guarantee covers all losses on the
segment of the portfolio: (1) The long- of all losses, for example up to 20 underlying exposures up to the full $9.5
run average of one-year default rates percent of the $85,000 exposure, or million aggregate exposure amount.
from the historical reference data, in the $17,000. —Once again, consider the pool of
same manner as for wholesale PDs, and • The guarantee covers a pre- multiple retail exposures above. In this
specified pro-rata or proportional share case, the guarantee covers a pro rata
(2) the estimated annualized cumulative
of losses, but the pre-specified pro rata share of losses, for example 20 percent
default rate (‘‘ACDR’’) over the
share is defined in terms of the value of of the $9.5 million aggregate exposure,
remaining expected life of the loans in
the property that secures the exposure. or $1.9 million. (Alternatively, if the
the segment.
For example, in the case of the exposure guarantee coverage had been pre-
If the ACDR is larger than the long- cited above, the guarantee covers losses specified as a dollar amount, say the
run average of one-year rates, then up to 12 per cent of the value of the first $1.9 million of losses, rather than
seasoning effects for this segment are collateral, or $12,000. (This case a pro rata share of the aggregate losses,
deemed to be material, and the ACDR represents traditional Private Mortgage that guarantee would not reflect the
must be used as the estimated segment Insurance (PMI) for first lien residential benefits of retail credit risk mitigation
PD. 12 mortgages, where insurance is typically treatment. Such guarantees of multiple
For example, if the expected required for loan-to-value (‘‘LTV’’) ratios retail exposures would need to meet the
remaining life for a segment of cards above 80 percent; for LTVs up to 85 requirements set forth in Standard 4–5
that has been on the books for one year, percent, the typical requirement is for in order to qualify for securitization
based on historical data for defaults and PMI in an amount equal to 12 percent treatment.)
attrition, is six years, and the estimated of the value of the property.)
Chapter 5: Wholesale Credit Risk
cumulative default rate over that period Guarantees of Multiple Retail Exposures Protection
is five percent, the ACDR = 5/6 = 0.833.
Guarantees of multiple retail
If, for the same segment, the five-year exposures that involve tranching of the Rule Requirements
average of annual default rates from the aggregate credit risk of the underlying Part III, Section 22(e): Double default
historical reference data set is 0.75, then exposures do not qualify under treatment. A bank must obtain the prior
seasoning effects are deemed to be Standard 4–4. Such guarantees may written approval of [AGENCY] under
material and the bank must use 0.833 as qualify for treatment as synthetic section 34 [of the NPR] to use the
the PD estimate for the coming (2nd) securitizations (provided they meet all double default treatment.
year. other requirements for securitization Part IV, Section 33: Guarantees and
Mapping—The segmentation of the treatment) as specified in Standard 4–5 Credit Derivatives: PD Substitution and
existing portfolio is the same as that and succeeding paragraphs. Other LGD Adjustment Treatments
employed for the reference data. This guarantees of multiple retail exposures Part IV, Section 34: Guarantees and
makes the mapping straightforward where there is no tranching of the Credit Derivatives: Double Default
along the lines of product and loan aggregate credit risk, such as those in Treatment
characteristics and borrower credit the following examples, may qualify 1. This chapter supplements the
quality. under Standard 4–4: detailed discussion of credit risk
• In some cases, a guarantee covers mitigation in the NPR by providing
Application—At the application stage, guidance on how banks may recognize
multiple retail exposures; however,
either the ACDR or the long-run average contractual arrangements for exposure-
coverage for each individual exposure
default rate estimated from the reference meets all the requirements of Standard level credit protection—eligible
data is applied as the estimated PD to 4–4 and succeeding paragraphs and is guarantees and eligible credit
the segments in the existing portfolio consistent with any one of the four derivatives—that transfer risk to one or
respectively, depending on whether or examples above. Furthermore, there are more third parties. Each of these forms
not seasoning effects are deemed to be no additional limits, caps, or restrictions of credit protection must meet certain
material. of any kind pertaining to the aggregate specific standards of eligibility, as
coverage. Such guarantees would meet articulated in the NPR, for recognition
12 If the bank intends to sell or securitize the
the requirements as guarantees of of the associated risk mitigation.
exposures in the segment within a 90-day time
frame, the ‘‘wholesale’’ PD can be used even if the individual retail exposures. 2. An important aspect of either of
ACDR is greater than the long-run average. See the —Consider a guarantee that covers these types of credit protection is that
main chapter text for more details. multiple retail exposures, with a total they are implemented at the exposure-
level, reducing credit risk faced by the any support that is or may be derived on the resulting risk weight as specified
bank due to a specific exposure to an from bank operations. Under no in the NPR. In determining the
individual obligor. Banks may use circumstances may a bank receive a magnitude of any LGD adjustment, the
similar mitigants—for example, risk-based capital benefit from credit bank should apply the general approach
portfolio credit derivatives—to transfer protection from an internal department to IRB quantification developed
credit risk associated with groups of of the bank or from the bank’s own elsewhere in this guidance;
exposures or whole portfolios. While subsidiary. Banks often manage credit quantification of LGD adjustments for
such contracts may make a valuable risk through internal transactions that, credit protection should reflect a
contribution to broader risk while possibly structured in ways rigorous application of standards no
management within the bank, and may similar to guarantees or credit different from those that apply to LGD
be appropriately considered in an derivatives, do not in themselves result quantification generally.
assessment of overall capital adequacy, in a reduction of credit risk at the 8. The NPR specifies various criteria
their effects are not recognized for IRB consolidated level. Such credit that must be met in order for a bank to
calculations of risk-based capital protection purchased internally may not apply the double default treatment.
requirements except in limited be recognized for IRB purposes. Once Among those requirements are that a
circumstances. the bank reliably demonstrates that the bank must have policies and processes
3. Exceptions are made for certain credit risk is ultimately transferred to a to detect excessive correlation between
types of basket credit derivatives and third party, for example through a the creditworthiness of the protection
securitization exposures. In addition, matched offsetting contract, credit provider and the obligor for the hedged
banks may recognize the benefits in IRB protection may be realized from the exposure. For example, the
calculations of pool-level guarantees (or third party provider. However, if this creditworthiness of a protection
credit derivatives) that are the protection provider is an affiliate, all of provider and an obligor would be
functional equivalent of an exposure-by- the above limitations apply. excessively correlated if the obligor
exposure guarantee provided the 5. For wholesale exposures, credit risk derives a high proportion of its income
following minimum conditions are met: mitigation from eligible guarantees and or revenue from transactions with the
• The guarantee is an eligible eligible credit derivatives is recognized protection provider. Similarly, excessive
guarantee. through one of three mutually exclusive correlation could arise from exposure to
• The contractual provisions of the approaches. The approaches are a common risk factor or set of risk
guarantee must identify the specific identified by the primary mechanism factors, such as industry or region; in
exposures in the pool to which the through which risk mitigation is some cases a bank may be able to
guarantee applies. recognized: PD substitution, LGD leverage other components of the bank’s
• The guarantee must cover all or a adjustment, or the recognition of internal credit risk management
pro-rata share of the pool’s aggregate double-default benefits. Recognition is processes to identify such dependence
credit losses in a manner that ensures at the exposure level, so a bank may on common risk factors.
each individual exposure is provided select among the three alternative 9. A bank’s choice among these
the same level of loss protection under approaches for each wholesale approaches for reflecting the impact of
the guarantee. exposure, subject to the NPR and to credit protection for a given exposure
• The guarantee must not contain cap relevant elements of the bank’s internal should be made in accordance with
provisions, deductibles, or other payout policies and procedures. specific criteria contained in a bank’s
limitations that would effectively limit 6. If a bank chooses to recognize credit policy. In addition to the specific
coverage. credit protection through PD eligibility requirements in the NPR and
Once a bank demonstrates that the substitution, it substitutes the PD general consideration of the credit
pool-level guarantee is the functional associated with the internal rating grade protection provider’s ability and
equivalent of an exposure-by-exposure assigned to the protection provider in willingness to perform under the
guarantee, the benefits may be place of the PD of the obligor in the agreement, the criteria should include
recognized in the IRB calculations using capital calculation. However, if the bank an assessment of the effect of the payout
the credit risk mitigation framework as determines that this substitution structure of the credit protection on the
provided in the NPR and this document. overstates the degree of risk mitigation, level and timing of recoveries. In some
This requires that the bank calculate its a lesser adjustment may be made by cases, the nature of the contractual
risk-based capital requirement for the using a PD associated with any internal arrangement reduces the likelihood that
pool on an exposure-by-exposure basis, rating grade inferior to that of the the bank will experience an obligor
as if the guarantee were applied at the protection provider. Note that in either default (as defined within the IRB
level of each individual exposure. case, the PD applied is one that is framework); in such cases, PD
S 5–1 Risk-based capital benefits associated with one of the bank’s substitution (or double-default
are only recognized for credit internal rating grades, determined in treatment, if applicable) is often more
protection that transfers credit risk to accordance with the bank’s established appropriate. In other cases, notably
third parties. processes for quantifying the default those in which the protection is likely
4. Banks may recognize the risk-based risk of those grades. Similar to come into effect only after a default
capital benefits of credit protection considerations apply in the case of has occurred, it is more likely that the
associated with eligible guarantees and double-default treatment; the PD for the appropriate adjustment should be made
eligible credit derivatives from third protection provider used in the capital through LGD.
parties. A bank may recognize the calculation should be the PD for an 10. A bank recognizing risk mitigation
benefits of credit protection from a internal rating grade assigned to the from eligible guarantees or eligible
parent or sister company only if (a) the protection provider. credit derivatives should also have
credit protection provider has the ability 7. Under the LGD adjustment policies that ensure adequate control of
to fulfill its obligations to the bank approach, the bank modifies the LGD any residual risks related to the use of
independent of the financial support of assigned to the hedged exposure to such forms of credit protection.
the bank, and (b) the internal risk rating reflect the risk mitigating effects of the S 5–2 Banks must ensure that credit
assigned to the affiliate fully excludes credit protection, subject to limitations protection for which risk-based capital
benefits are claimed represents credible and reliable risk parameter management systems, the underlying
unconditional and legally binding estimates. This chapter describes how a principle in this guidance is that the
commitments to pay on the part of the bank should collect, maintain, and data systems should be of sufficient
guarantors or counterparties. manage the data needed to support the depth, scope, and reliability to
11. As specified in the NPR, forms of other IRB system components for implement and evaluate the IRB system.
written third-party support that are wholesale and retail exposures (e.g., risk The systems should be able to support
conditional or are not legally binding rating and segmentation systems, the the bank’s ability to:
are not recognized as credit risk quantification process, and validation • Track obligors of wholesale
mitigation. Refer to Standard 2–11 in and other control processes), as well as exposures and to track wholesale
the Wholesale Risk Rating Systems the bank’s broader risk management and exposures throughout their life cycle
chapter of this guidance regarding the reporting needs. Additional detail from origination to disposition;
use of implied support as a rating specific to wholesale and retail • Capture all rating assignment data
criterion. exposures is provided in the appendices for wholesale portfolios, which include
12. In some instances, an eligible to this chapter. the significant quantitative and
credit derivative may incorporate a 2. While this chapter specifically
qualitative factors used to assign the
reference asset that differs from the addresses data management and
obligor and loss severity ratings;
underlying asset for which a bank has maintenance systems for wholesale and
acquired credit protection. A bank may retail exposures, the framework outlined • Capture exposure and borrower
recognize an eligible credit derivative in this chapter generally applies to all characteristics and performance history
that hedges an exposure that is different of a bank’s advanced systems for credit for retail exposures over a historical
from the credit derivative’s reference risk as described in Chapter 1 of this time period;
exposure used for determining the guidance. In addition, specific data • Capture all data for retail exposures
derivative’s cash settlement value, requirements for securitizations are necessary to develop the segmentation
deliverable obligation, or occurrence of described in Chapter 11. system and to assign exposures to
a credit event only if: 3. Banks may implement different segments;
• The reference exposure ranks pari data management and maintenance • Develop internal risk parameter
passu (that is, equal) or junior to the systems for wholesale and retail estimates;
hedged exposure; and exposures. Within a bank, moreover, • Validate risk parameter estimates;
• The reference exposure and the such data systems and processes may
• Validate the IRB system and
hedged exposure share the same obligor differ across business lines and
processes;
(that is, the same legal entity) and countries. Therefore, the data structures
and practices, and the precise data • Refine the IRB system;
legally enforceable cross-default or
cross-acceleration clauses are in place. elements to be collected will be dictated • Calculate risk-based capital ratios;
13. In such cases, a bank should by the features and methodology of the and
evaluate and document the relationship IRB system employed by each bank. • Produce internal and public reports.
between the reference asset and the 4. Reference data requirements related 6. Data management and maintenance
hedged exposure to ensure that the to IRB quantification, which are systems should enable banks to
reference asset is a reasonable proxy for discussed in Chapter 4 of this guidance, undertake necessary changes in their
the hedged exposure and is likely to describe the minimum requirements for IRB systems and improve methods of
behave in a similar manner upon the historical default and loss reference data credit risk management over time.
occurrence of a credit event. using the best available data for Systems should be capable of providing
quantification, inclusive of internal, detailed historical data and capturing
Chapter 6: Data Management and external or pooled data sets. Best new data elements for enhancing an IRB
Maintenance available data should include historical system. Given the importance of
Rule Requirements performance information necessary to developing robust data histories in this
accurately estimate risk parameters for process and the costs associated with
Part III, Section 22(i)(1): A bank must exposures in the bank’s existing
have data management and maintenance collecting additional data at a later date,
portfolio. Reference data for banks should err on the side of
systems that adequately support all quantification are likely to comprise a
aspects of its advanced systems and the collecting not only data that they are
smaller subset of the internal data currently using but also data that may
timely and accurate reporting of risk- elements cited in this chapter because
based capital requirements. potentially be useful to their IRB models
the objectives of ongoing internal data or in validation processes.
Part III, Section 22(i)(2): A bank must management cover a wider range of
retain data using an electronic format purposes, such as the development of A. Life Cycle Tracking for Wholesale
that allows timely retrieval of data for risk ratings or segmentation and the Exposures
analysis, validation, reporting, and validation of the IRB system. Data
disclosure purposes. S 6–4 For wholesale exposures,
histories built from the internal data
Part III, Section 22(i)(3): A bank must banks must collect, maintain, and
maintenance framework described in
retain sufficient data elements related to analyze essential data for obligors and
this chapter will gain growing
key risk drivers to permit adequate exposures. This should be done
significance in the risk parameter
monitoring, validation, and refinement estimation process over time. throughout the life and disposition of
of its advanced systems. the credit exposure.
II. General Data Requirements 7. Using a life cycle or ‘‘cradle to
I. Overview S 6–1 Banks must collect and grave’’ concept for each obligor and
1. Banks using the IRB framework for maintain sufficient data to support exposure supports front-end validation,
risk-based capital purposes must have their IRB systems. backtesting, system refinements, and
advanced data management and 5. While banks have substantial risk parameter estimates. A depiction of
maintenance systems that support flexibility in designing their data life-cycle tracking follows:
8. Data elements must be recorded at collection. For example, in judgmental C. Segmentation Data for Retail
origination and whenever the rating is rating systems, the qualitative factors Exposures
reviewed, regardless of whether the used in the rating decision have not S 6–4 For retail exposures, banks
rating is changed. Data elements traditionally been explicitly recorded. must collect and maintain all essential
associated with current and past ratings For purposes of the IRB framework, to data elements used in segmentation
must be retained. These elements the extent qualitative factors play an systems and the quantification process.
include: important role in assigning ratings, The data must cover a period of at least
• Key borrower and exposure banks should maintain these factors in five years and must include a period of
characteristics; a readily available database for economic downturn conditions, or the
• Ratings for obligors and exposures; validation purposes and to facilitate bank must adjust its estimates of risk
• Key factors used to assign the analysis to help banks improve the parameters to compensate for the lack
ratings; rating system over time. of data from periods of economic
• Person responsible for assigning the
10. For loss severity estimates, banks downturn conditions.
rating and model(s) used in that
assignment; should record the basic structural 13. Banks should maintain a
• Date rating assigned; and characteristics of exposures and the minimum five-year exposure-level
• Overrides to the rating and factors used in developing the loss history of the entire retail portfolio,
authorizing individual. severity rating or LGD estimate. These including all exposures and lines that
At disposition, data elements should often include the seniority of the credit, were open at any time during this
include: the amount and type of collateral, the period. The standard above establishes
• Nature of disposition: Renewal, most recent collateral valuation date key risk drivers used in the
repayment, loan sale, default, and the collateral’s fair value. segmentation system and in the
restructuring; quantification of the risk parameters.
11. Banks should also track any
• For defaults: Exposure, actual However, banks should retain
overrides of the obligor or loss severity
recoveries, source of recoveries, costs of additional data elements that are used
rating. Tracking overrides separately
workouts and timing of recoveries and in their internal credit risk management
allows banks to identify whether the systems. (See Appendix A of this
costs; outcome of such overrides suggests
• Guarantor support; chapter for examples of retail data
either problems with rating criteria or elements.)
• Sale price for loans sold; and too much discretion to adjust the
• Other key elements that the bank 14. For retail exposures, if the most
ratings.
deems necessary. recent period of economic downturn
See Appendix A for examples of data 12. Historical data, including rating conditions occurred more than five
elements that banks should collect and histories on wholesale exposures, may years ago, banks should retain
maintain under an IRB data be lost or irretrievable; for example, additional data to cover the downturn
management framework for wholesale when exposures are acquired through period. These data need not cover the
exposures. mergers, acquisitions, or portfolio period between the downturn period
purchases. Banks are encouraged, and the most recent five-year period.
B. Rating Assignment Data for whenever practical, to collect any These data may be in the form of
Wholesale Exposures missing historical data on rating representative statistical samples of the
S 6–3 Banks must capture and assignment drivers and to re-rate the portfolio rather than data from all
maintain all significant factors used to acquired obligors and exposures for exposures. The method of any sampling
assign obligor and loss severity ratings. prior periods. When retrieving historical should be statistically sound and well-
9. Assigning a rating to an obligor data is not practical, banks may attempt documented.
requires the systematic collection of to create a rating history by carefully 15. Banks should gather and retain
various borrower characteristics, both mapping the legacy system and the new disposition data, including recovery
quantitative and qualitative, because rating structure. Mapped ratings should data on defaulted exposures (e.g., date
these factors are critical to validating the be reviewed for accuracy. The level of and dollar value of recoveries and
rating system. Obligors are rated using effort placed on filling gaps in data collection expenses) sufficient to
various methods, as discussed in should be commensurate with the size develop ELGD, LGD, and EAD estimates
Chapter 2. Each of these methods and significance of the exposures to be for retail exposures. For many banks,
EN28FE07.002</GPH>
presents different challenges for input incorporated into the bank’s IRB system. information related to recoveries and
collection expenses currently exists drivers used for segmentation, so that 23. This guidance should also be
only at an aggregate level. These banks issues can be identified early. The data considered with the Proposed Agency
should develop interim solutions and a should support efforts to identify Information Collections published by
plan to improve exposure-level data whether raters and models are following the Agencies on September 25, 2006 for
availability. rating criteria and policies and whether public comment along with the NPR.
16. For retail exposures, historical ratings are consistent across portfolios. The notice contained information
segmentation data can be lost or In addition, data should support the collection templates (FFIEC 101) and
irretrievable; for example, when validation of risk parameters, information about the components of
exposures are acquired through mergers, particularly the comparison of realized reporting entities’ risk-based capital,
acquisitions, or portfolio purchases. In outcomes with estimates. For risk-weighted assets by type of credit
these cases, as an interim measure, backtesting risk parameters, data on risk exposure under the IRB framework,
banks should seek to obtain data from default and disposition characteristics including templates for credit risk and
external sources to supplement internal should be thorough. definitions of the data elements
data shortfalls. Alternatively, the 20. Data for validation should be rich contained therein. These templates will
reference data sometimes may be drawn in scope and depth in order to provide assist banks in determining their data
from other sections of the portfolio, but insights on the performance of the IRB retention needs related to the risk-based
only when the business lines, and system. This can contribute to a learning capital requirements for credit risk
exposure and borrower characteristics environment in which refinements can under the IRB framework.
are sufficiently similar (for examples, be made to the systems. These potential D. Supporting Risk Management
see Chapter 3). refinements include enhancements to
rating assignment controls, 24. The information that can be
D. Outsourced Activities gleaned from more extensive data
segmentation design, processes, criteria
S 6–5 Banks should ensure that or models, IRB system architecture, and collection will support a broad range of
outsourced activities performed by risk parameter estimates. risk management activities. Risk
third parties are supported by sufficient management functions will rely on
data to meet IRB requirements. B. Applying IRB System Improvements accurate and timely data to track credit
17. Certain processes, such as loan Historically quality, make informed portfolio risk
servicing, broker and correspondent 21. To maintain a consistent series of mitigation decisions, and perform
origination, collection, and asset information for credit risk monitoring portfolio stress tests. Obligor and loss
management, may be outsourced to or and validation purposes, banks should severity risk rating and segmentation
otherwise involve third parties. The be able to take improvements they make data will be used to support such
necessary data capture and oversight of to their risk rating systems for wholesale operations as internal capital allocation
risk management standards for these exposures and segmentation systems for models, pricing models, ALLL
portfolios and processes should be retail exposures and apply them calculations, and performance
carried out as if they were conducted historically. Moreover, banks are management measures. Summaries of
internally. encouraged to retain data beyond the these are included in reports to banks’
minimum requirements because they boards of directors, regulators, and in
E. Asset Sales public disclosures.
should have robust historical databases
S 6–6 Banks should maintain data containing key risk drivers and IV. Managing Data Quality and
to allow for a thorough review of asset performance components over as long a Integrity
sale transactions. historical period and as many variables
18. It is important that banks be able S 6–7 Banks should develop policies
as possible to facilitate the development
to quantify the impact of asset sale and controls around the integrity of the
and validation of better models and
activity on its IRB system. data maintained both internally and
methods.
Documentation for these transactions through third parties.
See Appendix B for an example as to 25. Because data are collected at so
should be sufficient for supervisors to how a bank could apply new
determine how asset sale activity affects many different stages involving a variety
information to improve its risk rating of groups and individuals, ensuring the
the integrity of the IRB system and the system.
resulting risk-based capital calculation. quality of the data poses numerous
For retail, asset sales may involve C. Calculating Risk-Based Capital Ratios challenges. For example:
exposures from a variety of portfolio and Reporting to the Public • Qualitative risk-rating variables will
segments, and sale pricing may not be have subjective elements and will be
22. Data retained by the bank will be open to interpretation;
available at a granular level. A bank
should be able to quantify the effect of
essential for risk-based capital • Exposures will be acquired through
calculations and public reporting under mergers and purchases, but without an
removing a portion of the loans or other the Pillar 3 disclosures. These uses
exposures from segments and the effect adequate and easily retrievable
underscore the need for a well-defined institutional rating history; and
of such asset sale activity on risk data management framework and strong • Data purchased from or maintained
parameter estimation. controls over data integrity. Total through third parties may not have
III. Data Applications exposures should be tied to systems of controls similar to the bank’s controls.
record and documentation should be Bank policies and controls should
A. Validation and Refinement maintained for this process for all address these potential challenges.
19. The data elements collected by reporting periods. Control processes and Specifically, banks should have policies
banks should facilitate meeting the data elements themselves should also be employing change control management
validation standards described in subject to periodic verification and processes and practices to ensure the
Chapter 7. These standards include testing by internal auditors. Supervisors integrity of the data. In addition, banks
validating the bank’s IRB system should rely on these processes and should seek reasonable assurances from
processes, including the ‘‘front end’’ should also perform testing as significant third-party providers
aspects, such as assigning ratings or risk circumstances warrant. concerning the integrity of the data.
A. Documentation and Definitions would be unable to perform that work directly to the documented criteria that
S 6–8 Banks should document the in the timely and comprehensive the bank employs when assigning
process for delivering, retaining, and manner required of the IRB system. ratings. For example, rating criteria
updating inputs to the data warehouse Forensic mining of paper files to build often include ranges of leverage or cash
and ensuring data integrity. an initial data warehouse from the flow for a particular obligor rating. In
S 6–9 Banks must maintain detailed bank’s credit history is encouraged. addition, banks are encouraged to
documentation of changes to the data Paper research may sometimes be develop and record quantitative
elements supporting the IRB system. necessary to identify data elements or representations of qualitative factors
26. Given the many challenges factors not originally considered (such as management effectiveness) in
presented by data for an IRB system, the significant in estimating the risk of a numeric form. For example, a 1 may
management of data should be particular class of obligor or exposure. signify exceptionally strong
formalized and banks should develop The time and expense of this recovery management and a 5 very weak
comprehensive definitions for their data effort highlights the importance of management. The rating data elements
elements. Fully documenting how the collecting a broad array of variables should be sufficient for evaluating the
bank’s flow of data is managed provides during the initial design of the IRB data factors driving the rating decisions.
a means of evaluating whether the data system.
Quantitative factors in obligor ratings
management framework is functioning Appendix A: Data Elements for • Asset and sale size; and
as intended. Moreover, banks should be Wholesale and Retail Exposures • Key ratios used in rating criteria:
able to communicate to persons
For illustrative purposes, the —Profitability;
developing or delivering various data
following section provides examples of —Cash flow;
the precise definition of the items
the kinds of data elements banks should —Leverage;
intended to be collected. Consequently,
collect under an IRB data management —Liquidity; and
a ‘‘data dictionary’’ and/or a ‘‘data
and maintenance framework first for —Other relevant factors.
standards manual’’ would ensure
wholesale exposures and second for
consistent inputs from business units Qualitative factors in obligor ratings
retail exposures.
and data vendors and would allow third • Quality of earnings and cash flow;
parties (e.g., IRB system review process, A. Examples of Data Elements for • Management effectiveness,
auditors, or banking supervisors) to Wholesale Exposures reliability;
evaluate data quality and integrity. • Strategic direction, industry
General Descriptive Obligor and
27. When changes are made to the IRB outlook, position;
Exposure Data
system and the supporting data • Country factors and political risk;
elements, the source of any significant The data below could be from an
and
changes in the risk-based capital exposure record or from various sources
• Other relevant factors.
requirements should be documented. within the data warehouse. Data
Therefore, it would be desirable to use maintained for guarantors would be the Third-party obligor ratings
change control management processes. same as that maintained for obligors. • Public debt rating and trend; and
B. Electronic Storage and Access Obligor/Guarantor Data • External credit model score and
• General data: name, address, trend.
S 6–10 Banks must retain data using
an electronic format that allows timely industry; Rating Notations
retrieval of data for analysis, • ID number (unique for all related
• Flag for overrides or exceptions;
validation, reporting, and disclosure parent/sub relationships);
and
purposes. • Rating, date, and rater; and
• PD corresponding to rating. • Authorized individual who can
28. To meet the significant data change rating.
management challenges presented by General Exposure Characteristics
the validation and control features of Key exposure factors in ELGD and LGD
the IRB system, banks must store their • Exposure amounts: committed, ratings
data electronically. Banks will have a outstanding;
• Exposure type: term, revolver, • Seniority;
variety of storage techniques and • Collateral type (cash, marketable
bullet, amortizing, etc.;
potentially a variety of systems to create securities, AR, stock, RE, etc.);
• Purpose: acquisition, expansion,
their data warehouses and data marts. • Collateral value and valuation date;
liquidity, inventory, working capital
The data architecture should be • Advance rates, LTV;
etc.;
designed to be scalable to allow for • Covenants; • Industry; and
growth in portfolios, data elements, • Exposure ID number; • Geography.
history, and product scope. IRB data • Origination and maturity dates;
requirements can be achieved by Rating Notations
• Last renewal date;
melding together existing accounting, • Obligor ID link; • Flag for overrides or exceptions;
servicing, processing, workout and risk • Rating, date and rater; and
management systems, provided the • ELGD; • Authorized individual who can
linkages between these systems are • LGD; and change rating.
well-documented and include sufficient • EAD.
edit and integrity checks to ensure that Final disposition data
the data can be used reliably. Rating Assignment Data Many banks maintain subsidiary
29. Banks lacking electronic databases The data below provide an example of systems for their problem exposures
for wholesale exposures would be the categories and types of data that with details recorded, at times
forced to resort to manual reviews of banks should retain in order to manually, on systems that are not linked
paper files for ongoing backtesting and continually validate and improve rating to the bank’s central exposure or risk
ad hoc ‘‘forensic’’ data mining and systems. These data items should tie management systems. The unlinked
data are a significant hindrance in • Application attributes, such as • Circumstances of default (e.g.,
developing reliable risk parameter income and financial information; nonaccrual, bankruptcy chapters 7–11,
estimates. • Credit scores, including custom nonpayment);
In advanced systems, the ‘‘grave’’ scores or generic scores; • Outstandings at default;
portion of obligor and exposure tracking • Other underwriting data used in the • Amounts undrawn and outstanding
is essential for producing and validating origination process; plus time series prior to and through
risk parameter estimates and is an • Score overrides and policy default;
important feedback mechanism for exceptions; • Amounts recovered and dates
adjusting and improving these estimates • Origination channel, such as a (including source: cash, collateral,
over time. Essential data elements are third-party vendor, telemarketing, direct guarantor, etc.);
outlined below. mail, or Internet; • Collection cost and timing;
• Product type and loan terms, such • Discount factors to determine
Obligor/guarantor as line amount, interest rate, payment economic cost of collection;
• Default date; and terms, balance transfer amount, and • Final disposition (e.g., restructuring
• Circumstances of default (e.g., reward programs; or sale);
nonaccrual, bankruptcy chapters 7–11, • Collateral characteristics, such as
• Sales price, if applicable; and
nonpayment). appraised value, geographic location,
• Accounting items (charge-offs to
and loan-to-value; and
Exposure • Guarantees or other credit risk date, purchased discounts).
• Outstandings at default; and mitigants, such as PMI. Appendix B: Applying Risk Rating
• Amounts undrawn and outstanding Ongoing Data Elements System Improvements Historically
plus time series prior to and through In the example below for wholesale
default. • Refreshed credit bureau attributes;
• Payment history and performance exposures, a bank experiences
Disposition characteristics, including payments, unexpected and rapid migrations and
draws, fees, NSF checks, delinquency, defaults in its rating grade 4 category
• Amounts recovered and dates
overlimit status, and utilization; during 2006. Analysis of the actual
(including source: cash, collateral,
• Collections activity, including financial condition of borrowers that
guarantor, etc.);
workout or forbearance programs, defaulted compared with those that did
• Collection cost and dates;
restructurings, payment deferrals, re- not suggests that the debt-to-EBITDA
• Discount factors to determine
aging and other similar programs; range for its expert judgment criteria of
economic cost of collection;
• Behavior scores; 3.0 to 5.5 is too broad. Research
• Final disposition (e.g., restructuring indicates that rating grade 4 should be
or sale); • Transaction-level information;
• Account management activities, redefined to include only borrowers
• Sales price, if applicable; and with debt-to-EBITDA ratios of 3.0–4.5
• Accounting items (charge-offs to such as line increase or decrease
programs, pricing adjustments, changes and that rating grade 5 should be 4.5–
date, purchased discounts). 6.5. In 2007, the change is initiated, but
in payment requirements or fee
B. Examples of Data Elements for Retail structures, and reward programs; prior years’ numbers are not recast (see
Exposures • Updated borrower information; and Exhibit A). Consequently, a break in the
Data Elements at Origination • Updated collateral information. series prevents the bank from evaluating
credit quality changes over several years
• Customer identifiers, such as Collection and recovery information and from identifying whether applying
borrower name; • Default date; the new rating criteria historically
• External credit bureau attributes; • Loss severity information; provides reasonable results.
EN28FE07.003</GPH>
Recognizing the need to provide the grade would be under the new rating over the past several years while the
senior managers and board members criteria. If the precise weight an expert mix in rating grade 4 increased slightly.
with a consistent risk trend, the new has given one of the redefined criteria This contrasts with the trend identified
criteria are applied historically to is unknown, banks are expected to make before the retroactive reassignment. The
obligors in rating grades 4 and 5 (see estimates on a best efforts basis. After result is that the multiyear transition
Exhibit B). The original ratings assigned the retroactive reassignment process, the statistics for rating grades 4 and 5
to the rating grades are maintained bank observes that the mix of obligors provide risk managers a clearer picture
along with notations describing what in rating grade 5 declined somewhat of risk.
This example is based on applying must be consistent with the bank’s (ii) An on-going monitoring process
ratings historically using data already internal risk management processes and that includes verification of processes
collected by the bank. However, for management information reporting and benchmarking; and
some risk rating system refinements, systems. (iii) An outcomes analysis process
banks may in the future identify drivers Part III, Section 22(j)(2): The bank’s that includes backtesting.
of default or loss that might not have board of directors (or a designated Part III, Section 22(j)(5): The bank
been collected for borrowers or committee of the board) must at least must have an internal audit function
exposures in the past. That is why banks annually evaluate the effectiveness of, independent of business-line
are encouraged to collect data that they and approve, the bank’s advanced management that at least annually
believe may serve as stronger predictors systems. assesses the effectiveness of the controls
of default in the future. For example, Part III, Section 22(j)(3): A bank must supporting the bank’s advanced systems
certain elements of a borrower’s cash have an effective system of controls and and reports its findings to the bank’s
flow might currently be suspected of oversight that: board of directors (or a committee
overstating the operational health of a (i) Ensures ongoing compliance with thereof).
particular industry. In the future, should the qualification requirements [in the I. Overview
a bank decide to reduce the weight NPR];
given to cash flow for this 1. A bank must have a system of
(ii) Maintains the integrity, reliability, controls that ensures that the
overstatement, resulting in a downgrade
and accuracy of the bank’s advanced components of the IRB system are
of many obligor ratings, the bank that
systems; and functioning effectively. This chapter
collected these data could apply this
rating change to prior years. This would (iii) Includes adequate governance provides guidance on the essential
provide a consistent picture of risk over and project management processes. elements of an effective control
time and also present opportunities to Part III, Section 22(j)(4): The bank environment for an IRB system for
validate the new criteria using historical must validate, on an ongoing basis, its wholesale and retail exposures,
data. Recognizing that banks will not be advanced systems. The bank’s including independent review
able to anticipate fully the data they validation process must be independent processes, a comprehensive validation
might find useful in the future, banks of the advanced systems’ development, process, and an internal audit review
are expected to reassign rating grades on implementation, and operation, or the and reporting process.
a best efforts basis when practical. validation process must be subjected to 2. While this chapter specifically
an independent review of its adequacy addresses the control framework
Chapter 7: Controls and Validation and effectiveness. Validation must supporting a bank’s IRB systems for
Rule Requirements include: wholesale and retail exposures, the

(i) The evaluation of the conceptual framework outlined in this chapter
Part III, Section 22(a)(2): The systems soundness of (including developmental generally applies to all of a bank’s
and processes used by a bank for risk- evidence supporting) the advanced advanced systems for credit risk as
EN28FE07.004</GPH>
based capital purposes under [the NPR] systems; described in Chapter 1 of this guidance.
In addition, specific validation • Incentives for individuals that business-line management, risk
requirements for certain counterparty perform critical reviews; management, and internal audit should
credit risk transactions, equity • Separation of duties (individuals be conducted as applicable. The
exposures, and securitization exposures should not review their own work); and validation activities, which are the
are provided in Chapters 9, 10, and 11, • Fully documenting all aspects of evaluation of conceptual soundness
respectively. the control structure to ensure it can be (including developmental evidence),
S 7–1 Banks must have an effective understood and evaluated by ongoing monitoring (i.e., process
system of controls that ensures ongoing supervisors and auditors. verification and benchmarking), and
compliance with the qualification outcomes analysis (backtesting), are
II. Reviews of the IRB System
requirements, maintains the integrity, described in more detail later in this
reliability, and accuracy of the IRB S 7–3 The annual assessment of the chapter.
system, and includes adequate IRB system presented to the board of S 7–4 Validation activities must be
governance and project management directors should be supported by the conducted independently of the
processes. bank’s comprehensive and independent advanced systems’ development,
3. An accurate and reliable IRB reviews of the IRB system. implementation, and operation, or
system will allow bank management to 7. As discussed in Chapter 1, the subjected to an independent assessment
make informed risk management and bank’s board of directors must at least of their adequacy and effectiveness.
capital management decisions. While annually evaluate the effectiveness of, 11. The developmental evidence
banks have flexibility in determining and approve, the bank’s advanced supporting risk rating and segmentation
how integrity in the IRB system is systems for credit risk. To do so, the systems’ design and quantification is
achieved, the control framework that board should be provided with generally compiled by the systems’
supports the IRB system should be information that would enable it to designers. This evidence should be
constructed to ensure that the IRB conclude, with reasonable assurance, subject to an ongoing substantive
system’s design and performance are that management has appropriate independent assessment by qualified
effective and that it continues to operate processes and controls in place that staff. This independent review should
as intended. support an effective IRB system. This be conducted at the time of system
4. The specific IRB-system controls, as information should include results from development and then updated
outlined in this chapter as well as in the bank’s comprehensive and whenever significant changes in
Chapter 1 of this guidance, should be independent reviews of the IRB system. methodology, data, or implementation
part of a broader control infrastructure 8. The bank’s independent review occur.
that embodies more generic control process may be tailored to the bank’s 12. Furthermore, when process
principles such as dual controls, management and oversight framework. verification, benchmarking, or outcomes
separation of duties, and The objective of these reviews should be analysis (backtesting) activities are not
appropriateness of incentives that to evaluate compliance with the completed by individuals independent
enable prudential corporate oversight. requirements in the NPR and this of the risk rating and segmentation
S 7–2 Control processes should be supervisory guidance and to measure systems’ design or use, these activities
independent and transparent to the effectiveness of the IRB system’s must be the focus of an ongoing
supervisors and auditors. design and operation. The review substantive independent assessment.
5. The objective of independence is to should include all components of the Responsibility for the assessment of
ensure the integrity of the IRB system. IRB system: developmental evidence and ongoing
When independence is not fully • Risk rating and segmentation validation may be drawn from a variety
achieved, there should be compensating systems; of organizational structures provided
controls to confirm that actions and • Quantification process, particularly functional independence and sufficient
conclusions are not compromised. the selection of reference data sets and expertise are demonstrated.
6. Independence can be achieved risk parameter estimation techniques;
structurally with organizational • Ongoing validation process; III. Consistency Between IRB Systems
separation, or functionally, through • Data management and maintenance and Risk Management Processes
policy and/or incentive based system that supports the IRB system; S 7–5 The systems and processes
separation. For example, reviews and used by a bank for risk-based capital
performed by individuals who are not • Control infrastructure supporting purposes must be consistent with the
structurally independent could be the IRB system. bank’s internal risk management
acceptable as functionally independent 9. Responsibility for the review processes and management information
reviews if the structure does not inhibit process could be distributed across reporting systems.
an objective evaluation. In these cases, multiple areas or housed within one 13. The systems and processes a bank
job responsibilities and reporting unit, so long as the bank can uses for risk-based capital purposes
relationships should be assessed to demonstrate that the review process must be consistent with the bank’s
determine if they present any inherent provides a comprehensive and objective internal credit risk management
conflicts that could impede conducting assessment of the areas reviewed. processes and management information
an effective review. Banks should Individuals performing the reviews reporting systems such that data from
consider a variety of factors when should possess the requisite technical the latter system and processes can be
designing a control structure to skills and expertise. used to verify the reasonableness of the
adequately address independence, 10. Validation will encompass some risk parameter inputs the bank uses for
including: of the IRB system review standards risk-based capital purposes.
• Expertise and experience of described above. However, to the extent 14. The wholesale risk ratings used
individuals conducting control that validation or other control for risk-based capital purposes should
activities; functions do not address a component be consistent with those used to guide
• Potential for conflicts of interest of the IRB system or if they do not meet day-to-day wholesale credit risk
and influence that could compromise the independence requirements, a management activities. Wholesale risk
the effectiveness of controls; separate independent review of ratings for IRB purposes should be
incorporated into and be consistent with and responsiveness to findings. Further, in the bank’s quantification process. As
a bank’s credit risk management, internal audit should evaluate the such, observed outcomes should not
internal capital assessment and depth, scope, and quality of the consistently or significantly exceed risk
planning, and corporate governance independent review processes and parameter estimates. This applies to
processes. The different uses and conduct appropriate testing to ensure each of the following:
applications of the risk rating systems’ that the conclusions of these reviews are • Actual long-run average default
outputs should promote greater well founded. rates for each rating grade or segment
accuracy and consistency of ratings and the assigned PD estimates;
across an organization. Banks should V. Validation Activities • Actual long-run average economic
demonstrate that ratings used for IRB 18. Validation is an ongoing process loss rates on defaulted exposures and
purposes are consistent with the bank’s that includes the review and monitoring the assigned ELGD estimates;
internal credit risk management activities that verify the accuracy of the • The economic loss rates on
processes. risk rating and segmentation systems defaulted exposures during actual
15. The risk drivers used for IRB retail and the quantification process. The economic downturn conditions and the
segmentation should be consistent with components of validation include assigned LGD estimates; and
those used to guide day-to-day retail evaluation of conceptual soundness • The exposure size of defaulted
credit risk management activities. Risk (including developmental evidence), exposures during actual economic
drivers for IRB segmentation purposes ongoing monitoring, and outcomes downturn conditions and the assigned
should correspond to risk drivers used analysis. EAD estimates.
as part of the overall credit risk Bias that results in a reduction of risk-
management of business lines. Banks A. General Validation Requirements based capital requirements should
should demonstrate that the risk drivers S 7–7 A bank’s validation policy receive immediate attention from
used for IRB segmentation purposes are should cover the key aspects of risk management.
consistent with those used in its day-to- rating and segmentation systems and S 7–9 Validation processes for risk
day planning, execution, and the quantification process. rating and segmentation systems, and
monitoring of retail lending activities. 19. The validation policy should be the quantification process must include
However, the IRB segmentation criteria approved by the bank’s senior the evaluation of conceptual soundness,
do not have to be identical to those used management, and should: ongoing monitoring, and outcomes
in credit risk management. • Describe the validation process; analysis.
16. Risk parameters used for credit • Outline the documentation 22. Validation should be designed to
risk management should be consistent requirements; give the greatest possible assurances of
with the IRB risk parameters. Banks will • Assign responsibilities; the accuracy of the risk rating and
be afforded some flexibility in their use • Outline the process for corrective segmentation systems and the
of estimated risk parameters, since the actions; and quantification process. Three activities
estimates prescribed for risk-based • Be updated periodically to must be carried out:
capital purposes may not be appropriate incorporate new developments in • Evaluating conceptual soundness
for other uses. For example, the PDs validation practices and to ensure that using developmental evidence—
used to estimate loan loss allowances validation methods remain appropriate. determining whether the approach is
could reflect current economic S 7–8 Validation must assess the sound;
conditions that are different from the accuracy of the risk rating and • Ongoing monitoring—verifying the
long-term averages appropriate for risk- segmentation systems and the process and comparing results to other
based capital calculations. While risk quantification process. sources of data or estimates
parameters used for internal risk 20. The accuracy of risk rating and (benchmarking); and
management purposes could be segmentation systems and the • Outcomes analysis—comparing
different from those used for risk-based quantification process is measured by actual outcomes with estimates by
capital purposes, banks should be able determining whether the: backtesting and other methods.
to demonstrate that the IRB measures of • Assignment of exposures to risk These integral, ongoing activities
credit risk are consistent with similar ratings or segments has been must evaluate both internally and
measures used in internal credit risk implemented as designed; externally developed risk rating and
management. • Performance data show that the risk segmentation systems, models, and the
rating or segmentation systems quantification process.
IV. Internal Audit adequately differentiate risk over time; 23. Validation processes, especially
S 7–6 Internal audit must, at least • Migration of wholesale risk ratings outcomes analysis, should recognize
annually, assess the effectiveness of the is consistent with the bank’s rating that realized outcomes for default, loss
controls supporting the IRB system and philosophy; severity, and additional drawdowns can
report its findings to the board of • Retail segmentation system vary in a systematic fashion with the
directors (or a committee thereof). separates exposures into stable and economic cycle. Thus, realized
17. A bank must have an internal homogeneous segments; and outcomes for a given risk parameter can
audit function that is independent of • Actual default, loss severity, and vary around the estimate of long run
business line management and that exposure experience of each rating average. A bank’s validation policy
assesses at least annually the grade or segment is consistent with risk should specify how realized outcomes
effectiveness of the controls supporting parameter estimates. are expected to vary with the economic
the IRB system and reports its findings 21. Some differences between cycle given the design of the IRB
to the board of directors (or its observed outcomes for individual system. For example, given a bank’s
designated committee). At least ratings or specific retail segments and obligor rating system design, a bank
annually, internal audit should review the estimated risk parameters are might expect realized defaults to be
the validation process including expected. Risk parameter estimates systematically below the PD estimate
procedures, responsibilities, should reflect a degree of conservatism during good states of the economic cycle
appropriateness of results, timeliness, appropriate for the inherent uncertainty and systematically above the PD
estimate during bad states of the supported by evidence that they work bank selected the chosen framework.
economic cycle. This should be well across reference data sets. Use of a For retail portfolios, data may be
specified in the policy documentation. ‘‘holdout’’ sample is a good model- available on alternative risk drivers for
Realized outcomes for loss severity are building practice to ensure that a model segmentation, and developmental
not directly comparable with LGD is robust. It is possible to perform evidence should include the empirical
estimates unless an economic downturn several out-of-sample tests by varying analysis conducted to choose between
is experienced. Nonetheless, outcomes the holdout samples. risk drivers.
analysis for conditions less severe than 29. Empirical developmental evidence 33. The development of risk rating
an economic downturn can shed light for a judgmental rating system will and segmentation systems and the
on the validity of the LGD quantification likely be derived differently than such quantification process requires
process. evidence for a model-driven system. developers to exercise informed
One approach to capture empirical judgment. Whether the developmental
B. Validation Activities developmental evidence for analysis evidence is sufficient will itself be a
Evaluating Conceptual Soundness using might entail having qualified, matter of expert opinion. Even if a
Developmental Evidence independent raters rate credits from system is model-based, an evaluation of
prior periods. Ideally, the raters would developmental evidence will entail
24. Developmental evidence is the not be familiar with the circumstances judging the merits of the model-building
primary mechanism used to evaluate the of the disposition of the credits (e.g., technique. Expert judgment is essential
conceptual soundness of the IRB default, downgrade, upgrade, paid as to the evaluation of the risk rating and
system. The developmental evidence for agreed, etc.) and would only use segmentation systems and the
risk rating and segmentation systems, information available to the original quantification process development.
and the quantification process should rater(s) at the time the credits were Experts should be able to draw
include documentation and empirical underwritten and subsequently conclusions about the likelihood of the
evidence supporting the methods used reviewed. These retrospective ratings satisfactory performance of an
and the variables selected in the design could then be compared to the outcomes implemented system.
and quantification of the IRB system. to determine whether the ratings
Where models are used, the evidence Ongoing Monitoring: Process
adequately differentiate risk. Verification and Benchmarking
should include documentation and a Conducting such tests may be difficult
description of the logic that supports the if historical data sets do not include a 34. The second component of the
model and an analysis of any statistical sufficient amount of the information validation process for risk rating and
model-building techniques. actually used when a rating was segmentation systems and the
25. Developmental evidence assigned. Careful consideration should quantification process is ongoing
supporting the risk rating system should be given to future data needs and monitoring. The objective of ongoing
include the reasons the system was anticipated uses for validation, even if monitoring is to confirm that the
selected over other systems. Other some variables are not used in the processes were implemented
developmental evidence should at a current model. appropriately and continue to perform
minimum describe the bank’s obligor S 7–10 Banks must evaluate the as intended. Such analysis involves
ratings approach and ratings developmental evidence supporting the process verification and benchmarking.
philosophy, the mapping methodology, risk rating and segmentation systems S 7–11 Banks must conduct ongoing
and the use and design of facility ratings and the quantification process. process verification of the risk rating
or loss severity estimates. 30. Evaluating developmental and segmentation systems and the
26. In supporting the segmentation evidence involves assessing how well quantification process to ensure proper
system, developmental evidence should the risk rating and segmentation systems implementation and operation.
describe the statistical design of the and the quantification process are 35. Process verification encompasses
segmentation system and the selection designed and constructed. The review of a range of activities that are used to
of risk drivers. Additionally, it should developmental evidence should assess whether all internal risk rating
explain why the system was selected determine whether: and segmentation processes, as well as
over other segmentation approaches. • Risk rating systems can be expected all quantification processes, are being
27. Developmental evidence to accurately assess obligor and facility used, monitored, and updated as
supporting a bank’s quantification risk; designed and intended. It includes
process should address each aspect of • Segmentation systems can be determining that data essential to these
the quantification process, whether the expected to separate exposures into processes have appropriate integrity,
process explicitly delineates the four segments with homogenous risk and that all elements of these processes
stages of quantification or implicitly characteristics and to allow for the continue to be appropriate to the nature
incorporates the stages. accurate measurements of risk within of the bank’s exposures. Process
28. Developmental evidence is more segments over time; and verification should also ensure that
persuasive when it includes empirical • The quantification process can be identified deficiencies are corrected.
evidence. Developmental evidence in expected to accurately estimate PDs, 36. Verification activities will vary
support of any model used in the risk ELGDs, LGDs, and EADs. depending on the risk rating and
rating and segmentation systems or the 31. Developmental evidence should segmentation systems and
quantification process should include be reviewed whenever the bank makes quantification approaches and their
documentation and a discussion of the material changes in its risk rating and related guidelines. Verification that data
logic that supports the model, an segmentation systems or quantification are accurate and complete is important
analysis of any model-building process. for all IRB systems and applies to both
techniques, sensitivity analysis (analysis 32. Evaluation of developmental internal and external data, including the
of outcome sensitivity with respect to evidence includes comparisons of a data provided by a third party.
model input changes and model bank’s implemented framework with 37. For models-based risk rating and
breakdown points), and an assessment alternatives considered in the segmentation, verification includes an
of forecast quality. Models should be development process and the reason the evaluation of the automated assignment
processes, such as verification of the S 7–12 Banks must benchmark their choices made in the four stages of
correct computer coding of the model risk rating and segmentation systems, quantification. Such benchmarking
and data inputs. For expert-judgment and their risk parameter estimates. compares:
and constrained-judgment risk rating 40. Benchmarking is using alternative • Reference data with data from other
systems, verification includes an methods or alternative data to draw data sources;
evaluation of whether the rater adhered inferences about the appropriateness of • Estimates of risk parameters with
to the rating policy and criteria, given ratings, segments, risk parameter estimates developed by alternative
the information available to the rater estimates or model outputs before methods using the same reference data;
and the documented rationale for the outcomes are actually known. • Mappings with alternative
rating decisions. Benchmarking is a useful validation mappings that would be expected to
38. Process verification of risk rating method that can be applied to all rating, provide similar results; and
and segmentation systems includes segmentation, and quantification • Adjustments at the application
monitoring and analysis of overrides. processes. stage with alternatives.
An override is a generic term that may 41. Benchmarking allows a bank to 45. Benchmarking activities can be
have different meanings in different compare the consistency of its risk accomplished in a number of ways and
contexts. Two types of overrides are parameter estimates with those of other at different levels of aggregation. Some
discussed below. estimation techniques and data sources. benchmarking activities are conducted
• ‘‘Judgmental overrides’’ occur when Benchmarking can be a valuable more frequently than others; for
judgments are made to reject the diagnostic tool for uncovering potential example, a bank benchmarks a system to
decision of an objective process, such as weaknesses in a bank’s quantification evaluate its performance more
a model or scorecard, which rates a process. While benchmarking allows for frequently than it benchmarks the
wholesale obligor, assigns an exposure inferences about the accuracy of the risk system to determine whether to
to loss-severity rating grade, or assigns rating and segmentation systems, and renovate it completely, an activity that
an exposure to a retail segment; the risk parameter estimates, it does not must be considerably more thorough.
judgmental overrides are an explicit substitute for backtesting. When Examples of benchmarking activities for
component of such a rating system’s differences are observed in the risk rating and segmentation systems,
benchmarking exercise, this does not and the quantification process are listed
design. As a matter of policy in a
necessarily indicate that the risk rating below:
constrained judgment rating system for
and segmentation systems, or the risk
wholesale lending, a rater is generally Risk Ratings or Segmentation
parameter estimates, are in error. A
allowed to adjust or override the results Benchmarking
benchmark is merely an alternative
of a statistical rating model. For retail
measure, and the difference may be due • On an ongoing basis, analyzing the
lending, the assignment of an exposure
to different data or methods. characteristics of obligors or exposures
to a segment could be overridden, but
Nevertheless, when differences are that have been assigned the same
such overrides generally are rare.
revealed, proper benchmarking requires wholesale risk rating or retail segment,
• ‘‘Policy overrides’’ refer to the bank to investigate the source of the and comparing the distribution of the
exceptions to bank policy with regard to differences and whether the extent of portfolio by these ratings or segments
risk rating assignment or segmentation. the difference is appropriate. This between different time periods.
In the case of pure models-based rating investigative process may identify ways • Periodically re-rating a sample of
and segmentation systems, an override in which a bank can improve its risk wholesale credits previously rated
would be considered to override policy. rating and segmentation systems, and under the bank’s standard method;
In a constrained judgment model, a the quantification process. examples of benchmark ratings include
policy override would occur when a 42. To benchmark risk ratings and alternate individual raters in a
rating is assigned by judgmental segmentation, a bank must at a judgmental system, an alternative
decision that does not conform to the minimum establish a process in which internally developed rating model, or
bank’s rating criteria. Overrides outside a representative sample of its internal third-party credit or debt ratings.
of policy are expected to be rare.13 ratings, portfolio segmentation, and risk • Periodically comparing the
39. Frequent overrides may call into parameters are compared to results from separation power of the IRB retail
question aspects of the risk rating or another source for the same exposures. segmentation to alternative
segmentation system. Overrides and Examples of other sources include segmentations used in credit risk
adjustments should be monitored and independent internal raters such as loan management and comparing the risk
the performance of ratings that have review, external corporate rating parameter estimates derived from the
been adjusted or overridden should be agencies, or retail credit bureau models, IRB retail segmentation with an
tracked for both the validation of rating and alternative internally developed alternative segmentation.
and segmentation systems and the IRB credit risk models (‘‘challenger
system as a whole. Banks should have models’’). Quantification Benchmarking
a policy addressing criteria for 43. Benchmarking of a risk rating, • On an ongoing basis, comparing a
judgmental overrides and tolerance regardless of the rating approach, bank’s PD, ELGD, LGD, and EAD
levels for policy overrides. The customarily asks whether another rater estimates with available alternative risk
frequency of overrides will depend or rating method attaches a comparable estimates, such as business line loss
upon the portfolio, the risk rating and rating to a particular obligor or forecasts or allowance methodologies.
segmentation design, and a bank’s exposure. Benchmarking of a Within retail portfolios, vintage analyses
practices. segmentation system customarily asks (tracking loss rates over the life of the
whether other risk drivers or other loan, given the same origination time
13 Another common use of overrides in retail

segmentation methods provide similar and borrower characteristics) can be
lending, not included in this context, relates to risk separation and assessments of the compared between different origination
underwriting decisions. ‘‘Low side’’ overrides
approve applications that would normally be portfolio risk distribution. periods.
rejected and ‘‘high side’’ overrides reject 44. Benchmarking of quantification • Periodically comparing a bank’s PD,
applications that would normally be approved. generally involves comparing different ELGD, LGD, and EAD estimates with
risk parameter estimates derived from 48. Banks have considerable accuracy of the IRB risk rating and
alternative choices at some step(s) of the flexibility in developing statistical tests segmentation systems, and the
quantification process, such as different to back-test the performance of their risk quantification process.
reference data sources, different rating and segmentation systems and the S 7–16 Developmental evidence
estimation models, etc. accuracy of their quantification process. must be updated whenever significant
Regardless of the backtesting method changes in methodology, data, or
Outcomes Analysis implementation occur. Other validation
used, the bank should establish
S 7–13 Banks must analyze expected ranges for validation results. activities must be ongoing and must not
outcomes and must develop statistical Backtesting often will not identify the be limited to a point in time.
methods to backtest their risk rating specific reasons for discrepancies 52. Process verification,
and segmentation systems and the between expectations and outcomes. benchmarking, and backtesting
quantification process. Rather, it will indicate only that further activities should be conducted often
46. The third component of the investigation is necessary. enough to ensure ongoing integrity of
validation process is outcomes analysis, 49. When establishing expected the risk rating and segmentation
which is the comparison of risk ranges, banks should consider relevant systems, and the quantification process.
parameter estimates and model results elements of a bank’s risk rating or For example, during high-default
with actual outcomes. Although banks segmentation systems that may affect periods, banks should analyze realized
are expected to employ all the outcomes, for example whether the default and loss severity rates more
components of the validation process, system is designed to measure risk frequently, perhaps quarterly. They
the data to perform comprehensive parameter estimates at a point in time, should document the results of
outcomes analysis on the existing through the cycle, or at stressed periods. validation, report them to appropriate
portfolio may not be available in the Also, changes in economic or market levels of senior risk management, and
early stages of implementation and may conditions and portfolio composition take action as appropriate.
be difficult when a bank’s process for between the historical data and data
assessing risks changes significantly. Chapter 8: Stress Testing of Risk-Based
from the present period can lead to Capital Requirements
Therefore, banks may at times need to differences between outcomes and risk
rely more heavily on other validation parameter estimates. Rule Requirements
activities such as developmental 50. In establishing expected ranges, a Part III, Section 22(j)(6): The bank
evidence, process verification, and bank should consider which elements of must periodically stress test its
benchmarking.14 its risk rating or segmentation system, advanced systems. The stress testing
47. Backtesting is the statistical and the quantification process, are most must include a consideration of how
comparison of estimates to realized likely to affect outcomes of the risk economic cycles, especially downturns,
outcomes. Banks must back-test their parameter estimates. However, affect risk-based capital requirements
risk parameter estimates by regularly determining expected ranges can be (including migration across rating
comparing actual portfolio or rating difficult if a bank has changed its grades and segments and the credit risk
grade/segment-level default rates, loss method of quantifying risk parameters mitigation benefits of double default
severities, and exposure-at-default and the estimates were calculated by a treatment).
experience with the PD, ELGD, LGD, different method than the outcomes. If 1. Under the IRB framework, changes
and EAD estimates on which risk-based so, it may be appropriate to recalculate in borrower credit quality will lead to
capital calculations are based. historical estimates in a manner changes in the risk-based capital
Backtesting indicates the combined consistent with the new method. If a requirements. Because credit quality
effectiveness of the assignment of bank adjusts final risk parameter typically improves or deteriorates in
exposures to wholesale obligor and loss estimates to be conservative, it may be conjunction with economic conditions,
severity ratings or to retail segments and appropriate to do its backtesting on the risk-based capital requirements may
the quantification of the risk parameters unadjusted estimates. also vary with the economic cycle.
attached to those ratings or segments. 51. Differences in realized default, During an economic downturn, risk-
S 7–14 Banks should establish loss severity, or exposure rates from based capital requirements typically
ranges around the estimated values of expected ranges may point to issues in increase as obligors or exposures
risk parameter estimates and model the reference data, estimation, mapping migrate toward lower credit quality risk
results in which actual outcomes are or application elements of ratings or segments.
expected to fall and have a validation quantification. They may also indicate 2. Stress testing analysis is a means of
policy that requires them to assess the potential problems in other parts of the understanding how economic cycles,
reasons for differences and that risk rating or segmentation system. The especially downturns, as represented by
outlines the timing and type of remedial bank’s validation policy should describe stress scenarios, will affect risk-based
actions taken when results fall outside (at least in broad terms) the types of capital requirements through migration
expected ranges. responses that should be considered across risk ratings or segments, effects
14 For wholesale risk rating systems, banks face
when actual outcomes fall outside the on double default treatment, and
the challenge of how to measure the system’s
expected ranges. If the discrepancies through effects on other relevant aspects
performance when backtesting is not conclusive. demonstrate a systematic tendency to of a bank’s advanced systems.15
Because of the rarity of defaults in most years and decrease risk-based capital S 8–1 Banks must conduct and
the bunching of defaults in a few years, the other requirements, the nature and source of document stress testing of their
parts of the validation process will assume greater
importance. If risk rating and segmentation
the bias requires even more detailed advanced systems as part of managing
processes are developed in a learning environment scrutiny. risk-based capital.
in which banks attempt to change and improve

them, backtesting may be delayed even further. In C. Minimum Frequency of Validation 15 Stress testing is a general term that can be
its early stages, the validation of risk rating and S 7–15 Each of the three activities in applied to different types of analysis, depending on
segmentation systems will depend on bank the purpose of the exercise. Examples of stress
management’s exercising informed judgment about
the validation process should be testing that have a different purpose than
the strength of the systems, not simply on empirical conducted often enough to ensure the contemplated here include a stress test of bank
tests. ongoing integrity, reliability, and solvency and a stress test of an individual obligor.
3. Supervisors expect that banks will revealed by rating migration patterns) of risk exposure varies with a market
manage their risk-based capital position the rating agency, or any other source of variable such as an interest rate or
so that they remain at least adequately ratings, associated with the recession security price. For certain transactions
capitalized during all phases of the transition matrix is consistent with the subject to counterparty credit risk where
economic cycle. A bank that is able to bank’s rating system, or appropriate there is financial collateral, a bank may
accurately estimate risk-based capital adjustments should be made for be allowed to recognize the risk
levels during a downturn can be more differences in rating philosophy. mitigating effect of that collateral
confident of appropriately managing 7. The scope of this estimation through an adjustment to EAD.
risk-based capital. Stress testing analysis exercise should be broad and include all 3. As provided in the NPR,
consists of identifying a stress scenario material portfolios under the framework transactions with counterparty credit
and then translating that scenario into for advanced systems. The time horizon risk for which a bank may adjust EAD
its effect on the levels of key of the stress testing analysis should be rather than LGD include:
performance measures, including risk- consistent with the specifics of the • Repo-style transactions including
based capital ratios. scenario and should be long enough to repurchase and reverse repurchase
4. Banks should use a range of measure the material effects of the agreements, and securities lending and
scenarios and methods when stress scenario on key performance measures. securities borrowing transactions;
testing to manage risk-based capital. For example, if a scenario such as a • Eligible margin loans; and
Scenarios may be historical, historical recession materially affected • Over-the-counter (‘‘OTC’’)
hypothetical, or model-based. Key income and segment or ratings derivatives transactions.
variables specified in a scenario could migration over two years, the 4. Several methods are available to
include, for example, interest rates, appropriate time horizon is at least two calculate EAD depending on the type of
transition matrices (ratings and score- years. transaction, presence of eligible
band segments), asset values, credit 8. The bank’s management of risk-
collateral, legal agreements surrounding
spreads, market liquidity, economic based capital should also take into
a transaction, the operational capability
growth rates, inflation rates, exchange account the effect of a bank’s
of a bank, and the modeling capability
rates, or unemployment rates. A single discretionary actions on risk-based
of a bank:
scenario may apply to the entire capital levels. For example, a bank’s
• A collateral haircut approach that
portfolio, or a number of scenarios may plan to reduce dividends in the face of
includes standard supervisory haircuts
apply to various sub-portfolios. The lowered income would, if implemented,
or the bank’s own estimates of the
severity of the stress scenario should be affect retained earnings and the capital
haircuts—applied to individual repo-
consistent with the periodic economic accounts. Such discretionary actions
should be consistent with the bank’s style transactions, eligible margin loans,
downturns experienced in the bank’s
documented risk-based capital and single-product groups of such
market areas. Such scenarios may be
management policy. Because transactions subject to a qualifying
less severe than those used for other
discretionary plans may or may not be master netting agreement (netting set).
purposes, such as testing a bank’s
implemented, a bank should estimate Additionally, the haircut approach is
solvency.
5. Given a scenario, a bank then the relevant capital ratios both with and available to recognize financial
estimates the effect of the scenario on without these actions. collateral in the current exposure
risk-weighted assets and its future methodology for OTC derivatives;
capital ratios relative to the risk-based
Chapter 9: Counterparty Credit Risk • A simple VaR methodology—
Exposure applied to single-product netting sets of
capital minimums. Estimating capital
ratios includes estimating levels of Rule Requirements repo-style transactions and eligible
capital (the numerator of the ratio) as margin loans;
Part III, Section 22(d): Counterparty • A current exposure methodology for
well as measures of risk-weighted assets credit risk model. A bank must obtain
(the denominator). OTC derivatives; and
the prior written approval of [AGENCY] • An internal models methodology
6. For example, suppose the scenario under section 32 [of the NPR] to use the
for both a retail and a wholesale available for all three transaction types.
internal models methodology for 5. Supervisor approval is required for
portfolio is a specific historical counterparty credit risk.
recession. For the retail portfolio, score- all methods except the collateral haircut
Part IV, Section 32: Counterparty
band transition matrices observed approach using standard supervisory
Credit Risk
during the recession could be used to haircuts and the current exposure
quantify migration between segments I. Overview methodology for OTC derivatives. To
and thus supply the new distribution of 1. This chapter supplements the receive approval, a bank should
segments expected for the current detailed discussion of counterparty demonstrate to its primary Federal
portfolio, given the scenario. For the credit risk in the NPR by describing supervisor:
wholesale portfolio, internal or rating some of the elements of counterparty • Internal operational processes used
agency ratings transition matrices credit risk mitigation, providing to determine the eligibility of
observed during the recession could be information that may aid banks in transactions for the method chosen;
used to quantify ratings migration, and choosing among the alternative methods • Internal processes used to
thus supply the distribution of rating to calculate EAD for these transactions, determine the regulatory and legal
grades. The distribution of segments and and providing some descriptions and ability to net transactions in bankruptcy;
rating grades would allow the illustrative examples of acceptable • Appropriate model validation and
calculation of risk-weighted assets that modeling practices for estimation of backtesting procedures;
would be expected during the recession • Appropriate internal controls for
EAD under the alternative methods.

scenario. Transitions into default would counterparty credit risk;
allow banks to estimate the effects of II. Transactions With Counterparty • Appropriate collateral management
credit losses on income and capital. As Credit Risk processes, which, at a minimum,
part of this analysis, the bank should 2. Transactions with counterparty determine whether collateral meets the
ensure that the rating philosophy (as credit risk are those where the credit definition of financial collateral; and
• Adequacy of the modeling conclude with a well-founded basis that • Cash on deposit with the bank
techniques used and how the models the agreement mentioned above meets (including cash held for the bank by a
meet qualification requirements. these requirements and is legal, valid, third-party custodian or trustee);
6. If a transaction qualifies for one of binding, and enforceable under • Gold bullion;
the EAD adjustment approaches and the applicable law in the relevant • Long-term debt securities that have
bank elects to use one of the EAD jurisdictions. an applicable external rating of one
adjustment methods for the transaction, 8. An eligible margin loan is an category below investment grade or
collateral may only be taken into extension of credit where: higher (e.g., at least BB¥);
account in the estimation of EAD and • The credit extension is • Short-term debt instruments that
may not also affect the other parameters, collateralized exclusively by debt or have an applicable external rating of at
such as LGD. For eligible transactions, equity securities that are liquid and least investment grade (e.g., at least A–
the capital requirement is based on an readily marketable; 3);
estimate of the PD of the counterparty • The collateral is marked to market • Equity securities that are publicly
and LGD for an unsecured exposure to daily and the transaction is subject to traded;
the counterparty. The EAD is adjusted daily margin maintenance requirements; • Convertible bonds that are publicly
to reflect a net exposure amount. Credit • The extension of credit is traded; and
exposures that do not qualify for the conducted under an agreement that • Money market mutual fund shares
EAD adjustment approach as discussed provides the bank the right to accelerate and other mutual fund shares if a price
in this section must follow the IRB and terminate the extension of credit for the shares is publicly quoted daily.
approach described elsewhere in this and to liquidate or set off collateral
IV. Netting
guidance. For those transactions, (i) the promptly upon an event of default
LGD for each individual transaction can (including upon an event of bankruptcy, S 9–1 All transactions with a
be adjusted, based on the collateral for insolvency, or similar proceeding) of the counterparty subject to a qualifying
the transaction; and (ii) except for the counterparty, provided that, in any such master netting agreement constitute a
current exposure methodology for OTC case, any exercise of rights under the netting set and may be treated as a
derivatives, netting cannot be agreement will not be stayed or avoided single exposure, otherwise each
considered in determining either EAD under applicable law in the relevant transaction shall have its risk-based
or PD. jurisdictions; and capital requirement calculated on a
• The bank has conducted and standalone basis.
III. Definitions documented sufficient legal review to 11. Counterparty credit risk may be
7. A repo-style transaction is a conclude with a well-founded basis that calculated at the level of a netting set.
repurchase or reverse repurchase the agreement mentioned above meets Consistent with the industry’s general
transaction, or a securities borrowing or these requirements and is legal, valid, practice for computing exposures to
securities lending transaction, including binding, and enforceable under counterparty credit risk, a bank can
a transaction in which the bank acts as applicable law in the relevant estimate the exposure amount or EAD,
agent for a customer and indemnifies jurisdictions. and calculate the associated capital
the customer against loss, provided that: 9. An OTC derivative contract is a requirement on the basis of one or more
• The transaction is based solely on derivative contract that is not traded on defined bilateral ‘‘netting sets.’’ A
liquid and readily marketable securities an exchange that requires the daily ‘‘netting set’’ is a group of transactions
or cash; receipt and payment of cash-variation with a single counterparty that are
• The transaction is marked to market margin. subject to a legally enforceable bilateral
daily and subject to daily margin • A derivative contract means a netting agreement that meets the
maintenance requirements; financial contract whose value is requirements to be a qualifying master
• The transaction is executed under derived from the values of one or more netting agreement or qualifying cross
an agreement that provides the bank the underlying assets, reference rates, or product master netting agreement under
right to accelerate, terminate, and close- indices of asset values or reference rates. the terms of the NPR. If a transaction
out the transaction on a net basis and to Derivative contracts include interest rate with a counterparty is not subject to a
liquidate or set off collateral promptly derivative contracts, exchange rate qualifying master netting agreement, it
upon an event of default (including derivative contracts, equity derivative comprises its own netting set and the
upon an event of bankruptcy, contracts, commodity derivative EAD will need to be calculated for that
insolvency, or similar proceeding) of the contracts, credit derivatives, and any transaction on its own. The total
counterparty, provided that, in any such other instrument that poses similar exposure amount or EAD for a given
case, any exercise of rights under the counterparty credit risk. counterparty is the sum of the exposure
agreement will not be stayed or avoided • Derivative contracts also include amounts or EADs of the individual
under applicable law in the relevant unsettled securities, commodities, and netting sets with that counterparty.
jurisdictions; 16 and foreign exchange transactions with a 12. Cross-product netting allows for
• The bank has conducted and contractual settlement or delivery lag banks using the internal models
documented sufficient legal review to that is longer than the lesser of the methodology to recognize bilateral
16 Where all transactions under the agreement are
market standard for the particular netting arrangements across repo-style
(i) executed under U.S. law and (ii) constitute instrument or 5 business days. This transactions, eligible margin loans, and
‘‘securities contracts’’ or ‘‘repurchase agreements ’’ would include, for example, agency OTC derivatives. To recognize cross-
under section 555 or 559, respectively, of the mortgage-backed securities transactions product netting for risk-based capital
Bankruptcy Code (11 U.S.C. 555 or 559), qualified conducted in the To-Be-Announced
financial contracts under section 11(e)(8) of the
purposes:
market. • Transactions must be conducted
Federal Deposit Insurance Act (12 U.S.C.

1821(e)(8)), or netting contracts between or among 10. Financial collateral is the under a qualifying master netting
financial institutions under sections 401–407 of the following set of financial instruments in agreement;
Federal Deposit Insurance Corporation which the bank has a perfected, first • A bank must be able to effectively
Improvement Act of 1991 (12 U.S.C. 4401–4407) or
the Federal Reserve Board’s Regulation EE (12 CFR priority security interest or the legal integrate the risk-mitigating effects of
Part 231), this requirement is deemed to be met. equivalent: cross-product netting into its risk
management and other information In addition, it must consider the collateral in mitigating the counterparty
technology systems; and operational requirements for tracking credit risk associated with repo-style
• The bank must obtain the prior the exposures of such transactions. To transactions and eligible margin loans.
written approval of its primary Federal determine which EAD adjustment For OTC derivative contracts, there are
supervisor. approach to apply, the bank should two EAD-based methodologies—the
13. Netting other than on a bilateral consider the treatment for similar current exposure methodology and an
basis, such as netting across transactions transactions, the need for regulatory internal models methodology. The
entered into by affiliates (known as approval, operational and legal current exposure methodology for
cross-affiliate netting), is not recognized requirements, and the scope and calculating EAD for an OTC derivative
for the purposes of calculating risk- complexity of the bank’s business in contract or set of OTC derivative
based capital requirements. each of the areas. In addition, banks contracts subject to a qualifying master
should consider whether transactions netting agreement is similar to the
V. Determination of Eligibility for EAD otherwise eligible for the EAD methodology in the general risk-based
Adjustment adjustment approach are subject to the capital rules.17 If the OTC derivative is
S 9–2 Banks should have an automatic stay under the U.S. collateralized and the internal models
appropriately documented process for Bankruptcy Code or similar provisions methodology is used, the collateral is
determining whether transactions are under other applicable bankruptcy law. recognized within that approach. If the
eligible for an EAD adjustment OTC derivative contract is collateralized
VI. Methods for Determining EAD
approach if they choose to use an EAD and the current exposure methodology
adjustment approach. 15. There are three EAD-based is used, the bank may use either the
14. The process for determining if a methodologies—a collateral haircut ELGD/LGD estimation methodology to
transaction is eligible for an EAD approach, a simple VaR methodology, recognize the benefits of financial
adjustment approach should consider and an internal model methodology— collateral or the collateral haircut
whether the transaction meets the that a bank may use instead of an ELGD/ approach. Table 1 illustrates which EAD
definition of a repo-style transaction, LGD estimation methodology to estimation methodologies may be
eligible margin loan, or OTC derivative. recognize the benefits of financial applied to particular types of exposure.
TABLE 1
Models approach
Current exposure Collateral haircut
methodology approach Simple VaR 18 Internal models
methodology methodology
OTC derivative ..................................................................... Yes ....................... No ......................... No ......................... Yes.

Recognition of collateral for OTC derivatives ...................... No ......................... Yes 19 .................... No ......................... Yes.
Repo-style transaction ......................................................... No ......................... Yes ....................... Yes ....................... Yes.
Eligible margin loan ............................................................. No ......................... Yes ....................... Yes ....................... Yes.
Cross-product netting set .................................................... No ......................... No ......................... No ......................... Yes.
S 9–3 Banks must use the same 17. Banks that are engaged in prime bank can recognize the risk mitigating
method for determining risk-based brokerage, market making, and other effect of financial collateral that secures
capital requirements for all similar sophisticated securities financing and a repo-style transaction, eligible margin
transactions. repurchase activities should consider loan, or single-product netting set of
16. Banks must use the same method using the VaR model approach or the such transactions subject to a qualifying
for similar transactions, but may use internal models approach. Banks that do master netting agreement through an
different methods for different not engage in such activities but are adjustment to EAD rather than ELGD
principally using repurchase agreements and LGD. The bank may use a collateral
transaction types. A bank may use a
and other financial contracts for haircut approach or one of two models
separate methodology for agency
liquidity, cash management, and other approaches: A simple VaR methodology
securities lending transactions—that is,
risk management purposes may use a (for single-product netting sets of repo-
repo-style transactions in which the
collateral haircut approach for eligible style transactions or eligible margin
bank, acting as agent for a customer,
margin loans and repo-style loans) or an internal models
lends the customer’s securities and transactions, and the current exposure methodology (the internal models
indemnifies the customer against loss— methodology for OTC derivatives. methodology is described under the
and all other repo-style transactions. methods for OTC derivatives, but may
S 9–4 The method for calculating A. Methodologies for Repo-Style
be applied to repo-style transactions and
EAD for transactions subject to Transactions and Eligible Margin Loans
margin loans as well). Figure 1
counterparty credit risk should be 18. Under any of the available illustrates the methodologies available
appropriate for the risk, extent, and methodologies for repo-style for eligible margin loans and repo-style
complexity of the bank’s activity. transactions and eligible margin loans, a transactions.
17 The general risk-based capital rules are in 12 CFR part 325, Appendix A (state non-member master netting agreement are eligible for the simple
CFR part 3, Appendix A (national banks), 12 CFR banks), and 12 CFR part 567 (savings associations). VaR methodology.
part 208, Appendix A (state member banks), 12 CFR 18 Only repo-style transactions and eligible 19 In conjunction with the current exposure
part 225, Appendix A (bank holding companies), 12 margin loans subject to a single-product qualifying methodology.
Collateral Haircut Approach standard supervisory haircuts or its own supervisory haircuts upward to a
19. Under the collateral haircut estimates of haircuts. holding period longer than 10 business
approach, a bank would set EAD equal 20. For purposes of the collateral days for eligible margin loans or 5
to the sum of three quantities: haircut approach, a ‘‘given security’’ business days for repo-style transactions
• The value of the exposure less the would include, for example, all to take into account collateral
value of the collateral; securities with a single Committee on illiquidity. To convert the haircut to a
• The sum across all securities of (i) Uniform Securities Identification holding period longer than 10 business
the absolute value of the net position in Procedures (‘‘CUSIP’’) number and days, the haircut should be multiplied
a given security (where the net position would not include securities with by the square root of the ratio of the
in a given security equals the sum of the different CUSIP numbers, even if issued actual holding period to the 10 business
current market values of the particular by the same issuer with the same day minimum holding period. As an
security the bank has lent, sold subject maturity date. example, assume a bank that uses
to repurchase, or posted as collateral to Standard Supervisory Haircuts standard supervisory haircuts has
the counterparty minus the sum of the extended an eligible margin loan of
current market values of that same 21. If a bank chooses to use standard $100 that is collateralized by 5-year U.S.
security the bank has borrowed, supervisory haircuts, it would use an Treasury notes with a market value of
purchased subject to resale, or taken as eight percent haircut for each currency $100. The value of the exposure less the
collateral from the counterparty); mismatch and the haircut appropriate to value of the collateral would be zero,
multiplied by (ii) the market price each security in Table 2 below. The and the net position in the security
volatility haircut appropriate to that haircuts in the table assume a 10 ($100) times the supervisory haircut
security; and business-day holding period (.02) would be $2. There is no currency
• The sum across all currencies (appropriate for eligible margin loans).
different from the settlement currency of These haircuts must be multiplied by
(i) the absolute value of the net position the square root of 1⁄2 to convert the
of both cash and securities in a given standard supervisory haircuts from the
currency; multiplied by (ii) the haircut 10 business-day holding period to the 5
appropriate to that currency mismatch. business-day holding period appropriate
To determine the appropriate for repo-style transactions. A bank
EN28FE07.005</GPH>
haircuts, a bank could choose to use would be required to adjust the
mismatch. Therefore, the EAD of the

exposure would be $0 + $2 = $2.
TABLE 2.—STANDARD SUPERVISORY MARKET PRICE VOLATILITY HAIRCUTS 20

Issuers ex-
Residual maturity for debt securi-
External rating grade category for debt securities empt from the Other issuers
ties21 3 b.p. floor
Two highest investment grade rating categories for long-term ratings/ ≤1 year ............................................ .005 .01
highest investment grade rating category for short-term ratings.
>1 year, ≤5 years ............................ .02 .04
>5 years .......................................... .04 .08
Two lowest investment grade rating categories for both short- and long- ≤1 year ............................................ .01 .02
term ratings.
>1 year, ≤5 years ............................ .03 .06
>5 years .......................................... .06 .12
One rating category below investment grade ........................................... All ..................................................... .15 .25
Main index equities 22 (including convertible bonds) and gold ................................................................................ .15
Other publicly-traded equities (including convertible bonds) .................................................................................. .25
Mutual funds ............................................................................................................................................................ Highest haircut applicable to
any security in which the fund
can invest
Cash on deposit with the bank (including a certificate of deposit issued by the bank) ......................................... 0
Own Estimates of Haircuts appropriate to take into account the loans using a minimum one-year
illiquidity of an instrument; historical observation period of price
22. With the prior written approval of • The bank must select a historical data on the instruments that the bank
the bank’s primary Federal supervisor, a observation period for calculating has lent, sold subject to repurchase,
bank may calculate security type and haircuts of at least one year; posted as collateral, borrowed,
currency mismatch haircuts using its • The bank must update its data sets purchased subject to resale, or taken as
own internal estimates of market price and re-compute haircuts no less collateral. In cases where the underlying
volatility and foreign exchange frequently than quarterly and must collateral is less liquid, a longer time
volatility. When a bank calculates its reassess its data sets and haircuts period may be appropriate.
own estimates haircut on a TN-day whenever market prices change
holding period, which is different from S 9–5 Banks that use the VaR model
materially; and approach for single product netting sets
the minimum holding period for the • The bank generally must estimate
transaction type, the applicable haircut of repo-style transactions or eligible
individually the volatilities of each margin loans must conduct rigorous
(HM) is calculated using the following security and foreign exchange rate
square root of time formula: and regular backtesting to validate its
separately, and may not take into
model.
account the correlations between them.
26. The qualifying requirements for
Simple VaR Methodology the use of such a model are less
24. With the prior written approval of stringent than the qualification
where requirements for the internal model
its primary Federal supervisor, a bank
(i) TM = 5 for repo-style transactions and 10 may estimate EAD for repo-style methodology described below. In
for eligible margin loans; principle, the VaR model generally
(ii) TN = holding period used by the bank to
transactions and eligible margin loans
derive HN and subject to a qualifying master netting should meet the quantitative and
(iii) HN = haircut based on the holding period agreement using a VaR model. Under qualitative criteria for recognition of
TN. the simple VaR methodology, a bank’s internal market risk models set out in
EAD for the transactions subject to such the Market Risk Amendment (‘‘MRA’’).
Requirements for the Use of Internally a netting agreement would be equal to The main ongoing qualification
Estimated Haircuts the value of the exposures minus the requirement for using the simple VaR
23. A bank must meet the following value of the collateral plus a VaR-based model is that the bank must validate its
eligibility requirements to use internal estimate of the potential future exposure VaR model by establishing and
estimates of collateral haircuts: (‘‘PFE’’). maintaining a rigorous and regular
25. The VaR model must estimate the backtesting regime to ensure the validity
• The bank must use a 99th percentile PFE as the bank’s empirically-based, of the model the bank uses. A
one-tailed confidence interval, a best estimate of the 99th percentile, one- backtesting regime that is conducted
minimum five-business-day holding tailed confidence interval for an once every quarter to compare values of
period for repo-style transactions, and a increase in the value of the net one, five, and/or ten day 99 percent
minimum 10-business-day holding collateralized exposure (SE¥SC) over a VaRs with changes in market values of
period for eligible margin loans; 5-business-day holding period for repo- representative portfolios would be
• The bank must adjust holding style transactions or over a 10-business- appropriate and generally would be a
periods upward where and as day holding period for eligible margin part of a regular program of backtesting.
20 The market price volatility haircuts in Table 2 example, the remaining maturity to call dates or 22 The proposed rule defines a ‘‘main index’’ as
are based on a 10-business-day holding period. reset dates for floating rate notes should not be used the S&P 500 Index, the FTSE All-World Index, and
21 Residual maturity refers to the residual
for the residual maturity. any other index approved by the bank’s primary
EN28FE07.006</GPH>
contractual maturity of the debt security. For Federal supervisor for purposes of the rule.
27. In general, the repo-style backtest hypothetical portfolios, or a B. EAD for OTC Derivative Contracts
should include the backtesting of combination of real and hypothetical 28. A bank may use either the current
several representative portfolios that portfolios that are designed to test exposure methodology or the internal
compares the one day 99 percent VaR specific aspects of the model, or specific models methodology to determine the
figure with the change in market value risk factors. EAD for OTC derivative contracts.
for each portfolio tested. The Figure 2 illustrates the possible
representative portfolios could be based methodologies for the calculation of
on actual counterparty portfolios, EAD for OTC derivatives.
Current Exposure Methodology • The CF for credit derivatives that 30. A bank may reflect the credit risk
29. The current exposure are not used to hedge the credit risk of mitigating effects of financial collateral
methodology for determining EAD for exposures subject to an IRB risk-based by adjusting the ELGD and LGD of the
OTC derivative contracts is similar to capital requirement is specified to be 5.0 contract or exposure. Alternatively, if
the methodology set forth in the general percent for contracts with investment the transaction is subject to daily
risk-based capital rules, in that the EAD grade reference obligors and 10.0 marking-to-market and re-margining, the
for an OTC derivative contract would be percent for contracts with non- bank may adjust the EAD of the contract
equal to the sum of the bank’s current investment grade obligors. The CFs for using the collateral haircut approach for
credit exposure and potential future credit derivative contracts do not repo-style transactions and eligible
exposure (‘‘PFE’’) on the derivative depend on the remaining maturity of the margin loans. A bank applying the
contract. The proposal’s conversion contract; and collateral haircut approach to OTC
factor (‘‘CF’’) matrix used to compute • Floating/floating basis swaps are derivatives must use a 10-business-day
PFE is based on the matrices in the minimum holding period.
not exempt from the CF for interest rate
general risk-based capital rules, with
derivative contracts.
EN28FE07.007</GPH>
two exceptions:
C. Internal Models Methodology for risk-based capital requirements (that distribution of the market values for the
31. The internal models methodology is, rollover risk) or may underestimate portfolio. There are many possible
for the calculation of EAD can be the exposures of eligible margin loans, methods for making this forecast
applied to repo-style transactions, repo-style transactions, and OTC ranging from Monte Carlo simulation to
eligible margin loans, and OTC derivatives with short maturities. For using an analytic formula.
derivatives. The internal models this reason, a netting set’s ‘‘effective 38. The process generally starts with
methodology requires a risk model that EPE’’ will be used as the basis for a calculation of the current market value
captures counterparty credit risk and calculating EAD for counterparty credit of the transactions with a counterparty
estimates EAD at the level of a ‘‘netting risk. Effective EPE is the time-weighted that are in a netting set. Cases where the
set,’’ that is, transactions with a single average of effective EE over one year current market value of the netting set
counterparty that are subject to a where the weights are the proportion is positive represent an exposure to the
qualifying master netting agreement. A that an individual effective EE counterparty (the counterparty owes the
transaction not subject to a qualifying represents in a one-year time interval. If bank money). Cases where the current
master netting agreement is considered all contracts in a netting set mature market value is negative do not
to be its own netting set and EAD must before one year, effective EPE is the represent exposures to the counterparty
be calculated for each such transaction average of effective EE until all contracts since the bank owes the counterparty
individually. A bank may use the in the netting set mature. Effective EE is money. To determine the current
internal model methodology for OTC defined as: exposure, the market value of collateral
derivatives (collateralized or Effective EEtk = max (Effective EEtk-1, posted by the counterparty is subtracted
uncollateralized) and single-product EEtk) from the current market value of the
netting sets thereof, for eligible margin where exposure is measured at future netting set. If this difference is negative
loans and single-product netting sets dates t1, t2, t3, * * * and effective EEt0 the current exposure is zero.
thereof, or for repo-style transactions equals current exposure. Under the 39. The distribution of exposures on
and single-product netting sets thereof. internal models methodology, a measure a future date can also include the
A bank may choose to use the internal that is more conservative than effective exposure reducing effect of financial
models methodology for one or two of EPE for every counterparty (for example, collateral. In cases where financial
these three types of exposures and not a measure based on peak exposure) can collateral is held, the distribution of
the other types. As described in be used in place of effective EPE with market values of the positions and the
paragraph 12 of this chapter, in cases prior approval of the primary Federal collateral held against the netting set is
where a bank has been approved by its supervisor. calculated together and cases of negative
primary Federal supervisor to 35. The internal model methodology combined market values of transactions
incorporate the effects of cross-product scales effective EPE using a multiplier, and collateral are set to zero since they
netting agreements in their internal termed ‘‘alpha.’’ Alpha is set at 1.4; a do not represent a credit exposure if the
models methodology, the bank may use bank’s primary Federal supervisor has counterparty were to default (the
the internal models methodology for the flexibility to raise this value in counterparty has posted more collateral
combinations of repo-style transactions, appropriate situations. With approval of than it owes the bank, or the bank owes
eligible margin loans, and OTC the primary Federal supervisor, a bank the counterparty).
derivatives conducted under a may use its own estimate of alpha as 40. The bank will have to determine
qualifying cross-product netting described below, subject to a floor of for which future dates to calculate
agreement. 1.2. probability distributions of the market
32. Banks use several measures to 36. The maturity adjustment for value of transactions in the netting set.
manage their exposure to counterparty transactions under the internal models These should be chosen to accurately
credit risk, including peak exposure methodology is described in the NPR. reflect the cashflows of transactions in
(‘‘PE’’), expected exposure (‘‘EE’’), and This maturity formula for M is based on a netting set.
expected positive exposure (‘‘EPE’’). PE the effective credit duration of the 41. For these future dates (e.g., 1, 3,
is the maximum exposure estimated to counterparty exposure. A bank that uses 5, and 10 days in the future and every
occur on a future date at a high level of an internal model to calculate a one- month out to one year 23) the bank will
statistical confidence. Banks often use sided credit valuation adjustment can calculate the distribution of market
PE when measuring counterparty credit use the effective credit duration values for the netting set.
risk exposure against counterparty 42. Expected exposure (‘‘EE’’) is
estimated by such a model for maturity,
credit limits. EE is the probability- defined as the expected value of the
M, if the bank can demonstrate to its
weighted average exposure to a probability distribution of credit risk
primary Federal supervisor that the
counterparty estimated to exist at any exposures to a counterparty at any
effective credit duration used by the
specified future date, whereas EPE is the specified future date before the maturity
bank gives the same value for M as the
time-weighted average of individual date of the longest term transaction in
maturity formula for Counterparty
expected exposures to a counterparty the netting set. Banks will need to
Credit Risk (‘‘CCR’’) described in the
where the weights are the proportion of convert from market values of
NPR.
the time interval that an individual transactions to credit risk exposures to
A Description of the Modeling Process make this calculation. When the
exposure represents.
33. Effective EPE, described below, is for Effective Expected Positive Exposure transactions in a netting set have a
to be used in the calculation of EAD 37. The basis of the calculation is to 23 These example dates are given to clarify the
under the internal models methodology. forecast, based on observed price meaning of future dates, they do not represent a
EAD is calculated as a multiple of movements, the range of possible values
requirement. As described in paragraph 47 of this

effective EPE. that a portfolio of transactions with a chapter, as well as in the NPR, a large number of
34. EE and EPE may not capture counterparty that constitute a netting set future dates may be computationally burdensome,
and the number of future dates will depend
additional risk arising from the can take in the future and assign explicitly on a trade off between the ability to
replacement of existing short-term probabilities to those possible values. calculate effective EPE in an expeditious manner
positions over the one year horizon used This is the statistical probability and the accuracy of the computation.
positive value, the counterparty owes months as (3, 3, 4, 4, 6), each monthly expected on the basis of a normal
money to the bank and there is a credit calculation would get a weight of 1/5 distribution, the statistical term for
risk exposure equal to the positive and the effective expected positive which is leptokurtosis. In many
market value of the transactions. When exposure would be 4. The zero exposure instances, there may not be a need to
the transactions have a negative market values for months six through twelve account for this. The characteristics of
value, the bank owes the counterparty would not be included in the average leptokurtosis will have a greater
money and there is no credit risk nor would the average be computed proportional effect on the measures of
exposure. Generally, banks will start by over a full year. peak exposure (or some high threshold
calculating the probability distribution percentile measure) than on the measure
Requirements for the Internal Models
of the market value of the transactions of expected exposure used here.
Methodology
in a netting set with a counterparty on However, the bank should adjust its
a future date. To convert from a S 9–6 Banks must meet certain EAD measure appropriately when the
probability distribution of market values qualifying criteria that consist of underlying distribution of the market
to a probability distribution of credit operational requirements, modeling risk factors displays a significant degree
risk exposures, cases where the market standards, and model validation of leptokurtosis.
value is negative should correspond to requirements before receiving their 50. Banks must measure, monitor, and
a credit risk exposure of zero, and cases primary Federal supervisor’s approval control both current exposure to
where the market value is positive to use the internal models method. counterparties and counterparty credit
should correspond to a credit risk 46. Banks must have the systems
risk over the whole life of the contracts
exposure equal to the market value of capability to estimate EE on a daily
in a netting set with a counterparty. The
the transactions. This means that basis. While this does not require the
bank should exercise active
expected exposure includes in the bank to report EE daily, or even to
management of both existing exposure
probability weighted average a value of estimate EE daily, the bank must be able
and exposure that could change in the
zero for all cases where the market to demonstrate that it is capable of
future due to market moves.
value, including the effect of collateral, performing the estimation daily.
47. Banks must estimate EE at enough 51. Banks must measure and manage
is negative. current exposures gross and net of
43. Effective expected exposure on a future time points to accurately reflect
all future cash flows of contracts in the collateral held, where appropriate. The
future date is the greater of expected bank must estimate expected exposure
exposure on that date or effective netting set. In order to accurately reflect
the exposure arising from a transaction, for OTC derivatives contracts both with
expected exposure on the previous and without the effects of collateral
future date. Effective expected exposure the model should incorporate those
contractual provisions, such as reset agreements.
is calculated recursively, and the value
dates, that can materially affect the 52. Banks must have procedures to
for the first future date should be the
timing, probability, or amount of any identify, monitor, and control specific
greater of the expected exposure
payment. The requirement reflects the wrong way risk throughout the life of an
calculated on that date or the current
need for an accurate estimate of exposure. Wrong way risk in this
exposure. This means that effective
effective EPE. However, in order to context is the risk that future exposure
expected exposure is not allowed to
decline as one moves to future dates balance the ability to calculate to a counterparty will be high when the
that are further in the future, and that exposures with the need for information counterparty’s probability of default is
effective expected exposure will always on a timely basis, the number of time also high.
be greater than or equal to current points is not specified. Supervisors will 53. The data used by banks should be
exposure. assess the tradeoff between the adequate for the measurement and
44. Effective expected positive computation requirements of more modeling of the exposures. In particular,
exposure then takes the time-weighted future time points against the need for current exposures must be calculated on
average of effective expected exposures. the ability to perform timely the basis of current and accurate market
For example, if effective expected assessments of counterparty credit risk data. When historical data are used to
exposure is calculated each month for in determining the number of time estimate model parameters, at least
the first six months as 5, 6, 6, 6, 7 and points that banks should use in three years of data that cover a wide
7 in order, and each quarter for the establishing a counterparty’s EE profile. range of economic conditions must be
second half of the year as 7 and 7, EE should be calculated for enough used. This requirement reflects the
respectively, then those first six future dates to accurately reflect the longer horizon for counterparty credit
monthly values would each get a weight timing of cash flows. This accuracy risk exposures compared to market risk
of 1/12 and the quarterly observations in should be subject to the bank’s internal exposures. The data should be updated
the second half of the year would each review process. at least quarterly or more frequently
get a weight of 1/4 in the average. 48. Banks must have been using an when conditions warrant. Banks are also
Effective expected positive exposure internal model that broadly meets the encouraged to incorporate model
using these values at these dates would minimum standards to calculate the parameters based on forward-looking
be 6.583. distributions of exposures upon which measures.
45. If the longest maturity contract in the EAD calculation is based for a S 9–7 Banks that use the internal
the netting set was less than a year then period of at least one year prior to models methodology for counterparty
the effective expected positive exposure approval. This requirement is to ensure credit risk transactions must establish
only includes the effective expected that the bank has integrated the initial model validation and ongoing
exposures out to the longest maturity modeling into its counterparty credit model review procedures. The model
and the time-weighted average only goes risk management process. review should consider whether the
out to the longest maturity. For 49. Bank models must account for the inputs and risk factors as well as the
example, if the longest maturity contract non-normality of exposure distribution model outputs are appropriate. The
in the netting set is 5 months and the where appropriate. Non-normality of review of outputs should include a
effective expected exposures are exposures means that high loss events backtesting regime that compares the
calculated for each month for those five occur more frequently than would be model’s output with realized exposures.
54. Because counterparty exposures Modeling Requirements for the Internal management of counterparty credit risk
are driven by movements in market Models Method using the appropriate models and tools.
variables, the validation of an EPE 61. The use of effective EPE for
Time Horizon determining risk-based capital
model is similar to the validation of a
VaR model that is used to measure 58. The time horizon over which the requirements does not necessitate the
market risk. A validation of either type time-weighted average of effective use of effective EPE for setting
of model compares forecasted changes expected exposures is taken for the counterparty exposure limits. Peak
in value to realized changes. However, calculation of effective expected exposure may be, and often is, a more
the EPE simulation model forms an positive exposure is one year or the appropriate measure to limit
average of credit exposures over a 1-year longest maturity of any transaction in a counterparty exposures. However, the
time horizon, whereas a market risk VaR netting set, whichever is shorter. probability distributions of future
typically forms an estimate of value Examples are provided in paragraphs 44 exposures that are used for the effective
changes. These differences make and 45. Banks which receive approval to EPE calculation should be the same as
backtesting internal models used to incorporate the effect of collateral those used for risk management and
measure counterparty credit risk more agreements using the shortcut method limit setting. This underlying
difficult to conduct and reliably described below may also use a shorter distribution of future exposures should
interpret than backtesting VaR models time horizon than one year. be used for one year at the bank prior
used to measure market risk. to the bank being approved to use
Recognition of Collateral
55. The pricing models used to internal models for its risk-based capital
calculate counterparty credit risk 59. With the prior written approval of calculation, but not necessarily to
exposure for a given scenario of future its primary Federal supervisor, a bank calculate EPE or Effective EPE.
shocks to market risk factors should be may fully incorporate into its internal 62. Banks should estimate the
tested as part of the model validation model the effect of a collateral probability distribution of future
process. These pricing models may be agreement that requires receipt of exposures out to the longest remaining
different from those used to calculate collateral when exposure to the maturity of any contract with a
VaR over a short horizon. Pricing counterparty increases. Banks may not counterparty, even though Effective EPE
models should account for the capture the effects of agreements that for risk-based capital purposes is
nonlinearity of option value with require receipt of collateral when calculated over one year. The exposures
respect to market risk factors where counterparty credit quality deteriorates. beyond one year must be monitored and
appropriate. A bank may use a shortcut method controlled by the bank.
56. Historical backtesting on where the effective EPE is equal to the 63. The bank should exercise active
representative counterparty portfolios lesser of: management of both existing exposure
should be part of the model validation • The threshold, defined as the and exposure that could change in the
process. The representative portfolio exposure amount at which the future due to market moves. The bank
should be held fixed over the counterparty is required to post should measure, monitor, and control
backtesting interval. A bank should collateral under the collateral the exposure to a counterparty over the
conduct such backtesting on a number agreement, if the threshold is positive, whole life of all contracts in the netting
of representative counterparty portfolios plus an add-on that reflects the potential set, in addition to accurately measuring
(actual or hypothetical) looking back an increase in exposure over the margin and actively monitoring the current
appropriate time period. These period of risk. The add-on is computed exposure to counterparties.
representative portfolios should be as the expected increase in the netting Alternative Models for Counterparty
chosen based on their sensitivity to the set’s exposure beginning from current Credit Risk
material risk factors and correlations to exposure of zero over the margin period
which the firm is exposed. It would of risk. The margin period of risk is 64. Banks that opt to use the internal
appropriate to conduct such backtests defined in the NPR. The minimum models method can choose to model
once each quarter. margin period of risk is 5 business days EAD for some transactions using a
57. Starting at a particular historical for repo-style transactions and 10 model different than an alpha (of 1.4 or
date, the backtest would use the internal business days for other transactions higher) times effective EPE. The bank
model to forecast each portfolio’s when liquid collateral is posted under a must receive approval of its primary
probability distribution of exposure at daily margin maintenance requirement. Federal supervisor in such cases, and
various time horizons. Using historical This period should be extended to cover must demonstrate to its supervisor that
data on movements in market risk any additional time between margin the alternative model is more
factors, the backtest then computes the calls, any potential close out difficulties, conservative than effective EPE
actual exposures that would have and the time to sell out collateral, multiplied by an alpha of 1.4 for each
occurred on each portfolio at each time particularly if it is illiquid; or counterparty. This demonstration is
horizon assuming no change in the • Effective EPE without a collateral necessary to receive initial approval,
portfolio’s composition. These realized agreement. and should be demonstrated to the
exposures would then be compared primary Federal supervisor whenever
with the model’s forecast distribution at Risk Management and Modeling circumstances change. For example,
various time horizons. The above 60. The modeling approval banks may already have a peak exposure
should be repeated for several historical requirements reflect the need for model for some transactions that is more
dates covering a wide range of market accurate and timely estimates of EAD, conservative than effective EPE
conditions (e.g., rising rates, falling secure contractual rights for collateral multiplied by 1.4. Rather than develop
rates, quiet markets, volatile markets). and netting, sound management of an Effective EPE model, the bank may
Significant differences between the counterparty credit risk using choose to continue to use the peak
realized exposures and the model’s appropriate risk measures, exposure model for these transactions
forecast distribution could indicate a consideration of risks that are outside of for a period of time, while adopting an
problem with the model or the models when managing risk, and an effective EPE model for other
underlying data. operational system that facilitates the transactions. The bank would have to
demonstrate that it meets the EAD together should be used to Chapter 10: Risk-Weighted Assets for
qualification requirements to use an determine the distribution of Equity Exposures
internal model for the peak exposure counterparty credit losses. The estimate
Rule Requirements
model and that the model results in a of unexpected losses at a one-year 99.9
conservative EAD. percent confidence level should capture Part III, section 22(g): Equity
65. Cases where a bank might opt to the correlation of a counterparty’s PD exposures model. A bank must obtain
use a more conservative model than with exposure, the effect of the prior written approval of [AGENCY]
alpha times effective EPE include concentrated exposures, the proportion under section 53 [of the NPR] to use the
transactions for which the bank has of a counterparty exposure that is internal models approach for equity
legacy models, new business lines, and accounted for by a market risk factor, exposures.
structured transactions that are not and the correlation of exposures across Part VI: Risk-Weighted Assets for
expected to comprise an ongoing counterparties. Equity Exposures
business and the conservative model is
71. The bank should provide a I. Overview
less computationally intensive.
66. Alternative models for description of the sources of model risk 1. This chapter supplements the
counterparty credit risk should be for the calculation of the numerator. The detailed discussion of equity exposures
applied to all similar transactions. primary Federal supervisor will review in the NPR. It describes supervisory
the models to determine if the internally guidance for determining risk-based
Own Estimates of Alpha estimated alpha is acceptable, if any capital requirements for equity
67. The value of alpha for a bank adjustment to the internally estimated exposures held in the banking book for
using internal models of EPE is 1.4 alpha is necessary, or if the models used banks subject to the Market Risk Rule
unless (i) the primary Federal to estimate alpha need to be adjusted. and for all equity exposures for banks
supervisor raises the value of alpha in 72. If a bank uses a conservative not subject to the Market Risk Rule.
appropriate circumstances based on the
internal model to determine EAD for II. Definition of Banking Book Equities
bank’s specific characteristics of
some transactions, the primary Federal
counterparty credit risk or (ii) the bank 2. Equity exposure means:
supervisor may require the bank to
meets the requirements outlined in the
remove these transactions from both the • A security or instrument (whether
NPR and has supervisory approval to voting or non-voting) that represents a
numerator and denominator for the
use its own estimate of alpha. A bank direct or indirect ownership interest in,
purposes of estimating alpha.
with sufficiently sophisticated models and a residual claim on, the assets and
that can perform the necessary credit Counterparty Credit Risk Mitigation income of a company, unless:
and market risk simulations and that Using Credit Derivatives —The issuing company is
has supervisory approval to do its own consolidated with the bank under
estimate of alpha may use the greater of 73. Under the internal models Generally Accepted Accounting
that estimated alpha or 1.2. method, the reference instrument Principles (‘‘GAAP’’);
68. For banks that receive supervisory underlying a credit derivative that pays —The bank is required to deduct the
approval to model alpha, the bank on the default of a ownership interest from Tier 1 or Tier
counterparty may be entered as a short 2 capital under the NPR;
exposure into a netting set of the —The ownership interest is
counterparty that credit protection is redeemable;
purchased on. The reference instrument —The ownership interest incorporates
Where: underlying the credit derivative should a payment or other similar obligation on
ULCCR = the bank’s own internal estimate of also be entered as a long exposure into the part of the issuing company (such as
the 99.9 percentile unexpected losses
from CCR over a one-year time horizon,
the netting set of the seller of the credit an obligation to pay periodic interest);
and protection. The purchase of a credit or
ULBII = the measure of unexpected losses derivative on a counterparty exposure —The ownership interest is a
from CCR using the Basel II risk-based transfers the risk of the instrument securitization exposure.
capital requirement, but with the EAD referenced in the credit derivative • A security or instrument that is
component of that requirement contract from the counterparty to the mandatorily convertible into a security
calculated using an alpha set equal to seller of the credit derivative. or instrument described in the first
1.0.
74. Banks may apply the PD bullet of this definition;
69. The estimate of alpha is calculated
substitution approach, the LGD • An option or warrant that is
as the ratio of the bank’s internal exercisable for a security or instrument
adjustment approach, or (if applicable)
measure of unexpected losses due to described in the first bullet of this
the double default treatment to a CCR
counterparty credit risk at a one-year definition; or
exposure hedged by an eligible
99.9 percent confidence level • Any other security or instrument
guarantee or eligible credit derivative.
(numerator) to the estimate of losses (other than a securitization exposure) to
using the internal model method in the VII. Defaulted Counterparties the extent the return on the security or
NPR, but with alpha set equal to one instrument is based on the performance
(denominator). This ratio must be run at 75. Operational or settlement errors of a security or instrument described in
least quarterly, and evidence of the do not necessarily trigger a default event the first bullet of this definition.
stability of this estimate over a quarter for PD assignment purposes. However, if
a credit-related charge-off occurs as the III. Applying the Framework
should be presented to the bank’s
primary Federal supervisor. result of a counterparty’s failure to 3. Under the proposed framework for
70. The numerator is determined perform on a financial contract, this equity exposures in the NPR, a bank
considering the PD, EAD, and LGD would constitute a default event for would have the option to use either a
together to determine unexpected risk-based capital purposes and the PDs simple risk-weight approach (‘‘SRWA’’)
losses. A simulation, or other model, for all exposures to that obligor should or an internal models approach (‘‘IMA’’)
EN28FE07.008</GPH>
which considers the variation of PD and be adjusted to the value of one. for equity exposures that are not
exposures to an investment fund. A this framework. The three approaches investment limits for all exposure
bank would use a look-through are: classes within the fund exceeds 100
approach for equity exposures to an • The full look-through approach; percent, the bank must assume that the
investment fund. Under the SRWA, a • The simple modified look-through fund invests to the maximum extent
bank would generally assign a 300 approach; or permitted under its investment limits in
percent risk weight to publicly-traded • The alternative modified look- the exposure class with the highest risk
equity exposures and a 400 percent risk through approach. weight under Table L, and continues to
weight to non-publicly-traded equity 8. There is a risk-weighted asset floor make investments in the order of the
exposures. Certain equity exposures to of 7 percent of the adjusted carrying exposure class with the next highest
sovereigns, multilateral institutions, and value of a bank’s exposure to an risk-weight under Table L until the
public sector enterprises would have a investment fund. A zero percent risk maximum total investment level is
risk weight of 0 percent, 20 percent, or weight can still be applied to a reached. If more than one exposure class
100 percent. Also, community particular exposure class within an applies to an exposure, the bank must
development equity exposures, as well investment fund; the 7 percent floor use the highest applicable risk weight.
as hedged equity exposures that meet applies to an investment fund, not its A bank may exclude derivative
specified conditions are risk weighted at constituents. contracts held by the fund that are used
100 percent. Non-significant equity 9. A bank may use the full look- for hedging, not speculative, purposes
exposures (i.e., exposures that aggregate through approach only if the bank is and do not constitute a material portion
to an amount that is less than or equal able to compute a risk-weighted asset of the fund’s exposures. The overall risk
to 10 percent of the bank’s Tier 1 plus amount for each of the exposures held weight assigned to an equity exposure to
Tier 2 capital) are also risk weighted at by the investment fund (calculated an investment fund under this approach
100 percent. under the proposed rule as if the may not be less than 7 percent.
4. The ‘‘adjusted carrying value’’ of an exposures were held directly by the
bank). Under this approach, a bank IV. Using Internal Models for Equity
equity exposure is:
would set the risk-weighted asset Exposures
• For the on-balance sheet component
of an equity exposure, the bank’s amount of the bank’s equity exposure to S 10–2 If a bank chooses to use an
carrying value of the exposure reduced the investment fund equal to the greater internal model, it must produce reliable
by any unrealized gains on the exposure of: estimates of the potential loss in the
(i) The product of bank’s portfolio from equity holdings
that are reflected in such carrying value (A) the aggregate risk-weighted asset
but excluded from the bank’s Tier 1 and under stress market conditions.
amounts of the exposures held by the 12. To qualify to use the IMA to
Tier 2 capital; and fund as if they were held directly by the
• For the off-balance sheet calculate risk-based capital
bank and requirements for equity exposures, a
component of an equity exposure, the (B) the bank’s proportional ownership
effective notional principal amount of bank must receive prior written
share of the fund; and approval from its primary Federal
the exposure, the size of which is (ii) 7 percent of the adjusted carrying
equivalent to a hypothetical on-balance supervisor. To receive such approval,
value of the bank’s equity exposure to the bank must demonstrate to its
sheet position in the underlying equity the investment fund.
instrument that would evidence the primary Federal supervisor’s
10. Under the simple modified look-
same change in fair value (measured in satisfaction that the bank meets the
through approach, a bank may set the
dollars) for a given small change in the following criteria:
risk-weighted asset amount for its equity • The bank must have a model that:
price of the underlying equity exposure to an investment fund equal to —Assesses the potential decline in
instrument, minus the adjusted carrying the adjusted carrying value of the equity value of its modeled equity exposures;
value of the on-balance sheet exposure multiplied by the highest risk —Is commensurate with the size,
component of the exposure as weight in Table L of the NPR that complexity, and composition of the
calculated in the previous bullet. applies to any exposure the fund is bank’s modeled equity exposures; and
5. Publicly-traded equity exposures permitted to hold under its prospectus, —Adequately captures both general
can be hedged to reduce their risk-based partnership agreement, or similar market risk and idiosyncratic risk.
capital requirement. However, private contract that defines the fund’s • The bank’s model must produce an
equities cannot be hedged to reduce permissible investments. The bank may estimate of potential losses for its
their risk-based capital requirement. exclude derivative contracts that are modeled equity exposures that is no less
S 10–1 Banks must apply the same used for hedging, not speculative than the estimate of potential losses
methodology to like instruments. purposes, and do not constitute a produced by a VaR methodology
6. A bank may apply (i) the SRWA to material portion of the fund’s exposures. employing a 99.0 percent, one-tailed
private equity exposures and the IMA to A bank may not assign an equity confidence interval of the distribution of
public equities, or (ii) the IMA to all exposure to an investment fund to an quarterly returns for a benchmark
equity exposures, or (iii) the SRWA to aggregate risk weight of less than 7 portfolio of equity exposures
all equity exposures. As described percent under this approach. comparable to the bank’s modeled
further in the NPR, the IMA provides for 11. Under the alternative modified equity exposures using a long-term
the application of SRWA risk weights look-through approach, a bank may sample period.
for those equity exposures that would assign the adjusted carrying value of an • The number of risk factors and
qualify for a risk weight between zero equity exposure to an investment fund exposures in the sample and the data
and 100 percent. on a pro rata basis to different risk- period used for quantification in the
7. Equity exposures in investment weight categories in Table L of the NPR bank’s model and benchmarking
funds must use one of three look- according to the investment limits in the exercise must be sufficient to provide
through approaches (where the fund fund’s prospectus, partnership confidence in the accuracy and
holdings are treated as if proportionally agreement, or similar contract that robustness of the bank’s estimates.
held directly by the bank) to determine defines the fund’s permissible • The bank’s model and
risk-based capital requirements under investments. If the sum of the benchmarking process must incorporate
data that are relevant in representing the and robust loss estimates and should techniques should be discussed in
risk profile of the bank’s modeled equity include at least one equity market cycle model documentation.
exposures, and must include data from containing adverse market movements 20. Survivorship bias is a particularly
at least one equity market cycle relevant to the risk profile of the bank’s important issue in cases where banks
containing adverse market movements specific holdings. In the case where the choose to use databases of actual returns
relevant to the risk profile of the bank’s internal model uses a scenario or stress of equity exposures. Internal data on
modeled equity exposures. If the bank’s test methodology, the bank should private equity exposure returns may
model uses a scenario methodology, the demonstrate that the shock employed reflect only those private equity
bank must demonstrate that the model provides a conservative estimate of exposures that have experienced
produces a conservative estimate of potential losses over a relevant long- positive returns and were exited
potential losses on the bank’s modeled term market or business cycle. successfully (i.e., where a true market
equity exposures over a relevant long- 16. In constructing VaR models price has been revealed). In short, the
term market cycle. If the bank employs estimating potential quarterly losses, returns on investments that have
risk factor models, the bank must banks should use quarterly data to the achieved success measure only the
demonstrate through empirical analysis extent practicable. Where estimates winners—as opposed to the entire
the appropriateness of the risk factors based on shorter time periods are population of relevant private equities
used. converted to a quarterly equivalent, the (including those that failed). This
• Daily market prices must be conversion should be made through the imparts an upward bias on the ex-ante
available for all modeled equity use of an analytically appropriate returns expected by banks. Accordingly,
exposures, either direct holdings or method supported by empirical banks that choose to use actual return
proxies. evidence, and should be applied statistics for individual private equity
• The bank must be able to through a well-developed and well- exposures or private equity funds,
demonstrate, using theoretical documented thought process and whether provided by external vendors
arguments and empirical evidence, that analysis. In general, time horizon or internally generated databases,
any proxies used in the modeling conversions should be applied should fully understand how these
process are comparable to the bank’s conservatively and consistently over statistics are computed and, where
modeled equity exposures and that the time. Furthermore, where only limited necessary, should make adjustments to
bank has made appropriate adjustments data are available or where technical account for any selection biases that
for differences. The bank must derive limitations are such that estimates from may be present.
any proxies for its modeled equity any single method will be of uncertain VI. Validation of Internal Models for
exposures and benchmark portfolio quality, banks should add appropriate Equity Exposures
using historical market data that are margins of conservatism.
S 10–3 Banks must validate internal
relevant to the bank’s modeled equity B. External Data models used for equity exposures.
exposures and benchmark portfolio (or, 21. The developmental evidence
where not, must use appropriately 17. It is recognized that there are
significant challenges associated with provided for a VaR model should
adjusted data), and such proxies must include a discussion of the results from
be robust estimates of the risk of the deriving market-based measures of risk
for both privately-held and publicly- a rigorous and comprehensive stress
bank’s modeled equity exposures. testing of the model and estimation
13. No one particular type of model is traded equities where objectively-
determined market prices may not be procedure. This stress test should be
preferred or required. Appropriate applied to volatility computations and
internal models may include either readily available. Accordingly, banks
with significant equity holdings with make use of either hypothetical or
traditional VaR models (e.g., historical historical scenarios that reflect worst-
simulation, variance/covariance, or these characteristics may need to use
external data in modeling the risks case losses given underlying positions.
Monte Carlo simulation) or scenario Stress tests should provide information
analysis ‘‘stress tests.’’ These models are associated with these holdings.
18. Banks should be able to about the effect of tail events beyond the
subject to the validation framework level of confidence assumed in the
demonstrate that the external data
outlined in Chapter 7 of this guidance. internal models approach.
14. The use of either single or multi- adequately capture the risks of the
underlying equity portfolio. 22. For purposes of evaluating the
factor models is permitted, provided capital requirements produced by a
that the factors are sufficient to capture Documentation should identify the
relevant factors (e.g., business lines, bank’s internal model methodology,
all material risks of a bank’s equity banks should demonstrate that non-VaR
holdings. Risk factors should balance sheet characteristics, geographic
location, company age, industry sector based internal models for equity
correspond to the appropriate equity exposures (e.g., a stress scenario
market characteristics (e.g., public, and subsector, operating characteristics)
used in mapping the external data to the analysis) provide risk estimates and
private, large cap, small cap, industry capital requirements that are at least as
sectors) in which the bank holds bank’s individual equity exposures.
conservative as those produced by a 99
significant positions. C. Estimation percent VaR over one quarter for a
V. Quantification of Equity Exposures 19. Banks will have discretion to benchmark portfolio. The benchmark
recognize and estimate empirical portfolio should have sufficient data to
A. Reference Data correlations, provided that the bank’s calculate a one quarter 99 percent VaR.
15. The data used to represent return system for measuring correlations is To demonstrate this, the bank should
distributions or depict stress scenarios sound and empirically supported. When run their internal model on the
should reflect as long a sample period calculating correlations, consideration benchmark portfolio and show that the
for which data are available and should be given to data consistency, internal model produces a capital
meaningful in representing the risk relevant time period, and the volatility amount for the benchmark portfolio that
profile of equity holdings. In the case of of correlations under stressed market is at least as great as the one quarter 99
VaR models, the data used should be conditions. The appropriateness of percent VaR for the benchmark
sufficient to provide statistically reliable correlation assumptions and estimation portfolio. Banks that choose a scenario
analysis ‘‘stress-test’’-type model or Part V: Risk-Weighted Assets for (net interest margin transactions,
some other form of non-VaR-based Securitization Exposures mitigating residual interest exposure).
model do not have to run a VaR model 5. Certain basic risk management
I. Overview practices are also important to the
in parallel, but banks should be able to
compare their internal model to the VaR 1. This chapter supplements the framework’s implementation. The
for the benchmark portfolio. detailed discussion of the framework for central component is a full written
securitization exposures in the NPR. It description, or implementation guide,
23. For VaR models, model validation
describes the concepts, eligibility detailing each step in the process. The
through backtesting must be conducted criteria, and mechanics associated with guide should include all key processes,
on a regular basis. Banks using such applying each of the three allowed such as methods of identifying
models should construct and maintain approaches—the ratings-based approach exposures, selecting approaches,
appropriate databases on the actual (‘‘RBA’’), the internal assessment documenting approvals and data
quarterly performance of their equity approach (‘‘IAA’’), and the supervisory elements, and establishing
exposures, as well as on the estimates formula approach (‘‘SFA’’). It also responsibility for oversight and quality
derived using their internal models. discusses related topics, such as risk control. The remainder of this chapter
Banks should also backtest the volatility transference, implicit support, early expands on how to apply the various
estimates used within their internal amortization provisions, and control approaches, as well as supervisory
models and the appropriateness of any and validation. This guidance applies to guidance regarding eligibility and sound
external data used in the model. Banks a bank regardless of its role in the risk management practices.
will have data available on different securitization—investor or originator.
equity exposures at different II. Scope of Application
S 11–1 Banks must use the
frequencies. For example, price data for securitization framework for any 6. Tranching of credit risk is the
public equities may be available daily, exposures that involve the tranching of structuring of cash flows and credit
and price data for private equities may credit risk (with the exception of a exposure so that an investor’s share of
be available on a monthly or quarterly tranched guarantee that applies only to the credit losses differ from its pro rata
basis. Banks can divide their equity an individual retail exposure). interest in the underlying exposures.
portfolio into several smaller portfolios 2. The securitization framework relies Another characteristic of a
based on data availability and conduct principally on one of two sources of securitization exposure is that payments
backtesting on the smaller portfolios. information, where available: (1) An to the various parties depend on
When sufficient data are available, assessment of the securitization performance of the underlying
banks should employ statistical-based exposure’s external credit risk ratings or exposures, as opposed to an obligation
measures of the accuracy of their VaR (2) the IRB risk-based capital of the entity originating those
models. requirement and expected loss of the exposures.
underlying exposures as if the 7. Examples of securitization
VII. Consistency Between Internal exposures had not been securitized. See exposures include asset-backed
Models Used for Equity Exposures and section 2 of the NPR for the definition securities, mortgage-backed securities
Risk Management Processes of a securitization exposure. (including those issued by Fannie Mae
3. To determine risk-weighted assets and Freddie Mac),24 stripped mortgage-
S 10–4 Internal models used to backed securities, credit enhancements
for securitization exposures, a bank
calculate risk-based capital and liquidity facilities to asset-backed
must: (1) Identify all securitization
requirements for equity exposures must commercial paper (‘‘ABCP’’) programs,
exposures subject to the framework, (2)
be consistent with models used in the collateralized debt obligations (‘‘CDO’’),
assign each exposure to an approach
bank’s risk management processes and loan participation agreements that
according to the specified hierarchy,
management information reporting include a tranching of payments such as
and (3) calculate risk-weighted assets (or
systems. required deductions from capital) last-in and first-out, guarantees and
24. The internal model should be according to the requirements for the credit derivatives that provide tranched
fully integrated into the bank’s risk applicable approach. (i.e., non-proportional) credit protection
management infrastructure. It should, S 11–2 Banks should develop against a pool of credit exposures,
when appropriate, be used to establish written implementation policies and reserve accounts, and other retained
equity price risk limits, to evaluate procedures describing the allowed residual interests.
alternative investments, and to measure approaches, methods of application, 8. Since securitization transactions
and assess equity portfolio performance and designated responsibilities for may be structured in a variety of ways,
(including the risk-adjusted complying with the securitization the economic substance of the
performance). The bank should framework. transaction rather than its legal form
should guide both the designation of
demonstrate the internal model’s role in 4. In addition to the IRB requirements,
exposures and the calculation of risk-
risk management (using investment originating banks should maintain
based capital requirements.
committee minutes, for example). specific securitization policies and
procedures including the appropriate III. General Principles of the
Chapter 11: Securitizations accounting treatment for the Securitization Framework
Rule Requirements securitization exposure (FASB 140, FIN
A. Risk Transference
46R), pooling and servicing agreements
Part III, Section 22(f): Securitization for each securitization exposure (to S 11–3 Securitization transactions
exposures. A bank must obtain the prior assess compliance with risk transference must transfer credit risk to at least one
written approval of [AGENCY] under and recourse requirements, waterfall

section 44 [of the NPR] to use the structure, trigger requirements for early 24 Fannie Mae and Freddie Mac mortgage-backed
pass-through securities are to be treated as

internal assessment approach for amortization structures), and securitization transactions even though the risk of
securitization exposures to ABCP contractual arrangements related to risk the securitized mortgage pool has not been tranched
programs. mitigation of the securitization exposure among investors.
third party to qualify for treatment terms of the transaction. The issuer payment to all other claims on the cash
under the securitization framework. provides such support often to maintain flows from the underlying exposures of
9. Securitization exposures must meet access to funding and/or to protect its the securitization; and
all of the risk transference requirements reputation in the market. Providing • The servicer has no legal obligation
imposed by Generally Accepted implicit support violates the risk to, and does not, make advances to the
Accounting Principles (‘‘GAAP’’) and transference principles inherent in a securitization if the servicer concludes
regulatory requirements. In this regard, securitization transaction and, for risk- that the advances are unlikely to be
banks should continue to use published based capital purposes, requires that the repaid. The advance is made only after
supervisory guidance related to risk bank treat the underlying securitized expected repayment is supported by a
transference, recourse, and other assets as if the securitization transaction credit assessment that is consistent with
activities that constitute implicit had not occurred.26 For example, banks prudent lending standards.
recourse. are considered to have provided 15. If these conditions are not
10. For an exposure to qualify for implicit support when they either: satisfied, a bank that provides a servicer
treatment under the securitization • Sell assets to a securitization trust cash advance facility must determine its
framework, the transaction must meet or other special-purpose entity (SPE) at risk-based capital requirement for the
the requirements outlined in Statement a discount from the price specified in undrawn portion of the facility in the
of Financial Accounting Standards No. the securitization documents (typically same manner as the bank would
140 and must transfer credit risk from par value); determine its risk-based capital
the originator of the underlying • Purchase assets from a requirement for any other undrawn
exposures to at least one third party. In securitization trust or other SPE at an securitization exposure.
synthetic securitizations, credit risk amount greater than fair value; D. Clean-Up Calls
mitigants are often used to transfer the • Exchange performing assets for
credit risk of the underlying exposures, nonperforming assets; or 16. A clean-up call is a contractual
which generally remain on the bank’s • Provide credit enhancements provision that permits a bank to call
balance sheet. In order to exclude the beyond contractual requirements. securitization exposures before their
underlying exposures from risk-based 12. Policies governing securitization stated maturity date. In a traditional
capital requirements, banks must activities should explicitly refer to the securitization, a clean-up call is
comply with the operational issue of implicit support, and include generally accomplished by repurchasing
requirements for recognition of credit criteria for identifying and reporting the remaining securitization exposures
risk mitigants in synthetic instances of implicit support. An once the amount of underlying
securitizations set forth in section 41 of independent risk management or review exposures or outstanding securitization
the NPR. When the transaction does not group should systematically monitor exposures fall below a specified level
qualify for GAAP sales treatment, does securitization transactions to identify and it becomes uneconomical to
not satisfy the risk transference actions that constitute implied support maintain the transaction. In the case of
requirement, contains an ineligible and ensure appropriate regulatory a synthetic securitization, the clean-up
clean-up call, or the bank has tainted capital treatment is applied. call may take the form of a clause that
the transaction by providing implicit extinguishes the credit protection once
support to the transaction,25 the bank C. Servicer Cash Advances the amount of underlying exposures has
must include the underlying exposures 13. The risk-based capital requirement fallen below a specified level. An
in the calculation of risk-based capital for servicer cash advances generally will originating bank may exclude
requirements as if the securitization be calculated using either the RBA or securitized exposures from its risk-
transaction did not occur. For example, SFA. The RBA can be used if the bank weighted assets calculated in
transactions reported as GAAP sales that can assign an inferred rating to the connection with a securitization that
do not transfer credit risk to third servicer cash advance based upon a has a clean-up call only if the clean-up
parties, such as transfers of assets rated subordinated tranche. If the RBA call is an eligible clean-up call as
subject to credit-enhancing is not available, and the bank can defined in the NPR. The following are
representations and warranties, require compute the risk parameter estimates required criteria for an eligible clean-up
the bank to include the underlying for the SFA, the bank can apply the call:
exposures in the calculation of risk- SFA. • The exercise of the clean-up call is
based capital as if the transfer had not 14. A bank is not required to hold solely at the discretion of the servicer;
occurred. risk-based capital against the undrawn • The clean-up call is not structured
portion of an eligible servicer cash to avoid allocating losses to
B. Implicit Support securitization positions held by
advance facility. An eligible servicer
S 11–4 Banks that provide implicit cash advance is a servicer cash advance investors, or otherwise structured to
support to securitization transactions facility in which: provide credit enhancements to the
must hold risk-based capital as if the • The servicer is entitled to full securitization; and
underlying assets had not been reimbursement of advances (except that • The clean-up call is only
securitized, and must deduct from Tier a servicer may be obligated to make exercisable for traditional
1 capital any after-tax gain-on-sale non-reimbursable advances if any such securitizations when 10 percent or less
resulting from the securitization. advance with respect to any underlying of the principal amount of underlying
11. Implicit support is credit support exposure is limited to an insignificant exposures or securitization exposures
provided by a bank in excess of its amount of the outstanding principal are outstanding, or for synthetic
contractual obligation under the original balance of the underlying exposure); securitization transactions, when 10
percent or less of the principal amount
• The servicer’s right to

25 In addition, as discussed in the NPR, if a bank
reimbursement is senior in right of of the original reference portfolio is
provides implicit support to any securitization, the outstanding.
bank’s primary Federal supervisor may require the
bank to hold risk-based capital against the 26 A bank that provides implicit support is also S 11–5 A clean-up call constitutes
underlying exposures of some or all of the bank’s subject to related disclosure requirements in section implicit support if, in exercising the
other securitizations. 42(h) of the NPR. call, the bank provides support in
excess of its contractual obligation to against the overlapping position. supervisory tables based on external or
provide support to the securitization. Instead, the bank may limit its capital inferred ratings. Subject to specific
17. The ultimate determination of requirement for the overlapping conditions, the SFA may be used for
whether the exercise of a clean-up call positions to the single applicable securitization exposures when the IAA
constitutes implicit support depends on treatment that results in the highest or RBA is not available. Securitization
the facts. If the bank affects a clean-up capital requirement. However, if exposures that do not qualify for one of
call on terms that differ from contractual different banks have overlapping these three approaches are deducted
provisions, the following actions will exposures to an ABCP program, each from regulatory capital.
point to a finding of implicit support: bank must hold capital against the 23. Banks must apply the three
• Exercising a clean-up call that entire amount of its exposure. approaches according to the following
serves as the functional equivalent of a 20. When a bank sponsors an ABCP hierarchy:
credit enhancement; or program and is required to consolidate 1. RBA—If the securitization exposure
• Purchasing assets from a trust or the program as a variable interest entity is not required to be deducted and
other SPE at an amount greater than fair under GAAP solely because it qualifies qualifies for the RBA, the bank must
value. as a primary beneficiary, it may exclude apply the RBA.28 In general, an
E. Maximum Capital Requirements for the consolidated ABCP program assets originating bank qualifies to use the
Securitization Exposures from risk-weighted assets. However, the RBA if its retained securitization
decision to exclude the consolidated exposure has at least two external
S 11–6 The maximum risk-based
program from risk-weighted assets does ratings or an inferred rating based on at
capital requirement for all
not exempt the bank from holding risk- least two external ratings, while an
securitization exposures held by a bank
based capital against any exposures to investing bank qualifies to use the RBA
associated with a single securitization
that program in accordance with the if its securitization exposure has one or
transaction is the amount of risk-based
overall securitization framework. more external or inferred ratings.
capital plus expected losses that would
2. IAA or SFA—If a securitization
have been required had the underlying IV. Hierarchy of Approaches
exposure is not required to be deducted,
exposures not been securitized. S 11–7 Banks must follow the
18. Unless one or more of the does not qualify for the RBA, and is an
specified hierarchy of approaches to exposure to an ABCP program, the bank
underlying exposures does not meet the determine risk-weighted asset amounts
definition of a wholesale, retail, may apply either the IAA or the SFA.
for all securitization exposures. However, the bank must consistently
securitization, or equity exposure, the 21. The first step in determining the
total risk-based capital requirement for use either the IAA or the SFA when this
risk-weighted asset amount for a type of exposure would be eligible for
all securitization exposures held by a securitization exposure for either an
single bank associated with a single both approaches.
investing or originating bank is to 3. SFA—If the securitization exposure
securitization—including any risk-based deduct entirely from Tier 1 capital all
capital requirement that relates to an is not required to be deducted, does not
increases in capital due to after tax gain- qualify for the RBA, and is not an
early amortization provision, but on-sale income from the transaction. In
excluding any capital requirements that exposure to an ABCP program, the bank
addition, any CEIOs, including any AIRs may apply the SFA if it is able to
relate to the bank’s gain-on-sale or that meet the definition of a CEIO, must
CEIOs (and any accrued interest calculate, on an ongoing basis, the SFA
be deducted 50 percent from Tier 1 risk parameters.
receivables (‘‘AIR’’) that meet the capital and 50 percent from Tier 2
definition of a CEIO) associated with the 24. When a securitization exposure
capital.27 If the amount deductible from does not qualify for the RBA, IAA, or
securitization—cannot exceed the sum Tier 2 capital exceeds the amount of
of (i) the bank’s total risk-based capital SFA, a bank is required to deduct the
actual Tier 2 capital, the excess must be exposure 50 percent from Tier 1 capital
requirement for the underlying deducted from Tier 1 capital.
exposures as if the bank directly held and 50 percent from Tier 2 capital. If the
22. Next, the bank applies one of the amount deductible from Tier 2 capital
the underlying exposures; and (ii) the three approaches for determining risk-
bank’s total expected credit loss for the exceeds the bank’s actual Tier 2 capital,
weighted assets: The RBA, the IAA, or however, the bank must deduct the
underlying exposures. the SFA. The RBA and the IAA
19. If a bank has multiple shortfall amount from Tier 1 capital.
calculate risk-weighted assets using 25. The following diagram illustrates
securitization exposures to an ABCP
program that provide overlapping the hierarchy for the treatment of a
27 For specific guidance on the treatment of AIRs
coverage of the underlying exposures, securitization exposure for either an
see the Interagency Advisory on the Regulatory
such as when a bank provides a Capital Treatment of Accrued Interest Receivable investing or originating bank:
program-wide credit enhancement and Related to Credit Card Securitizations, dated May
17, 2002, and the Interagency Advisory on the 28 Regardless of any other provision, the risk
multiple pool-specific liquidity Accounting Treatment of Accrued Interest weight for a non-credit enhancing interest-only
facilities, the bank is not required to Receivable Related to Credit Card Securitizations, residential mortgage backed security (e.g., FNMA IO
hold duplicative risk-based capital dated December 4, 2002. Strip), may not be less than 100 percent.
V. IRB Approaches for Securitization 28. A rating may be inferred if the S 11–9 The securitization
Exposures subject securitization exposure is senior transaction must have an external
A. Ratings-Based Approach to another securitization exposure in the rating assigned by an NRSRO that fully
transaction (that is backed by the same reflects the credit risk associated with
26. Banks may use the RBA to underlying obligations and is issued by timely repayment of principal and
determine the appropriate risk weight the same issuer) that has an external interest.
for a securitization exposure if the rating from an NRSRO. The applicable
exposure is externally rated, or for a 29. When a securitization exposure is
rating to be applied for an inferred structured, the originating bank can
non-rated exposure for which a rating
rating is the current rating of the elect to have the securitization
can be inferred. The appropriate risk
subordinate rated tranche. Inferred transaction placed in the NRSRO’s
weight is multiplied by the
securitization exposure amount to arrive ratings should be updated at least monitoring/surveillance program that
at the appropriate risk-weighted asset annually, or more frequently when requires a periodic review of the
amount. warranted, so that any changes in the financial performance of the underlying
S 11–8 In order to use the RBA, the external rating or characteristics of the exposures. By placing the securitization
securitization exposure must be rated exposure are reflected in a timely exposure in the NRSRO monitoring
externally rated by an NRSRO, or be manner. An inferred rating cannot be program, the integrity of the credit
eligible for an inferred rating. derived from a proxy securitization rating is maintained for the life of the
27. For a bank to utilize the RBA, the exposure (e.g., a similarly structured but securitization exposure, and thereby
securitization exposure must be rated by separate securitization exposure). ensures that the credit rating fully
EN28FE07.009</GPH>
an NRSRO as defined in the NPR. reflects the entire amount of credit risk
with regard to all payments owed to the provisions in the indenture, would be NRSRO, as well as validate the mapping
holder of the exposure. Securitization treated as the senior position. In a process to ensure its integrity and
exposures receiving a rating only at synthetic securitization, a super-senior accuracy, and (c) document the criteria
origination are not eligible for the RBA. tranche would be treated as the senior used to arrive at the ICA rating. See
The external rating must take into tranche. Eligible servicer cash advances section 44(a)(1) of the NPR for a
account and reflect the entire amount of are not considered in the seniority complete list of the criteria a bank’s ICA
credit risk exposure the bank has with assignment for the RBA. process must meet in order for the bank
regard to all payments owed to it. If the 34. Pool granularity refers to the to obtain approval from its supervisor to
bank is owed both principal and number of different underlying use the IAA.
interest, the rating must fully reflect the exposures. The RBA considers the 38. After assigning an internal rating
credit risk associated with timely impact of pool granularity on credit risk based on the appropriate ICA
repayment of both. With certain by assigning higher risk-weight framework, the bank calculates risk-
securitization exposures, such as percentages to non-granular pools. weighted assets by applying the
combination bonds, which generally are Securitizations of retail exposures applicable risk weights from the RBA
combinations of a subordinated, unrated contain a significant number of tables to the amounts of the ABCP
securitization exposure and a highly underlying exposures and will be program exposures. Consistent with the
rated principal-only strip, the principal considered granular for risk-weighting RBA, the applicable risk-weight
component of the bond often receives a purposes. assignment requires three additional
higher rating than the interest inputs—the seniority of the exposure,
component. A rating structure such as B. Internal Assessment Approach an assessment of pool granularity, and
this does not qualify as a full credit Overview whether the ICA is a long- or short-term
exposure rating, and therefore the RBA rating. Pool granularity is based on the
35. A bank’s exposures to ABCP number of underlying exposures, with
is not available. In the event that a
conduit programs (i.e., liquidity exposures to a single obligor aggregated.
rating does not capture the full credit
facilities and credit enhancements) are ABCP liquidity facilities would be
exposure, the bank may use the SFA if
considered securitization exposures for considered senior exposures provided
applicable, or deduct.
30. When a bank has used the RBA (or which the bank must hold risk-based they meet the definition of a senior
IAA) to calculate its risk-based capital capital. Where ABCP exposures qualify securitization exposure in the NPR.
requirement for a securitization for the RBA approach, the RBA must be 39. For example, the ICA for a $10
exposure whose external or inferred used to calculate risk-weighted assets. million (maximum contractual value)
rating (or IAA rating) reflects the credit However, exposures such as ABCP liquidity facility has an ICA that is
enhancement of a credit risk mitigation liquidity facilities and credit equivalent to a long-term external rating
(‘‘CRM’’) technique, a bank may not enhancements are generally unrated. of ‘‘AA.’’ Using the RBA tables, a risk
obtain additional risk-based capital Subject to qualification standards, a weight of 8 percent is applicable,
recognition of the CRM technique bank may use either the IAA or the SFA; resulting in risk-weighted assets of
through the securitization CRM rules in however, one approach must be used $800,000 provided (1) the position is
section 46 of the NPR. consistently for all the bank’s exposures senior exposure, (2) the pool is granular,
31. When a credit risk mitigant is not to ABCP programs. and (3) there is a long-term rating (e.g.,
obtained by the SPE but rather is 36. To qualify for the use of the IAA, ‘‘AA’’). If it is determined that the pool
obtained by a bank separately to protect a bank must at a minimum demonstrate is non-granular, the risk weight is 25
itself against losses on a specific that its ABCP program meets specific percent, or risk-weighted assets of $2.5
securitization exposure (e.g., ABS operational requirements set forth in the million.
tranche), the bank may use the NPR. A bank may apply the IAA to 40. The IAA’s reliance on an NRSRO’s
applicable securitization CRM treatment exposures related to ABCP programs rating methodology and ratings criteria
to recognize the hedge as outlined in and to exposures to programs that are for the applicable asset class does not
section 46 of the NPR. similarly structured, which could reduce the level of analysis, review, and
S 11–10 Banks should document the include structured investment vehicles, due diligence that the bank should
factors that support their use of the tender option bonds, and variable note conduct as part of the initial purchase
RBA. programs, as long as they meet the decision, and regularly thereafter.
32. Factors the bank should document NPR’s definition of an ABCP program. 41. The systems and processes used
include the identification of the The bank must demonstrate that it has by the bank for risk-based capital
NRSROs, type of underlying exposures met the qualification standards for each purposes must be consistent with the
(e.g., wholesale, retail), seniority of the asset class for which it has exposure. bank’s internal risk management
securitization exposure, pool 37. The IAA requires a bank to use an processes and management information
granularity, and placement of reference internal credit assessment (‘‘ICA’’) reporting systems. For example, the
tranches in the waterfall for inferred framework that maps or corresponds conduit’s ICA ratings process should be
ratings. directly to NRSRO rating criteria for a linked to the required seller-provided
33. Senior securitization exposures similar asset class. For example, if the credit enhancement levels,
supported by granular pools receive pool of assets consists of credit card establishment of transaction dynamic
special treatment under the RBA. Only receivables, the bank’s credit assessment trigger levels, tracking of individual
one tranche may be considered ‘‘senior’’ for a liquidity facility or credit obligor exposure levels, and
for each transaction. In a traditional enhancement extended to the pool establishment of concentration levels.
securitization where all tranches above should be based on the NRSRO’s rating Also, the risk management systems
the first-loss piece are rated, the most criteria for credit card receivables. In should capture the market (interest rate
highly rated position would be treated order to use the IAA, the bank’s ICA mismatch), liquidity (commercial paper
as the senior tranche. However, when process should at a minimum (a) maturity laddering, extendable funding
several tranches share the same rating, identify reliable historical loss rates on products) and operational (integration of
only the most senior tranche in the cash the underlying exposures, (b) map servicer and investor reporting) risks
waterfall, according to security internal ratings to specific ratings of the associated with the conduit activities.
VI. Internal Credit Assessment Process specific external rating. The bank defined underwriting standards for
in the IAA should be able to demonstrate that the purchased assets; the minimum
S 11–11 Banks’ internal credit pool’s loss estimate is empirically requirements for a seller’s credit quality;
assessment processes should be based, credible, and predictive of limits on transaction size; limits on
comprehensive, transparent, expected losses. Historical and current concentrations for obligors, asset types,
independent, well-defined, and fully information on delinquencies, charge- or geographic exposure; required
documented. offs, recoveries, dilution,29 and obligor structural features; procedures for
42. The ICA process should address and geographic concentrations should monitoring and reporting pool
the full range of activities, including be maintained to support these performance; and required levels of
pre-purchase analysis of the proposed estimates. liquidity and credit support.
46. The time horizon for historical
transaction, verification of the seller’s 51. The bank should maintain a
losses should be consistent with the
representation of the assets’ risk transaction summary to support each
number of years used in the NRSRO’s
characteristics, the assignment of ABCP program exposure. The summary
external rating criteria. For instance,
internal credit assessments, and on- should include the following: The
with respect to the performance of a
going validation to ensure the integrity structure of the pool transaction; the
pool that is comprised of trade
of the process and rating accuracy. type and details of the bank’s support
receivables, the program administrator
43. The bank must have an effective for the program or pool; a profile of the
should use at least three years of loss
system of controls and oversight that seller (asset originator); the criteria used
data when determining the required
ensures compliance with these to determine the eligibility of assets; the
level of credit enhancement.
operational requirements and maintains 47. When adjustments are made to an risk characteristics of the purchased
the integrity and accuracy of the internal credit assessment that are based assets (e.g., credit quality and tenor);
internal credit assessments. The bank on factors not included in the NRSRO’s dilution risk; statistics on the historical
must have an internal audit function rating criteria, written rationale and performance of the underlying assets
independent from the ABCP program support should be available. In addition, and other similar asset pools; and
business line and internal credit the bank should be able to provide termination events.30
assessment process that assesses at least evidence that the adjustments were
annually whether the controls over the 52. When the liquidity facility and
subject to an appropriate approval
internal credit assessment process process. either transaction specific or program-
function as intended. 48. When reviewing the seller’s risk wide credit enhancement overlap, banks
44. Banks should be able to profile, the sponsoring bank (or program are required to hold capital only once
demonstrate that these assessments administrator) should analyze both the for any overlap. However, banks must
accurately capture and quantify the risk credit risks of the underlying assets and allocate the program-wide credit
inherent in these exposures. To the seller’s risk profile. The transaction enhancement overlap across pools that
facilitate transparency, banks should summary provided by the seller should results in the highest risk-based capital
have (1) approved policies and include information on the default risk requirement. For example, assume an
procedures, (2) a written and detailed of the underlying assets, including ABCP program is made up of a pool of
summary of the processes, including the historical loss characteristics, credit card receivables, a pool of loan
roles and responsibilities of relevant concentrations, delinquencies, and receivables, and a pool of trade
parties, and (3) management payment history. In addition, the bank receivables. The bank has issued
information reports on items such as should assess the quality of the seller’s liquidity facilities for $400,000 for each
pool status, usage of liquidity and/or underwriting practices as an indicator of pool and a $120,000 program-wide
credit enhancement facilities, and other the future performance of the credit enhancement facility. The
risk management issues (e.g. level of underlying assets. liquidity facilities for the credit card
losses relative to seller-provided credit 49. The assessment of the seller’s risk and loan pools are internally-rated as
protection or proximity to termination profile should include past and ‘‘AAA,’’ with the trade receivables’ pool
events). expected financial performance and rated as ‘‘A+.’’ The credit enhancement
45. The bank should clearly document condition (e.g., leverage, cash flow, and is rated ‘‘A.’’ The appropriate risk-based
its processes for determining the interest coverage), the seller’s current capital charge for the liquidity facility
required level of seller-provided credit market position, expected future and credit enhancement is detailed in
enhancement, including the level of competitiveness, and debt rating. the table below.
historical losses and the NRSRO’s stress 50. Credit and investment policies
factor used to establish equivalency to a should include the following: Well- Pool Summary
Purchase Pool LF LF Internal NRSRO

Conduit funding authorization balance coverage tenor credit ass. equivalent
Credit Card ......................................................... $400,000 $0 $400,000 366 day ..... 2 ‘‘AAA’’

Account Rec. ...................................................... 400,000 250,000 400,000 366 day ..... 2 ‘‘AAA’’
Trade Rec. ......................................................... 400,000 300,000 400,000 366 day ..... 3 ‘‘A+’’
29 Dilution is the reduction of the asset receivable the seller-provided credit enhancement for the pool downgrade of the seller’s credit rating below a
due to customer returns of sold goods, warranty of assets sold to the conduit. certain rating grade, or the deterioration of the asset
30 Termination events, also referred to as

claims, disputes between the seller and its pool to the point where charge-offs, delinquencies,
customers, and other factors. Sellers are generally ‘‘dynamic’’ or wind-down triggers, are used to or dilution reaches predetermined levels. Program-
required to establish a reserve to cover a multiple mitigate the occurrence of losses due to a wide triggers include the conduit’s failure to repay
deteriorating asset pool or an event that may hinder
of historical dilution. The adequacy of the dilution maturing commercial paper or draws on the
the conduit’s ability to repay maturing commercial
reserve is reviewed at the inception of the paper. Pool-specific triggers include the insolvency program-wide credit enhancement that exceed a
transaction and may or may not be incorporated in or bankruptcy of the seller/servicer of assets, a certain amount.

Total ............................................................ 1,200,000 550,000 1,200,000

Credit Enhancement .......................................... 120,000 .................... .................... ................... 4 ‘‘A’’
Overlap and Risk-Weighted Assets
LF exposure CE exposure
amount net of amount net of
LF RWA CE RWA Total RWA
overlap adjust- overlap adjust-
ment ment
Credit Card ............................................. $0 $0 $120,000 $24,000 $24,000

Account Rec. ......................................... * 250,000 ** 17,500 0 0 17,500
Trade Rec. ............................................. 300,000 30,000 0 0 30,000
Total Risk-Weighted Assets ........... $47,500 $24,000 $71,500

* $250,000 ¥ 0 = $250,000.
** (LF ¥ CE Overlap) × RWA% for respective NRSRO equivalent rating ($250,000 × 7% = $17,500).
53. Using the same underlying is transaction specific, allocated at ‘‘A.’’ The appropriate risk-based capital
exposures as in the above example, the $40,000 per transaction. The liquidity charge for the liquidity facility and
bank has issued liquidity facilities for facilities for the credit card and loan credit enhancement is detailed in the
$400,000 for each pool and a $120,000 pools are internally-rated as ‘‘AAA,’’ table below.
credit enhancement facility. However, with the trade receivables’’ pool rated as
the credit enhancement in this example ‘‘A+.’’ The credit enhancement is rated Pool Summary

Credit Card ......................................................... $400,000 $0 $400,000 366 day ..... 2 ‘‘AAA’’

Account Rec. ...................................................... 400,000 250,000 400,000 366 day ..... 2 ‘‘AAA’’
Trade Rec. ......................................................... 400,000 300,000 400,000 366 day ..... 3 ‘‘A+’’
Total ............................................................ 1,200,000 550,000 1,200,000

Credit Enhancement .......................................... 120,000 .............. 4 ‘‘A’’
Overlap and Risk-Weighted Assets
LF exposure CE exposure
amount net of LF RWA amount of overlap CE RWA Total RWA
overlap adjust- adjustment
ment
Credit Card ............................................. $0 $0 $40,000 $8,000 $8,000

Account Rec. ......................................... * 210,000 ** 14,700 40,000 *** 8,000 22,700
Trade Rec. ............................................. 260,000 26,000 40,000 8,000 34,000
Total Risk-Weighted Assets ........... $40,700 $24,000 $64,700

* $250,000 ¥ 40,000 = $210,000.
** (LF ¥ CE Overlap) × RWA% for respective NRSRO equivalent rating ($210,000 × 7% = $14,700).
*** CE × RWA% for respective NRSRO equivalent rating ($40,000 × 20% = $8,000).
S 11–12 Banks should analyze the performance, and other criteria such as internal credit assessments are
servicer’s capabilities and document a publicly available NRSRO servicer appropriately aligned to external ratings
the analysis in the internal assessment. rating report. and reflect the NRSRO’s rating criteria.
54. The analysis should consider the VII. Validation of IAA 56. The robustness of the validation
servicer’s data systems, data capabilities process should be consistent with the
(or consider the capabilities of the S 11–13 The bank must validate its
complexity and volume of the bank’s
servicer’s data systems), excess capacity, ICA process on an ongoing basis and at
activities. Validation should consider
collections processes, reliance on least annually the ICA process and
the relevance and appropriateness of the
vendors or other service bureaus, and results must be subject to the full range
of the bank’s IRB validation activities. NRSRO rating methodologies to the

backup servicing arrangements. A
purchased assets, the integrity of the
separate rating for the servicer may also 55. The bank should review the
mapping process and its application to
be assigned, and should consider the relationship between the credit
servicer’s financial position, operating assessment process and the NRSRO’s the bank’s ABCP program exposures,
capabilities, historical pool current rating criteria to ensure that and the quality of the bank’s risk
management and internal controls in calculation relies, in large part, on the • ABCP credit enhancements and
this business line. risk-based capital requirement that liquidity facilities for which the bank
57. Developmental evidence is would be assessed had the exposures has not received approval to use the
particularly relevant to the IAA. A bank underlying the securitization not been IAA, or chooses for any reason not to
should be able to provide evidence to securitized. The SFA relies on this use it.
support the integrity of its ICA process. calculation as its starting point since The above is intended to provide
Written documentation should include, securitizing a pool of exposures does examples of securitization exposures
but is not limited to: (1) How the not change the overall amount of credit that would be subject to the SFA;
process is consistent with the NRSRO’s risk, but merely changes how credit risk however, there are likely additional
rating criteria to which the bank is is distributed to the holders of the securitization exposures that could be
mapping assessments, (2) the process for securitization exposures. Regulatory evaluated with the SFA. As the
verifying the seller’s estimates of overrides, based on supervisory securitization market evolves,
historical loss for the purchased assets, judgment, have been added to this pure additional structures may emerge that
and (3) the methodology used to assess model-based assessment of credit risk to will be subject to the SFA.
the risk characteristics of the asset ensure that (1) a minimum regulatory
seller, the servicer, and program Implementation of the SFA
capital requirement is assessed on all
administrator (when not the bank). The securitization exposures, (2) tranches 63. Banks are required to provide
bank should be able to support that its with insufficient credit enhancement seven inputs when implementing the
process is complete and that its ICAs are are assessed a dollar-for-dollar capital SFA. These inputs include:
accurate based on their design and requirement, and (3) model • The amount of underlying
implementation. discontinuities are minimized. exposures (UE);
58. Process verification should focus • The sum of the IRB capital
on whether the policies and procedures Common Unrated Securitization requirement and expected loss on the
are sufficiently detailed to support Exposures Subject to the SFA underlying exposures, divided by UE
transparency and replication of the 61. The SFA provides banks a means (KIRB);
assessments, as well as the extent to of calculating risk-based capital • The effective number of underlying
which the process operates as designed. requirements for unrated securitization exposures (N);
The process review should include (1) exposures. The SFA allows for a more • The exposure-weighted average loss
quantifying risk across the spectrum of risk sensitive capital requirement for given default of the underlying
the bank’s exposures, and (2) evaluating higher quality, unrated securitization exposures (EWALGD);
the completeness, accuracy, and positions that lie above the KIRB • The percentage of the tranche of
applicability of the data that supports boundary, provided the bank has access interest the bank owns (TP);
the securitization framework. to the information necessary to • The thickness of the tranche of
59. The bank should perform parameterize the SFA. Regardless of the interest (T) in relation to UE; and
backtesting or outcomes analysis on the • The credit enhancement level for
information the bank has on the
ICA ratings. This should also include the tranche of interest (L).
underlying securitized exposures and
tracking the financial performance of 64. To use the SFA the bank must
the securitization structure, CEIOs,
the underlying exposures including the have these inputs to calculate the
including any AIRs that meet the
ICA rating for the securitization capital requirement on the underlying
definition of a CEIO, will remain subject
exposure. At a minimum, the review exposures. The first four inputs (UE, N,
to deduction.
process should be performed annually, EWALGD, and KIRB) require the bank to
62. Banks could use the SFA to
or more frequently when there are have a detailed knowledge of the
determine risk-based capital
significant changes in the NRSRO’s characteristics of the underlying
requirements for the following common
rating criteria or the performance of the securitized exposures. The remaining
unrated securitization exposures:
underlying assets warrants an • Unrated credit enhancements, three inputs (TP, T and L) require
adjustment to the bank’s internal including cash collateral, and spread detailed knowledge of the structural
assessment. Performance analysis accounts; features of the securitization.
should cover not only the level of excess • Unrated CDO equity tranches; 65. Since the calculation of KIRB
spread, but also trends and volatility in • Other unrated retained or requires detailed knowledge of the
excess spread components such as purchased subordinated securities from underlying exposures, the SFA may be
interest and fee revenues, bond traditional or synthetic securitizations; difficult for an investor in an unrated
coupons, payment rates, loss rates, and • Loans sold or serviced with securitization exposure to implement.
other variable components affecting recourse when the risk retained is of a For example, if a bank provides credit
securitization performance. different priority than the risk enhancement to wholesale exposures
transferred; originated and securitized by another
A. Supervisory Formula Approach • Loan participations and party, the bank as credit enhancer may
Overview syndications when there is other than a not have access to the data to accurately
pro-rata form of distribution; derive the inputs necessary (e.g., and
60. The SFA may be available to
• Unrated securitization exposures PD, LGD, M and EAD) to calculate KIRB.
determine the risk-based capital In this situation, the bank as credit
resulting from a bank’s participation in
requirement for unrated securitization enhancer would not be able to use the
the FHLB Mortgage Partnership Finance
exposures when an external rating is not SFA to compute regulatory capital
Program or Mortgage Purchase Program;
available or cannot be inferred, or when
• Unrated exposures resulting from requirements on the unrated
the bank chooses not to use, or does not securitization exposure, and would be
pool-level mortgage insurance programs;
qualify to use, the IAA.31 The SFA • Senior synthetic securitization required to deduct the exposure from
31 The exposure may be related to a conduit
exposures when a rating cannot be regulatory capital.
program, but the bank does not meet the operational inferred; 66. Banks must also be prepared to
standards to use the IAA. Under this scenario, • MBS/ABS retained by the originator update the SFA inputs quarterly.
banks may use the SFA. with less than two external ratings; and Because the output of the SFA is
predicated upon KIRB, any changes in exposure without the specific provision. Calculation of N and EWALGD
the quality of the underlying exposures In this situation, the valuation
will result in a change in the SFA allowance can be used to reduce the 70. Although the SFA can be used for
capital requirement. For example, amount of deduction from capital a pool containing only one asset, the
deterioration in the collateral values of associated with the securitization SFA generally yields higher risk-based
the underlying exposures would likely exposure. A detailed application of this capital requirements for highly
result in increased values for EWALGD treatment appears in Example 2 of this concentrated, non-granular pools.
and KIRB, which would generate a chapter’s Appendix A. Therefore, the effective number of
higher SFA capital requirement for each exposures (N) weights each exposure by
Calculation of UE its size to account for the higher risk in
securitization tranche. Additionally, the
prepayment of smaller exposures in a 69. The amount of underlying more highly concentrated, non-granular
pool may lead to a more concentrated, exposures (UE) is the EAD of any pools. When calculating N, multiple
riskier pool as N decreases. underlying wholesale and retail exposures to the same borrower are
exposures (including the amount of any considered a single exposure. A sample
Calculation of KIRB funded spread accounts, cash collateral calculation of N is included in
67. KIRB represents the ratio of (i) the accounts, and other similar funded Appendix A.
IRB capital requirement plus the credit enhancements) plus the amount 71. The exposure-weighted average
expected credit losses of the underlying of any underlying exposures that are loss given default (EWALGD) is the LGD
exposures had they not been securitized securitization exposures plus the of each exposure weighted by the size
to (ii) UE, which is discussed below. All adjusted carrying value of any of each exposure. The weighting process
underlying exposures should be underlying equity exposures. For is designed to give the LGD of larger
included in the calculation of KIRB, purposes of the SFA, the amount of an exposures more weight in determining
including assets in reserve accounts. on-balance sheet securitization exposure the EWALGD of the overall pool. A
The counterparty credit risk charge is: (i) The bank’s carrying value, if the sample calculation of exposure-
associated with derivative instruments exposure is held-to-maturity or for weighted EWALGD is also included in
should also be reflected in the trading; or (ii) the bank’s carrying value Appendix A.
numerator of KIRB, while the EAD of minus any unrealized gains and plus
derivatives should be reflected in the any unrealized losses on the exposure, 72. For retail securitizations, banks
denominator. The calculation of KIRB if the exposure is available-for-sale. The are not required to calculate N and
should also reflect the effects of any amount of an off-balance sheet EWALGD. The two SFA variables— h
credit risk mitigant that is applied on securitization exposure is the notional and v —requiring N and EWALGD as
the underlying exposures that benefits amount of the exposure. For a inputs, are reduced to 0 for
all the securitization exposures. CEIOs, commitment, such as a liquidity facility securitizations where all underlying
including any AIRs that meet the extended to an ABCP program, the exposures are retail exposures.
definition of a CEIO, should not be notional amount may be reduced to the 73. A simplified method of
included in the calculation of KIRB. maximum potential amount that the calculating N and EWALGD is also
68. When banks have established a bank currently would contractually be available for securitizations as long as
valuation allowance other than an ALLL required to fund. For an OTC derivative the size of the largest exposure is known
or liability reserve on an underlying contract that is not a credit derivative, with certainty and is no larger than 3
exposure, both the numerator and the notional amount is the EAD of the percent of the entire pool. In this case,
denominator of KIRB should be derivative contract as calculated in banks may set EWALGD = 50% and N
calculated using the gross amount of the section 32 of the NPR. can be calculated as:
Where: and that tranche’s thickness (T)— loss severity in the underlying
• C1 is the largest exposure in the pool; require the bank to understand the exposures may reduce L and T.
• Cm is the share of the pool composed by securitization’s structure and loss Additionally, a bank’s decision to
the ‘‘m’’ largest underlying exposures; prioritization. Banks should document mitigate its exposure through a partial
and sale of a particular tranche will reduce
the amount of the tranche they own
• ‘‘m’’ is selected by the bank. TP.
relative to the outstanding issuance of
Alternatively, if only C1 is available the tranche in order to accurately
and is no more than .03, a bank may set Calculation of T, L, and TP
calculate TP. Additionally, banks
EWALGD at 50% and N at 1/C1. When 76. T is the ratio of the amount of the
should document their understanding of
determining N and EWALGD for a tranche of interest to UE. L is the sum
the securitization’s structure and loss
particular non-retail securitization, of (i) T to (ii) UE, for all tranches
prioritization in order to accurately
banks should document which subordinate to the tranche of interest.
calculate L and T. The current outstanding principal
methodology for calculating N and
EWALGD is applied. 75. Banks must also update their balance or notional amount of the
74. The remaining three required calculations of TP, L and T on an tranche of interest should be used when
inputs necessary to implement the ongoing basis. For example, payments to calculating T. TP is the ratio of the
SFA—the percentage of the tranche of senior tranches in a particular structure amount of the bank’s securitization
interest the bank owns (TP), that may result in increases in L for junior exposure to the amount of the tranche
EN28FE07.010</GPH>
tranche’s credit enhancement level (L), tranche holders. Increasing defaults or that contains the securitization
exposure. L should be measured entirely of rated securitization interests, of the credit risk that is being absorbed
without any consideration of the effects the bank first would sum the exposure by the pool insurance, and detail how
of tranche-specific credit enhancement amounts associated with these rated cash proceeds from the pool insurance
(e.g., third party guarantees or collateral securitization interests to obtain UE. are applied within the waterfall
that benefit only the tranche of interest). Next, the bank would use the RBA to structure to effect a reduction in credit
77. UE must equal the sum of the determine KIRB for these rated risk.
individual thickness levels of each securitization interests, applying dollar- 84. For securitization exposures
tranche. Therefore, credit enhancement for-dollar capital to those exposures where the underlying exposures benefit
based upon future cash flows, such as rated below BB¥. Since the RBA risk from guarantees such as pool level
excess spread, CEIOs, non-credit weights include expected losses, no mortgage insurance, the bank may be
enhancing IOs, or the subordination of additional adjustment to KIRB for able to utilize the synthetic
fees in the cash flow waterfall, should expected losses is necessary. After securitization rules to calculate the
be excluded for purposes of calculating determining KIRB, the bank calculates benefit of the guarantee. The bank
L and T. Both L and T should include the effective number of exposures based should ensure that securitizations for
only funded reserve and spread upon the relative size of the underlying which the SFA or synthetic
accounts. Derivatives embedded in securitization tranches included in the securitization is applied have
securitization structures should be re-securitization pool, without ‘‘looking reasonably strict contractual loss
measured based only upon current through’’ to the exposures underlying prioritization rules embedded into the
mark-to-market value, if positive, the securitized tranches. Next, the bank deal. The following example outlines
without regard to potential future would assume that EWALGD equals 100 the process for calculating the capital
exposure. percent. At this point, the bank would requirement for a securitization that
78. Cash advances made by a servicer have sufficient information on the contains a pool level credit risk mitigant
to an SPE to cover delinquent or late underlying exposures to apply the SFA with a stop loss level:
payments on the underlying exposures to the unrated re-securitization tranche Example
should be included in the calculation of of interest. Pool level insurance covers the first
L and T. When a servicer makes a cash $8 of loss on a $100 retail mortgage loan
advance to an SPE, it puts money into Pool Level Mortgage Insurance
pool.
the SPE in order to pay down investor 82. Certain transactions may
tranches; the pay-down of investor incorporate pool insurance as a form of Step Process
tranches does not bring any credit enhancement for a pool of 1. Calculate the risk-based capital
corresponding reduction in the mortgage loans. Pool insurance can take requirement for the underlying
principal balance of the underlying various forms but generally provides exposures according to the retail IRB
exposures. Therefore, in order for the insurance coverage for the pool of loans rules: EL estimation, retail
sum of the tranches to equal UE, up to a maximum amount (a ‘‘stop loss’’ segmentation, PD and LGD estimation,
servicer cash advances should be level) and can include loss coverage for and the retail risk-weight function;
considered in the calculation of L and each loan within the pool. The extent of 2. Use the risk-based capital
T. Servicer cash advances that are not coverage is negotiable and may result in requirement from step 1 to determine
considered credit enhancing can be 100 percent loss coverage on defaulted KIRB and then use the SFA to calculate
assumed to be the most senior loans, or modified pool insurance that the risk-based capital requirement on
securitization exposure in a results in lower or variable levels of the $92 senior position (where the $8
securitization, with L calculated coverage on defaulted loans using loan- first loss coverage of the insurance is
accordingly. For servicer cash advances to-value limits, for example. treated as a junior tranche);
that are in any way credit enhancing, 83. The credit risk mitigation benefits 3. Calculate the risk-based capital
the calculation of L should reflect the of pool insurance may be recognized in requirement on the $8 position as if it
advance’s degree of subordination. determining the appropriate risk-based were a direct exposure to the insurer
79. Refer to this chapter’s Appendix A capital requirement. Pool insurance that using the guarantor’s PD, the bank’s
‘‘Description of the Supervisory covers all or a pro rata share of all losses estimate of the guarantor’s ELGD and
Formula Approach (SFA),’’ for further in a pool is recognized in the retail LGD, and the corporate risk-weight
details. segmentation process (see Chapter 4, S function. The PD of the guarantor is
4–4 and accompanying text). Pool subject to the 3 basis point wholesale
Special Considerations for insurance that incorporates a tranching floor; and
Re-securitizations of credit risk is addressed in the 4. The total risk-weight capital
80. Re-securitizations, such as CDO- securitization framework. In requirement is the sum of the capital
squared, represent a new securitization circumstances where a securitization requirements in steps 2 and 3.
in which the underlying exposures are structure with external credit ratings
themselves securitization interests and benefits from pool level insurance, such Loss Prioritization
present a unique challenge in the ratings incorporate the effects of credit S 11–14 Banks should document the
calculation of UE, N, EWALGD and risk mitigation and would, under the securitization structure and loss
KIRB. As a general rule, banks holding securitization framework (RBA), provide prioritization.
securitization exposures in re- a method for the assessment of the 85. A bank may use the SFA only if
securitizations should not ‘‘look appropriate capital requirement. For it can calculate each of the SFA input
through’’ to the exposures underlying unrated securitization transactions, the parameters on an ongoing basis. For the
the securitized securitization tranches credit risk mitigation effect of the pool purpose of calculating L, the credit
when calculating UE, N, EWALGD and insurance would need to be assessed enhancement level for the tranche of
KIRB and must set EWALGD equal to under the SFA framework. The pool interest, this requirement implies that
100 percent for re-securitizations. insurance and its application to the pool bank must be able to calculate how the
81. For example, if a bank holds an assets should be fully documented. pool’s credit losses will be allocated
unrated securitization exposure in Specifically, the documentation should among the deal’s various tranches not
which the underlying exposures consist describe and support the quantification only at the deal’s inception, but over
time. Otherwise, the SFA may not be Total risk-based capital requirements for IX. Data Management Requirements
used. securitization transactions subject to the
86. For some transactions, the A. Data Elements
early amortization capital requirement
allocation of credit losses among continue to be limited by the maximum S 11–15 Banks should retain the
tranches may depend on certain capital requirement discussed earlier. specific data elements necessary to
contingencies, such as the specific Policies should also address the use of calculate the appropriate securitization
timing of credit losses over the life of early amortization clauses, including risk-based capital requirement.
the deal, the possibility that realistic consideration of contingency 90. Reporting systems should
subordinated tranches may amortize funding plans, capital plans, and produce, at least monthly, information
prior to full retirement of senior reporting systems necessary to monitor that captures overall securitization
tranches, the speed at which reserve and assess the risk and likelihood of an activity, as well as specific data
accounts will be built up through early amortization event. elements of individual transactions.
retained excess spread, or structural 88. For an originating bank, the risk- Performance tracking should include
features whereby the losses allocated to weighted asset amount for the investors’ vintage performance, cash collections,
a particular tranche may depend on how interest in the securitization is equal to cash flow sensitivity, covenant
these losses are distributed among the the product of the following four compliance, and, when applicable,
exposures in the underlying pool. The quantities: (1) The investors’ interest potential for early amortization events.
existence of such contingencies does not EAD; (2) the appropriate conversion Accounting methods, residual valuation
automatically disqualify a bank from factor; (3) KIRB; and 12.5. Under the methods, and regulatory reporting
using the SFA to compute the capital requirements should be in writing and
securitization framework, the investors’
charge for an unrated securitization consistently applied. The valuation
interest is made up of the investors’
exposure. However, the structure of the assumptions for retained interests and
drawn balances and the EAD associated
transaction should be sufficiently clear servicing assets or liabilities should be
with the investors’ undrawn lines. The
cut to enable the bank to determine the conservative, fully documented, and
undrawn balances of the securitized
loss prioritization associated with each reviewed by senior management on a
exposures would be allocated between
potential contingency. Furthermore, the
the seller’s and investors’ interests on a regular basis. Accurate and timely risk-
calculation of L should address
pro rata basis, based on the proportions based capital calculations should be
contingencies in a manner that is
of the seller’s and investors’ shares of maintained that include the recognition
demonstrably conservative, for example,
the securitized drawn balances. and reporting of any recourse obligation
by calculating L to reflect those
89. Once the transaction’s structure resulting from securitization
contingencies that are least favorable to
has been determined, the level of excess transactions.
the bank. In all cases, the calculation of
L must comply with applicable rules for spread must also be considered in 91. Refer to this chapter’s Appendix
recognizing credit enhancements (e.g., determining the applicable credit B, ‘‘Data Elements for Securitization
unfunded reserve accounts may not be conversion factor for uncommitted Exposures,’’ for further details on the
recognized). credit lines. To determine the capital to data elements that a bank’s reporting
be held against the investors’ interest in systems should electronically capture
VIII. Early Amortization Provisions a securitization of uncommitted retail and store.
87. In addition to holding capital exposures, the bank should compare the Appendix A: Description of the
against any retained interest in a three-month average excess spread to Supervisory Formula Approach (SFA)
securitization transaction, originating the point at which the bank is required
banks are required to hold capital to trap excess spread as required by the This appendix provides illustrative
against the investors’ interest (both structure. When the transaction does not examples to demonstrate how the
drawn and undrawn balances) in a require excess spread to be trapped, the framework described in this guidance
securitization that includes one or more trapping point is 4.5 percent. For applies to different securitization
underlying exposures in which the securitization trusts that issue several exposures. The examples provide
borrower is permitted to vary the drawn series with spread capture points that insight into the SFA capital calculation
amount within an agreed limit under a vary (e.g., credit card master trust and the KIRB boundary, as well as the
line of credit and that contains an early structures), the trapping point for this supervisory capital add-ons, in addition
amortization feature. The likelihood of provision would be the most to its application to products which
triggering an early amortization conservative series in the trust. The represent tranched cover.
increases as the level of excess spread bank should divide the excess spread The supervisory formula capital
declines. Accordingly, a bank would be level by the trapping point, and then requirement for a given unrated
required to hold increasing amounts of reference Table 8 in section 47 of the securitization exposure is calculated as
risk-based capital as the probability of NPR to determine which conversion UE * TP multiplied by the greater of: (i)
an early amortization event increases. factor is applicable. .0056 · T, or (ii) S[L + T]¥S[L] where:
RWA are determined when the tranche in question by computing risk that is attributable to a first-loss
supervisory formula output is capital for the tranche of interest and all position covering loss up to and
multiplied by 12.5. tranches beneath it (S[L + T]) and including Y. Because the tranche of
The factor (i) above imposes a 56 basis subtracting from that the capital for all interest covers losses over a specified
point minimum or floor IRB risk-based tranches beneath the tranche of interest range (defined in terms of L and T), its
capital requirement per dollar of tranche (S[L]). For tranches with credit systematic risk can be represented as
exposure. Regulators have imposed this enhancement levels below KIRB (Y ≤ K[L + T] ¥ K[L].
floor because the supervisory formula KIRB), the supervisory formula assigns a
regularly produces a risk-based capital Unquestionably, the supervisory
dollar-for-dollar capital requirement. formula appears very complex, but
requirement of nearly zero for high
quality tranches that, nonetheless, have For tranches with greater credit actually the mechanics are algebraic in
positive credit risk. The floor is enhancement levels (Y > KIRB), the nature and merely require the user to
equivalent to the RBA risk-based capital supervisory formula produces a risk- determine certain inputs and solve. To
requirement for an externally rated AAA based capital requirement that is a blend better understand the components of the
securitization exposure, which lessens of credit risk modeling and supervisory supervisory formula, it is best to begin
the potential regulatory capital arbitrage judgment. The function K[Y] represents with the model-based estimate of credit
opportunities that could arise. a pure model-based estimate of the risk, the K[Y] term. This estimate of risk
Factor (ii) represents the supervisory underlying securitized pool’s aggregate is given by the following equation:
formula, which derives capital for the systematic or non-diversifiable credit
EN28FE07.011</GPH> EN28FE07.012</GPH>
where b[Y;a,b] is shorthand for the The techniques commonly used to exposures are conditionally
Beta distribution. For the purpose of estimate the potential loss experience in independent, multiplying the
calculating the supervisory formula, it is ASRF models depend on the probability of performance together N
sufficient to know that the Beta relationship between the risk factor and times (the effective number of
distribution, when suitably transformed credit losses. In some cases, it is exposures) yields the cumulative
and normalized, can be used to model necessary to simulate the pattern of conditional probability that every
the loss distribution given that the potential losses that can result when the exposure performs, or h.
systematic risk factor is at the 99.9th risk factor takes on high value—also a and b are defined entirely in terms
percentile. Even more concretely, the known as Monte Carlo simulation. of g and c, defined below. They are used
Beta distribution evaluated at the Monte Carlo techniques, while to simplify the notation of the Beta
specified parameters is a number which commonly used, require significant distribution.
can be readily calculated in Excel using computing resources. In other cases, it
the betadist (L,a,b) function. may be possible to characterize this
pattern of losses with an appropriate
The model used to estimate the non-
functional form. In language that is
diversifiable risk in the pool of
slightly more rigorous, it is possible to
exposures is developed from the class of
approximate the conditional loss c is the approximation of the mean
credit value-at-risk (CVaR) models
distribution. Gordy and Jones (2003) parameter for the ‘‘fitting function’’ and
known as asymptotic single risk factor undertook the task of specifying this
models (ASRF models). In essence, is given by:
‘‘reasonable functional form,’’ which
ASRF models simplify the many forces became the basis for the supervisory
that may affect a pool of exposures by formula.32
assuming that there is only one ‘‘risk Most of the expressions that comprise
factor’’ that causes credit losses to be the supervisory formula arise due to the The ‘‘fitting function’’ approximates
correlated across exposures. effort to describe the shape of the the pool’s conditional loss distribution.
Alternatively, one can think of the conditional loss function. Expressions This approximation is necessary to
single risk factor as a random variable (3) through (9), discussed below, are avoid using simulation or numerical
encompassing the many possible states used to parameterize K[Y]. methods to solve for K[Y] as previously
of economic activity—from very good to mentioned. However, note that h (the
very bad. Under the ASRF assumptions, cumulative conditional probability that
CVaR for a portfolio is equal to the every exposure performs) is likely to be
portfolio’s expected credit losses over small in most cases. Consequently, C
the modeling horizon given a very bad Note that will be approximately equal to KIRB
state of the economy. (The pattern of under normal circumstances.
losses that result when the risk factor g is the precision parameter for the
takes on a specific value is also known fitting function and is determined by c,
EN28FE07.020</GPH>
as the conditional loss distribution.) The f and v. This term arises from the
SFA calculates the capital necessary to is the probability of default for one processes through which Gordy and
cover credit losses over a one-year exposure in the pool when the risk Jones approximate the conditional loss
horizon when the risk factor is at the factor is at the 99.9th percentile. distribution.
Therefore,
EN28FE07.019</GPH>
99.9th percentile i.e., when economic
conditions are as bad as the worst year
in 1000 years. This is consistent with
the approach applied throughout Basel
II and the manner in which KIRB is is the conditional probability that the f is an approximation of the variance
EN28FE07.018</GPH>
calculated. exposure performs. Assuming that the of the fitting function:
Each securitization has rules different arrangements. In the model, useful for modeling purposes, may not EN28FE07.017</GPH>
EN28FE07.016</GPH>
governing how payments are disbursed the waterfall is represented by the accurately describe the structure of a
to the tranches, often called the cash tranche structure with the most junior specific securitization.
flow ‘‘waterfall.’’ These rules can be tranche suffering losses up to its entire v is the variance of the conditional
quite complex and the supervisory position before more senior tranches are loss distribution:
formula must handle the spectrum of affected. This simplification, while
EN28FE07.015</GPH>
EN28FE07.013</GPH> EN28FE07.014</GPH>
32 For those familiar with calculus, Gordy and risk-based capital requirements by integrating an requirement for exposure up to and including the
Jones approximate the marginal amount of credit appropriately parameterized approximation, which tranche of interest, it is necessary to subtract any
risk associated with an arbitrarily small slice of a behaves similarly to a cumulative density function. subordinate exposures’ capital requirements.
tranche. From this, it is possible to calculate the Note that since integration yields the capital
In the portion of expression (1) related representation of a securitization. The rapidly the farther Y is from KIRB.
to the supervisory add-on the terms are add-on applies primarily to positions Returning to expression (1) we can
included to prevent exploitation of with credit enhancement just above KIRB extract the supervisory add-on portion:
inadequacies in the model’s stylized and its quantitative effect diminishes
where
Notice that expressions (3) through Example 1: Comprehensive SFA wholesale exposures will be used to
(10) do not change for a given Calculation illustrate the basic application of the
securitization. In other words, since Because of the complexities SFA. Since none of the six tranches are
these expression do not contain associated with applying the SFA, a externally rated, and the securitization
information which is tranche-specific, comprehensive example has been does not meet the definition of an ABCP
the results from expressions (3) through developed to aid in application. conduit, neither the RBA nor the IAA is
(10) can be used when calculating S[Y] applicable.
Transaction Summary Table 1 below identifies the
for any tranche of a given securitization
if Y > KIRB. A six-tranche, privately placed characteristics of the ten underlying
securitization with 10 underlying exposures in the securitized pool.
TABLE 1.—UNDERLYING WHOLESALE EXPOSURE CHARACTERISTICS

Principal PD LGD EL IRB capital
Exposure balance Maturity (M)
(percent) (percent) percent charge
(EAD)
#1 ..................................................................................... $5.00 0.75 35.0 0.26 5 $0.35

#2 ..................................................................................... 5.00 0.75 35.0 0.26 5 0.35
#3 ..................................................................................... 5.00 0.75 35.0 0.26 5 0.35
#4 ..................................................................................... 5.00 0.75 35.0 0.26 5 0.35
#5 ..................................................................................... 15.00 0.50 25.0 0.13 2 0.43
#6 ..................................................................................... 20.00 1.25 55.0 0.69 10 2.59
#7 ..................................................................................... 30.00 1.25 55.0 0.69 10 3.87
#8 ..................................................................................... 5.00 0.75 35.0 0.26 5 0.35
#9 ..................................................................................... 5.00 0.75 35.0 0.26 5 0.35
#10 ................................................................................... 5.00 0.75 35.0 0.26 5 0.35
Pool .................................................................................. 100.00 0.96 43.5 0.46 4.55 9.34
Calculation of Bank-Supplied Inputs and underlying collateral has 10 actual exposures; however, the
characteristics, each of the seven bank- effective number of exposures is much
In order to utilize the SFA, banks supplied inputs can be calculated. less than 10 because three larger
must supply seven inputs. Based upon N is the exposure-weighted number of exposures dominate the pool. To
the previously provided information exposures in the pool. In the stylized illustrate numerically:
regarding the securitization’s structure example, the wholesale securitization
EN28FE07.024</GPH>
EN28FE07.023</GPH>
EWALGD is the exposure-weighted underlying exposures. To illustrate

average loss given default for the numerically for our stylized example:
EN28FE07.021</GPH> EN28FE07.022</GPH>
By utilizing the exposure-weighted sum of the individual exposures’ IRB using the wholesale IRB risk-weight
average expected loss (0.46%) and the capital requirements ($9.34, calculated function) KIRB can be determined:
UE is equivalent to the sum of the T represents a tranche’s thickness or being equal, will generate a lower SFA
underlying exposures in the pool, or its size relative to the underlying capital requirement than one with a
$100 in this case. securitized exposures, while L lower credit enhancement level.
TP is set to 100 percent in our represents the credit enhancement level The tranches, in order of seniority
example, primarily so that the aggregate of the subject tranche. All things being from most senior to most junior, have
equal, a thicker tranche will generate a notional values of $60, $15, $10, $8, $5
capital requirement for the entire
higher SFA capital requirement in and $2, which we designate Tranche A
securitization, as well as individual
dollar terms relative to a thinner through Tranche F, respectively. Table 2
charges for each tranche, can be tranche. Further, a tranche with a higher below depicts the calculation of L and
illustrated. credit enhancement level, all things T for each tranche of the securitization.
Calculating the Risk-Based Capital F are equivalent since both L + T and Tranche E: UE · TP · ((L + T) ¥ L) =
Requirement for Tranches A through F L are below KIRB. Two important results $100 · 100% · ((2% + 5%) ¥ 2%) =
are apparent when using the SFA for $5
Using the seven bank-supplied inputs
determined above, the SFA capital tranches below KIRB. First, the capital Tranche F: UE · TP · ((L + T) ¥ L) =
requirement can be calculated for each requirement for each tranche (E and F) $100 · 100% · ((0% + 2%) ¥ 0%) =
tranche of the securitization. The is dollar-for-dollar. Put slightly $2
calculations for each tranche of the differently, tranches of securitized
exposures that absorb losses below KIRB Group 2: Tranche Straddling the KIRB
sample securitization are illustrated Boundary
below. The calculations are categorized are subject to dollar-for-dollar capital
in three separate groups to display the requirements. Second, when L + T < Tranche D straddles KIRB since L + T
idiosyncrasies of the SFA: (1) The KIRB, no additional information beyond > KIRB (15% > 9.80%) and L < KIRB, (7%
tranches below KIRB (E and F), (2) the UE, TP, L and T is required to determine < 9.80%). Since L + T > KIRB, the bank
tranche straddling KIRB (D), and (3) the the SFA capital requirement. Since would have to calculate equations (3)
tranches above KIRB (A through C). Tranches E and F are subject to dollar- through (10) to determine S[L + T]. As
EN28FE07.025</GPH> EN28FE07.026</GPH>
for-dollar (100 percent) charges, they noted previously, only UE, TP and L are
Group 1: Tranches Below the KIRB clearly exceed the 56 basis point floor. necessary to determine S[L] since L <
Boundary
The capital requirement calculations for KIRB. As noted in the ‘‘Mechanics of the
The methodology for determining the Tranches E and F are displayed below SFA’’ section of this guidance,
capital requirements for Tranches E and to reinforce this concept: equations (3) through (10) do not change
for a given securitization. The (10) for the sample securitization are
calculations for equations (3) through included below:
Next, the supervisory add-on term can

be calculated. First the value for K[KIRB]
is calculated:
EN28FE07.029</GPH>
EN28FE07.027</GPH> EN28FE07.028</GPH>
K[KIRB] is then substituted into the

full supervisory add-on term:
Since S[L + T] is a combination of the percent exceeds the 56 basis point floor each of these tranches are given below.
model-based estimate of non- (.56% · 8% = .45%), the SFA capital Again, the prior calculations for
diversifiable credit risk (K[L + T]) and requirement for Tranche D is: Tranche equations (3) through (10) can be used
the supervisory add-on, S[L + T] can be D: UE · TP · (S[L + T] ¥ S[L]) = $100 for Tranches A through C since these
determined as follows: · 100% · (4.83%) = $4.83 values are the same for every tranche of
S[15%] = 7.96% + 3.87% = 11.83% Group 3: Tranches Above the KIRB a securitization. Further simplifying the
Since L < KIRB, can easily be Boundary task, S[L] equals S[L + T] for the tranche
determined in the same fashion used for immediately junior.
Tranches E and F. S[L + T] ¥ S[L] = Tranches A through C all lie above the
11.83% ¥ 7% = 4.83%. Since 4.83 KIRB boundary. The calculations for Tranche A
Tranche B
EN28FE07.032</GPH>
EN28FE07.030</GPH> EN28FE07.031</GPH>
Tranche C
The next step is verifying whether any TABLE 3.—SFA CAPITAL sold all but Tranches E and F, the KIRB
of the above capital calculations for REQUIREMENTS FOR EXAMPLE 1 cap would not apply since the aggregate
tranches A, B, or C violate the 56 basis capital requirement ($7) would be less
point supervisory floor. In dollar terms, Tranche SFA capital than the charge implied by KIRB ($9.80).
Tranche
the above formulas produce capital amount requirement However, if the bank retained Tranche
requirements for these tranches equal to D in addition to Tranches E and F, then
A ............... $60 $0.34
$0.02, $0.38, and $1.44, respectively, the aggregate SFA capital requirement
B ............... 15 0.38
while the corresponding floors are $0.34 C ............... 10 1.44 ($11.83) would exceed the KIRB cap and
(=.56% · $60), $.08 (=.56% · $15), and D ............... 8 4.83 the risk-based capital requirement
$0.06 (=.56% · $10). Thus, the floor is E ............... 5 5.00 would be capped at $9.80.
F ................ 2 2.00
binding only for tranche A, whose Example 2: Sale of a Pool of Mortgages
capital charge is increased to $0.34. The Total ... 100 13.98 With Partial Recourse
SFA capital requirement for each
Transaction Summary
tranche is presented below: The 56 basis point floor, supervisory
add-on, and below KIRB deduction A bank sells a high-quality mortgage
Tranche A: UE · TP · (.0056 · T) = $100
requirements can result, as in the case loan pool of $100. As a condition of the
· 100% · .34% = $0.34 sale, the bank agrees to cover the first
of this example, with the aggregate
Tranche B: UE · TP · (S[40%] ¥ S[25%]) capital requirement for a bank $10 of losses on mortgages. The bank
= $100 · 100% · .38% = $0.38 exceeding the implied capital correctly applies GAAP accounting and
Tranche C: UE · TP · (S[25%] ¥ S[15%]) requirement for the underling removes the sold loans from its books,
= $100 · 100% · 1.44 = $1.44 exposures. For this reason, the total while establishing a $0.40 recourse
capital that an entity must hold is liability reserve (valuation allowance)
Summary capped at the level implied by KIRB (UE for the estimated fair market value of the
· TP · KIRB also referred to as the KIRB recourse liability. Note that this is a
Table 3 below summarizes the SFA- cap). Whether this bank is subject to the specific reserve, not a general reserve.
produced capital requirements for each cap depends on which tranches the The characteristics of the sold mortgage
tranche of the securitization: bank retains. For example, if the bank loan pool are noted below:
TABLE 4.—UNDERLYING MORTGAGE LOAN POOL CHARACTERISTICS

Principal IRB capital
Exposure balance PD LGD EL KIRB
requirement
(EAD)
Retail ............................................................................................................ $ 100.00 0.50% 10.0% 0.05% $ 0.62 0.67%
The transaction noted above is an positions are created: (1) A $90 senior Calculation of Bank-Supplied Inputs
example of tranched cover. In this case, position and (2) a $10 junior position.
the bank has agreed to absorb the first Since neither position carries an Table 5 below shows the values for L
$10 of losses, which results in the external rating, the SFA is the and T. Because this is a retail
selling bank retaining a disproportionate appropriate method with which to securitization, h and v can be set to
risk position in the transaction. As a determine the capital requirement, zero. We continue to assume that TP =
result of this contractual sales provided the seller and the purchaser 100%.
agreement, two distinct credit risk are eligible to use it.
EN28FE07.033</GPH>
Calculation of the SFA Capital

Requirement for Tranche 1 and 2
In the case of Tranche 1, S[L + T] ¥ cannot be used to offset a position’s TABLE 7.—SFA CAPITAL
S[L] <.0056 · T = .0056 · 90% = 0.50% risk-based capital requirement. Thus, REQUIREMENTS FOR EXAMPLE 2
and is subject to the supervisory floor. the risk-based capital requirement for
Using this and values from Table 6 Tranche 2 is not reduced by the Tranche SFA capital
Tranche
above, the SFA capital requirement for valuation allowance and remains $0.67. amount requirement
Tranches 1 and 2 can be determined as Another interesting feature of this
1 ................ $90 $0.50
follows: example is that because the investing
2 ................ 10 0.67
Tranche 1: UE · TP · (.0056 · T) = $100 bank holds Tranche 1 and the
· 100% · (.50%) = $.50 originating bank holds Tranche 2, the Total ... 100 1.17
Tranche 2: UE · TP · (S[L + T] ¥ S[L]) SFA produces an aggregate capital
= $100 · 100% · (.79%) = $.79 requirement for the entire transaction Example 3: Collateralized Loan
Notice that the capital requirement for ($1.17) that is well above the KIRB cap Obligation—SFA and RBA Interaction
Tranche 2 exceeds the KIRB cap (UE · TP ($0.67). The capital required in excess of
· KIRB = $100 · 100% · (.67%) = $.67) the KIRB cap is the result of the 56 basis Transaction Summary
and is reduced to $.67. point floor capital requirement assessed This example represents a typical
against Tranche 1. Without the floor, cash-funded collateralized loan
Summary Tranche 1 would not receive a capital obligation using corporate loans. The
Table 7 below summarizes the SFA requirement. The investing bank is example assumes that the originating
capital requirement for each tranche of assessed a capital requirement even bank retains an unrated residual
the securitization. Note, in this example, though the originating bank is subject to exposure to Class E and that investing
the originating bank established a $.40 the KIRB cap. If the investing bank could banks acquire the externally rated
EN28FE07.034</GPH> EN28FE07.038</GPH>
recourse reserve liability with a charge not calculate KIRB because the bank tranches.
through earnings. However, while such cannot compute the risk-based capital Since the Class E exposure is unrated
reserves can be used to offset requirement for all underlying and is not an ABCP exposure, the
deductions from capital required under exposures, the entire $90 position originating bank can use the SFA
the Securitization Framework, they would be deducted from capital. provided it is eligible and can calculate
all the necessary inputs. Table 8 below securitized pool. We assume for exposures (N) is set to 100 and TP to
identifies the characteristics of the simplicity that the effective number of 100 percent.
aggregated underlying exposures in the
TABLE 8.—UNDERLYING LOAN POOL CHARACTERISTICS

Principal balance IRB capital
Exposure EL KIRB
(EAD) requirement
Wholesale .................................................................................................................... $ 100.00 ..................... 1.32% $ 7.32 8.64%
Calculation of Bank-Supplied Inputs bank to calculate the SFA for Tranche necessary for the investing banks to
Table 9 below identifies the other E (e.g. L and T) and the external ratings apply the RBA.
inputs necessary for the originating
Originating Bank Capital Calculation originating bank to apply the SFA to

Table 10 below provides the various Tranche E.
calculations necessary for the
EN28FE07.035</GPH>
Using values from Table 10 above, the exceeds the KIRB cap (UE · TP · KIRB = capital for each of the rated tranches
SFA capital requirement can be $100 · $100% ·8.64% = $8.64) and is after applying the RBA. The relevant
determined as follows: reduced accordingly. RBA risk weights in this example
Tranche E: UE · TP · (S[L + T] ¥ S[L]) Investing Bank Capital Calculation: depend not only on the external rating,
=$100 · $100% · (9.59%) = $9.59 but also on the tranche’s seniority.
Again we have a case where the For an investing bank, Table 11 below
capital requirement for Tranche E illustrates the amount of required
TABLE 11.—RBA RISK WEIGHTS APPLICABLE TO RATED TRANCHES
RBA risk Capital as
Required
Tranche Rating Exposure weights % of expo-
capital
(percent) sure
A ............................................................... ‘‘AAA’’ ....................................................... $ 67.50 7 $0.38 0.56

B ............................................................... ‘‘AA’’ .......................................................... 7.50 15 0.09 1.20
C ............................................................... ‘‘A’’ ............................................................ 8.00 20 0.13 1.60
D ............................................................... ‘‘BBB’’ ....................................................... 5.00 75 $0.30 6.00
Comparison of RBA and SFA Generated Appendix B: Examples of Data • The person who authorizes limit
Capital Requirements Elements for Securitization Exposures and concentration levels, and his or her
For illustrative purposes, this authority levels; and
TABLE 12.—RBA AND SFA CAPITAL appendix provides examples of the • Reports of all policy exceptions.
REQUIREMENTS FOR EXAMPLE 3 kinds of data elements banks should For Exposures Subject to the Ratings-
collect under an IRB data management Based Approach
Tranche SFA capital framework for securitization exposures.
Tranche amount requirement
For All Securitization Exposures • The NRSRO providing the rating;
A ............... $ 67.50 $ 0.38 • Documentation indicating that the
• The description and amount of each
B ............... 7.50 0.09 exposure is part of the surveillance/
exposure;
C ............... 8.00 0.13 monitoring program, is publicly
• The fundamental characteristics of
D ............... 5.00 0.30 published, and is in transition matrices;
E ............... 12.00 the exposure (e.g., tenor, fixed or
8.64
variable rates, call, and early • A description and amount of any
Total ... 100.00 9.54 amortization features); rated security supporting an inferred
• The exposure’s initial rating and rating;
If the other classes of notes were held
effective date; • Seniority and granularity (for non-
• The amount of any exposures retail securitizations) of the exposure;
by the originating bank, the RBA would
deducted from risk-based capital under • Whether the NRSRO rating is a
be used to determine required capital
provisions of the framework; short-term or long-term credit
since all of these classes are rated. • A description and amount of
Notably, regardless of how many classes exposure limits at the aggregate and assessment;
are held in addition to Class E, the total transaction level; • The risk-weight schedule used, and
amount of capital that the originating • A description and amount of the risk-weight column applied; and
bank must hold for the transaction will concentration limits, for the underlying • The date, magnitude, and details of
not exceed the KIRB cap ($8.64).
EN28FE07.039</GPH>
exposure level and capital; any rating changes.
For Exposures Subject to the Internal capture requirement when multiple default). The [bank]’s wholesale obligor
Assessment Approach series are issued from a trust); rating system must have at least seven
• The name of the sourced NRSRO, • The three-month average excess discrete rating grades for non-defaulted
and the rating criteria for the referenced spread for the transaction (or the lowest obligors and at least one rating grade for
asset class; three-month average within the trust); defaulted obligors. Unless the [bank] has
• The designation of whether the chosen to directly assign ELGD and LGD
• The criteria used for selecting the
amortization provision is ‘‘controlled’’ estimates to each wholesale exposure,
NRSRO;
• NRSRO stress loss factors used for or ‘‘non-controlled’’; and the [bank] must have an internal risk
• The credit-conversion factor rating system that accurately and
each ICA;
• Historical loss and dilution schedule (controlled or non-controlled) reliably assigns each wholesale
estimates used in applying NRSRO applied to the exposure, and the row exposure to loss severity rating grades
criteria; and column applied. (reflecting the [bank]’s estimate of the
• Seller-servicer rating assignment, if Attachment A—The NPR Qualification ELGD and LGD of the exposure). A
any; Requirements Related to the IRB [bank] employing loss severity rating
• Any quantitative adjustments to Framework grades must have a sufficiently granular
ratings criteria, stress loss factors, or loss severity grading system to avoid
loss estimates based upon qualitative Part III. Qualification grouping together exposures with
judgments (e.g., seller-servicer strength, Section 22. Qualification widely ranging ELGDs or LGDs.
concentration, etc.); Requirements 33 (3) For retail exposures, a [bank] must
• The external rating for the have a system that groups exposures
(a) Process and systems requirements. into segments with homogeneous risk
commercial paper issued by the ABCP (1) A [bank] 34 must have a rigorous
program (that is supported by the characteristics and assigns accurate and
process for assessing its overall capital reliable PD, ELGD, and LGD estimates
exposure); adequacy in relation to its risk profile
• Seniority and granularity of the for each segment on a consistent basis.
and a comprehensive strategy for The [bank]’s system must group retail
exposure;
maintaining an appropriate level of exposures into the appropriate retail
• Whether the ICA is a short-term or
capital. exposure subcategory and must group
long-term credit assessment; (2) The systems and processes used by
• The risk-weight schedule used, and the retail exposures in each retail
a [bank] for risk-based capital purposes exposure subcategory into separate
the risk-weight column applied;
under this appendix must be consistent segments. The [bank]’s system must
• The person or model responsible for
with the [bank]’s internal risk identify all defaulted retail exposures
assigning the rating;
management processes and management and group them in segments by
• Any overrides to the rating and the
information reporting systems. subcategories separate from non-
authorizing official (if applicable); and
(3) Each [bank] must have an defaulted retail exposures.
• The date, magnitude, and details of
appropriate infrastructure with risk (4) The [bank]’s internal risk rating
any rating changes.
measurement and management policy for wholesale exposures must
For Exposures Subject to the processes that meet the qualification describe the [bank]’s rating philosophy
Supervisory Formula Approach requirements of this section and are (that is, must describe how wholesale
• The dollar amount of underlying appropriate given the [bank]’s size and obligor rating assignments are affected
exposures in the transaction (UE); level of complexity. Regardless of by the [bank]’s choice of the range of
• The securitization exposure’s whether the systems and models that economic, business, and industry
proportion of the tranche (TP); generate the risk parameters necessary conditions that are considered in the
• The risk-based capital requirements for calculating a [bank]’s risk-based obligor rating process).
of the underlying exposures as if they capital requirements are located at any (5) The [bank]’s internal risk rating
were held on the bank’s balance sheet affiliate of the [bank], the [bank] itself system for wholesale exposures must
(KIRB); must ensure that the risk parameters provide for the review and update (as
• The exposure’s credit enhancement and reference data used to determine its appropriate) of each obligor rating and
level (L); risk-based capital requirements are (if applicable) each loss severity rating
• The exposure tranche’s thickness representative of its own credit risk and whenever the [bank] receives new
(T); operational risk exposures. material information, but no less
• The securitization transaction’s (b) Risk rating and segmentation frequently than annually. The [bank]’s
effective number of underlying systems for wholesale and retail retail exposure segmentation system
exposures (N); and exposures. (1) A [bank] must have an must provide for the review and update
• The transaction’s exposure- internal risk rating and segmentation (as appropriate) of assignments of retail
weighted loss-given-default (EWALGD). system that accurately and reliably exposures to segments whenever the
differentiates among degrees of credit [bank] receives new material
For Securitization Transactions With risk for the [bank]’s wholesale and retail information, but no less frequently than
Early-Amortization Provisions (On a exposures. quarterly.
Monthly Basis) (2) For wholesale exposures, a [bank] (c) Quantification of risk parameters
• The total amount of the sold must have an internal risk rating system for wholesale and retail exposures. (1)
(investor’s interest) and retained that accurately and reliably assigns each The [bank] must have a comprehensive
positions in the securitization obligor to a single rating grade risk parameter quantification process
transaction; (reflecting the obligor’s likelihood of that produces accurate, timely, and
• The IRB risk-based capital reliable estimates of the risk parameters
33 71 FR 55922 through 55924 (Sept. 25, 2006).

requirements of the underlying for the [bank]’s wholesale and retail
34 For simplicity, and unless otherwise noted, the
exposures as if they were held on the exposures.
NPR uses the term [bank] to include banks, savings
originating bank’s balance sheet; associations, and bank holding companies.
(2) Data used to estimate the risk
• The excess spread-capture schedule [AGENCY] refers to the primary Federal supervisor parameters must be relevant to the
for the transaction (or earliest spread of the bank applying the rules. [bank]’s actual wholesale and retail
exposures, and of sufficient quality to —Text omitted— downturns, affect risk-based capital
support the determination of risk-based (i) Data management and requirements (including migration
capital requirements for the exposures. maintenance. (1) A [bank] must have across rating grades and segments and
(3) The [bank]’s risk parameter data management and maintenance the credit risk mitigation benefits of
quantification process must produce systems that adequately support all double default treatment).
conservative risk parameter estimates aspects of its advanced systems and the (k) Documentation. The [bank] must
where the [bank] has limited relevant timely and accurate reporting of risk- adequately document all material
data, and any adjustments that are part based capital requirements. aspects of its advanced systems
of the quantification process must not (2) A [bank] must retain data using an
result in a pattern of bias toward lower electronic format that allows timely Attachment B—Supervisory Standards
risk parameter estimates. retrieval of data for analysis, validation, Chapter 1: Advanced Systems for Credit
(4) PD estimates for wholesale and reporting, and disclosure purposes. Risk
retail exposures must be based on at (3) A [bank] must retain sufficient
data elements related to key risk drivers S 1–1 An IRB system must have five
least 5 years of default data. ELGD and
to permit adequate monitoring, interdependent components that enable
LGD estimates for wholesale exposures
validation, and refinement of its an accurate measurement of credit risk
must be based on at least 7 years of loss
advanced systems. and risk-based capital requirements.
severity data, and ELGD and LGD
(j) Control, oversight, and validation S 1–2 Senior management must
estimates for retail exposures must be
mechanisms. (1) The [bank]’s senior ensure that all of the components of the
based on at least 5 years of loss severity
management must ensure that all bank’s advanced systems for credit risk
data. EAD estimates for wholesale
components of the [bank]’s advanced function effectively and comply with
exposures must be based on at least 7
systems function effectively and comply the qualification requirements in the
years of exposure amount data, and EAD
with the qualification requirements in NPR.
estimates for retail exposures must be
this section. S 1–3 The board of directors or its
based on at least 5 years of exposure
(2) The [bank]’s board of directors (or designated committee must at least
amount data.
(5) Default, loss severity, and a designated committee of the board) annually evaluate the effectiveness of,
exposure amount data must include must at least annually evaluate the and approve, the bank’s advanced
periods of economic downturn effectiveness of, and approve, the systems.
conditions, or the [bank] must adjust its [bank]’s advanced systems. S 1–4 Each bank (including each
estimates of risk parameters to (3) A [bank] must have an effective depository institution) must ensure that
compensate for the lack of data from system of controls and oversight that: the risk parameters and reference data
periods of economic downturn (i) Ensures ongoing compliance with used to determine its risk-based capital
conditions. the qualification requirements in this requirements are representative of its
(6) The [bank]’s PD, ELGD, LGD, and section; own credit risk.
EAD estimates must be based on the (ii) Maintains the integrity, reliability, S 1–5 Banks should establish specific
definition of default in this appendix. and accuracy of the [bank]’s advanced accountability for the overall
(7) The [bank] must review and systems; and performance of their advanced systems
update (as appropriate) its risk (iii) Includes adequate governance for credit risk.
parameters and its risk parameter and project management processes. S 1–6 A bank’s advanced systems
quantification process at least annually. (4) The [bank] must validate, on an should be transparent.
(8) The [bank] must at least annually ongoing basis, its advanced systems. Chapter 2: Wholesale Risk Rating
conduct a comprehensive review and The [bank]’s validation process must be Systems
analysis of reference data to determine independent of the advanced systems’’
relevance of reference data to [bank] development, implementation, and S 2–1 Banks must identify obligor
exposures, quality of reference data to operation, or the validation process defaults in accordance with the IRB
support PD, ELGD, LGD, and EAD must be subjected to an independent definition of default.
estimates, and consistency of reference review of its adequacy and S 2–2 Banks should demonstrate that
data to the definition of default effectiveness. Validation must include: their wholesale risk rating processes are
contained in this appendix. (i) The evaluation of the conceptual sufficiently independent to produce
(d) Counterparty credit risk model. A soundness of (including developmental objective ratings.
[bank] must obtain the prior written evidence supporting) the advanced S 2–3 IRB risk rating systems must
approval of [AGENCY] under section 32 systems; have two dimensions obligor default
to use the internal models methodology (ii) An on-going monitoring process and loss severity corresponding to PD
for counterparty credit risk. that includes verification of processes (obligor default), and ELGD and LGD
(e) Double default treatment. A [bank] and benchmarking; and (loss severity).
must obtain the prior written approval (iii) An outcomes analysis process S 2–4 Banks must assign discrete
of [AGENCY] under section 34 to use that includes back-testing. obligor rating grades.
the double default treatment. (5) The [bank] must have an internal S 2–5 The obligor rating system must
(f) Securitization exposures. A [bank] audit function independent of business- rank obligors by likelihood of default.
must obtain the prior written approval line management that at least annually S 2–6 Banks must assign an obligor to
of [AGENCY] under section 44 to use assesses the effectiveness of the controls only one rating grade.
the internal assessment approach for supporting the [bank]’s advanced S 2–7 A bank’s rating policy must
securitization exposures to ABCP systems and reports its findings to the describe its ratings philosophy and how
programs. [bank]’s board of directors (or a quickly obligors are expected to migrate
(g) Equity exposures model. A [bank] committee thereof). from one rating grade to another in
must obtain the prior written approval (6) The [bank] must periodically stress response to economic cycles.
of [AGENCY] under section 53 to use test its advanced systems. The stress S 2–8 In assigning an obligor to a
the internal models approach for equity testing must include a consideration of rating grade, a bank should assess the
exposures. how economic cycles, especially risk of obligor default over a period of
at least one year taking into account the risk-driver information is sufficiently or downward, may be an appropriate
possibility of adverse economic accurate and timely to track changes in part of the quantification process, but
conditions. underlying credit quality and that the must not result in an overall bias toward
S 2–9 Banks must have at least seven updated information is used to assign lower risk parameter estimates.
discrete obligor rating grades for non- exposures to appropriate segments. S 4–12 Risk parameter estimates
defaulted obligors and at least one rating S 3–6 The bank’s retail exposure should incorporate a degree of
grade for defaulted obligors. segmentation system must provide for conservatism that is appropriate for the
S 2–10 Banks should justify the the review and update (as appropriate) overall rigor of the quantification
number of obligor rating grades used in of assignments of retail exposures to process.
its risk rating system and the segments whenever the bank receives S 4–13 Mapping should be based on
distribution of obligors across those new material information, but no less a comparison of available data elements
grades. frequently than quarterly. that are common to the existing
S 2–11 Banks may recognize implied portfolio and each reference data set.
support as a rating criterion subject to Chapter 4: Quantification
S 4–14 A mapping process should be
specific supervisory considerations; S 4–1 Banks should have a fully established for each reference data set
however, banks should not rely upon specified process covering all aspects of and for each estimation model.
the possibility of U.S. government quantification (reference data, S 4–15 Banks that combine estimates
financial assistance, except for the estimation, mapping, and application). from internal and external data or that
financial assistance that the U.S. The quantification process should be use multiple estimation methods should
government has legally committed to fully documented. have a clear policy governing the
provide. S 4–2 Risk parameter estimates must combination process and should
S 2–12 Banks must have a loss be based on the IRB definition of examine the sensitivity of the results to
severity rating system that is able to default. At least annually, a bank must alternative combinations.
assign loss severity estimates (ELGD and conduct a comprehensive review and S 4–16 The aggregation of risk
LGD) to each wholesale exposure. analysis of reference data to determine parameter estimates from individual
S 2–13 Banks should have empirical the relevance of reference data to the exposures within rating grades or
support for their loss severity rating bank’s exposures, quality of reference segments should be governed by a clear
system and the rating system should be data to support risk parameter estimates, and well-documented policy.
capable of supporting the quantification and consistency of reference data to the S 4–17 PD estimates must be
of ELGD estimates (and LGD estimates IRB definition of default. empirically based and must represent a
if approved for internal estimates). S 4–3 Banks must separately quantify
long-run average.
S 2–14 Banks must have a wholesale risk parameter estimates
S 4–18 Effects of seasoning, when
sufficiently granular loss severity rating before adjusting the estimates for the
material, must be considered in the PD
system to group exposures with similar impact of eligible guarantees and
estimates for retail portfolios.
estimated loss severities or a process eligible credit derivatives.
S 4–4 Banks may take into account S 4–19 ELGD and LGD estimates
that assigns estimated ELGDs and LGDs
the risk-reducing effects of guarantees in must be empirically based and must
to individual exposures.
S 2–15 Rating criteria should be support of retail exposures when reflect the concept of ‘‘economic loss.’’
written, clear, consistently applied, and quantifying the PD, ELGD, and LGD of S 4–20 ELGD estimates must reflect
include the specific qualitative and the segment. the expected default-weighted average
quantitative factors used in assigning S 4–5 Banks may only reflect the risk- economic loss rate over a mix of
ratings. reducing benefits of tranched guarantees economic conditions, including
S 2–16 Risk ratings must be updated of multiple retail exposures by meeting economic downturn conditions.
whenever new material information is the definition and operational criteria S 4–21 LGD estimates must reflect
received, but in no instance less than for synthetic securitizations. expected loss severities for exposures
annually. S 4–6 At a minimum, the that default during economic downturn
quantification process and the resulting conditions, and must be greater than or
Chapter 3: Retail Segmentation Systems risk parameters must be reviewed equal to ELGD estimates.
S 3–1 Banks must use the IRB annually and updated as appropriate. S 4–22 A bank may use internal
definition of default when identifying S 4–7 Quantification should be based estimates of LGD only if supervisors
defaulted retail exposures. upon the best available data for the have previously determined that the
S 3–2 Banks must first place accurate estimation of the risk bank has a rigorous and well-
exposures into one of the three retail parameters. documented process for assessing the
exposure subcategories (residential S 4–8 The sample period for the effects of economic downturn
mortgage, QRE, and other retail). Banks reference data must meet the minimum conditions on loss severities and for
must then separate exposures into length for each risk parameter by producing LGD estimates consistent
segments with homogeneous risk portfolio. with downturn conditions. The process
characteristics. S 4–9 The reference data must must appropriately identify downturn
S 3–3 A retail segmentation system include periods of economic downturn conditions, identify the impact of
must produce segments that accurately conditions, or the parameter estimates economic downturn conditions on loss
and reliably differentiate risk and must be adjusted to compensate for the rates, identify any material adverse
produce accurate and reliable estimates lack of data from such periods. correlations between drivers of default
of the risk parameters. S 4–10 Banks should clearly and LGD, and incorporate any identified
S 3–4 Banks should clearly define document how they adjust for the correlations and/or downturn impact
and document the criteria for assigning absence of significant data elements in into the quantification of LGD.
an exposure to a particular retail either the reference data set or the S 4–23 Estimates of additional
segment. existing portfolio. drawdowns must reflect net additional
S 3–5 Banks should develop and S 4–11 Judgmental adjustments to draws expected during economic
document their policies to ensure that risk parameter estimates, either upward downturn periods.
S 4–24 Estimates of additional Chapter 7: Controls and Validation in which actual outcomes are expected
drawdowns prior to default for S 7–1 Banks must have an effective to fall and have a validation policy that
individual wholesale exposures or retail system of controls that ensures ongoing requires them to assess the reasons for
segments must not be negative. compliance with the qualification differences and that outlines the timing
S 4–25 Quantification of the risk and type of remedial actions taken when
requirements, maintains the integrity,
parameters should appropriately results fall outside expected ranges.
reliability, and accuracy of the IRB
recognize the risk characteristics of S 7–15 Each of the three activities in
system, and includes adequate
exposures that were removed from the validation process should be
governance and project management
reference data sets through loan sales or conducted often enough to ensure the
processes.
securitizations. ongoing integrity, reliability, and
S 7–2 Control processes should be
Chapter 5: Wholesale Credit Risk independent and transparent to accuracy of the IRB risk rating and
Protection supervisors and auditors. segmentation systems, and the
S 7–3 The annual assessment of the quantification process.
S 5–1 Risk-based capital benefits are S 7–16 Developmental evidence must
only recognized for credit protection IRB system presented to the board of
be updated whenever significant
that transfers credit risk to third parties. directors should be supported by the
changes in methodology, data, or
S 5–2 Banks must ensure that credit bank’s comprehensive and independent
implementation occur. Other validation
protection for which risk-based capital reviews of the IRB system.
S 7–4 Validation activities must be activities must be ongoing and must not
benefits are claimed represents be limited to a point in time.
unconditional and legally binding conducted independently of the
commitments to pay on the part of the advanced systems’ development, Chapter 8: Stress Testing of Risk-Based
guarantors or counterparties. implementation, and operation, or Capital Requirements
subjected to an independent assessment S 8–1 Banks must conduct and
Chapter 6: Data Management and of their adequacy and effectiveness.
Maintenance document stress testing of their
S 7–5 The systems and processes advanced systems as part of managing
S 6–1 Banks must collect and used by a bank for risk-based capital risk-based capital.
maintain sufficient data to support their purposes must be consistent with the
IRB systems. bank’s internal risk management Chapter 9: Counterparty Credit Risk
S 6–2 For wholesale exposures, banks processes and management information Exposure
must collect, maintain, and analyze reporting systems. S 9–1 All transactions with a
essential data for obligors and S 7–6 Internal audit must, at least counterparty subject to a qualifying
exposures. This should be done annually, assess the effectiveness of the master netting agreement constitute a
throughout the life and disposition of controls supporting the IRB system and netting set and may be treated as a
the credit exposure. report its findings to the board of single exposure, otherwise each
S 6–3 Banks must capture and directors (or a committee thereof). transaction shall have its risk-based
maintain all significant factors used to S 7–7 A bank’s validation policy capital requirement calculated on a
assign obligor and loss severity ratings. should cover the key aspects of risk
S 6–2 For retail exposures, banks standalone basis.
rating and segmentation systems and the S 9–2 Banks should have an
must collect and maintain all essential quantification process.
data elements used in segmentation appropriately documented process for
S 7–8 Validation must assess the determining whether transactions are
systems and the quantification process. accuracy of the risk rating and
The data must cover a period of at least eligible for an EAD adjustment approach
segmentation systems and the if they choose to use an EAD adjustment
five years and must include a period of quantification process.
economic downturn conditions, or the approach.
S 7–9 Validation processes for risk S 9–3 Banks must use the same
bank must adjust its estimates of risk rating and segmentation systems, and
parameters to compensate for the lack of method for determining risk-based
the quantification process must include capital requirements for all similar
data from periods of economic the evaluation of conceptual soundness,
downturn conditions. transactions.
ongoing monitoring, and outcomes S 9–4 The method for calculating
S 6–5 Banks should ensure that
analysis. EAD for transactions subject to
outsourced activities performed by third
S 7–10 Banks must evaluate the counterparty credit risk should be
parties are supported by sufficient data
developmental evidence supporting the appropriate for the risk, extent, and
to meet IRB requirements.
S 6–6 Banks should maintain data to risk rating and segmentation systems complexity of the bank’s activity.
allow for a thorough review of asset sale and the quantification process. S 9–5 Banks that use the VaR model
transactions. S 7–11 Banks must conduct ongoing approach for single product netting sets
S 6–7 Banks should develop policies process verification of the risk rating of repo-style transactions or eligible
and controls around the integrity of the and segmentation systems and the margin loans must conduct rigorous and
data maintained both internally and quantification process to ensure proper regular backtesting to validate its model.
through third parties. implementation and operation. S 9–6 Banks must meet certain
S 6–8 Banks should document the S 7–12 Banks must benchmark their qualifying criteria that consist of
process for delivering, retaining, and risk rating and segmentation systems, operational requirements, modeling
updating inputs to the data warehouse and their risk parameter estimates. standards, and model validation
and ensuring data integrity. S 7–13 Banks must analyze outcomes requirements before receiving their
S 6–9 Banks must maintain detailed and must develop statistical methods to primary Federal supervisor’s approval
documentation of changes to the data backtest their risk rating and to use the internal models method.
elements supporting the IRB system. segmentation systems and the S 9–7 Banks that use the internal
S 6–10 Banks must retain data using quantification process. models methodology for counterparty
an electronic format that allows timely S 7–14 Banks should establish ranges credit risk transactions must establish
retrieval of data for analysis, validation, around the estimated values of risk initial model validation and ongoing
reporting, and disclosure purposes. parameter estimates and model results model review procedures. The model
review should consider whether the externally rated by an NRSRO, or be Acronym Definition
inputs and risk factors as well as the eligible for an inferred rating.
model outputs are appropriate. The S 11–9 The securitization transaction FHLB .............. Federal Home Loan Bank.
review of outputs should include a must have an external rating assigned by FIN ................. Financial Accounting Stand-
backtesting regime that compares the an NRSRO that fully reflects the credit ards Board interpretation
model’s output with realized exposures. risk associated with timely repayment of number.
principal and interest. FTSE .............. Financial Times Securities
Chapter 10: Risk-Weighted Assets for S 11–10 Banks should document the Exchange.
Equity Exposures GAAP ............. Generally accepted account-
factors that support their use of the
ing principles.
S 10–1 Banks must apply the same RBA. GDP ............... Gross domestic product.
methodology to like instruments. S 11–11 Banks’ internal credit GSE ............... Government sponsored en-
S 10–2 If a bank chooses to use an assessment processes should be terprise.
internal model, it must produce reliable comprehensive, transparent, HVCRE .......... High-volatility commercial
estimates of the potential loss in the independent, well-defined, and fully real estate.
bank’s portfolio from equity holdings documented. IAA ................. Internal assessment ap-
under stress market conditions. S 11–12 Banks should analyze the proach.
S 10–3 Banks must validate internal servicer’s capabilities and document the ICA ................. Internal credit assessment.
models used for equity exposures. analysis in the internal assessment. ID ................... Identification.
S 10–4 Internal models used to S 11–13 The bank must validate its IMA ................. Internal models approach.
calculate risk-based capital ICA process on an ongoing basis and at IRB ................. Internal ratings-based.
least annually the ICA process and KIRB ................ Capital requirement for un-
requirements for equity exposures must
results must be subject to the full range derlying pool of exposures
be consistent with models used in the (securitizations).
bank’s risk management processes and of the bank’s IRB validation activities. L ..................... Credit enhancement level for
management information reporting S 11–14 Banks should document the the tranche of interest.
systems. securitization structure and loss LEQ ................ Loan equivalent exposure.
prioritization. LF ................... Liquidity facility.
Chapter 11: Securitizations S 11–15 Banks should retain the LGD ................ Loss given default.
S 11–1 Banks must use the specific data elements necessary to LTV ................ Loan-to-value ratio.
securitization framework for any calculate the appropriate securitization M .................... Effective maturity.
exposures that involve the tranching of risk-based capital requirement. MBS ............... Mortgage-backed security.
credit risk (with the exception of a MSA ............... Metropolitan statistical area.
Attachment C—Acronym List N .................... Effective number of under-
tranched guarantee that applies only to
lying exposures.
an individual retail exposure). Acronym Definition NPR ............... Noticed of proposed rule-
S 11–2 Banks should develop written
making.
implementation policies and procedures ABCP ............. Asset-backed commercial
NRSRO .......... Nationally recognized statis-
describing the allowed approaches, paper.
tical rating organization.
methods of application, and designated ABS ................ Asset-backed security.
NSF ................ Nonsufficient funds.
responsibilities for complying with the AIR ................. Accrued interest receivable.
ALLL ............... Allowance for loan and lease OTC ............... Over-the-counter.
securitization framework. losses. PD .................. Probability of default.
S 11–3 Securitization transactions ANPR ............. Advance notice of proposed PE .................. Peak exposure.
must transfer credit risk to at least one rulemaking. PFE ................ Potential future exposure.
third party to qualify for treatment AR .................. Accounts receivable. PMI ................. Private mortgage insurance.
under the securitization framework. ARM ............... Adjustable rate mortgage. QRE ............... Qualifying revolving expo-
S 11–4 Banks that provide implicit ASRF ............. Asymptotic single risk factor sure.
support to securitization transactions model. RBA ................ Ratings-based approach.
CCR ............... Counterparty Credit Risk. RE .................. Real estate.
must hold risk-based capital as if the
CF .................. Credit conversion factor. RWA ............... Risk-weighted assets.
underlying assets had not been S&P ................ Standard and Poors.
CDO ............... Collateralized debt obliga-
securitized, and must deduct from Tier tions. SBIC ............... Small business investment
1 capital any after-tax gain-on-sale CE .................. Credit enhancement. company.
resulting from the securitization. CEIO .............. Credit-enhancing Interest- SFA ................ Supervisory formula ap-
S 11–5 A clean-up call constitutes Only. proach.
implicit support if, in exercising the CFR ................ Code of Federal Regula- SPE ................ Special purpose entity.
call, the bank provides support in tions. T ..................... Thickness of the tranche of
excess of its contractual obligation to CRM ............... Credit risk mitigation. interest.
provide support to the securitization. CUSIP ............ Committee on Uniform Secu- TFR ................ Thrift financial report.
rities Identification Proce- TP .................. Percentage of the tranche of
S 11–6 The maximum risk-based
dures. interest the bank owns.
capital requirement for all securitization CVA ................ Credit valuation adjustment. UE .................. Underlying exposure.
exposures held by a bank associated CVaR ............. Credit value-at-risk. ULBII .............. Unexpected losses from
with a single securitization transaction EAD ................ Exposure at default. counterparty credit risk
is the amount of risk-based capital plus EBITDA .......... Earnings before interest, based on the Basel II cap-
expected losses that would have been taxes, depreciation and ital requirement with an
required had the underlying exposures amortization. alpha of 1.0.
not been securitized. EE .................. Expected exposure. ULCCR ........... Unexpected losses from
EPE ................ Expected positive exposure. counterparty credit risk at
S 11–7 Banks must follow the
EL ................... Expected loss. a one year 99.9% con-

specified hierarchy of approaches to ELGD ............. Expected loss given default.
determine risk-weighted asset amounts fidence level based on
EWALGD ....... Exposure-weighted average banks internal models.
for all securitization exposures. loss given default. USC ............... U.S. Code.
S 11–8 In order to use the RBA, the FASB .............. Financial Accounting Stand- VaR ................ Value-at-risk.
securitization exposure must be ards Board.
Proposed Supervisory Guidance on considerable flexibility in developing while providing each bank the ability to
Advanced Measurement Approaches operational risk management, data and uniquely tailor the framework to its
for Operational Risk assessment, and quantification organizational structure and culture.
Table of Contents processes that are appropriate for the This guidance should not be interpreted
nature of their activities, business as weakening or superseding the safety
I. Introduction environment, and internal controls. and soundness principles articulated in
A. Purpose This guidance should be considered existing statutes, or in the regulations or
B. Qualification Requirements, Supervisory with the related notice of proposed guidance issued by the Agencies.
Standards, and Operational Risk AMA
Systems
rulemaking (NPR), published in the The standards are organized into five
C. Supervisory Objectives and Approach Federal Register on September 25, major groupings: Operational risk
II. Definitions 2006.2 The NPR proposes the AMA management; operational risk data and
III. Operational Risk Management regulatory framework and the AMA assessment; operational risk
A. Governance qualification requirements for banks quantification; data management and
B. Board of Directors and Management that are required to operate, or seek to maintenance; and verification and
Oversight operate, under that framework. This validation. Operational risk
C. Firm-Wide Operational Risk supervisory guidance provides management includes standards for the
Management Function
D. Line of Business Management additional detail regarding supervisory governance and organizational
E. Reporting standards for operational risk structures (including reporting) needed
IV. Operational Risk Data and Assessment management, data and assessment, and to manage operational risk. Operational
A. Capture and Maintenance of Elements quantification processes that will help a risk data and assessment establishes the
B. Internal Operational Loss Event Data bank comply with the qualification standards for a consistent and
C. External Operational Loss Event Data requirements in the NPR. comprehensive capture of the four
D. Scenario Analysis elements of the AMA.4 Operational risk
E. Business Environment and Internal B. Qualification Requirements, quantification encompasses the
Control Factors Supervisory Standards, and Operational standards governing the systems and
V. Operational Risk Quantification Risk AMA Systems
A. Analytical Framework processes that quantify a bank’s
B. Eligible Operational Risk Offsets Although operational risk is not a new operational risk exposure. The sections
C. Unit of Measure risk, deregulation and globalization of addressing data management and
D. Accounting for Dependence financial services, together with the maintenance, and verification and
E. Risk Mitigation growing sophistication of financial validation, establish standards to help
F. Alternative Approaches for Depository technology, and new business activities ensure that a bank’s AMA System
Institutions and delivery channels are making remains robust and relevant as its
G. Documentation of Operational Risk
banks’ operational risk profiles (i.e., the operational risk profile changes over
Quantification Systems
VI. Data Management and Maintenance level of operational risk across banks’ time. The objectives of the standards are
VII. Verification and Validation activities and risk categories) more to help ensure rigor, integrity, and
VIII. Appendices complex. As such, banks and transparency for each bank’s AMA
A. The NPR Qualification Requirements, supervisors are increasingly viewing System and the resulting operational
Risk-Weighted Assets for Operational operational risk management as a risk component of the bank’s risk-based
Risk, and Disclosure Requirements distinct risk discipline. The NPR and capital requirement.
B. Supervisory Standards this guidance outline a more disciplined A bank’s AMA System should provide
C. The NPR Qualification Process for the consistent application of
approach to operational risk
D. Basel II Operational Risk Information operational risk policies and procedures
Collection Templates management and measurement.
E. Operational Loss Event Types and The NPR establishes the qualification throughout the bank, and address the
Examples requirements that a bank must meet in roles of both the independent firm-wide
order to use advanced systems for operational risk management function
I. Introduction calculating its risk-based capital and the lines of business. A sound AMA
A. Purpose requirement. The NPR qualification System will identify operational risk
requirements for banks using an AMA losses, calculate operational risk
This document sets forth the exposures and associated operational
System to calculate the operational risk
supervisory guidance of the federal risk regulatory capital, promote risk
component of the bank’s risk-based
banking agencies 1 (‘‘Agencies’’) for U.S. management processes and procedures
capital requirement are listed in
banks, savings associations, and bank to mitigate or control operational risks,
Appendix A.3 This guidance identifies
holding companies (‘‘banks’’) that use and help ensure that management is
supervisory standards (‘‘S’’) that a bank
Advanced Measurement Approaches fully aware of emerging operational risk
should follow to implement and
(AMA) for calculating the risk-based issues. This framework should also
maintain an AMA System for regulatory
capital requirement for operational risk provide for the consistent and
capital purposes. Banks meeting these
under the Basel II capital regulation. comprehensive capture and assessment
standards should be well positioned to
The primary Federal supervisor will of data elements needed to identify,
demonstrate that their AMA System
review a bank’s AMA System relative to measure, monitor, and control the
meets the qualification requirements of
relevant regulatory requirements and bank’s operational risk exposure. This
the NPR. The relevant supervisory
this guidance to determine whether the includes identifying the nature, type(s),
standards are listed at the beginning of
bank may use Basel II-based rules to and underlying cause(s) of the
each major section of the guidance, with
determine its risk-based capital operational loss event(s). Moreover, the
a full compilation of the standards
requirements. Banks will have
provided in Appendix B. The standards

4 The four elements of the AMA include internal
1 The Federal banking agencies are: the Board of
establish broad regulatory guidelines, operational loss event data, external operational
Governors of the Federal Reserve System, the loss event data, scenario analysis, and business
2 71 FR 55830 (Sept. 25, 2006).
Federal Deposit Insurance Corporation, the Office of environment and internal control factors. See
the Comptroller of the Currency, and the Office of 3 This guidance does not include all of the Section IV for a detailed discussion of the
Thrift Supervision. qualifying criteria contained in the NPR. supervisory standards for each element.
framework must also include A bank’s AMA System will be • Benchmarking means the
independent verification and validation assessed as part of the ongoing comparison of a bank’s internal
to assess the effectiveness of the supervision process. Some elements of estimates with relevant internal and
controls supporting the bank’s AMA sound operational risk management (for external data sources or estimation
System, including compliance with example, internal controls and techniques.
policies, processes, and procedures. information technology) have long been • Business environment and internal
Given the importance of these functions, subject to examination by supervisors. control factors means the indicators of
the Agencies believe that a bank’s Where practical, supervisors will make a bank’s operational risk profile that
validation and verification functions every effort to leverage these reflect a current and forward-looking
should begin their work soon after the examination activities to assess the assessment of the bank’s underlying
bank has started to implement its AMA effectiveness of AMA processes. business risk factors and internal
System. Substantive weaknesses or changes in a control environment.
In practice, a bank’s operational risk bank’s operational risk profile identified • Dependence means a measure of the
AMA System should reflect the scope in an examination or through other association among operational losses
and complexity of the business lines, as supervisory activities will be factored across and within business lines and
well as the corporate organizational into the AMA qualification process.5 operational loss event types.
structure. Each bank’s operational risk A part of the supervisory review will • Eligible operational risk offsets
profile is unique and requires a tailored include an assessment of the bank’s means amounts, not to exceed expected
risk management approach, appropriate implementation plan.6 The operational loss, that:
for the scale and materiality of the risks implementation plan must address how (1) Are generated by internal business
present, and the size of the bank. There the bank complies or plans to comply practices to absorb highly predictable
is no single framework that suits every with the AMA qualification and reasonably stable operational losses,
bank; the Agencies expect that different requirements. The plan must also including reserves calculated consistent
banks will develop and implement address the qualifying standards for the with GAAP; and
unique risk management, data and bank and each consolidated subsidiary (2) Are available to cover expected
assessment, and quantification systems, (U.S. and foreign-based). A operational losses with a high degree of
consistent with their culture and risk comprehensive and sound planning and certainty over a one-year horizon.
profile. governance process to oversee the • Expected operational loss (EOL)
C. Supervisory Objectives and Approach implementation efforts must also be means the expected value (mean) of the
The supervisory standards in this maintained. For a complete description distribution of potential aggregate
document apply to banks subject to the of the NPR’s qualification process, operational losses, as generated by the
Basel II regulation. However, the please see Appendix C. bank’s operational risk quantification
Agencies will not simply evaluate a system using a one-year horizon.
II. Definitions
bank’s qualification using each of the • External operational loss event
There are important definitions data, with respect to a bank, means
individual supervisory standards.
Supervisors will also assess how well relevant to an AMA System for the gross operational loss amounts, dates,
the various components of a bank’s purposes of the Agencies’ risk-based recoveries, and relevant causal
AMA System complement and reinforce capital requirements. They are: information for operational loss events
one another to achieve the overall • Advanced Measurement Approach occurring at organizations other than the
objectives of effective management and (AMA) System means a bank’s advanced bank.
measurement of operational risk. operational risk management processes, • GAAP means U.S. generally
In performing their evaluation, the operational risk data and assessment accepted accounting principles.
Agencies will exercise supervisory systems, and operational risk • Internal operational loss event data,
judgment in evaluating both the quantification systems. with respect to a bank, means gross
individual components and the overall • Backtesting means the comparison operational loss amounts, dates,
AMA System. The NPR provides that of a bank’s internal estimates with recoveries, and relevant causal
the primary Federal supervisor may actual outcomes during a sample period information for operational loss events
require a bank to assign a different risk- not used in model development. In this occurring at the bank.
weighted asset amount for operational context, backtesting is one form of out- • Operational loss means a loss
risk, to change aspects of its operational of-sample testing. (excluding insurance or tax effects)
risk analytical framework (for example, resulting from an operational loss event.
distributional or dependence 5 For example, mergers and acquisitions Operational loss includes all expenses
assumptions), or to make other changes potentially change the operational risk profile of the associated with an operational loss
bank, pose challenges in integrating operational risk
to the bank’s operational risk management, data and assessment, and
event except for opportunity costs,
management processes, data and quantification processes of the affected banks, and forgone revenue, and costs related to
assessment systems, or quantification consequently raise supervisory issues regarding a risk management and control
systems if the supervisor determines bank’s AMA System. The Agencies will assess the enhancements implemented to prevent
effects of mergers and acquisitions as a part of the
that the risk-weighted asset amount for ongoing supervision of operational risk
future operational losses.
operational risk produced by the bank is management. • Operational loss event means an
not commensurate with the bank’s 6 A bank that becomes subject to the requirements event that results in loss and is
operational risk profile. The primary of the rule must adopt a written implementation associated with internal fraud; external
plan no later than six months after the later of the fraud;7 employment practices and
Federal supervisor may exercise this effective date of the final rule or the date the bank
authority, for example, if it has
meets one of the applicability criterion of the rule.

identified significant changes or A bank that chooses to be subject to the 7 Retail credit card losses arising from non-
weakness within operational risk requirements of the final rule must adopt a written contractual, third-party initiated fraud (for example,
implementation plan and notify its primary Federal identity theft) are to be treated as external fraud
management processes that have not supervisor in writing of its intent at least twelve operational losses. All other third-party initiated
been appropriately captured in the months before it proposes to be subject to the first losses are to be treated as credit losses—see
bank’s AMA System. floor period. discussion under Standard 17 for more details.
workplace safety; clients, products, and scale and complexity of the bank’s • A description of the verification
business practices; damage to physical operational risk profile. However, and validation processes and
assets; business disruption and system within all AMA banks, there are three procedures; and
failures; or execution, delivery, and key components that should be evident: • Descriptions of the review and
process management (see Appendix D The firm-wide operational risk approval process for significant policy
for examples of loss event types). management function, line of business and procedural changes and exceptions.
• Operational risk means the risk of management, and an independent audit The bank’s documentation should
loss resulting from inadequate or failed function. These three areas should have clearly differentiate the roles and
internal processes, people, and systems functional independence,8 but should responsibilities of the independent
or from external events (including legal work in cooperation to ensure that an verification and validation functions.
risk, but excluding strategic and effective AMA System is in place. Activities to verify the bank’s AMA
reputational risk). S 2. The bank must have and System are typically included in the
• Operational risk exposure means document a process that clearly bank’s internal or external audit
the 99.9th percentile of the distribution describes its AMA System, including programs. More specifically,
of potential aggregate operational losses, how the bank identifies, measures, independent verification includes the
as generated by the bank’s operational monitors, and controls operational risk. work done to test and verify the bank’s
risk quantification system using a one- Management should maintain AMA policies and procedures.
year horizon (and not incorporating comprehensive documentation on Verification activities should be
eligible operational risk offsets or operational risk management policies, sufficiently broad to confirm that the
qualifying operational risk mitigants). processes, and procedures and bank’s AMA System is working
• Parallel run period means a period communicate them to appropriate staff. effectively and in a manner consistent
of at least four consecutive quarters after The documentation should outline all with policies approved by the bank’s
adoption of the bank’s implementation aspects of the bank’s AMA System, board of directors. In addition, the
plan before the bank’s first floor period including the following: verification function ensures that
during which the bank complies with • The roles and responsibilities of the validation of AMA models was
all the qualification requirements to the board of directors,9 the independent completed in accordance with the
satisfaction of the bank’s primary firm-wide operational risk management bank’s validation policy. Validation
Federal supervisor. function, line of business management, includes processes the bank uses to test
• Scenario analysis means a and the independent verification and and assess the accuracy of models used
systematic process of obtaining expert validation functions; to quantify the operational risk exposure
opinions from business managers and • A definition for operational risk and the operational risk component of
risk management experts to derive that, at a minimum, encompasses the the bank’s risk-based capital
reasoned assessments of the likelihood regulatory definition of operational risk, requirement.
and loss impact of plausible high- including the loss event types that will The documentation need not be
severity operational losses. be monitored; contained in a single comprehensive
• Total risk-weighted assets means: • The capture and use of internal and document. Instead, banks may choose to
(1) The sum of: external operational risk loss event data, develop and maintain an umbrella
(i) Credit risk-weighted assets; and including clear documentation of which document that provides the board of
(ii) Risk-weighted assets for losses are used in and which are directors with an overview of its AMA
operational risk; minus excluded from estimating the bank’s System, including how the framework
(2) The sum of: operational risk exposure; allows for identifying, measuring,
(i) Excess eligible credit reserves not • The appropriate use of scenario monitoring, and controlling operational
included in Tier 2 capital; and analysis; risk. A bank should consider including
(ii) Allocated transfer risk reserves. • The development and incorporation the following in this overview
• Unexpected operational loss (UOL) of business environment and internal document:
means the difference between the bank’s control factor assessments, and risk • Define the bank’s philosophy and
operational risk exposure and the bank’s mitigants; strategy for operational risk
expected operational loss. • A description of the analytical management and its risk tolerance;
• Unit of measure means the level framework that quantifies the • Define the roles and responsibilities
(for example, organizational unit or operational risk exposure of the bank; of those involved in the development,
operational loss event type) at which the • How eligible operational risk offsets implementation, and oversight of the
bank’s operational risk quantification are determined, measured, and bank’s AMA System; and
accounted for; • Reference additional detailed
system generates a separate distribution
• A description of report content, policies, processes, and procedures.
of potential operational losses.
distribution, and frequency for board of S 3. The bank must maintain
III. Operational Risk Management directors, line of business, and firm- effective internal controls supporting its
wide reporting, including escalation of AMA System.
A. Governance As one of the foundations of safe and
emerging issues and changing trends;
S 1. The bank’s AMA System must sound banking, sound internal controls
include an operational risk 8 For the purposes of this guidance, ‘‘functional are essential to a bank’s management of
management function and audit independence’’ is the ability to carry out work operational risk and are an important
function that are independent of freely and objectively and render impartial and requirement for AMA qualification.
unbiased judgments. Independence is often
business line management. The evidenced through separate reporting lines. When properly designed and
operational risk management function consistently enforced, a sound system of
Supervisory assessments of independence will rely

should address operational risk on a upon guidelines contained in existing regulatory internal controls will help management
firm-wide basis. guidance (for example, audit, internal control safeguard the bank’s resources, produce
systems, and board of directors/management).
The organizational structure that 9 For the purposes of this guidance, the ‘‘board of reliable financial reports, and comply
supports a bank’s AMA System may directors’’ refers to either the full board or its with laws and regulations. Sound
vary across banks, but should reflect the designated board committee. internal controls, assessed annually for
effectiveness by internal audit, should cornerstone of an effective operational The board of directors may delegate
also reduce the possibility of significant risk management process. The board of the responsibility and authority for the
human errors and irregularities in directors is responsible for overseeing design and implementation of the AMA
internal processes and systems, and the establishment and ongoing System to management. Management is
should assist in their timely detection effectiveness of the AMA System. The responsible for translating the bank’s
when they do occur. The audit board of directors must approve the AMA System into specific policies,
function’s annual assessment is not bank’s written implementation plan. In processes, and procedures,
required to assess all operational risk addition, the board of directors must at implementing them across business
controls, but the scope of the assessment least annually evaluate the effectiveness lines, and ensuring independent
should be sufficient to assess the of, and approve, the bank’s AMA verification and validation of the AMA
effectiveness of the controls supporting System. Information provided to the System. Management is also responsible
the bank’s AMA System (see Section board of directors for this review should for communicating the policies,
VII). be detailed enough for the bank’s board processes, and procedures throughout
The Agencies are not introducing new members to understand and evaluate its the bank to ensure consistent
internal control standards, but rather AMA System.11 The board of directors’ understanding and treatment of
emphasizing the importance of existing evaluation should reflect the results of operational risk.
standards.10 Internal control systems any independent reviews and the While each level of management is
may differ among banks due to the findings of the verification and responsible for implementing the AMA
nature and complexity of a bank’s validation functions.12 System in their areas, senior
products and services, organizational Other board of directors’ management should clearly assign
structure, and risk management culture. responsibilities with respect to authority and responsibilities to
The existing regulatory standards allow operational risk may include: business managers to encourage and
for these differences, while also • Understanding and approving the maintain accountability. Moreover,
establishing regulatory expectations for bank’s tolerance for operational risk; 13 senior management should ensure
the scope and quality of the internal • Ensuring appropriate management appropriate implementation of the AMA
control structure. responsibility, accountability, and System within individual business
The extent to which a bank maintains reporting; lines.
effective internal controls will be Senior management is responsible for
• Understanding the major aspects of
assessed through ongoing supervisory ensuring that operational risk is
the bank’s operational risk profile
processes. As noted earlier, the appropriately managed across the bank
through the periodic review of high-
Agencies will leverage existing and that all components of the bank’s
level reports that address material risks,
examination processes to avoid AMA System function effectively and
capital adequacy, and strategic
duplication in assessing implementation meet regulatory requirements.
implications for the bank;
of a bank’s AMA System. Specifically, management should ensure
• Ensuring that management
B. Board of Directors and Management demonstrates that it is actively using its that the bank has qualified staff and
Oversight AMA System as a basis for assessing sufficient resources to carry out the
and managing operational risk, and that operational risk functions outlined in its
S 4. The bank must ensure that an AMA System. Appropriate staff and
effective framework is in place to the framework’s use is not limited to
determining regulatory capital; resources should be available within the
identify, measure, monitor, and control lines of business, the firm-wide
operational risk, and to accurately • Ensuring that mechanisms exist to
allow for the independent verification of operational risk management function,
compute the bank’s operational risk and the verification and validation
component of the bank’s risk-based the AMA System’s implementation and
validation activities; functions to monitor and enforce
capital requirement. The board of
• Ensuring that mechanisms exist to compliance with the bank’s policies and
directors must at least annually
allow for the independent validation of procedures related to the AMA System.
evaluate the effectiveness of, and Other management responsibilities
approve, the bank’s AMA System, the bank’s risk measurement and
include ensuring that:
including the strength of the bank’s quantification processes; and
• The bank’s overall operational risk
control infrastructure. • Ensuring Compliance with
profile is monitored, maintained at
S 5. The board of directors and regulatory disclosure requirements.
prudent levels, and supported by
management should ensure that the adequate capital;
bank’s operational risk management, 11 Important sources of information about the
• Compensation policies are
data and assessment, and effectiveness of the AMA System include: (1)
sufficiently flexible to attract and retain
quantification processes are Internal audit’s annual review of the effectiveness
of operational risk controls and the independent qualified and competent operational
appropriately integrated into the bank’s verification function’s annual assessment of the risk expertise; and
existing risk management and decision- adequacy of the overall operational risk framework, • Operational risk issues are
making processes and that there are and (2) the results of the validation function’s
communicated consistently to staff
adequate resources to support these testing of model results and assessment of
quantification processes—see Standards 3 and 32. responsible for managing other risks (for
processes throughout the bank. 12 See Section VII—Verification and Validation example, credit, market, and liquidity
Strong board of directors and for more details regarding independent review risk), as well as staff responsible for
management oversight forms the requirements. purchasing insurance and overseeing
13 Banks use several approaches to define
10 Each Agency has extensive guidance on operational risk tolerance, including establishing
third-party outsourcing arrangements.
corporate governance, internal controls, and risk expectations for control self assessments, C. Firm-Wide Operational Risk
monitoring and reporting in its respective establishing targeted ceilings for operational losses,
examination policies and procedures. All Agencies developing key risk indicators, or establishing other Management Function
have standards for safe and sound operations and qualitative expectations for operational risk S 6. The bank must have a firm-wide
for safeguarding customer information. In addition, management. These approaches will continue to
there are a number of interagency standards that evolve and banks are encouraged to continue to
operational risk management function
cover topics relevant to the internal control develop effective metrics to define their operational that oversees the AMA System and is
structure. risk tolerance. independent of business line
management. The operational risk manage operational risk associated with IV. Operational Risk Data and
management function is also the products and activities offered. Assessment
responsible for the development of Implementation of the AMA System The bank must have operational risk
operational risk data and assessment within each line of business should data and assessment systems that
systems, operational risk quantification correspond to the scope of that business include credible, transparent,
systems, and related processes and its operational complexity and risk systematic, and verifiable processes that
throughout the bank. profile. Line of business operational risk incorporate the following elements on
S 7. The firm-wide operational risk reporting should be appropriate in an ongoing basis:
management function should ensure frequency and scope to identify, • Internal operational loss event data,
adequate analysis and reporting of measure, monitor, and control • Relevant external operational loss
operational risk information. The operational risk. Reporting should also event data,
function should also develop and report address the condition of the internal • Scenario analysis, and
on the firm-wide operational risk control environment for a given line of • Assessments of the bank’s business
profile. business. environment and internal control
The roles and responsibilities of the factors.
E. Reporting
firm-wide operational risk management In addition, the operational risk data
function may vary among banks, but S 10. The board of directors and and assessment systems must be
should be clearly documented in senior management must receive structured in a manner consistent with
operational risk policies and reports on operational risk exposure, the bank’s current business activities,
procedures. The firm-wide function operational risk loss events, and other risk profile, technological processes,
should have organizational stature relevant operational risk information. and risk management processes. The
commensurate with the bank’s The reports should include information operational risk data and assessment
operational risk profile. At a minimum, regarding firm-wide and business line systems should provide for the
the function should ensure the risk profiles, loss experience, and consistent and comprehensive capture
development of policies, processes, and relevant business environment and of the four elements needed to measure
procedures that explicitly manage internal control factor assessments. and verify the bank’s operational risk
operational risk as a distinct risk. These reports should be received exposure. The four elements should be
Responsibilities of the firm-wide quarterly. combined in a manner that most
operational risk management function To facilitate monitoring of operational effectively allows the bank to quantify
may include: risk, results from the data and its exposure to operational risk.
• Assisting in the implementation of assessment, and quantification
the AMA System; processes should be summarized and A. Capture and Maintenance of
• Reviewing the bank’s performance included in reports that can be used by Elements
against stated operational risk different audiences to understand, S 11. The bank must have a
objectives, goals, and risk tolerances; manage, and control operational risk systematic process for incorporating
• Periodically evaluating the and losses. Reports generated by the internal loss event data, external loss
effectiveness of the bank’s AMA bank’s AMA System 15 should provide event data, scenario analyses, and
System;14 the foundation for reporting to the board assessments of its business environment
• Reviewing and analyzing of directors and senior management. and internal controls factors to support
operational loss event data and reports; Comprehensive management reporting, both its operational risk management
and geared toward the firm-wide operational and measurement framework, as well
• Ensuring appropriate reporting to risk management function and line of as its calculation of the bank’s
senior management and the board of business management, should include: operational risk component of its risk-
directors. • Operational loss experience, based capital requirement.
D. Line of Business Management including an overview and assessment S 12. The bank must use the
of loss experience over time; regulatory definition of operational risk
S 8. Line of business management is when assessing the operational risks to
• Operational risk exposure;
responsible for ensuring appropriate which the bank is exposed in order to
day-to-day management of the • Changes in assessments of business
environment and internal control calculate its risk-based capital
operational risks within its business requirement for operational risk. The
unit. factors;
bank should have clear standards for
S 9. Line of business management • Changes in factors signaling an
the collection and modification of all
should ensure that internal controls increased risk of future losses;
four elements in the operational risk
and practices within its business unit • Trend analysis, allowing line of data and assessment systems that
are consistent with firm-wide policies, business and independent firm-wide support its AMA System.
processes, and procedures. operational risk management to assess The four required elements of a bank’s
Line of business management should and manage operational risk exposures, data and assessment systems that
ensure that business-specific policies, systemic line of business risk issues, support its AMA System aid the bank in
processes, and procedures are in place, and other corporate risk issues; identifying the level of and trends in
and appropriate staff is available to • Policy and risk tolerance reporting; operational risk, determining the
and effectiveness of risk management and
• Operational risk causal factors.
14 The evaluation of a bank’s operational risk
framework may consider loss experience; effects of

control, highlighting opportunities to
better mitigate operational risk, and
external market changes, other environmental

factors, and the potential for new or changing 15 The firm-wide operational risk management assessing operational risk on a forward-
operational risks associated with new products, function, lines of business, and the verification and looking basis. The bank should
activities or systems; and the framework’s ability to validation functions should be generating reports
detect or prevent potential operational losses. This for their unique needs. These reports should form
demonstrate that the four elements
evaluation process should include an assessment of the basis for aggregating reporting to senior jointly cover all significant operational
leading industry practices. management and the board of directors. risks to which it is exposed. In the case
where the bank has sustained an integrating a new business line. the data capture requirements by
operational loss event above its Internal data should be captured across appropriate staff. The independent firm-
established threshold, but the loss is not all business lines, corporate functions, wide operational risk management
yet included in the internal loss events, product types, and geographic function should ensure that the loss
database, the bank should be able to locations. The bank must have a data are captured across all business
demonstrate that the exposure is systematic process for capturing and lines, corporate functions, products
reasonably captured elsewhere, such as using internal operational loss event types, event types, and from all
in one of its external loss observations data in its operational risk data and geographic locations that could generate
or in one of its scenarios (see Standard assessment systems. operational risk. The bank’s operational
16 regarding the use of thresholds). S 14. The bank should be able to map loss policies and procedures should
The bank should demonstrate that it internal operational losses to the seven consider the effect and treatment of
has implemented its AMA System operational loss-event categories. operational loss events that are
appropriately in all lines of business S 15. The bank should have a policy recovered within a short period of time.
and corporate functions that could that identifies when an operational loss The bank’s data and assessment
generate operational risk. For regulatory is recognized and should be added to system should have the ability to
capital purposes, a bank must use the the loss event database. The policy aggregate internal losses that are
definition of operational risk that is should provide for consistent treatment associated with the same loss event.
provided in Section II—Definitions. A across the bank. This means the bank should be able to
bank may use an expanded definition S 16. The bank may establish link operational loss events that cross
for risk management and measurement appropriate internal operational loss multiple business lines or event types.
purposes, if it considers it more event data thresholds and, if so, must Institutions should also maintain
appropriate for risk management and demonstrate the appropriateness of policies to ensure consistent
measurement purposes. such thresholds. identification and capture of multiple
As part of its AMA System S 17. The bank should have a clear loss events that occur within one or
implementation, a bank should policy that allows for the consistent several time periods, but that result
demonstrate that it has established a treatment of loss event classifications
from the same initial operational loss
consistent and comprehensive process (for example, credit, market, or
event. When capturing internal losses
for the capture and modification of all operational loss events) across the
that span more than one business line,
four required elements. While the organization.
Internal data with sufficient integrity the bank may choose to assign the entire
primary Federal supervisor will review loss to one business line (for example,
the quantification processes that is important in identifying the level of
and trends in operational risk. A key to where the effect is the greatest, where
combine these elements to determine the control breakdown occurred).
the operational risk exposure, the internal data integrity is the consistent
and complete capture of loss event data Alternatively, the bank may choose to
supervisor must have the capacity to apportion the loss across several
review the data collection process and across the bank. The bank must have a
minimum historical observation period affected business lines. Regardless of
the individual elements as well. how losses are assigned, the method
The bank should have a defined of five years of internal operational loss
event data, or such shorter transitional should be well-reasoned and
process that establishes responsibilities
period approved by the bank’s primary sufficiently documented. The treatment
over the systems developed to capture
Federal supervisor. For example, when of related losses will also have an effect
and modify the AMA elements. In
a bank has recently acquired a firm that on dependence modeling, as discussed
particular, the issue of modifying the
does not have comprehensive internal under Standard 28. If data are not
data capture systems should be
loss event data, the resulting bank captured across all business lines or
addressed in policies or procedures.
should make use of both its internal loss from all geographic locations, the bank
System and process documentation
data and the acquired firm’s data to should document and explain the
should be maintained, with any
properly reflect the risks of the resulting exceptions, including why the
modification tracked separately and
institution. Depending on the quality of exceptions will not impair the bank’s
reasons for the changes kept in the
the data from the acquired firm, the estimation of its operational risk
historical record. Such tracking allows
resulting bank may have to place more exposure.
management and supervisors to identify
weight on relevant external loss event The description of the loss event,
the nature and rationale of the
data, results from scenario analysis, and including causal factors, should be
modification. For example, the Agencies
factors reflecting assessments of the collected for internal operational loss
are particularly interested when a bank
business environment and internal events. Examples of additional loss
modifies its loss database by excluding
controls. Additionally, if a bank exits a event information to be collected
a loss event from the quantitative
business line and can clearly include:
measurement process. Management • Gross loss amount;
should have clear standards for demonstrate that its exposure has been • Where the loss is reported and
addressing modifications and clearly eliminated and that the loss experience expensed;
delineate who has authority to override does not have relevance to other • Loss event type category;
the data systems and under what remaining activities, the bank would • Date of the loss;
circumstances. In addition, management likely be able to exclude that business • Discovery date of the loss;
should track override decisions. unit’s loss experience from subsequent • Event end date;
quantification processes. • Insurance recoveries;
B. Internal Operational Loss Event Data The bank should have a policy that • Other recoveries; and
S 13. The bank must have a historical identifies when an operational loss is • Adjustments to the loss estimate.
observation period of at least five years recognized and should be added to the The level of detail describing the loss
for internal operational loss event data. loss event database. Policies and event and management action should be
A shorter period may be approved by procedures should be communicated to commensurate with the size of the gross
the primary Federal supervisor to ensure there is satisfactory loss amount. The bank may also choose
address transitional situations, such as understanding of operational risk and to capture additional data that enhance
its operational risk management, data loss events; and (3) credit, market, and consortia while other banks are using
and assessment, and quantification operational risk losses are being data obtained from vendor databases or
processes. For example, it may be accounted for in the correct manner for public sources such as court records or
appropriate to capture data on ‘‘near regulatory capital purposes. media reports. In all cases, management
miss’’ events, where no financial loss The agencies have established a should carefully evaluate the data
was incurred. While these near misses boundary between credit and source to ensure that the information
may not factor directly into the operational risks for regulatory capital being reported is relevant and accurate.
regulatory capital calculation, they may purposes. Losses that arise from events The bank should document its process
be useful to inform scenario analysis or associated with a credit arrangement for and decisions regarding external
for the operational risk management with a borrower are credit losses with data selection and scaling.
process. one proposed exception: Retail credit
For regulatory capital purposes, AMA D. Scenario Analysis
card fraud losses (for example, identity
banks should be able to map operational theft) are to be considered external fraud S 20. The bank must have a
risk losses into the seven operational operational losses. systematic process for determining how
loss event categories defined in Section scenario analysis will be incorporated
II. Banks will not be required to produce C. External Operational Loss Event Data into its operational risk data and
reports or perform analysis on the basis S 18. THE BANK MUST HAVE A SYSTEMATIC assessment systems.
of the operational loss event categories PROCESS FOR DETERMINING HOW EXTERNAL Scenario analysis allows the bank to
for internal purposes, but should use the LOSS DATA WILL BE INCORPORATED INTO incorporate forward-looking elements
information to verify the ITS OPERATIONAL RISK DATA AND into its operational risk data and
comprehensiveness of the bank’s data ASSESSMENT SYSTEMS. assessment systems. More specifically,
set. S 19. THE BANK SHOULD SYSTEMATICALLY scenario analysis is a systematic process
The bank may refrain from collecting REVIEW EXTERNAL DATA TO ENSURE AN of obtaining expert opinions from
internal operational loss event data for UNDERSTANDING OF INDUSTRY business and risk managers to derive
individual operational losses below OPERATIONAL LOSS EXPERIENCE. reasoned assessments of the likelihood
established thresholds, if the bank can External data may serve a number of and loss impact of plausible high-
demonstrate to its primary Federal different purposes in an AMA System. severity operational losses that may
supervisor that the thresholds are For example, where internal loss data occur at a bank. Scenario analysis is
reasonable. There are a number of are limited, external data may be a especially relevant for business lines or
factors that a bank may use to establish useful input in determining the bank’s operational loss event types in which
the thresholds. Thresholds may be level of operational risk exposure. Even internal data, external data, or
based on business lines, corporate where external loss data are not an assessments of business environment
functions, product types, geographic explicit input to a bank’s database, such and internal control factors do not
location, or other appropriate factors. data may provide a means for the bank provide a sufficiently robust estimate of
The Agencies will allow flexibility in to understand industry experience and the bank’s exposure to operational risk.
this area, provided the bank can assess the adequacy of its internal data. For example, a bank’s scenario analysis
demonstrate that the thresholds are External data may also prove useful to should include consideration of high-
reasonable, do not exclude important inform scenario analysis, provide severity loss events that occur
internal operational loss event data, and additional data for severity infrequently in the industry. It could
permit the bank to capture substantially distributions, or in model validation also include the effects of mergers or
all the dollar value of the bank’s and out-of-sample testing. other significant organizational changes
operational losses. A bank could The bank must establish a systematic that may affect the nature of operational
demonstrate to its primary Federal process for determining the losses in the future. Business line and
supervisor that it has chosen methodologies for incorporating risk management experts’ use of well-
appropriate thresholds by estimating the external loss data into its operational reasoned, external data may itself be a
change in operational risk exposure as risk data and assessment systems. To form of scenario analysis.
a result of using different thresholds.16 incorporate external loss data into a The bank must have a systematic
Banks may also find it useful to bank’s framework, examples of the type process for determining the
capture loss events in their operational of information a bank should collect methodologies for incorporating
risk databases that are treated as credit include: scenario analysis into its operational
risk for regulatory capital purposes, but • Loss amount; risk data and assessment systems. The
have an underlying element of • Loss description; 17 process should cover key elements of
operational risk. These types of events, • Loss event type category; scenario analysis, such as the manner in
while not incorporated into the • Loss event date; which the scenarios are generated, the
regulatory capital calculation for • Adjustments to the loss amount (for frequency with which they are updated,
operational risk, may have implications example, recoveries and insurance and the scope and coverage of
for operational risk management. For settlements) to the extent that they are operational loss events they are
banks that capture loss events known; and intended to reflect. The bank should
differently for regulatory capital and • Sufficient information about the document its process for conducting
risk management purposes, bank reporting institution to facilitate scenario analysis, as well as the results
management should demonstrate that comparison to its own organization. of the analysis.
(1) loss events are being captured Banks may obtain external loss data in E. Business Environment and Internal
consistently across the bank; (2) the data any reasonable manner. For example, Control Factors
systems are sufficiently advanced to some banks are using data acquired
S 21. The bank must incorporate
allow for this differential treatment of through membership with industry
business environment and internal
16 As discussed later in Standard 26, the choice 17 Loss descriptions should be included to the control factors into the bank’s
of thresholds may affect the amount of EL offset that extent possible, but are not generally available from operational risk data and assessment
a bank can recognize. consortium data sources. systems.
S 22. The bank must periodically regard, banks should identify and assess exposure, which is defined as the 99.9th
compare the results of its business the level of and trends in operational percentile of the distribution of
environment and internal control factor risk and related control structures across potential aggregate operational losses
assessments against the bank’s actual the organization. These assessments over a one-year horizon. The bank’s
operational risk loss experience. should be current and comprehensive operational risk exposure is the starting
Business environment and internal across the bank, and should identify the point in determining the risk-based
control factors are indicators of the critical operational risks facing the capital requirement for operational risk
bank’s operational risk profile that bank. (see Graph 1).
reflect the underlying business risk The business environment and
factors, an assessment of the current internal control factor assessments A bank’s estimate of operational risk
internal control environment, and a should identify positive and negative exposure includes both EOL and UOL,
forward-looking assessment of the trends in operational risk management forming the basis of the bank’s risk-
bank’s control environment. The within the bank. These assessments based capital requirement for
framework established to maintain the include reviewing both the control operational risk. The bank’s estimate of
business environment and internal processes relating to current activities, operational risk exposure should also
control factor assessments should be as well as those relating to anticipated consider qualitative factors (for
sufficiently flexible to encompass the changes in a bank’s business risk example, changes in business
range and complexity of actual and profile. Periodic comparisons must be environment and internal control
planned activities, changes in internal made between the bank’s actual factors). Qualitative factors can be
control systems, or an increased volume operational loss exposure and the incorporated into the bank’s
of information. In principle, a bank with assessment results. quantification methodology in different
strong internal controls in a stable ways and at different modeling stages.
business environment will have, all V. Operational Risk Quantification While not prescribing a specific
other things being equal, less exposure A bank must have a comprehensive methodology, the Agencies will assess
to operational risk than a bank with operational risk quantification system, the processes banks use to integrate
internal control weaknesses, that is using inputs from its data and qualitative factors into the
experiencing rapid growth, or that is assessment systems, that provides an quantification of operational risk
introducing new products. In this estimate of the bank’s operational risk exposure.
Operational risk exposure may be offsets for appropriateness. A bank may and limits (described in Section E
reduced with eligible operational risk also adjust its operational risk exposure below).
offsets, up to the amount of EOL (see to reflect reductions from operational The dollar risk-based capital
Section B below). The bank’s primary risk mitigants (for example, insurance), requirement for operational risk,
Federal supervisor will review the subject to the qualification requirements resulting from the bank’s risk
bank’s use of eligible operational risk quantification system, is the greater of:
EN28FE07.036</GPH>
• The bank’s operational risk requirements are intended to help (1) the qualitative/quantitative inputs
exposure adjusted for qualifying ensure that the regulation can and assumptions from the previous
operational risk mitigants minus eligible accommodate continued evolution of quarter or (2) the risk profile of the bank
operational risk offsets; or operational risk quantification that may affect the estimate of
• 0.8 multiplied by the difference techniques, yet remain amenable to operational risk exposure or the
between the bank’s operational risk consistent application and enforcement resulting operational risk capital
exposure and eligible operational risk across banks. The Agencies expect that requirement. Specifically, the bank
offsets (if any). there will be significant variation in should ensure that all major inputs,
If the bank has no qualifying analytical frameworks across banks, elements, and assumptions are
operational risk mitigants, the dollar with each bank tailoring its framework reviewed, and adjusted as necessary, to
risk-based capital requirement for to leverage existing technology reflect relevant changes in the bank’s
operational risk is equal to its platforms and risk management operational risk profile (for example,
operational risk exposure less any procedures. The framework must use changes in loss experience, data inputs,
eligible operational risk offsets. the following inputs: Internal business activity, external factors,
In recognition of the modeling operational loss event data, relevant assumptions, insurance coverage, and
challenges in legal entities with little external operational loss event data, eligible offsets). Senior management
internal operational risk loss data, a assessments of business environment should determine and document which
bank may generate an estimate of its and internal control factors, and components of the quantification system
operational risk exposure using an scenario analysis. The Agencies expect will need to be revised prior to
alternative approach to that described that there will be some uncertainty in recalculating the bank’s operational risk
above, with the prior written approval the analytical frameworks because of the exposure and operational risk capital
of its primary Federal supervisor. evolving nature of operational risk data requirement due to any identified
Requirements for the use of an and assessment systems. Therefore, the material change in inputs or
alternative approach are provided in analytical frameworks should be assumptions. A complete review and
Section V.F. below. conservative and reflect the recalculation of a bank’s estimate of
The bank’s risk-weighted asset evolutionary status of operational risk operational risk exposure and its risk-
amount for operational risk equals the management, measurement and based capital requirement for
bank’s dollar risk-based capital quantification, and its impact on data operational risk, including updating all
requirement for operational risk capture and analytical modeling. modeling inputs and assumptions, must
determined as described above The Agencies expect there will be be done at least annually.
multiplied by 12.5. variation across banks in the
combination and weighting of the four B. Eligible Operational Risk Offsets
A. Analytical Framework S 26. In calculating the risk-based
elements. In weighting each element, a
S 23. The bank must have an bank should consider availability and capital requirement for operational
operational risk quantification system applicability of each of the four risk, management may deduct certain
that provides an estimate of the bank’s elements within each unit of measure. eligible operational risk offsets from its
operational risk exposure. For example, banks with comprehensive estimate of operational risk exposure.
S 24. The bank’s operational risk internal data that reflect the full range To the extent that these offsets do not
quantification system must use a of their potential loss exposures may fully cover expected operational loss
combination of internal operational choose to place less emphasis on (EOL), the bank’s risk-based capital
loss event data, relevant external external data or scenario analysis. requirement for operational risk must
operational loss event data, business Conversely, banks with limited internal incorporate the shortfall. Eligible
environment and internal control factor data would generally rely more heavily operational risk offsets may only be
assessments, and scenario analysis on external data and scenario analysis used to offset EOL, not UOL.
results. The bank should combine these in estimating their operational risk In calculating the risk-based capital
elements in a manner that most exposure. requirement for operational risk, a bank
effectively enables it to quantify its Banks should be able to demonstrate may deduct certain eligible operational
operational risk exposure. The bank (see Standard 30) the effect of each risk offsets from its estimate of
should choose the analytical element on the operational risk operational risk exposure. As with other
framework that is most appropriate to exposure estimate. In cases where this is aspects of the AMA, the eligible
its business model. not possible, or where an element is not operational risk offset process is
S 25. The bank must review and used as a direct input into the intended to be flexible and dynamic in
update its operational risk quantitative model, the bank should order to accommodate the continuing
quantification system whenever it calculate a benchmark estimate using evolution of underlying business
becomes aware of information that may that element individually. practices and accounting standards.
have a material effect on the bank’s A bank must review and update its Supervisors will review all offsets to
estimate of operational risk exposure or operational risk quantification system ensure they are eligible as defined by
risk-based capital requirement for whenever it becomes aware of the NPR. The Agencies intend to
operational risk, but no less frequently information that may have a material develop a process of approving eligible
than annually. A complete review and effect on the bank’s estimate of operational risk offsets that is practical,
recalculation of the bank’s operational risk exposure, but no less clearly articulated, and grounded in
quantification system, including all frequently than annually. On a quarterly prudential bank supervisory principles.
modeling inputs and assumptions, must basis, a bank must publicly disclose its Banks should clearly document how
be done at least annually. total and Tier 1 risk-based capital ratios eligible operational risk offsets are
While not specifying the exact and their components, including measured and accounted for, including
methodology, the Agencies have operational risk related data (see how they meet the conditions outlined
developed regulatory requirements that Appendix D). As a part of this above.
a bank must use to determine its disclosure process, the bank should The maximum offset is bounded by
operational risk exposure. These consider any material changes in either EOL. Furthermore, the losses
corresponding to the eligible operational met in their particular individual of-sample testing). Such advances
risk offset must be fully consistent with circumstances. would in turn enhance the ability of the
the EOL-plus-UOL capital requirement bank to estimate its aggregate
D. Accounting for Dependence
calculated using the bank’s AMA model. operational losses at the 99.9 percent
If certain small losses are not modeled S 28. The bank may use internal confidence level.
(for example, because they are below a estimates of dependence among • Banks should perform sensitivity
collection threshold), an operational operational losses within and across analyses of the effect of alternative
risk offset should not be taken for such business lines and operational loss dependence assumptions on their
losses. events if the bank can demonstrate to operational risk exposure estimate.
Banks must demonstrate that losses the satisfaction of its primary Federal • Banks should not restrict
corresponding to the potential eligible supervisor that the bank’s process for dependence structures to those based on
operational risk offset are highly estimating dependence is sound, robust normal distributions, as normality may
predictable and reasonably stable. The to a variety of scenarios, and underestimate the amount of
bank’s estimation process for eligible implemented with integrity, and allows dependence between tail events.
for uncertainty surrounding the • Dependence assumptions should be
operational risk offsets should be
estimates. If the bank has not made consistent with the way in which loss
consistent over time. The Agencies
such a demonstration, it must sum events are defined and used. For
consider balance sheet reserves,
operational risk exposure estimates example, if one underlying factor causes
established consistent with GAAP to
across units of measures to calculate its multiple losses, such as an earthquake
cover such losses, as eligible operational
total operational risk exposure. that results in damage to multiple
risk offsets. Eligible offsets also must be
A bank using internal estimates of buildings, recording multiple loss
clear capital substitutes or otherwise dependence, whether explicit or entries in the data set would require the
available to cover EOL with a high embedded, must demonstrate that its bank to model the dependence between
degree of certainty over a one-year process for estimating dependency is these losses. Judicious aggregation of
horizon. Reserves associated with large, sound, robust to a variety of scenarios, related losses within the data set (in this
unexpected operational losses (UOL) do and implemented with integrity, and example, aggregating all of the losses
not qualify as eligible operational risk allows for the uncertainty surrounding caused by a single earthquake into one
offsets. While additional eligible the estimates. To the extent a bank loss entry) could satisfy some of the
operational risk offsets may be cannot support its process for estimating expectations regarding dependence
considered in the future, the Agencies’ dependence, the bank must sum modeling.
review of the implementation of AMA operational risk exposure estimates • The choice between a bottom-up or
Systems indicates that banks so far have across its chosen units of measure to a top-down modeling approach affects
only been able to demonstrate that calculate the bank’s total operational how a bank accounts for dependence. A
losses resulting from external credit risk exposure. While dependence bottom-up approach requires explicit
card fraud or securities processing modeling for operational risk is an assumptions regarding dependence to
errors may meet the test of being highly evolving area, banks should consider estimate operational risk exposure at the
predictable and reasonably stable. the following principles and guidelines: bank-wide level. Top-down approaches
C. Unit of Measure • Assumptions regarding dependence inherently mask dependence and, under
should be supported by empirical many circumstances, assume statistical
S 27. The bank must employ a unit analysis (data) where possible. The independence across business lines and
of measure that is appropriate for the Agencies expect this analysis will event types. To the extent a top-down
bank’s range of business activities and become more feasible over time as data approach is used, a bank should ensure
the variety of operational loss events to availability increases and greater that dependence within units of
which it is exposed, and that does not consensus emerges with regard to measure is suitably reflected in the
combine business activities or dependence modeling. operational risk exposure estimate.
operational loss events with different • Where empirical support is not • As with other areas of the
risk profiles within the same loss possible, dependence assumptions framework, assumptions regarding
distribution. should be based on the judgment of dependence should be conservative
Banks should weigh the advantages business line experts. In such cases, it given the uncertainties surrounding
and disadvantages of estimating a single would be important to express dependence modeling for operational
loss distribution or very few loss dependence concepts in intuitive terms. risk. The Agencies will closely review
distributions (top-down approach), For example, business line experts frameworks that assume statistical
versus a larger number of loss could assess the probability of certain independence across loss events.
distributions for specific event types large loss event scenarios occurring
and/or business lines (bottom-up simultaneously. For banks that already E. Risk Mitigation
approach). One advantage of the top- rely heavily on scenario analysis, using S 29. The bank may adjust its
down approach is that data sufficiency expert judgment to assess dependence operational risk exposure results by no
is less likely to be a limiting factor, in this manner would merely be an more than 20 percent to reflect the
whereas with the bottom-up approach extension of the scenario analysis impact of operational risk mitigants. In
there may be pockets of missing or process from a business line perspective order to recognize the effects of risk
limited data. However, a loss severity to a broader perspective. mitigants, management must estimate
distribution may be more difficult to • The bank should demonstrate that it its operational risk exposure with and
specify with the top-down approach, as has considered the possibility that without their effects.
it is a statistical mixture of (potentially) dependence may not be constant over There are many mechanisms to
heterogeneous business line and event time and may increase during stress manage operational risk, including risk
type distributions. Supervisors will environments. transfer through risk mitigation
consider the conditions necessary for • The bank should develop a process products. Because risk mitigation can be
the validity of top-down approaches and for assessing on-going improvements to an important element in limiting or
evaluate whether these conditions are the approach (for example, through out- reducing operational risk exposure in a
bank, an adjustment that will directly • Has a minimum notice period for circumstances, a bank may propose use
affect the amount of regulatory capital cancellation by the provider of 90 days; of an alternative operational risk
that is held for operational risk is being • Has no exclusions or limitations quantification system, subject to
permitted. The adjustment is limited to based upon regulatory action or for the approval by the bank’s primary Federal
20 percent of the overall operational risk receiver or liquidator of a failed bank; supervisor. The Agencies are not
exposure less any eligible operational and prescribing any estimation
risk offsets. • Coverage has been explicitly methodologies for the alternative
In order to recognize the effects of risk mapped to a potential operational loss approach. However, the Agencies expect
mitigants, the bank must calculate two event. that use of an alternative approach will
estimates of its operational risk Insurance policies that meet these occur on a very limited basis.
exposure. The first estimate should standards may be incorporated into a Furthermore, such approaches will not
include the effects of risk mitigants, in bank’s adjustment for risk mitigation. A be available at the bank holding
addition to all other adjustments and bank should be conservative in its company level.
effects (for example, expected losses, recognition of such policies; for A bank proposing to use an
diversification, and qualitative example, the bank should demonstrate alternative operational risk
adjustments) that are to be reflected in that insurance policies used as the basis quantification system must submit a
the risk-based capital requirement for for the adjustment have a history of proposal to its primary Federal
operational risk. The second estimate timely payouts. Banks must decrease the supervisor. In evaluating a bank’s
should be identical to the first, except amount of the adjustment if the proposal, the primary supervisor will
that it should not reflect the effects of remaining term is less than one year. review the bank’s justification in light
risk mitigants. The first exposure The bank’s methodology for of:
estimate should be used to calculate incorporating the effects of insurance • The bank’s size, complexity, and
risk-weighted assets for operational risk must also capture, through appropriate risk profile; and
(as described in the introduction to discounts to the amount of risk • Whether the proposed approach can
Section V), provided that it is at least 80 mitigation, the residual term of the be supported empirically.
percent of the second estimate. If the policy, if the remaining term is less than Additional areas that a primary
first exposure estimate is less than 80 one year. In addition, the bank should Federal supervisory may consider in its
percent of the second estimate, then risk be able to show that the policy would evaluation of a proposal to use an
weighted assets for operational risk actually be used in the event of a loss alternative approach include:
should be calculated as the second situation; that is, the deductible should • The bank’s ability to establish that,
exposure estimate multiplied by 0.8 and not be set so high that no loss would for data or other reasons, a stand-alone
by 12.5. ever conceivably exceed the deductible AMA is not feasible or that it would not
Currently, the primary risk mitigant threshold. result in a credible capital estimate;
used for operational risk is insurance. The Agencies do not specify how • Whether capital levels using the
The industry has raised the possibility banks should calculate the risk alternative approach are commensurate
that some securities products may be mitigation adjustment. Nevertheless, with the bank’s operational risk profile;
developed to provide risk mitigation banks should use conservative • Whether the alternative approach is
benefits; however, to date no specific assumptions when calculating sensitive to changes in the bank’s
products have emerged that have adjustments. As the payout of a operational risk profile; and
characteristics sufficient to be particular policy varies over time and • Whether the proposed approach
considered a capital replacement for depends upon the frequency and allows for the bank’s board members to
operational risk. However, as innovation severity of covered losses, calculation of fulfill their fiduciary responsibilities to
in this field continues, a bank may be the adjustment should be embedded in ensure that the bank is adequately
able to realize the benefits of risk the analytical framework rather than capitalized.
mitigation through certain capital being an ex-post adjustment to the Furthermore, a bank using an
markets instruments with the approval quantified operational risk exposure alternative operational risk
of their primary Federal supervisor. number. A bank should discount (i.e., quantification system must meet the
For a bank that wishes to adjust its apply its own estimates of haircuts) the regulatory requirements for the
regulatory capital requirement as a impact of insurance coverage to take establishment and use of operational
result of the risk mitigating effect of into account factors that may limit the risk management, and data and
insurance, management must likelihood or size of claims payouts. assessment systems.19
demonstrate that the insurance policy: Among these factors are the remaining A bank proposing an alternative
• Has been provided by an term of a policy (for example, when it approach that is based on an allocation
unaffiliated company that has a is less than a year); the willingness and methodology should be aware of certain
minimum claims paying ability that is ability of the insurer to pay on a claim limitations associated with the use of
rated in one of the three highest ratings in a timely manner; the legal risk that such an approach. Specifically, the
categories by a Nationally Recognized a claim may be disputed; and the agencies will not accept an allocation of
Statistical Rating Organization possibility that a policy can be operational risk capital requirements
(NRSRO); 18 cancelled before the contractual that includes non-depository
• Has an initial term of at least one expiration. institutions or the benefits of
year and a residual term of more than F. Alternative Approaches for diversification across entities. The
90 days; Depository Institutions exclusion of allocations that include
non-depository institutions is in
The Agencies recognize that in certain
18 Rating agencies may use slightly different

recognition that depositors and creditors
rating scales. For the purpose of this supervisory limited circumstances, there may not be
guidance, the insurer must have a rating that is at of a depository institution generally
sufficient data available for a bank to
least the equivalent of an ‘‘A’’ under Standard and
Poor’s Insurer Financial Strength Ratings or an
generate an AMA estimate of its own 19 See also Standards 1 through 22 for supervisory
‘‘A2’’ under Moody’s Insurance Financial Strength operational risk exposure at the 99.9 guidance on risk management and data and
Ratings. percent confidence level. In these assessment systems.
have no legal recourse to capital funds statistical goodness-of-fit tests should be operational risk management, data and
that are not held by the depository used to evaluate distributional assessment, and quantification
institution or its affiliate depository assumptions). processes, as well as the verification and
institutions.20 • Identify the qualitative assumptions validation mechanisms described in this
embedded in the methodology and guidance. The precise data to be
G. Documentation of Operational Risk provide explanations for the choice of collected will be determined by a bank’s
Quantification Systems these assumptions. (For example, specific AMA System methodology.
S 30. The bank must document all qualitative assumptions could include A bank should have access to the key
material aspects of its AMA System. the use of business environment and data elements needed for operational
This documentation should include the internal control factor assessments, risk management, data and assessment,
rationale for the development, scenario analysis, and business and quantification. An important factor
operation, and assumptions judgment to derive dependence in ensuring consistent reporting of the
underpinning its chosen analytical assumptions). data elements is the development of
framework, including the choice of • Provide results based on alternative comprehensive definitions for each data
inputs, distributional assumptions, and quantitative and qualitative element used by the bank for reporting
the weighting across qualitative and assumptions to gauge the overall operational loss events or for the risk
quantitative elements. model’s sensitivity to these assessment inputs. The data must be
Whatever analytical approach a bank assumptions. stored in an electronic format to allow
chooses, it must document all material • Identify all simplifying or for timely retrieval for analysis,
aspects of its AMA System. Generally, normalizing assumptions. (For example, verification, validation, reporting, and
the documentation should include: A assumptions could include setting a disclosure purposes.
discussion of the bank’s modeling maximum cap on losses in order to While banks have substantial
philosophy; a ‘‘how to’’ guide that influence the shape of the severity flexibility in the design of their data
would provide sufficient detail for an distribution or to normalize results at maintenance systems, data systems
independent party to substantially specific units of measure for internal should be of sufficient depth, scope, and
replicate the capital calculation; and an capital purposes or prior to aggregation. reliability to implement and evaluate
audit trail of any changes to the Assumptions should be consistent with the AMA System. The systems should
framework’s assumptions. More relevant loss data from both internal and be capable of:
specifically, this documentation should: external sources). • Identifying and tracking operational
• Provide an overview of the • Provide results to assess the impact risk loss events from initial discovery
analytical approach (for example, of simplifying or normalizing through final resolution across all
description of the model(s) and/or assumptions. business lines, including instances
statistical technique(s) used, model • Compare the operational risk where a loss event impacts multiple
inputs and outputs, and steps taken to exposure estimate generated by the business lines.
ensure the integrity of the data used in analytical framework with actual loss • Producing timely and accurate
the estimation process). experience over time, to assess the internal and public reports on
• Identify how the different inputs framework’s performance and the operational risk data and assessment,
are combined and weighted to arrive at reasonableness of its outputs. and quantification results, including
the overall operational risk exposure so • Identify all limitations of and patterns revealed by loss data, scenario
that the analytical framework is changes to assumptions, and provide analysis, and business environment and
transparent. explanations for such changes. internal control factor assessments. The
• Demonstrate that the analytical • Include details and rationale for bank should also have sufficient data to
framework is comprehensive and establishing thresholds and their use. produce exception reports for
internally consistent. Comprehensive • Include information on the management (for example, a record of
and consistent means that all required technical process underlying the and justification for omitted large loss
inputs are incorporated and analytical approach (for example, events).
appropriately weighted and that there programming language(s) and software • Supporting risk management
are not overlaps or double counting. used, logical process flow diagrams, activities and providing access to data
• Identify the quantitative system or source of record for the data management processes for all interested
assumptions embedded in the elements, how outputs are used in parties, including audit.
methodology and provide explanations subsequent steps of the approach). In addition, the systems must be
for the choice and limitations of these • Include technical change control capable of retaining sufficient data
assumptions (for example, quantitative information relating to the analytical elements related to key risk drivers to
assumptions include distributional approach (for example, a record of the permit adequate monitoring, validation,
assumptions, and dependence changes, the associated rationale for the and refinement of the bank’s AMA
assumptions between operational losses changes and the effects on the analytical System.
across and within business lines). approach). Banks should also be able to use the
• Include where possible, • Provide the results of an data to identify patterns, track problem
documentation of quantitative measures independent verification and validation areas and identify emerging risks. Such
of each assumption’s validity, based on of the analytical framework. data should include not only
the relevant data elements (for example, operational loss event information, but
VI. Data Management and Maintenance also information on business
20 The cross-guarantee provision of the Federal S 31. Banks using the AMA approach environment and internal control factor
for regulatory capital purposes must assessments, which are incorporated
Deposit Insurance Act provides that a depository

institution is liable for any losses incurred by the have data management and into the operational risk exposure
FDIC in connection with the failure of commonly- maintenance systems that adequately calculation.
controlled depository institutions. There are no
statutory provisions requiring cross-guarantees support all aspects of an AMA System. Since data are collected at different
between a depository institution and its non- AMA data management systems must stages of the risk management and
depository institution affiliates. support the requirements for the quantification process, and involve a
variety of groups and individuals, there consider, whenever possible, the work internal audit, staff performing the
are potential challenges to ensuring the performed by the bank’s verification and validation of bank models should not
quality of the data including: validation functions when assessing the participate in the verification of the
• Retaining data over long bank’s AMA System. validation process.
timeframes; Banks may use independent and
• Ensuring that data purchased from, qualified internal (for example, internal Validation of operational risk models
or maintained by, third parties meet the audit, and quality assurance) or external should include review of:
bank’s standards; and parties to perform verification and • Adjustments to empirical
• Retaining sufficient data elements validation. The verification and operational risk capital estimates,
and documentation of model validation functions should annually including operational risk exposure;
methodologies, parameter estimates and assess and report to the board of • On-going monitoring processes that
assumptions to permit adequate ex-post directors on the adequacy of the overall
review of operational risk data. include verification of processes and
AMA System. This assessment should benchmarking;
Banks’ policies and controls should include the review of both the accuracy
address these potential data challenges. and integrity of the AMA System, • Outcome analysis processes that
Furthermore, for external data, banks control elements, as well as the scope includes model performance evaluation
should seek reasonable assurance from and effectiveness of operational risk and out-of-sample testing;
third-party providers concerning data reporting. The verification and • The operational risk models’
quality and integrity and a clear validation functions should also review conceptual soundness and underlying
understanding of the sources and reporting processes to ensure the assumptions;
limitations of external data. timeliness, accuracy, and
Management should identify those comprehensiveness of operational risk • Assumptions underlying
responsible for maintaining the bank’s reporting systems, both at the firm-wide operational risk exposure, data decision
data maintenance systems. In particular, and the line of business levels. Other models, and the risk-based capital
policies and processes should be areas of assessment include, but are not requirement for operational risk;
developed for delivering, storing, limited to: • Stress testing, robustness, and
retaining, and updating the data • Organizational structure, sensitivity analysis, as appropriate; and
warehouse. Policies and procedures governance, and oversight;
should also cover the edit checks for • The sufficiency of the
• Internal and external data sources,
data input functions. Like other areas of collection processes, and repositories; documentation pertaining to the
the AMA System, it is critical that • Scenario analysis; analytical approach and of the change
management ensure accountability for • Reporting and MIS; control process, including a review of
ongoing data maintenance, as this will • Business environment and internal the historical record of changes and
impact operational risk management control factor assessments; associated rationale.
and measurement efforts. • Quantification methodology and Appropriate reports summarizing the
assumptions, including a review of the results of independent verification and
VII. Verification and Validation integrity of the operational risk validation of the bank’s AMA System,
S 32. The bank must validate, on an exposure calculation; and
ongoing basis, its AMA system. The • Compliance with internal standards including associated models, should be
bank’s validation process must be for validation of the models used to provided to the board of directors and
independent of the AMA System’s quantify operational risk exposure. appropriate management. The board of
development, implementation, and Banks should have a formal written directors should ensure that senior
operation, or the validation process validation process that documents the management initiates timely corrective
must be subject to an independent development of risk quantification action where necessary.
review of its adequacy and models and assures model accuracy, The bank may determine the scope of
effectiveness. whether developed internally or its annual assessment, and the
Bank policies and procedures should externally. The validation process frequency of specific verification and
clearly differentiate the roles and should address model documentation, validation work, based on risk-based
responsibilities of the independent data sources, model assumptions, auditing principles. The extent of
verification and validation functions. coding and mathematical computations, verification of individual components of
Verification of the bank’s AMA System conceptual soundness of the approach, the bank’s AMA System may be based
typically encompasses internal and comparison of estimates to results of on a risk assessment of the overall
external audit activities. More alternative quantitative and qualitative
system, which identifies key processes,
specifically, verification includes the models, model performance evaluation,
controls, activities, and assumptions.
work done to test and verify that the and out-of-sample testing. The
policies, procedures, and processes that validation process must also require the All material components of a bank’s
make up the bank’s AMA System are bank to periodically stress test its AMA System should be assessed and
working effectively and as intended. In quantitative and qualitative models. tested (as appropriate) at least annually,
addition, the verification function also Stress testing must include a with the remaining components tested
ensures that validation of AMA models consideration of how economic cycles, consistent with risk-based auditing and
was completed in accordance with the especially downturns, affect the bank’s testing principles. Documentation of the
bank’s validation policy. Validation, operational risk-based capital verification and validation program
often performed by non-audit staff, requirement. Technically competent should support the scope and frequency
includes the processes the bank uses to individuals who are independent of the of work performed.
test and assess the accuracy and development, implementation, or

integrity of models being used to operation of the model should perform
quantify operational risk exposure and validation. These individuals may or
risk-based capital for operational risk. may not be a part of the internal audit
The primary Federal supervisor will function. If validation is done by
Appendix A—The NPR Qualification relevant operational risk information to actual operational losses incurred in the
Requirements, Risk-Weighted Assets for business unit management, senior intervening period.
Operational Risk, and Disclosure management, and the board of directors (3) Operational risk quantification
Requirements (or a designated committee of the systems. (i) The [bank]’s operational risk
Part III. Qualification board). quantification systems:
(2) Operational risk data and (A) Must generate estimates of the
Section 22. Qualification assessment systems. A [bank] must have [bank]’s operational risk exposure using
Requirements 21 operational risk data and assessment its operational risk data and assessment
(a) Process and systems requirements. systems that capture operational risks to systems; and
(1) A [bank] 22 must have a rigorous which the [bank] is exposed. The (B) Must employ a unit of measure
process for assessing its overall capital [bank]’s operational risk data and that is appropriate for the [bank]’s range
adequacy in relation to its risk profile assessment systems must: of business activities and the variety of
(i) Be structured in a manner operational loss events to which it is
and a comprehensive strategy for
consistent with the [bank]’s current exposed, and that does not combine
maintaining an appropriate level of
business activities, risk profile, business activities or operational loss
capital.
technological processes, and risk events with different risk profiles within
(2) The systems and processes used by
management processes; and the same loss distribution.
a [bank] for risk-based capital purposes (ii) Include credible, transparent,
under this appendix must be consistent (C) May use internal estimates of
systematic, and verifiable processes that dependence among operational losses
with the [bank]’s internal risk incorporate the following elements on
management processes and management within and across business lines and
an ongoing basis: operational loss events if the [bank] can
information reporting systems. (A) Internal operational loss event
(3) Each [bank] must have an demonstrate to the satisfaction of
data. The [bank] must have a systematic
appropriate infrastructure with risk [AGENCY] that its process for
process for capturing and using internal
measurement and management estimating dependence is sound, robust
operational loss event data in its
processes that meet the qualification to a variety of scenarios, and
operational risk data and assessment
requirements of this section and are implemented with integrity, and allows
systems.
appropriate given the [bank]’s size and (1) The [bank]’s operational risk data for the uncertainty surrounding the
level of complexity. Regardless of and assessment systems must include a estimates. If the [bank] has not made
whether the systems and models that historical observation period of at least such a demonstration, it must sum
generate the risk parameters necessary five years for internal operational loss operational risk exposure estimates
for calculating a [bank]’s risk-based event data (or such shorter period across units of measure to calculate its
capital requirements are located at any approved by [AGENCY] to address total operational risk exposure.
affiliate of the [bank], the [bank] itself transitional situations, such as (D) Must be reviewed and updated (as
must ensure that the risk parameters integrating a new business line). appropriate) whenever the [bank]
and reference data used to determine its (2) The [bank] may refrain from becomes aware of information that may
risk-based capital requirements are collecting internal operational loss have a material effect on the [bank]’s
representative of its own credit risk and event data for individual operational estimate of operational risk exposure,
operational risk exposures. losses below established dollar but no less frequently than annually.
—Text omitted— threshold amounts if the [bank] can (ii) With the prior written approval of
(h) Operational risk—(1) Operational demonstrate to the satisfaction of the [AGENCY], a [bank] may generate an
risk management processes. A [bank] [AGENCY] that the thresholds are estimate of its operational risk exposure
must: reasonable, do not exclude important using an alternative approach to that
(i) Have an operational risk internal operational loss event data, and specified in paragraph (h)(3)(i) of this
management function that: permit the [bank] to capture section. A [bank] proposing to use such
(A) Is independent of business line substantially all the dollar value of the an alternative operational risk
management; and [bank]’s operational losses. quantification system must submit a
(B) Is responsible for designing, (B) External operational loss event proposal to [AGENCY]. In considering a
implementing, and overseeing the data. The [bank] must have a systematic [bank]’s proposal to use an alternative
[bank]’s operational risk data and process for determining its operational risk quantification system,
assessment systems, operational risk methodologies for incorporating [AGENCY] will consider the following
quantification systems, and related external operational loss data into its principles:
processes; operational risk data and assessment (A) Use of the alternative operational
(ii) Have and document a process to systems. risk quantification system will be
identify, measure, monitor, and control (C) Scenario analysis. The [bank] allowed only on an exception basis,
operational risk in [bank] products, must have a systematic process for considering the size, complexity, and
activities, processes, and systems determining its methodologies for risk profile of a [bank];
(which process must capture business incorporating scenario analysis into its (B) The [bank] must demonstrate that
environment and internal control factors operational risk data and assessment its estimate of its operational risk
affecting the [bank]’s operational risk systems. exposure generated under the
profile); and (D) Business environment and alternative operational risk
(iii) Report operational risk exposures, internal control factors. The [bank] must quantification system is appropriate and
operational loss events, and other incorporate business environment and can be supported empirically; and
internal control factors into its (C) A [bank] must not use an
21 71 FR 55922 through 55924 (Sept. 25, 2006). operational risk data and assessment allocation of operational risk capital
22 For simplicity, and unless otherwise noted, the systems. The [bank] must also requirements that includes entities other
NPR uses the term [bank] to include banks, savings
associations, and bank holding companies.
periodically compare the results of its than depository institutions or the
[AGENCY] refers to the primary Federal supervisor prior business environment and internal benefits of diversification across
of the bank applying the rules. control factor assessments against its entities.
(i) Data management and [bank]’s board of directors (or a (iii) Has a minimum notice period for
maintenance. (1) A [bank] must have committee thereof). cancellation by the provider of 90 days;
data management and maintenance (6) The [bank] must periodically stress (iv) Has no exclusions or limitations
systems that adequately support all test its advanced systems. The stress based upon regulatory action or for the
aspects of its advanced systems and the testing must include a consideration of receiver or liquidator of a failed
timely and accurate reporting of risk- how economic cycles, especially depository institution; and
based capital requirements. downturns, affect risk-based capital (v) Is explicitly mapped to a potential
(2) A [bank] must retain data using an requirements (including migration operational loss event; and
electronic format that allows timely across rating grades and segments and (2) Operational risk mitigants other
retrieval of data for analysis, validation, the credit risk mitigation benefits of than insurance for which the [AGENCY]
reporting, and disclosure purposes. double default treatment). has given prior written approval. In
(3) A [bank] must retain sufficient (k) Documentation. The [bank] must evaluating an operational risk mitigant
data elements related to key risk drivers adequately document all material other than insurance, [AGENCY] will
to permit adequate monitoring, aspects of its advanced systems. consider whether the operational risk
validation, and refinement of its —Text omitted—
mitigant covers potential operational
advanced systems. Part VII. Risk-Weighted Assets for losses in a manner equivalent to holding
(j) Control, oversight, and validation Operational Risk regulatory capital.
mechanisms. (1) The [bank]’s senior
management must ensure that all Section 61. Qualification Requirements Section 62. Mechanics of Risk-Weighted
components of the [bank]’s advanced for Incorporation of Operational Risk Asset Calculation
systems function effectively and comply Mitigants 23 (a) If a [bank] does not qualify to use
with the qualification requirements in (a) Qualification to use operational or does not have qualifying operational
this section. risk mitigants. A [bank] may adjust its risk mitigants, the [bank]’s dollar risk-
(2) The [bank]’s board of directors (or estimate of operational risk exposure to based capital requirement for
a designated committee of the board) reflect qualifying operational risk operational risk is its operational risk
must at least annually evaluate the mitigants if: exposure minus eligible operational risk
effectiveness of, and approve, the (1) The [bank]’s operational risk offsets (if any).
[bank]’s advanced systems. quantification system is able to generate (b) If a [bank] qualifies to use
(3) A [bank] must have an effective an estimate of the [bank]’s operational operational risk mitigants and has
system of controls and oversight that: risk exposure (which does not qualifying operational risk mitigants,
(i) Ensures ongoing compliance with incorporate qualifying operational risk the [bank]’s dollar risk-based capital
the qualification requirements in this mitigants) and an estimate of the requirement for operational risk is the
section; [bank]’s operational risk exposure greater of:
(ii) Maintains the integrity, reliability, adjusted to incorporate qualifying (1) The [bank]’s operational risk
and accuracy of the [bank]’s advanced operational risk mitigants; and exposure adjusted for qualifying
systems; and (2) The [bank]’s methodology for operational risk mitigants minus eligible
(iii) Includes adequate governance incorporating the effects of insurance, if operational risk offsets (if any); or
and project management processes. the [bank] uses insurance as an
(2) 0.8 multiplied by the difference
(4) The [bank] must validate, on an operational risk mitigant, captures
between:
ongoing basis, its advanced systems. through appropriate discounts to the
(i) The [bank]’s operational risk
The [bank]’s validation process must be amount of risk mitigation:
(i) The residual term of the policy, exposure; and
independent of the advanced systems’ (ii) Eligible operational risk offsets (if
development, implementation, and where less than one year;
(ii) The cancellation terms of the any).
operation, or the validation process (c) The [bank]’s risk-weighted asset
must be subjected to an independent policy, where less than one year;
(iii) The policy’s timeliness of amount for operational risk equals the
review of its adequacy and [bank]’s dollar risk-based capital
payment;
effectiveness. Validation must include: (iv) The uncertainty of payment by requirement for operational risk
(i) The evaluation of the conceptual the provider of the policy; and determined under paragraph (a) or (b) of
soundness of (including developmental (v) Mismatches in coverage between this section multiplied by 12.5.
evidence supporting) the advanced the policy and the hedged operational
systems; loss event. Part VIII. Disclosure
(ii) An on-going monitoring process (b) Qualifying operational risk Section 71. Disclosure Requirements 24
that includes verification of processes mitigants. Qualifying operational risk
and benchmarking; and mitigants are: (a) Each [bank] must publicly disclose
(iii) An outcomes analysis process (1) Insurance that: each quarter its total and tier 1 risk-
that includes back-testing. (i) Is provided by an unaffiliated based capital ratios and their
(5) The [bank] must have an internal company that has a claims payment components (that is, tier 1 capital, tier
audit function independent of business- ability that is rated in one of the three 2 capital, total qualifying capital, and
line management that at least annually highest rating categories by a NRSRO; total risk-weighted assets).25
assesses the effectiveness of the controls (ii) Has an initial term of at least one [Disclosure paragraph (b)]
supporting the [bank]’s advanced year and a residual term of more than [Disclosure paragraph (c)]
systems and reports its findings to the 90 days; —Text omitted—
23 71 FR 55946 through 55947 (Sept. 25, 2006). 25 Other public disclosure requirements continue
24 71 FR 55947 and 55952 (Sept. 25, 2006). to apply—for example, Federal securities law and
regulatory reporting requirements.
TABLE 11.9—OPERATIONAL RISK

Qualitative disclosures ............................ (a) .......................... The general qualitative disclosure requirement for operational risk.
(b) .......................... Description of the AMA, including a discussion of relevant internal and external
factors considered in the bank holding company’s measurement approach.
(c) .......................... A description of the use of insurance for the purpose of mitigating operational
risk.
Appendix B—Supervisory Standards operational risks within its business S 15. The bank should have a policy
S 1. The bank’s AMA System must unit. that identifies when an operational loss
include an operational risk management S 9. Line of business management is recognized and should be added to
function and audit function that are should ensure that internal controls and the loss event database. The policy
independent of business line practices within its business unit are should provide for consistent treatment
management. The operational risk consistent with firm-wide policies, across the bank.
processes, and procedures. S 16. The bank may establish
management function should address
S 10. The board of directors and appropriate internal operational loss
operational risk on a firm-wide basis.
senior management must receive reports event data thresholds and, if so, must
S 2. The bank must have and
on operational risk exposure, demonstrate the appropriateness of such
document a process that clearly
operational risk loss events, and other thresholds.
describes its AMA System, including S 17. The bank should have a clear
how the bank identifies, measures, relevant operational risk information.
The reports should include information policy that allows for the consistent
monitors, and controls operational risk. treatment of loss event classifications
S 3. The bank must maintain effective regarding firm-wide and business line
risk profiles, loss experience, and (for example, credit, market, or
internal controls supporting its AMA
relevant business environment and operational loss events) across the
System.
internal control factor assessments. organization.
S 4. The bank must ensure that an S 18. The bank must have a
effective framework is in place to These reports should be received
quarterly. systematic process for determining how
identify, measure, monitor, and control external loss data will be incorporated
operational risk, and to accurately S 11. The bank must have a
systematic process for incorporating into its operational risk data and
compute the bank’s operational risk assessment systems.
component of the bank’s risk-based internal loss event data, external loss
S 19. The bank should systematically
capital requirement. The board of event data, scenario analyses, and
review external data to ensure an
directors must at least annually evaluate assessments of its business environment
understanding of industry operational
the effectiveness of, and approve, the and internal controls factors to support
loss experience.
bank’s AMA System, including the both its operational risk management S 20. The bank must have a
strength of the bank’s control and measurement framework, as well as systematic process for determining how
infrastructure. its calculation of the bank’s operational scenario analysis will be incorporated
S 5. The board of directors and risk component of its risk-based capital into its operational risk data and
management should ensure that the requirement. assessment systems. S 21. The bank
bank’s operational risk management, S 12. The bank must use the must incorporate business environment
data and assessment, and quantification regulatory definition of operational risk and internal control factors into the
processes are appropriately integrated when assessing the operational risks to bank’s operational risk data and
into the bank’s existing risk which the bank is exposed in order to assessment systems.
management and decision-making calculate its risk-based capital S 22. The bank must periodically
processes and that there are adequate requirement for operational risk. The compare the results of its business
resources to support these processes bank should have clear standards for the environment and internal control factor
throughout the bank. collection and modification of all four assessments against the bank’s actual
S 6. The bank must have a firm-wide elements in the operational risk data operational risk loss experience.
operational risk management function and assessment systems that support its S 23. The bank must have an
that oversees the AMA System and is AMA System. operational risk quantification system
independent of business line S 13. The bank must have a historical that provides an estimate of the bank’s
management. The operational risk observation period of at least five years operational risk exposure.
management function is also for internal operational loss event data. S 24. The bank’s operational risk
responsible for the development of A shorter period may be approved by quantification system must use a
operational risk data and assessment the primary Federal supervisor to combination of internal operational loss
systems, operational risk quantification address transitional situations, such as event data, relevant external operational
systems, and related processes integrating a new business line. Internal loss event data, business environment
throughout the bank. data should be captured across all and internal control factor assessments,
S 7. The firm-wide operational risk business lines, corporate functions, and scenario analysis results. The bank
management function should ensure events, product types, and geographic should combine these elements in a
adequate analysis and reporting of locations. The bank must have a manner that most effectively enables it
operational risk information. The systematic process for capturing and to quantify its operational risk exposure.
function should also develop and report using internal operational loss event The bank should choose the analytical
on the firm-wide operational risk data in its operational risk data and framework that is most appropriate to
profile. assessment systems. its business model.
S 8. Line of business management is S 14. The bank should be able to map S 25. The bank must review and
responsible for ensuring appropriate internal operational losses to the seven update its operational risk
day-to-day management of the operational loss-event categories. quantification system whenever it
becomes aware of information that may systems that adequately support all business lines, portfolios, or exposures
have a material effect on the bank’s aspects of an AMA System. from application of the advanced
estimate of operational risk exposure or S 32. The bank must validate, on an approaches in this appendix (which
risk-based capital requirement for ongoing basis, its AMA system. The business lines, portfolios, and exposures
operational risk, but no less frequently bank’s validation process must be must be, in the aggregate, immaterial to
than annually. A complete review and independent of the AMA System’s the [bank]);
recalculation of the bank’s development, implementation, and (3) Include the [bank]’s self-
quantification system, including all operation, or the validation process assessment of:
modeling inputs and assumptions, must must be subject to an independent (i) The [bank]’s current status in
be done at least annually. review of its adequacy and meeting the qualification requirements
S 26. In calculating the risk-based effectiveness. in section 22; and
capital requirement for operational risk, Appendix C—The NPR Qualification (ii) The consistency of the [bank]’s
management may deduct certain eligible Process current practices with the [AGENCY]’s
operational risk offsets from its estimate supervisory guidance on the
of operational risk exposure. To the Part III. Qualification
qualification requirements;
extent that these offsets do not fully Section 21. Qualification Process 26 (4) Based on the [bank]’s self-
cover expected operational loss (EOL), assessment, identify and describe the
the bank’s risk-based capital (a) Timing. (1) A [bank] 27 that is
described in paragraph (b)(1) of section areas in which the [bank] proposes to
requirement for operational risk must undertake additional work to comply
incorporate the shortfall. Eligible 1 must adopt a written implementation
plan no later than six months after the with the qualification requirements in
operational risk offsets may only be section 22 or to improve the consistency
used to offset EOL, not UOL. later of the effective date of this
appendix or the date the [bank] meets a of the [bank]’s current practices with the
S 27. The bank must employ a unit of [AGENCY]’s supervisory guidance on
measure that is appropriate for the criterion in that section. The plan must
incorporate an explicit first floor period the qualification requirements (gap
bank’s range of business activities and analysis);
the variety of operational loss events to start date no later than 36 months after
the later of the effective date of this (5) Describe what specific actions the
which it is exposed, and that does not
appendix or the date the [bank] meets at [bank] will take to address the areas
combine business activities or
least one criterion under paragraph identified in the gap analysis required
operational loss events with different
(b)(1) of section 1. [AGENCY] may by paragraph (b)(4) of this section;
risk profiles within the same loss
distribution. extend the first floor period start date. (6) Identify objective, measurable
(2) A [bank] that elects to be subject milestones, including delivery dates and
S 28. The bank may use internal
to this appendix under paragraph (b)(2) a date when the [bank]’s
estimates of dependence among
of section 1 must adopt a written implementation of the methodologies
operational losses within and across
implementation plan and notify the described in this appendix will be fully
business lines and operational loss
[AGENCY] in writing of its intent at operational;
events if the bank can demonstrate to
the satisfaction of its primary Federal least 12 months before it proposes to (7) Describe resources that have been
supervisor that the bank’s process for begin its first floor period. budgeted and are available to
(b) Implementation plan. The [bank]’s implement the plan; and
estimating dependence is sound, robust
implementation plan must address in (8) Receive board of directors
to a variety of scenarios, and
detail how the [bank] complies, or plans approval.
implemented with integrity, and allows
to comply, with the qualification (c) Parallel run. Before determining its
for uncertainty surrounding the
requirements in section 22. The [bank] risk-based capital requirements under
estimates. If the bank has not made such
also must maintain a comprehensive this appendix and following adoption of
a demonstration, it must sum
and sound planning and governance the implementation plan, the [bank]
operational risk exposure estimates
process to oversee the implementation must conduct a satisfactory parallel run.
across units of measures to calculate its
efforts described in the plan. At a A satisfactory parallel run is a period of
total operational risk exposure.
minimum, the plan must: no less than four consecutive calendar
S 29. The bank may adjust its
(1) Comprehensively address the quarters during which the [bank]
operational risk exposure results by no
qualification requirements in section 22 complies with all of the qualification
more than 20 percent to reflect the
for the [bank] and each consolidated requirements in section 22 to the
impact of operational risk mitigants. In
subsidiary (U.S. and foreign-based) of satisfaction of [AGENCY]. During the
order to recognize the effects of risk
the [bank] with respect to all portfolios parallel run, the [bank] must report to
mitigants, management must estimate
and exposures of the [bank] and each of the [AGENCY] on a calendar quarterly
its operational risk exposure with and
its consolidated subsidiaries; basis its risk-based capital ratios using
without their effects. (2) Justify and support any proposed
S 30. The bank must document all [the general risk-based capital rules] and
temporary or permanent exclusion of the risk-based capital requirements
material aspects of its AMA System.
This documentation should include the 26 71
described in this appendix. During this
FR 55921 through 55922 (Sept. 25, 2006).
rationale for the development, 27 For simplicity, and unless otherwise noted, the
period, the [bank] is subject to [the
operation, and assumptions NPR uses the term [bank] to include banks, savings general risk-based capital rules].
underpinning its chosen analytical associations, and bank holding companies. (d) Approval to calculate risk-based
[AGENCY] refers to the primary Federal supervisor capital requirements under this
framework, including the choice of of the bank applying the rules. In addition, the text
inputs, distributional assumptions, and appendix. The [AGENCY] will notify
in Appendix C refers often to an ‘appendix.’ Use of

the weighting across qualitative and ‘appendix’ within the text refers to where the NPR the [bank] of the date that the [bank]
quantitative elements. rule text will be inserted within each Agency’s may begin its first floor period following
capital adequacy regulation. The ‘appendix’ is titled a determination by the [AGENCY] that:
S 31. Banks using the AMA approach ‘‘Capital Adequacy Guidelines for [Bank]s: Internal-
for regulatory capital purposes must Ratings-Based and Advanced Measurement (1) The [bank] fully complies with the
have data management and maintenance Approaches.’’ qualification requirements in section 22;
(2) The [bank] has conducted a (B) The appropriate transitional floor (ii) A [bank]’s advanced approaches
satisfactory parallel run under percentage in Table 1. total risk-based capital ratio equals the
paragraph (c) of this section; and (ii) A [bank]’s floor-adjusted total risk- [bank]’s total risk-based capital ratio as
(3) The [bank] has an adequate based capital ratio during a transitional calculated under this appendix (other
process to ensure ongoing compliance floor period is equal to the sum of the than this section on transitional floor
with the qualification requirements in [bank]’s tier 1 and tier 2 capital as periods).
section 22. calculated under [the general risk-based
(e) Transitional floor periods. (4) Reporting. During the transitional
capital rules], divided by the product of:
Following a satisfactory parallel run, a (A) The [bank]’s total risk-weighted floor periods, a [bank] must report to the
[bank] is subject to three transitional assets as calculated under [the general [AGENCY] on a calendar quarterly basis
floor periods. risk-based capital rules]; and both floor-adjusted risk-based capital
(1) Risk-based capital ratios during (B) The appropriate transitional floor ratios and both advanced approaches
the transitional floor periods—(i) Tier 1 percentage in Table 1. risk-based capital ratios.
risk-based capital ratio. During a (iii) A [bank] that meets the criteria in (5) Exiting a transitional floor period.
[bank]’s transitional floor periods, a paragraph (b)(1) or (b)(2) of section 1 as A [bank] may not exit a transitional
[bank]’s tier 1 risk-based capital ratio is of the effective date of this rule must use floor period until the [bank] has spent
equal to the lower of: [the general risk-based capital rules]
(A) The [bank]’s floor-adjusted tier 1 a minimum of four consecutive calendar
effective immediately before this rule quarters in the period and the
risk-based capital ratio; or became effective during the parallel run
(B) The [bank]’s advanced approaches [AGENCY] has determined that the
and as the basis for its transitional [bank] may exit the floor period. The
tier 1 risk-based capital ratio.
floors. [AGENCY]’s determination will be
(ii) Total risk-based capital ratio.
During a [bank]’s transitional floor based on an assessment of the [bank]’s
periods, a [bank]’s total risk-based TABLE 1.—TRANSITIONAL FLOORS ongoing compliance with the
capital ratio is equal to the lower of: qualification requirements in section 22.
Transitional
(A) The [bank]’s floor-adjusted total Transitional floor period floor
risk-based capital ratio; or percentage Appendix D—Basel II Operational Risk
(B) The [bank]’s advanced approaches Information Collection Templates
total risk-based capital ratio. First floor period ................... 95 (Schedule V) 28
(2) Floor-adjusted risk-based capital Second floor period .............. 90
BILLING CODES 4810–33–P, 6210–01–P, 6714–01–P,
ratios. (i) A [bank]’s floor-adjusted tier 1 Third floor period .................. 85 6720–01–P
risk-based capital ratio during a
transitional floor period is equal to the (3) Advanced approaches risk-based 28 Notices of Proposed Rulemaking and Proposed
[bank]’s tier 1 capital as calculated capital ratios. (i) A [bank]’s advanced Agency Information Collections—Requests for
under [the general risk-based capital approaches tier 1 risk-based capital ratio Comments were published in the Federal Register
rules], divided by the product of: equals the [bank]’s tier 1 risk-based for comment on September 25, 2006 (71 FR 55981
(A) The [bank]’s total risk-weighted capital ratio as calculated under this through 55986). The Notices contained Basel II
assets as calculated under [the general appendix (other than this section on information collection templates, including a
risk-based capital rules]; and transitional floor periods). template for operational risk that is included in this
Appendix.
BILLING CODES 4810–33–C, 6210–01–C, 6714–01–C,

6720–01–C
EN28FE07.037</GPH>
OPERATIONAL RISK—DEFINITIONS
Business environment and internal control fac- The indicators of a bank’s operational risk profile that reflect a current and forward-looking as-
tors. sessment of the bank’s underlying business risk factors and internal control environment.
Dependence ........................................................ A measure of the association among operational losses across and within business lines and
operational loss event types.
Eligible operational risk offsets ........................... Amounts, not to exceed expected operational loss, that: (1) Are generated by internal busi-
ness practices to absorb highly predictable and reasonably stable operational losses, includ-
ing reserves calculated consistent with GAAP; and (2) are available to cover expected oper-
ational losses with a high degree of certainty over a one-year horizon.
Expected operational loss (EOL) ........................ The expected value of the distribution of potential aggregate operational losses, as generated
by the bank’s operational risk quantification system using a one-year horizon.
Frequency distribution ......................................... Statistical distribution used to calculate the frequency of losses.
Operational loss event ........................................ An event that results in loss and is associated with internal fraud; external fraud; employment
practices and workplace safety; clients, products, and business practices; damage to phys-
ical assets; business disruption and system failures; or execution, delivery, and process
management.
Operational risk ................................................... The risk of loss resulting from inadequate or failed internal processes, people, and systems or
from external events (including legal risk but excluding strategic and reputational risk).
Operational risk exposure ................................... The 99.9th percentile of the distribution of potential aggregate operational losses, as gen-
erated by the bank’s operational risk quantification system over a one-year horizon (and not
incorporating eligible operational risk offsets or qualifying operational risk mitigants).
Risk mitigants (e.g., insurance) ........................... A contractual arrangement whose primary purpose is to transfer risk to a third party.
Scenario analysis ................................................ A systematic process of obtaining expert opinions from business managers and risk manage-
ment experts to derive reasoned assessments of the likelihood and loss impact of plausible
high-severity operational losses.
Severity distribution ............................................. Statistical distribution used to calculate the severity of losses.
Unexpected operational loss (UOL) .................... The difference between the bank’s operational risk exposure and the bank’s expected oper-
ational loss.
Unit of measure ................................................... The level (for example, organizational unit or operational loss event type) at which the bank’s
operational risk quantification system generates a separate distribution of potential oper-
ational losses.
Appendix E—Operational Loss Event

Types and Examples
Internal fraud ....................................................... Employee theft, intentional misreporting of positions, and insider trading on an employee’s
own account.
External fraud ...................................................... Robbery, forgery, and check kiting.
Employment practices and workplace safety ...... Workers’ compensation and discrimination claims, violation of employee health and safety
rules, and general liability.
Clients, products, and business practices .......... Fiduciary breaches, misuse of confidential customer information, money laundering, and sale
of unauthorized products.
Damage to physical assets ................................. Terrorism, vandalism, earthquakes, fires, and floods.
Business disruption and system failures ............. Hardware and software failures, telecommunication problems, and utility outages.
Execution, delivery, and process management .. Data entry errors, collateral management failures, incomplete legal documentation, and vendor
disputes.
Proposed Supervisory Guidance on the • Minimum risk-based regulatory 2. This document addresses the
Supervisory Review Process (PILLAR capital requirements (Pillar 1); process for supervisory review in the
2). • Supervisory review (Pillar 2); and proposed U.S. Advanced Framework.
1. This guidance supplements the • Market discipline through Supervisory review as described in this
notice of proposed rulemaking (NPR) enhanced public disclosures (Pillar 3). guidance covers three main areas:
published jointly by the U.S. Federal The regulatory capital requirements in • Comprehensive supervisory
banking agencies 1 in the Federal Pillar 1 of the U.S. Advanced assessment of capital adequacy;
Register on September 25, 2006.2 The Framework would apply to credit risk
and operational risk.3 • compliance with regulatory capital
NPR proposes the implementation of a
requirements;
New Advanced Capital Adequacy
Framework (U.S. Advanced Framework)
3 Some banks may be subject to both the U.S.
• Internal capital adequacy
Advanced Framework and the revised Market Risk
encompassing three pillars: Capital Rule, as published in the Federal Register
assessment process (ICAAP).
on September 25, 2006 (71 FR 55958). If so, the
1 The Federal banking agencies are: The Board of
requirement for banks to conduct an internal
Governors of the Federal Reserve System; the assessment of capital adequacy for market risk in
Federal Deposit Insurance Corporation; the Office of the revised Market Risk Capital Rule could be not need to conduct a comprehensive internal
the Comptroller of the Currency; and the Office of satisfied by the requirement for banks to have a capital adequacy assessment covering all risk types,
Thrift Supervision; and will collectively be referred comprehensive internal capital adequacy but only an internal assessment for market risk of
to as ‘‘the agencies,’’ ‘‘supervisors,’’ or ‘‘regulators’’ assessment (covering all risk types) under the U.S. covered positions as defined in the revised Market
in this guidance. Advanced Framework. Additionally, banks subject Risk Capital Rule.
2 71 FR 55830 (Sept. 25, 2006). only to the revised Market Risk Capital Rule would
3. The process of supervisory review overall U.S. banking system. Minimum adequate. The primary supervisor may
described in this document reflects a regulatory capital requirements (Pillar 1 require the bank to take actions
continuation of the longstanding in the U.S. Advanced Framework) designed to address identified
approach employed by the agencies in establish a threshold below which a supervisory concerns, which may
their supervision of banking sound bank’s regulatory capital must include holding an amount of capital
institutions. However, the new methods not fall. Regulatory capital ratios permit greater than otherwise would be
proposed for calculating regulatory some comparative analysis of capital required. In addition, a primary
capital requirements in the U.S. adequacy across regulated institutions supervisor may, under its enforcement
Advanced Framework affect certain because they are based on certain authority, require a bank to modify or
aspects of supervisory review. Thus, common assumptions. However, enhance risk management and internal
this guidance highlights areas of supervisors must perform a more control processes, or reduce risk
existing supervisory review that are comprehensive assessment of capital exposures, or take any other action as
being augmented or more clearly adequacy that considers risks specific to deemed necessary to address identified
defined to support implementation of the bank, conducting analyses that go supervisory concerns.
the U.S. Advanced Framework. It beyond minimum regulatory capital
Compliance With Regulatory Capital
applies only to those banks calculating requirements.
7. Supervisors generally expect banks Requirements
U.S. regulatory capital requirements
under that framework, and not to banks to hold capital above their minimum 10. In order to qualify under the U.S.
calculating U.S. regulatory capital regulatory capital levels, commensurate Advanced Framework to use new
requirements by other means.4 with their individual risk profiles, to methods for calculating regulatory
4. The supervisory review process account for all material risks. Going capital requirements, banks must meet
described in this document is intended forward, supervisors will continue to certain process and systems
to help ensure overall capital adequacy assess the overall capital adequacy of requirements. Supervisors must ensure
by: any bank through a comprehensive that banks are indeed meeting these
• Confirming a bank’s compliance evaluation that considers all relevant requirements. Thus, one aspect of
with regulatory capital requirements; available information. In determining supervisory review pertains to the
• Addressing the limitations of the extent to which banks should hold evaluation of a bank’s compliance with
regulatory capital requirements as a capital in excess of regulatory the qualification requirements for the
measure of a bank’s full risk profile— minimums, supervisors would consider systems and processes to be used in the
including risks not covered or not the combined implications of a bank’s calculation of regulatory capital under
adequately quantified; compliance with qualification the U.S. Advanced Framework. The
• Encouraging banks to develop and requirements for regulatory capital supervisory guidance regarding the U.S.
use better techniques in identifying and standards, the quality and results of a Advanced Framework provides a
measuring the risks they face; and bank’s ICAAP, and supervisory detailed explanation of these
• Ensuring that each bank is able to assessment of the bank’s risk qualification requirements for the
assess its own individual capital management processes, control systems and processes for the
adequacy (beyond regulatory capital structure, and other relevant calculation of regulatory capital.
requirements), based on its risk profile information relating to the bank’s risk 11. Banks adopting the U.S. Advanced
and business mix. profile and capital position. This Framework must comply with the
5. This guidance does not supersede supervisory assessment process is qualification requirements not just for
or alter the functioning of the existing consistent with current supervisory initial qualification, but also for ongoing
U.S. Prompt Corrective Action practice, under which supervisors use. A bank that falls out of compliance
requirements.5 This guidance also does assess the overall capital adequacy of a with the qualification requirements
not change requirements for compliance bank through a comprehensive would be required to establish a plan
with existing regulations and evaluation of all relevant information. satisfactory to its primary Federal
supervisory standards related to risk 8. On an ongoing basis, the supervisor to return to compliance, as
management practices or other areas. supervisory assessment process discussed in the U.S. Advanced
The supervisory review process determines whether a bank’s overall Framework.
described in this guidance helps to capital remains adequate as underlying 12. Supervisors will ensure that each
support supervisors’ ability to intervene conditions change. Changes in a bank’s bank using the U.S. Advanced
when necessary to prevent an risk profile or in relevant capital Framework complies with the
individual bank’s capital from falling measures are areas of particular focus qualifying requirements for calculating
below the level required to support its that are effectively addressed through regulatory capital, both at the
risk profile. the supervisory review process. consolidated level and at any U.S.
Comprehensive Supervisory Generally, material increases in risk that subsidiary banks also subject to the U.S.
Assessment of Capital Adequacy are not otherwise mitigated should be Advanced Framework. Thus, each bank
accompanied by commensurate applying the U.S. Advanced Framework
6. Capital helps protect individual increases in capital. Conversely, must have appropriate risk
banks from insolvency, thereby reductions in overall capital (to a level measurement and management
promoting safety and soundness in the still above regulatory minimums) may processes and systems that meet the
4 The term ‘‘bank’’ as used in this guidance
be appropriate if the supervisory rule’s qualification requirements for
includes banks, savings associations and bank
assessment provides support to calculating regulatory capital.
holding companies. The terms ‘‘bank holding conclude that risk has materially
declined or that it has been ICAAP
company’’ and ‘‘BHC’’ refer only to bank holding

companies regulated by the Federal Reserve Board appropriately mitigated. 13. The qualification requirements in
and do not include savings and loan holding 9. As a result of its comprehensive the U.S. Advanced Framework state that
companies regulated by the Office of Thrift
Supervision. supervisory assessment, a bank’s ‘‘a bank must have a rigorous process for
5 See section 38 of the Federal Deposit Insurance primary Federal supervisor may take assessing its overall capital adequacy in
Act (12 U.S.c. 1831o). action if it is not satisfied that capital is relation to its risk profile and a
comprehensive strategy for maintaining that regulatory capital measures are banks employ risk mitigation
an appropriate level of capital.’’ 6 A appropriate for internal use and reflect techniques, they should understand the
bank’s internal process for assessing its the bank’s risk profile. risk to be mitigated and the potential
overall capital adequacy, the ICAAP, 18. The design and operation of effects of that mitigation (including its
must be conducted by a bank in systems to meet the ICAAP requirement enforceability and effectiveness).
addition to its calculation of regulatory will necessarily differ based upon the • Credit risk: A bank should have the
capital requirements.7 complexity of each bank’s operations ability to assess credit risk at the
14. The fundamental objectives of a and risk profile. Many banks currently portfolio level as well as at the exposure
sound ICAAP are: employ ‘‘economic capital’’ measures or counterparty level. Banks should be
• Identifying and measuring material for some elements of risk management, particularly attentive to identifying
risks; such as, limit setting, or for evaluating credit risk concentrations and ensuring
• Setting and assessing internal performance and determining aggregate that their effects are adequately
capital adequacy goals that relate capital adequacy needs.8 In some cases, assessed. This should include
directly to risk; economic capital measures may relate consideration of various types of
• Ensuring the integrity of internal directly to ICAAP requirements; in other dependence among exposures,
capital adequacy assessments. cases, banks may be using economic incorporating the credit risk effects of
15. Assessing overall capital adequacy extreme outcomes, stress events, and
capital measures that do not relate
through the ICAAP requires thorough shocks to assumptions about portfolio
directly to ICAAP requirements. For the
identification of all material risks, and exposure behavior. Banks should
latter, a bank does not necessarily need
measurement of those that can be also carefully assess concentrations in
reliably quantified, and systematic to change its existing process or
systems, but may build upon or counterparty credit exposures,
assessment of all risks and their including counterparty credit risk
implications for capital adequacy. In reconcile its economic capital process in
relation to the ICAAP requirement to exposures emanating from trading in
this manner, an ICAAP should less liquid markets, and determine the
contribute broadly to the development demonstrate how the two are generally
related. Regardless of the specific effect that these might have on capital
of better risk management within the adequacy.
organization at both the individual implementation method(s) chosen, a
bank’s overall ICAAP should address • Market risk: A bank should be able
entity and consolidated levels. to identify risks in trading activities
16. Each bank that uses the U.S. the three ICAAP objectives stated in
paragraph 14. resulting from a movement in market
Advanced Framework should have an prices. This determination should
ICAAP appropriate for its unique risk Identifying and Measuring Material consider factors such as illiquidity of
characteristics and should not rely Risks in ICAAP instruments, concentrated positions,
solely upon the assessment of capital one-way markets, non-linear/deep out-
adequacy at the parent company level. 19. The first objective of an ICAAP is
to identify all material risks. Risks that of-the money positions, and the
This does not preclude the use of a potential for significant shifts in
consolidated ICAAP as an important can be reliably measured and quantified
should be treated as rigorously as data correlations. Exercises that incorporate
input to a subsidiary bank’s own extreme events and shocks should also
ICAAP, provided that each entity’s and methods allow. The appropriate
means and methods to measure and be tailored to capture key portfolio
board and senior management ensure vulnerabilities.
that such processes are appropriately quantify those material risks are likely
to vary across banks. • Operational risk: A bank should be
modified from the consolidated ICAAP able to assess the potential risks
to address the unique structural and 20. Some of the risks to which banks
are exposed include credit risk, market resulting from inadequate or failed
operating characteristics and risks of internal processes, people, and systems,
their bank. risk, operational risk, interest rate risk
in the banking book, and liquidity risk as well as from events external to the
17. In general, the ICAAP will likely bank. This assessment should include
go beyond the restrictive or simplifying (as outlined below).9 However, other
risks, such as reputational risk, business the effects of extreme events and shocks
assumptions in regulatory requirements. relating to operational risk. Events could
However, in certain instances the or strategic risk, and country risk may
be as important for a bank and, in such include a sudden increase in failed
ICAAP may build on and utilize processes across business units or a
methods, practices, and results from a cases, should be given equal
consideration to the more formally significant incidence of failed internal
bank’s work for determining regulatory controls.
capital requirements. For example, an defined risk types.10 Additionally, if
• Interest rate risk in the banking
ICAAP may use data, ratings, or book: A bank should identify the risks
8 The term ‘‘economic capital’’ generally refers to
estimates from internal ratings-based the capital attributed to cover the economic effects associated with changing interest rates
approaches to credit risk. Furthermore, of an institution’s risk taking activities. In practice, on balance sheet and off-balance sheet
while an ICAAP should generally be a economic capital takes on a variety of definitions exposures in the banking book from
distinct and comprehensive process that and is applied in a number of ways at the product,
business-line, and consolidated institution level. both a short-term and long-term
produces its own capital measures, in 9 Examination policies and procedures from each perspective. This might include the
some cases banks may be able to justify agency provide extensive guidance on the major impact of changes due to parallel
risk categories. A bank’s risk management shocks, yield curve twists, yield curve
6 Part III, section 22 (a) (1) of the U.S. Advanced processes, including its ICAAP, should be
Framework. consistent with this existing body of guidance, as
inversions, changes in the relationships
7 Should the primary Federal supervisor exempt well as with relevant interagency guidance. of rates (basis risk), and other relevant
a bank from the application of the U.S. Advanced 10 For example, a bank may be engaged in scenarios. The bank should be able to
Framework based upon a written determination that businesses for which periodic fluctuations in support its assumptions about the
the application of the rule is not appropriate in light activity levels, combined with relatively high fixed behavioral characteristics of servicing
of the bank’s asset size, level of complexity, risk costs, have the potential to create unanticipated
profile, or scope of operations, such exemption losses that must be supported by adequate capital. rights, non-maturity deposits and other
would likewise apply to the requirement that the Additionally, a bank might be involved in strategic
bank have an ICAAP in the U.S. Advanced activities (such as expanding business lines or elements of risk and for which additional capital
Framework. engaging in acquisitions) that introduce significant would be appropriate.
assets and liabilities, especially those accordingly, banks should recognize the of capital adequacy, banks should
exposures characterized by embedded biases and assumptions embedded in, challenge fundamental assumptions
optionality. Given uncertainty in such and the limitations of, the qualitative embedded in the measurement of risks;
assumptions, stress testing and scenario approaches used. in certain cases, assumptions that were
analysis should be used in the analysis 24. An effective ICAAP should assess accurate during one historical time
of interest rate risks. risks across the entire bank. A bank period may no longer be valid and may
• Liquidity risk: A bank should choosing to conduct risk aggregation lead to mismeasurement or
understand risks resulting from its among various risk types or business misunderstanding of risks and/or the
inability to meet its obligations as they lines should understand the challenges capital needed to support them. Banks
come due, because of difficulty in in such aggregation. In addition, when should be explicitly aware of how
liquidating assets or in obtaining aggregating risks, banks should be sure sensitive their risk measurements are to
adequate funding. This assessment to address any potential concentrations various input assumptions.
should include analysis of sources and across more than one risk dimension, 29. A bank should consider external
uses of funds, an understanding of the recognizing that losses could arise in conditions and other factors that
funding markets in which the bank several risk dimensions at the same influence overall capital adequacy. The
operates, and an assessment of the time, stemming from the same event or potential impact of contingent
efficacy of a contingency funding plan a common set of factors. For example, exposures and changing economic and
for events that could arise. a localized natural disaster could financial environments should be
The risk factors discussed above generate losses from credit, market, and addressed; such analysis can include
should not be considered an exhaustive operational risks at the same time. stress testing or scenario analysis, but in
list of those affecting any given bank. 25. In considering possible effects of all cases should incorporate both
All relevant factors that present a diversification, management should be quantitative and qualitative methods.11
material source of risk to capital should systematic and rigorous in documenting 30. A bank’s ICAAP should ensure
be incorporated in a well-developed decisions, and in identifying adequate capital is held against all
ICAAP. Furthermore, banks should be assumptions used in each level of risk material risks not just at a point in time,
mindful of the capital adequacy effects aggregation. Assumptions about but over time, in order to account for
of concentrations that may arise within diversification should be supported by inevitable changes in a bank’s strategic
each risk type. analysis and evidence. The bank should direction, evolving economic
21. All measurements of risk have systems capable of aggregating conditions, and volatility in the
incorporate both quantitative and risks based on the bank’s selected financial environment. Indeed,
qualitative elements, but generally a framework. For example, a bank sensitivity of capital to economic and
quantitative approach should form the calculating correlations within or among financial cycles is an important feature
foundation of a bank’s measurement risk types should consider data quality to be included in a bank’s planning for
framework. In some cases, quantitative and consistency, and the volatility of current and future capital needs. For
tools can include the use of large correlations over time and under example, a bank’s ICAAP should
historical databases; when data are more stressed market conditions. consider the potential effects of a
scarce, a bank may choose to rely more sudden, sustained downturn. The level
heavily on the use of stress testing and Setting and Assessing Capital Adequacy
of capital deemed adequate by an
scenario analyses. Banks should Goals That Relate to Risk
ICAAP might also be influenced by a
understand when measuring risks that 26. The second objective of an ICAAP bank’s intention to hold additional
measurement error always exists, and in is to set and assess capital adequacy capital to mitigate the impact of
many cases is, itself, difficult to goals in relation to all material risks. volatility in capital requirements, the
quantify. In general, an increase in Importantly, banks should recognize need to accommodate acquisition plans,
uncertainty related to modeling and that regulatory capital requirements or the decision to accommodate market
business complexity should result in a represent a floor below which a bank’s perceptions of capital adequacy and
larger capital cushion. overall capital level must not fall, even their impact on funding costs.
22. Quantitative approaches that focus if bank management believes that there 31. Various definitions of bank capital
on most likely outcomes for budgeting, is justification for a lower overall level. are used within banking. A bank should
forecasting, or performance 27. Assessments of risk and capital state clearly the definition of capital
measurement purposes may not be fully adequacy should reflect the risk appetite used in any aspect of its ICAAP. For
applicable for capital adequacy because of the bank. This appetite may be example, the definition used in models
the ICAAP should also take less likely expressed through an established risk to measure capital adequacy relative to
events into account. Stress testing and tolerance that generally reflects a risk may not correspond to capital
scenario analysis can be effective in desired level of risk coverage and/or a actually held (available capital
gauging the consequences of outcomes certain degree of creditworthiness, such resources), and the bank should
that are unlikely but would have a as an explicit solvency standard. understand such differences. For
considerable impact on safety and Because risk profiles and choices of risk internal purposes, some banks may
soundness. tolerance may differ across banks, choose a narrow capital definition, such
23. To the extent that risks cannot be chosen capital targets may also differ.
reliably measured with quantitative 28. Actual capital held should reflect 11 The use of stress testing and scenario analysis
tools—for example, where not only the measured amount of risk, in identifying and measuring risk exposures and
measurements of risk are based on but also potential uncertainties related assessing capital adequacy in an ICAAP is not the
same as the stress testing requirement related to
scarce data or unproven quantitative to the measurement of risk. In minimum regulatory capital requirements (as
methods—qualitative tools, including addressing concerns about how
described in the U.S. Advanced Framework and

experience and judgment, may be more limitations of risk measurement affect supervisory guidance relating to qualification
heavily utilized. Banks should be capital adequacy, banks should pay requirements). The stress testing and scenario
analysis encouraged in the ICAAP guidance is
cognizant that qualitative approaches particular attention to the relative intended to focus on overall capital needs and their
have their own inherent biases and importance to the bank of the activities possible fluctuations—not just fluctuations in
assumptions that affect risk assessment; producing the risk. In their assessment minimum regulatory capital requirements.
as only common equity, while others appropriateness and adequacy of capital adequacy. Beyond that,
may define capital more broadly. Banks ICAAP. In addition, where applicable, management should be able to
should also state explicitly the impact documentation should cover all aspects demonstrate that the ICAAP influences
that retained earnings have on capital ordinarily expected for sound use of business decisions and overall risk
positions. Since components of capital quantitative methods, including model management, and is not simply a
are not necessarily alike and have selection, limitations, data selection and compliance exercise. An ICAAP should
varying ability to absorb losses, a bank maintenance, controls, and validation. influence decision-making at both the
should thoroughly understand the 36. An ICAAP should be enhanced consolidated and individual business-
relationship between its internal capital and refined over time, with learning and line levels.
definition and its assessment of capital experience (both quantitative and 40. An ICAAP should, to the extent
adequacy. The bank should document qualitative) contributing to its possible, be integrated with other
any changes in its internal definition of improvement. It should evolve with management processes related to risk
capital, and the reason for those changes in the risk profile and activities assessment, business planning and
changes. of the bank as well as advances in risk forecasting, pricing strategies and
32. For effective capital planning, measurement and management performance measurement.
banks should identify the time horizon practices. Special attention may be Additionally, the components of an
over which they are assessing capital necessary for areas where the
adequacy. Banks should evaluate ICAAP, including models and their
operational or business environment has inputs, should be used in (or at the very
whether long-run capital targets are changed, such as the introduction of
consistent with short-run goals, based least be consistent with elements used
new products and activities. in) regular business and risk
on current and planned changes in risk 37. The board of directors and senior
profiles and the recognition that management decisions.
management have certain
accommodating additional capital needs responsibilities in developing, 41. As part of the ICAAP, the board
can require significant lead time. Capital implementing, and overseeing an or its delegated agent, as well as
planning should factor in the potential ICAAP. The board or its appropriately appropriate senior management, should
difficulties of raising additional capital delegated agent should approve the periodically review the resulting
during downturns or other times of ICAAP and its components, review assessment of overall capital adequacy
stress. Banks should have contingency them on a regular basis, and approve and determine that actual capital held is
plans to address unexpected capital any revisions. That review should consistent with the risk appetite of the
needs or liquidity/funding issues. encompass the effectiveness of the bank, taking into account all material
ICAAP, the appropriateness of risk risks. This review should include an
Ensuring Integrity of Internal Capital
tolerance levels and capital planning, analysis of how measures of internal
Adequacy Assessments
and the strength of control capital adequacy compare with other
33. A satisfactory ICAAP comprises a capital measures (such as regulatory,
complete process with proper oversight infrastructures. Senior management
should continually ensure that the accounting-based or market-
and controls, not just an ability to carry determined). The review should also
out certain capital calculations. The ICAAP is functioning effectively and as
intended; considerations by senior result in formal procedures to correct
various elements of a bank’s ICAAP any deficiencies uncovered in the
should supplement and reinforce one management should be explicit, formal,
and documented. Additionally, internal assessment process, especially if capital
another to achieve the overall objective is not consistent with the risk profile or
of assessing the adequacy of the bank’s audit should play a key role in the
controls and governance surrounding an risk appetite of the bank.
actual capital resources, taking into
account the full risk profile. ICAAP on an ongoing basis. Dated: February 12, 2007.
34. Adequate internal controls and 38. Each bank should ensure that the John C. Dugan,
documentation should be in place to components of its ICAAP, including any Comptroller of the Currency.
ensure transparency, objectivity, and models and their inputs, are subject to
By order of the Board of Governors of the
consistency in an ICAAP. Decisions validation policies and procedures. Federal Reserve System.
regarding the design and operation of Validation is generally defined as an
Dated: February 13, 2007.
the ICAAP should reflect sound risk ongoing process that encompasses, but
is not limited to, the collection and Jennifer J. Johnson,
management objectives, and should not
be unduly influenced by competing review of developmental evidence, Secretary of the Board.
business objectives. Principles process verification, benchmarking, Dated at Washington, DC, the 15th day of
underlying a bank’s ICAAP should be outcomes analysis, and monitoring February, 2007.
incorporated in policies that are activities used to confirm that processes By order of the Federal Deposit Insurance
reviewed and approved at appropriate are operating as designed. The Corporation.
levels within the organization. sophistication of validation policies and Robert E. Feldman,
35. Banks should have complete procedures should be appropriate to the
Executive Secretary.
documentation covering the ICAAP. At bank’s business, structure, and
sophistication, as well as the relative Dated: February 15, 2007.
a minimum, such documentation
should include a description of the importance of each component of By the Office of Thrift Supervision,
overall process, including committees ICAAP. In conducting validation, banks John M. Reich,
and individuals responsible for the should adhere to the existing body of Director.
ICAAP, the frequency of ICAAP-related supervisory guidance on the subject. [FR Doc. 07–811 Filed 2–27–07; 8:45 am]
reporting, and procedures for the 39. The primary use of an ICAAP is
BILLING CODES 4810–33–P, 6210–01–P, 6714–01–P,

periodic evaluation of the to provide an assessment of internal 6720–01–P

Notice: Reports and guidance documents; availability, etc.: Risk-based capital; internal ratings-based systems for credit risk, advanced measurement approaches for operational risk, etc.; supervisory guidance

Загружено:

Сведения о документе

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

Notice: Reports and guidance documents; availability, etc.: Risk-based capital; internal ratings-based systems for credit risk, advanced measurement approaches for operational risk, etc.; supervisory guidance

Загружено:

Авторское право:

Доступные форматы

Wednesday,

February 28, 2007

5 Supervisory expectations pertaining to a bank’s

somewhat differently from the proposed

minimums, supervisors would consider and • Hand Delivery/Courier: Guard

1 The Federal banking agencies are: The Board of

standardization outweigh the benefits of listed at the front of each chapter, as

incorporated into the parent

circumstances.) be particularly sensitive to changes in these data would be considered

parameter estimates. Nonetheless, final ELGD and

elevated mortgage prepayments owing B. Estimation Example 2

calculation should be on a pooled basis all other wholesale. —Quantification methodologies to

identified drivers of loss severity C. Mapping estimation process, no exposure or

exposure up to and after the time a

exposure in the event of credit deterioration of the

before proceeding to mapping and estimates the shapes of a family of

Rule Requirements include: wholesale and retail exposures, the

13 Another common use of overrides in retail

in which banks attempt to change and improve

EAD under the alternative methods.

Federal Deposit Insurance Act (12 U.S.C.

OTC derivative ..................................................................... Yes ....................... No ......................... No ......................... Yes.

haircuts, a bank could choose to use would be required to adjust the

mismatch. Therefore, the EAD of the

TABLE 2.—STANDARD SUPERVISORY MARKET PRICE VOLATILITY HAIRCUTS 20

requirement. As described in paragraph 47 of this

written approval of [AGENCY] under and recourse requirements, waterfall

pass-through securities are to be treated as

• The servicer’s right to

Purchase Pool LF LF Internal NRSRO

Credit Card ......................................................... $400,000 $0 $400,000 366 day ..... 2 ‘‘AAA’’

30 Termination events, also referred to as

Purchase Pool LF LF Internal NRSRO

Total ............................................................ 1,200,000 550,000 1,200,000

Overlap and Risk-Weighted Assets

Credit Card ............................................. $0 $0 $120,000 $24,000 $24,000

Total Risk-Weighted Assets ........... $47,500 $24,000 $71,500

Purchase Pool LF LF Internal NRSRO

Credit Card ......................................................... $400,000 $0 $400,000 366 day ..... 2 ‘‘AAA’’

Total ............................................................ 1,200,000 550,000 1,200,000

Overlap and Risk-Weighted Assets

Credit Card ............................................. $0 $0 $40,000 $8,000 $8,000

Total Risk-Weighted Assets ........... $40,700 $24,000 $64,700

of the bank’s IRB validation activities. NRSRO rating methodologies to the

TABLE 1.—UNDERLYING WHOLESALE EXPOSURE CHARACTERISTICS

#1 ..................................................................................... $5.00 0.75 35.0 0.26 5 $0.35

Pool .................................................................................. 100.00 0.96 43.5 0.46 4.55 9.34

EWALGD is the exposure-weighted underlying exposures. To illustrate

Next, the supervisory add-on term can

K[KIRB] is then substituted into the

TABLE 4.—UNDERLYING MORTGAGE LOAN POOL CHARACTERISTICS

Retail ............................................................................................................ $ 100.00 0.50% 10.0% 0.05% $ 0.62 0.67%

Calculation of the SFA Capital

TABLE 8.—UNDERLYING LOAN POOL CHARACTERISTICS

Wholesale .................................................................................................................... $ 100.00 ..................... 1.32% $ 7.32 8.64%

Originating Bank Capital Calculation originating bank to apply the SFA to

A ............................................................... ‘‘AAA’’ ....................................................... $ 67.50 7 $0.38 0.56

exposure level and capital; any rating changes.

33 71 FR 55922 through 55924 (Sept. 25, 2006).

EL ................... Expected loss. a one year 99.9% con-

provided in Appendix B. The standards

meets one of the applicability criterion of the rule.

Supervisory assessments of independence will rely

framework may consider loss experience; effects of