Commission Delegated Regulation (EU) 2024/1085 of 13 March 2024 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical standards on the assessment methodology under which competent authorities verify an institution’s compliance with the requirements to use internal models for market risk

COMMISSION DELEGATED REGULATION (EU) 2024/1085 of 13 March 2024 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical standards on the assessment methodology under which competent authorities verify an institution’s compliance with the requirements to use internal models for market risk (Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and amending Regulation (EU) No 648/2012 (1), and in particular Article 325az(8), first subparagraph, point (b), and third subparagraph, thereof,

Whereas:

(1) Institutions are only allowed to use internal models for market risk if they comply with the requirements laid down in Regulation (EU) No 575/2013. Institutions should not only comply with those requirements when they apply for permission to use those internal models, but also when they use those models, and when they apply for material extensions or changes to such internal models. It is therefore appropriate to lay down that competent authorities, when they verify whether institutions comply with those requirements, apply the same criteria and the same assessment methodology to each of those phases. However, for reasons of efficiency and to reduce administrative burdens, competent authorities, when assessing compliance by institutions that have already been granted permission to use such alternative internal models, should not be required to reassess such permission. They should rather only assess compliance with those rules that are relevant to the scope of the assessment concerned, and build, in each case, on the conclusions from previous assessments.

(2) To ensure that institutions comply on a continuous basis with the requirements laid down in Regulation (EU) No 575/2013, competent authorities should evaluate the overall quality of the solutions, systems and approaches implemented by an institution, and request constant improvements and adaptations to changed circumstances.

(3) To ensure harmonisation and comparability of supervisory practices across different jurisdictions, competent authorities’ assessment of whether institutions comply with the requirements laid down in Regulation (EU) No 575/2013 should comply with prescriptive assessment techniques. Competent authorities should, however, be able to take into account the nature, size and complexity of an institution’s structure and business model, the complexity of the alternative internal models, the nature of the financial products those models cover, the quality of information provided by the institution concerned, and the resources they have at their disposal. Competent authorities should therefore, when they assess whether an institution complies with the requirements laid down in Regulation (EU) No 575/2013, be granted a certain discretion, enabling them to carry out additional checks and to apply the most appropriate methods for verifying compliance with particular requirements. In addition, to enable competent authorities to conduct that assessment in a proportionate manner, and given the broad range of financial products available in trading activities, it is necessary to lay down categories of financial products of increasing level of complexity, on which competent authorities should base their assessment.

(4) To ensure sufficient in-house understanding of the alternative internal model, including outsourced operations, it is necessary to lay down that, despite any outsourcing of some risk tools, IT systems, and risk management solutions, all key tasks, activities or functions related to the internal model are to be conducted by the risk control unit referred to in Article 325bi(1), point (b), of Regulation (EU) No 575/2013. For the same reasons, those rules should also require that the risk control unit implements adequate controls and performs quality and validation tests for any outsourced solution, that full documentation on those controls and test is available in all cases, and that competent authorities assess any tools and IT solutions obtained from third party vendors in a manner similar to cases where they have been fully developed via internal processes.

(5) Governance and operational aspects play a central role in the proper functioning of the alternative internal model. The methodology to verify whether an institution complies with the requirements laid down in Regulation (EU) No 575/2013 (‘assessment methodology’) should therefore comprehensively assess those governance and operational aspects, including the trading desk set-up, the role of the senior management and the management body, the risk-control unit, and the independent review of the alternative internal model itself.

(6) The assessment methodology relating to governance aspects should take into account that certain institutions that ask for permission to use the alternative internal model approach already obtained approval, before Regulation (EU) No 575/2013 was amended by Regulation (EU) 2019/876 of the European Parliament and of the Council (2), to use an internal model to calculate the own funds requirements for market risk. It is therefore necessary to lay down assessment rules that are similar to those laid down in the past for those aspects that were not amended by Regulation (EU) 2019/876, and to introduce new rules that cover new provisions introduced by that Regulation, including the trading desk requirements laid down in Article 104b of Regulation (EU) No 575/2013.

(7) To enable competent authorities to assess compliance with the requirements for the validation and review of alternative internal models, institutions should perform the internal validation of the model at least annually. While initial validation should cover all methodologies applied throughout the internal model, it is appropriate to lay down, in consideration of staff and resources constraints, that the annual validation focuses on at least the main issues detected either in previous internal validations or previous internal audit reviews, and on any changes or new methodologies introduced in the alternative internal model.

(8) Trading activities and financial markets are evolving constantly and rapidly. To enable competent authorities to take those characteristics into account when assessing whether institutions comply with the requirements laid down in Regulation (EU) No 575/2013, the assessment methodology should contain qualitative and procedural standards with regard to the formal approval by the institution of new financial instruments and products, and their introduction in the trading area. Standards for a formal new product approval policy are necessary to ensure that the introduction of new financial instruments and products, which may pose additional risk factors or require methodological changes to the internal risk measurement models, is fully compatible with the comprehensive control and validation.

(9) The quality of data and the accuracy of risk estimation and of calculation of own funds requirements for market risk are highly dependent on the reliability of the IT systems used for that purpose. Equally, the continuity and consistency of the risk management processes and the calculation of own funds requirements for market risk can only be ensured where such IT systems are safe, secure, and reliable, and where the IT infrastructure is sufficiently robust. It is therefore necessary that, when assessing the market risk internal models, competent authorities also check the reliability of the institution’s IT systems and the robustness of the IT infrastructure used for the internal models.

(10) One of the novelties of the new market risk framework laid down in Part Three, Title IV, Chapter 1b, of Regulation (EU) No 575/2013 is the determination of own funds requirements on the basis of expected shortfall measures. It is necessary to ensure that institutions actively monitor the accuracy of those figures. It is therefore appropriate to require institutions to directly back-test their expected shortfall measures as part of the internal back-testing programme required by Article 325bj of Regulation (EU) No 575/2013. As there is not yet an established methodology among market participants for back-testing an expected shortfall measure, no specific methodology should be prescribed, and institutions should be left free to take into account the evolution of new techniques and best practices in that regard, in line with the qualitative requirements set out in Article 325bi of that Regulation.

(11) Internal-risk measurement models can only considered to be implemented with integrity, as referred to in Article 325bi(1) of Regulation (EU) No 575/2013, where all regulatory requirements are met. In addition, several building blocks of the Basel reforms in the area of market risk have been implemented in Union law by means of delegated acts, inter alia, Commission Delegated Regulation (EU) 2022/2058 (3), Commission Delegated Regulation (EU) 2022/2059 (4), Commission Delegated Regulation (EU) 2022/2060 (5), Commission Delegated Regulation (EU) 2023/1577 (6), Commission Delegated Regulation (EU) 2023/1578 (7) and Commission Delegated Regulation (EU) 2024/397 (8). It follows that competent authorities should consider whether institutions comply with the requirements laid down Regulation (EU) No 575/2013, taking into account those delegated acts. To ensure a comprehensive assessment of compliance of market risk internal models, it is necessary to specify techniques for competent authorities to assess institutions’ compliance with aspects covered both by the Regulation (EU) No 575/2013 and by those delegated regulations. For that reason, competent authorities should examine specific documentation that institutions are required to produce.

(12) The back-testing and the profit and loss attribution requirements provide a solid basis for a critical monitoring of the performance of the internal-risk measurement model. It is therefore necessary to lay down assessment rules to consider the results of those tests. In relation to back-testing, it should be ensured that overshootings are critically analysed to identify potential weaknesses in the model, and that institutions monitor whether the changes in the portfolios’ values are driven by modellable or by non-modellable risk factors. Furthermore, in light of the profit and loss attribution test results, competent authorities should assess the accuracy of the pricing functions employed by the institution, as their accuracy is essential for a sound calculation of the own funds requirements.

(13) In order to ensure the consistent application of the requirements laid down in Article 325bh of Regulation (EU) No 575/2013, it is necessary to further specify those requirements. Whether institutions comply with those requirements should be assessed on the basis of the broad risk factor categories referred to in Table 2 of Article 325bd of Regulation (EU) No 575/2013. It is therefore necessary, for each of those categories, to lay down how competent authorities are to assess whether basis risk is captured, and whether the treatment of curves and surfaces in the internal risk-measurement model is sound.

(14) Due to the fast changing and evolving nature of financial markets, unreliable, inaccurate, incomplete, or outdated data result in errors in the risk estimation and in the calculation of own funds requirements, including in market risk models. In the context of risk management processes of an institution, such erroneous data may also lead to poor management decisions. Consequently, to ensure the reliability and high quality of data and their proper use in the internal processes and the processes for the calculation of own funds requirements, the way data are collected and stored and the procedures for such collecting and storing should be well documented, including a full description of the characteristics, quality checks, automatic filters, and specific sources of daily data. Competent authorities, when they assess market risk internal models, should therefore give particular attention to the quality and reliability of the data used for modelling purposes, and to the processes applied to ensure that such quality and reliability are maintained.

(15) To ensure a correct calculation of the own funds requirements, competent authorities, when they assess the overall quality of the data, should assess whether the approach employed by the institution to proxy time series is sound. The assessment methodology should therefore verify that the requirements set out in Regulation (EU) No 575/2013 governing the usage of proxies are complied with. Where relevant, the rules laid down in that assessment methodology should differ depending on whether the time series for which a proxy has been used relates to a risk factor that passed the modellability assessment, or to a risk factor that did not.

(16) In relation to the internal default risk model, and more in particular Articles 325bn, 325bo, 325bp of Regulation (EU) No 575/2013, it is necessary that the assessment methodology ensures that those risk models lead to accurate results. The rules laid down in the assessment methodology should therefore cover all aspects affecting the outcome of those models, including the scope of the positions captured by those models, the estimates of default probabilities and losses given default, the choice of systematic risk factors to simulate the default of issuers, and all modelling assumptions made by the institution, including any copula assumption made for simulating the default of multiple issuers.

(17) Risks stemming from climate change and broader environmental issues are changing the risk picture for the financial sector and are expected to become even more prominent. Considering the importance of those risk drivers, competent authorities should verify that institutions consider those risk drivers in their stress testing programmes referred to in Article 325bi(1), point (g), Regulation (EU) No 575/2013. In that context, institutions have already taken steps to include environmental risks in their stress testing programmes. However, to ensure that institutions have sufficient time to fully reflect those risks in their stress testing programmes, competent authorities should assess compliance of institutions with any requirements related to climate change and broader environmental related aspects only as of 1 January 2025. Similarly, in light of the complexity of the implementation of the expected shortfall direct backtesting, institutions should be given an additional period before competent authorities assess their compliance in this area. Hence, the related date of application of the assessment should be set to start as of 1 January 2026.

(18) This Regulation is based on the draft regulatory technical standards submitted to the Commission by the European Banking Authority.

(19) The European Banking Authority has conducted open public consultations on the draft regulatory technical standards on which this Regulation is based, analysed the potential related costs and benefits and requested the advice of the Banking Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1093/2010 of the European Parliament and of the Council (9),

HAS ADOPTED THIS REGULATION:

CHAPTER 1

GENERAL PROVISIONS

Article 1

Structure of the assessment

(a) the governance aspects, in accordance with Chapter 2 of this Regulation;

(b) aspects relating to the internal risk-measurement model used to compute the expected shortfall measure and the stress scenario risk measure, in accordance with Chapter 3 of this Regulation;

(c) aspects relating to the internal default risk model used to compute the additional own funds requirement for default risk, in accordance with Chapter 4 of this Regulation.

For the purposes of the first subparagraph, competent authorities shall apply the principles related to proportionality in accordance with Article 2, the quality of the documentation in accordance with Article 3, and the outsourcing arrangements in accordance with Article 4.

(a) require the institution to remove the positions corresponding to those product classes from that trading desk;

(b) refuse to grant permission to calculate the own funds requirements in accordance with the internal model approach for that trading desk.

(a) require the institution to remove the positions corresponding to those product classes from that trading desk;

(b) refuse to grant the permission to calculate the own funds requirements in accordance with the internal model approach for that trading desk.

Article 2

Proportionality – product categories and model complexities

Competent authorities shall apply the assessment methodology set out in this Regulation in a manner that is proportionate to the size and complexity of the trading activities included in the internal model, based on the following categories of financial instruments in increasing order of complexity:

(a) simple instruments without optionality;

(b) instruments, other than those referred to in point (a), without path-dependent features, on a single underlying, including indices, with a continuous payoff in the same currency as the underlying;

(c) instruments with path-dependent features, instruments on multiple underlyings, instruments with payoffs in currencies that are different to that of the underlying, and any other instruments that are not referred to in points (a) or (b).

Article 3

Quality and auditability of documentation

Competent authorities shall verify that the documentation submitted by an institution in support of its application for permission to use an internal model for the calculation of own funds requirements for market risk is of sufficient quality and is sufficiently detailed and accurate to allow for examination by qualified third parties.

Competent authorities shall in particular verify that:

(a) the documentation concerned is approved at the appropriate management level of the institution with sufficient authority delegated by the management body for the purposes of internal models;

(b) the institution has established policies which ensure high-quality standards for internal documentation, including internal accountability to ensure that the documentation concerned is complete, consistent, accurate, updated, approved in accordance with point (a), and secure;

(c) the documentation set out in the policies referred to in point (b) provides for the identification of the type of document, the author, the reviewer, the authorising agent, the owner, the dates of development and approval, the version number, and the history of amendments;

(d) the institution accurately and diligently documents the policies, procedures, and methodologies it applies pursuant to this Regulation;

(e) the documentation concerned is sufficiently detailed to enable qualified third parties to understand all aspects of the internal risk-measurement model.

Article 4

Outsourcing

(a) tasks and responsibilities reserved for the risk control unit are not outsourced;

(b) the senior management and the management body are actively involved in the supervision of any tasks outsourced by the institution, and in the acquisition of any IT risk management tool solutions from third parties;

(c) the institution itself has sufficient knowledge about any outsourced tasks, activities or functions and of the structure of any data and methodologies obtained from a third party, and is able to verify the quality of the work performed by the third party to which it outsources its tasks, as well as the results of that work;

(d) the internal audit and the ongoing monitoring by the institution of any outsourced tasks, activities and functions are not limited or inhibited by such outsourcing;

(e) full access to all relevant information is granted to competent authorities.

(b) review other relevant documents of the institution or the third party.

CHAPTER 2

ASSESSMENT OF QUALITATIVE REQUIREMENTS

Article 5

Overview of the assessment of qualitative requirements

When assessing an institution’s compliance with the qualitative requirements set out in Article 325bi of Regulation (EU) No 575/2013, competent authorities shall:

(a) verify whether the institution has a clear organisational structure for the governance and management of the market risk model, including well defined, transparent and appropriate lines of responsibility;

(b) verify whether the decision-making process of the institution regarding all aspects of market risk internal models is clearly established in the institution’s internal documentation;

(d) verify, in accordance with Article 7, whether the set-up of the trading desks for which the institution is in the process of being granted the approval, or has already obtained the approval, is adequate;

(e) assess, in accordance with Article 8, the internal governance and oversight of the institution in relation to the risk control unit;

(f) assess, in accordance with Article 9, whether the internal policy is adequate for the introduction of new products;

(g) verify, in accordance with Article 10, whether the internal model is reviewed independently;

(i) assess, in accordance with Article 13, the adequacy of the internal regular reporting;

(l) assess, in accordance with Article 19, the adequacy of the IT systems;

(m) verify, in accordance with Article 20, whether the internal risk-measurement model, including any pricing model, has a proven track record of being reasonably accurate in measuring risks, and does not differ significantly from the models that the institution uses for its internal risk management.

For the purposes of point (a), competent authorities shall take into account the nature and size of the institution, and the scale and complexity of its activities.

Article 6

Assessment of the adequacy of the composition and role of the management body and senior management

(b) verify whether the senior management is constituted of members that represent the highest hierarchical levels below the management body, and has defined responsibility for the proper functioning of the internal model for market risk;

(c) verify whether the composition of any internal committee structure established by the management body to support its decision-making is adequate, as required by paragraph 2;

(d) verify whether the role of the senior management is adequate, as required by paragraph 3;

(e) verify whether the role of the management body, and of the committees constituting the internal committee structure referred to in point (c), are adequate, as required by paragraph 4.

Where an institution’s management body delegates any of its tasks to an internal committee, competent authorities shall, in the context of those delegated tasks, make the assessments required by this Regulation at the level of the internal committee designated by the management body.

(a) for each committee of the internal committee structure, the management body has clearly set out its mandate, hierarchy, reporting lines, permanent members, frequency of meetings, and levels of responsibility;

(b) the internal committee structure has a committee that assesses any new product, proposes those products to the senior management for approval, and monitors those products and whether the risk control unit, and any other function of the institution that is affected by the introduction of a new product, are represented in such committee;

(c) the governance underpinning the internal committee structure allows for the effective and timely control of all internal position limits referred to in Article 325bi(1), point (b), of Regulation (EU) No 575/2013;

(d) the governance underpinning the internal committee structure ensures active involvement of the management body in the risk-control process as required by Article 325bi(1), point (c), of Regulation (EU) No 575/2013;

(e) as part of the internal documentation, the institution has documented all aspects referred to in point (a).

(b) the senior management of the institution is informed of, and follows up on, the recommendations made by the internal audit, the risk control unit, the validation function, in relation to the internal risk-measurement model or the internal default risk model;

(c) the senior management of the institution is able to ensure the overall quality of the institution’s governance of the valuation of positions included in the internal risk-measurement model or the internal default risk model.

(a) on the basis of a proposal from the risk control unit, approves all relevant policies and procedures related to the implementation of the internal model, including the appropriate organisational structure, to ensure that the internal model is implemented with integrity;

(b) on the basis of a proposal from the risk control unit and after due consideration of the conclusions and recommendations resulting from the validation process, approves the methodologies for assessing market risk applied in the internal model;

(c) on the basis of an assessment from the risk control unit and after due consideration of the conclusions and recommendations resulting from the validation process, approves any new products;

(d) on the basis of a proposal from the risk control unit, approves and updates the internal position limits;

(e) on the basis of a proposal from the risk control unit laying down and assessing the acceptable level of risk, approves the acceptable level of risk, the internal capital allocation and the budget by trading desk;

(f) adopts the approval procedure for breaches of internal position limits;

(g) approves or requires corrective actions in relation to breaches of the internal position limits escalated by the risk control unit in accordance with Article 16(1), point (b);

Article 7

Assessment of whether trading desks comply with Article 104b of Regulation (EU) No 575/2013

When assessing whether trading desks comply with Article 104b of Regulation (EU) No 575/2013, competent authorities shall:

(c) review the organisational structure referred to in Article 104b(2), point (b), of Regulation (EU) No 575/2013 and the annual business plan referred to in Article 104b(2), point (e), of that Regulation, as documented in the internal policies of the institution under Article 325bi(1), point (e), of that Regulation;

(d) verify whether for each trading desk, the institution has identified one or two head dealers, and that where two head dealers have been appointed, they either have roles, responsibilities, and authorities that are clearly separated, or one has ultimate oversight over the other;

(e) review the reports referred to in Article 104b(2), points (d) and (f), of Regulation (EU) No 575/2013, and verify whether all aspects referred to in those points are complied with;

(h) verify whether the business strategy entails that at least 10 % of the own funds requirements for market risk are calculated in accordance with the internal model approach.

For the purposes of point (a)(i), competent authorities shall verify whether the business strategy specifies how much of the trading activities are customer driven, and whether the business strategy entails trade origination and structuring, or execution of services, or both.

For the purposes of point (b), competent authorities may, where appropriate, require the institution to provide a sample of transactions between trading desks, including between trading desks for which the institution computes the own funds requirements with the internal model approach and trading desks for which the institution uses the standardised approach.

Article 8

Assessment of the internal governance and oversight of the institution in relation to the risk control unit

(a) is completely separate and independent from the personnel and the management functions responsible for the trading business areas;

(c) is adequate, is proportionate to the size of the institution and the risks of the business, and has the resources necessary to perform its tasks effectively;

(d) has sufficiently experienced, qualified and trained staff to undertake all relevant activities for the effective risk management of the internal model and for monitoring and challenging the actions of other units, in particular of the trading business units;

(e) is responsible for the outcome of the calculations based on the internal-risk measurement model and the internal default risk model.

(a) the risk control unit is composed of one or more separate organisational structures in the institution’s organisational chart;

(b) the heads of the risk control unit or units are senior managers of the institution;

(c) the staff and the senior management responsible for the risk control unit are not responsible for any trading business activities;

(d) senior managers of the risk control unit and those responsible for business areas have different reporting lines to the management body of the institution;

(e) the variable remuneration of the staff and senior management responsible for the risk control unit is not linked to the performance of the tasks related to trading business areas under their supervision in a way that hinders or impedes their independence.

(a) the documented view of the risk control unit when either the management body or the relevant committee of the internal committee structure discuss any of the issues referred to in paragraph 1, point (b);

(b) the minutes of the institution’s management body or relevant committee of the internal committee structure, and the action points reflected therein;

(c) the reports of the risk control unit about internal position limits, and any decisions regarding limit breaches;

(d) information provided by the staff and senior management of the institution, where appropriate.

For the purposes of point (b), competent authorities shall assess the degree of involvement of the risk control unit when the institution’s management body or relevant committee of the internal committee structure discuss any of the issues referred to in paragraph 1, point (b). Competent authorities shall identify cases where the view of the risk control unit and the final decision taken by either the management body or the relevant committee of the internal committee structure diverge.

Article 9

Assessment of the new product policy

When assessing whether the internal policies referred to in Article 325bi(1), point (e), of Regulation (EU) No 575/2013 are adequate for the introduction of any new product, including new financial instruments, activities, markets, booking locations or business lines, competent authorities shall verify whether:

(a) the risk control unit has documented a new product policy and the management body has approved that policy, including a definition of ‘new product’;

(c) the management body, based on an assessment by the new product committee, authorises the trading of new products;

(e) without the specific approval from the new product committee, the business areas are not authorised to trade new products before the issues referred to in point (b) are addressed;

(f) in the specific cases where traders are allowed to trade new products that do not comply with point (b), the new-product committee approves the transactions on an individual basis and within the limits referred to in point (d)(i);

(g) the new product committee meets frequently enough to evaluate and approve any new product transaction and to monitor all the issues referred to in point (b) that those transactions may pose;

(h) transactions are monitored individually until all issues referred to in point (b) have been fully addressed and, based on an assessment by the new product committee, the management body confirms that the transactions are fully incorporated into all relevant IT systems and controlled via the regular risk-management system;

(i) all new products, regardless of their degree of incorporation into the IT systems, are computed both in the internal risk-measurement model and in the daily changes to the portfolio’s value used for back-testing and profit and loss attribution test purposes.

Article 10

Independent review of the internal risk-measurement model

(a) the reviewer is independent;

(b) the resources assigned to the review are appropriate;

(c) the process established within the institution to address the recommendations made by the reviewer is adequate;

(d) the reviewer reviews the internal risk-measurement models on at least an annual basis, and includes the conclusions of that review in a report submitted to the senior management and the management body;

(e) the report referred to in point (d) provides sufficient information to the senior management and the management body of the institution on all elements referred to in Article 325bi(2) and Article 325bp(7) of Regulation (EU) No 575/2013, and identifies the areas in the annual work plan that require a more detailed compliance analysis of those elements;

(f) the review is adequate, proportionate to the size and the complexity of the portfolios concerned, and effective in identifying shortcomings.

(a) the review is proportionate to the nature, size, and complexity of the institution’s business and organisational structure, and in particular to the complexity of the internal models and their implementation;

(b) the reviewer has resources that are adequate to undertake all relevant activities, and sufficiently experienced and qualified staff;

(c) the reviewer is not, nor has been involved in any aspect of the design and implementation of the internal model subject to review;

(d) the reviewer is independent from the staff and management function responsible for the business and risk control units;

(e) the variable remuneration of the staff and management responsible for the review is not linked to the performance of the tasks related to the institution’s trading business areas in a way that hinders or impedes their independence.

Article 11

Assessment of the validation of any internal risk measurement models, and of the outcome of such validation

(a) the validation process is conducted by staff that is not nor has been involved in any way in the development of the internal model subject to validation;

(b) the validation process is conducted with sufficient resources, including experienced and qualified staff;

(c) the variable remuneration of the staff and senior managers responsible for the validation process is not dependent on the performance of the tasks related to the institution’s risk control or business areas in a way that hinders or impedes their independence;

(d) all necessary corrective measures resulting from the validation process are reflected in the validation report referred to in paragraph 2, and implemented in a timely manner;

(e) a decision-making process is in place to ensure that the senior management of the institution takes into account the findings and recommendations resulting from the validation process;

(f) the reviewer referred to in Article 10(1), point (a), regularly assesses the compliance with the conditions referred to in Article 10(1), points (e) and (f).

(b) verify whether the conclusions, findings and recommendations of the validation report are directly communicated to, and considered by, the management body of the institution before that management body approves a model to be applied for the calculation of own funds requirements and before any subsequent changes in the methodologies are applied;

(c) verify whether any remedial measure proposed by the validation functions is documented in the validation report and is accompanied by a timeline that is adequate for fixing the identified deficiencies;

(d) verify whether an escalation process is included in the internal policies of the institution for those remedial measures that are overdue, and whether, based on evidence from the past, that process is followed;

(e) assess the overall quality of the outcome of the validation process by comparing the deficiencies identified in the assessment of the internal model in accordance with this Regulation with the deficiencies identified by the validation unit in the validation process.

Article 12

Assessment of the adequacy of the scope and completeness of the internal validation

(a) critically reviews all aspects of the methodologies and pricing functions used for capital purposes, including those applied to new products, thereby taking account of strengths and weaknesses compared to any alternative methodologies;

(d) assesses the soundness of any empirical correlations used both within and across the broad categories of risk factors to calculate the unconstrained expected shortfall measure referred to in Article 325bh(2) of Regulation (EU) No 575/2013;

(f) assesses the assumptions made to obtain estimates of default probabilities and losses given default to compute own funds requirements for default risk;

(g) assesses the assumptions made in relation to the modelling of hedges in the computation of own funds requirement for default risk as referred to in Article 325bo of Regulation (EU) No 575/2013;

(h) analyses the results of the stress testing programme, including the results relating to default risk, and extracts relevant conclusions, if any, around methodological flaws or weaknesses stemming from particular market scenarios;

(j) verifies the robustness of the implementation of the internal risk measurement model in IT systems, and ensures that all business and support units apply methodologies consistently and for all relevant geographic areas;

(a) for the internal validation conducted when the model is initially developed, the institution has performed and documented a complete validation process for all methodologies applied in the internal model;

(c) assess how the work plan referred to in point (b) ensures that a comprehensive and risk-oriented internal validation process is performed, and that relevant aspects are not omitted from the scope of the internal validation.

Article 13

Assessment of the adequacy of reporting

When assessing the adequacy of the reports referred to in Article 104b(2), points (d) and (f), and Article 325bi(1), point (b), of Regulation (EU) No 575/2013, competent authorities shall verify:

(a) whether the institution maintains an inventory of those reports, specifying their content, frequency and addressees;

(b) whether the inventory referred to in point (a) has been approved at the appropriate management level and is updated in consultation with the risk control unit.

Article 14

Assessment of adequacy of trading limits

When assessing the adequacy of trading limits referred to in Article 103(2), point (b)(ii), Article 104b(2), points (c) and (f), and Article 325bi(1), point (b), of Regulation (EU) No 575/2013, competent authorities shall verify whether:

(a) the institution has a clear breakdown of trading limits that is consistent with the acceptable level of risk set by the institution and the budget of each trading desk;

(b) the choice of the trading limits reflects the trading strategy of the trading desk and the nature of the underlying risks;

(d) the institution has a further breakdown in the value-at-risk limits, proportional to the institution’s trading strategies;

(e) all internal limits, including those referred to in point (c), are properly documented and formally approved;

(f) as part of the limit approval and update process, the risk control unit assesses and documents the consistency and compatibility between the value-at-risk limits approved by the management body and the rest of the internal limits not based on value-at-risk, including sensitivities or loss trigger;

(g) the institution properly documents and formally approves an inventory of authorised instruments and underlying risk positions that traders can enter.

For the purposes of point (c)(i), the value-at-risk limit shall be the sum of individual value-at-risk limits when the permission to use the internal model approach, as referred to in Article 325(1), point (b), of Regulation (EU) No 575/2013, has not been granted.

Article 15

Assessment of the adequacy of the process to update trading limits

(a) the update process is coordinated and duly documented by the risk control unit;

Article 16

Assessment of the adequacy of the process relating to trading limit breaches

(a) the institution has a clear and documented procedure for the approval by the management body of breaching trading limits;

(b) the management body has specified materiality conditions according to which any breach of the trading limits are to be reported to the management body itself, irrespective of the level where the trading limits have been approved;

(c) the risk control unit documents any breaches of the trading limits and reports such breaches to the responsible committee, sub-committee or individual manager;

(d) the committee, sub-committee or individual manager referred to in point (c) either takes action when a trading limit is breached, or reports such breach to the management body, in accordance with point (b);

Article 17

Assessment of the adequacy of the stress testing programme

(a) the institution reviews scenarios applied as part of the stress testing programme at least annually;

(b) the risk control unit runs the stress test scenarios determined in the stress testing programme frequently and at least every month, and at a higher frequency where the institution has significant trading activities;

(c) the scenarios to be applied as part of the stress testing programme comprise, apart from historically observed or hypothetical scenarios, scenarios resulting from reverse stress testing and ad-hoc scenarios designed to address the relevant specific risk drivers;

(d) the scenarios referred to in point (c) are reviewed at least on an annual basis.

(a) losses arising from events, including credit events;

(b) hypothetical rating downgrades;

(c) market events on specific issuers’ types;

(d) changes to copulas’ types and parameters, where modelled explicitly.

Article 18

Assessment of the adequacy of the reverse and ad-hoc stress testing scenarios

(a) the risk control unit applies the reverse stress test as a tool to identify possible combinations of severe events and risk concentrations within the institution, including severe events and risk concentrations that derive from environmental risks;

(b) the analysis performed with the reverse stress test complements the regular stress testing;

(a) whether the risk control unit uses the results obtained from sensitivity analysis towards single risk factors, considered individually and jointly, to identify scenarios that include the stress of a combined set of plausible risk factors;

For the purposes of point (b)(i), the risk control unit may consider larger shocks to reflect the impossibility of unwinding positions in a timely manner, in particular for cash instruments, that is caused by the fact that positions are concentrated, or that are due to a sharp increase in market illiquidity.

For the purposes of point (b)(iv), the risk control unit may, in particular:

(a) assess the potential risk incurred when hedging positions valued using a proxy;

(b) apply the stressed scenario movements to the proxy while keeping illiquid positions constant.

Article 19

Assessment of the internal risk-measurement model in relation to the robustness of the IT systems

(a) assess the robustness of the IT systems during the last 250 business days;

Article 20

Assessment of reasonable accuracy of the internal risk-measurement model, including pricing model

(b) verify whether the inventories referred to in point (a) are updated at least annually, and whether the internal policies of the institution provide for a specific update whenever that would be necessary due to substantial changes in the information provided in the inventories;

(c) verify whether all the differences between the pricing functions used to compute the end-of-day value and the pricing functions used in the internal risk-measurement model are validated as part of the internal validation referred to in Article 325bj of Regulation (EU) No 575/2013;

(d) assess, on the basis of the profit and loss attribution results and the back-testing results, whether there are pricing functions that may present deficiencies;

(e) analyse the conclusions in the most recent reports by the institution’s internal validation referred to in Article 325bj of Regulation (EU) No 575/2013 regarding the accuracy of the internal risk-measurement model;

(f) analyse the conclusions laid down in the most recent reports about the institution’s internal review of the accuracy of the internal risk-measurement model, as referred to in Article 325bi(1), point (h), of Regulation (EU) No 575/2013;

(g) verify whether the institution has documented the differences between the internal risk-measurement model and the models that the institution uses for its internal risk management for the same scope of positions, and whether the institution is able to explain those differences;

(h) analyse the results of the tests performed by the institution as part of its internal validation to verify whether the assumptions made in the internal risk-measurement model are appropriate and do not underestimate or overestimate the risk, as referred to in Article 325bj(3), point (a), of Regulation (EU) No 575/2013, in particular for the trading desks with the highest differences between the own funds requirements calculated in accordance with the alternative standardised approach referred to in Part Three, Title IV, Chapter 1a of Regulation (EU) No 575/2013, and the own funds requirements calculated in accordance with the internal risk-measurement model.

For the purposes of point (d), competent authorities may, where appropriate, require the institution to calculate, on a set of instruments and commodities for which the competent authority wants to test the accuracy of the pricing functions, the risk-theoretical changes referred to in Chapter 2, Section 2, of Commission Delegated Regulation (EU) 2022/2059 (10) and the hypothetical changes referred to in Chapter 1, Section 2, of that Delegated Regulation, and require the institution to justify differences in outcome between the two measures.

(a) the actual, hypothetical, and risk theoretical changes over 60 business days in the trading desk portfolio’s value, without any hedges with the entity of the group being considered;

(b) the value-at-risk numbers at trading desk level as referred to in Article 325bf of Regulation (EU) No 575/2013 over 60 business days, without any hedges with the entity of the group being considered;

(c) an assessment of the profit and loss attribution results and back-testing results in light of the changes in the portfolio’s values referred to in point (a) and the value-at-risk numbers referred to in point (b).

Article 21

Assessment of the internal risk-measurement model in relation to additional back-testing programmes

(a) runs the back-testing programme referred to in paragraph 2 or another internal back-testing programme that enables the institution to identify the contribution of modellable and non-modellable risk factors to the back-testing results;

(b) applies direct expected shortfall back-testing approaches to its portfolios.

For the purposes of point (b), competent authorities shall verify how the institution motivates the choice of the applied direct expected shortfall back-testing methodology, and analyse whether that methodology is conceptually sound.

The institution may use the back-testing programmes referred to in the first subparagraph as an element to detect and monitor potential deficiencies in the calculation of the excepted shortfall measures. Where a competent authority decides on the permission to use the internal model approach to compute the own funds requirement for market risk in accordance with Article 325az, those back-testing programmes shall not supersede the outcomes of the regulatory back-testing referred to in Article 325bf of Regulation (EU) No 575/2013 and the profit and loss attribution requirements referred to in Article 325bg of that Regulation.

(a) an overshooting is identified as a one-day change in HPL MRF or in

(b) APL MRF that exceeds the value-at-risk number referred to in Article 325bf(6), point (a), of Regulation (EU) No 575/2013;

(d) the institution identifies potential weaknesses in its risk-measurement model by counting the overshootings, as identified in accordance with point (a), that occurred over the last 250 business days, and by comparing the amount of the identified overshootings against the thresholds referred to in Article 325bf(3), points (a) and (b), of Regulation (EU) No 575/2013.

CHAPTER 3

ASSESSMENT OF THE INTERNAL RISK-MEASUREMENT MODEL USED TO COMPUTE THE EXPECTED SHORTFALL RISK MEASURE AND THE STRESS SCENARIO RISK MEASURE

SECTION 1

Overview of the assessment

Article 22

Introduction to the assessment of the internal risk-measurement model used to compute the expected shortfall measure and the stress scenario risk measure

When assessing an institution’s compliance with the requirements applicable to the internal risk-measurement model used to compute the expected shortfall risk measure and the stress scenario risk measure, competent authorities shall assess whether the institution complies with:

(a) Section 2 of this Chapter, which contains requirements on risk factors, including the modellability assessment and the mapping to the appropriate liquidity horizon;

(c) Section 4 of this Chapter, which contains requirements on back-testing and profit and loss attribution;

(d) Section 5 of this Chapter, which contains requirements on the treatment of foreign exchange risk and commodity risk in the non-trading book;

(e) Section 6 of this Chapter, which contains requirements on the expected shortfall measure and the stress scenario risk measure calculations.

SECTION 2

Assessment of the internal risk measurement model’s risk factors set-up and properties

Subsection 1

Assessment of the internal risk measurement model’s risk factors set-up

Article 23

Assessment of the internal risk-measurement model’s coverage of the risk

(a) the institution documents whether there are risk factors used in the standardised approaches that are not included in the internal risk-measurement model;

For the purposes of point (a), institutions shall aggregate factors so that each aggregate shares the same attributes in relation to point (ii), point (iv)(1), and point (iv)(2).

For the purposes of point (b)(i), competent authorities shall apply the assessment method referred to in paragraph 3, and may complement that method by the assessment method referred to in paragraph 4.

For the assessment referred to in paragraph 2, point (b)(i), competent authorities shall identify trading desks or hypothetical portfolios used by the institution for the internal validation referred to in Article 325bj(3), point (c), of Regulation (EU) No 575/2013 whose values depend on factors that are not included in the internal risk-measurement model. Competent authorities shall verify for those trading desks whether the results of the back-testing referred to in Article 325bf of Regulation (EU) No 575/2013 or of the own internal model validation tests referred to in Article 325bj(3), point (b), of Regulation (EU) No 575/2013 indicate weaknesses in the internal risk-measurement model.

(b) require the institution to explain deviations in the changes in the portfolio’s values calculated in accordance with points (a)(i), (ii), and (iii).

Article 24

Assessment of general interest rates risk factors

(a) require the institution to provide a list of all the currencies towards which the institution’s portfolio is sensitive and, for each of those currencies, all the yield curves towards which the institution’s portfolio is sensitive;

(b) require the institution, for each of the yield curves referred to in point (a), to specify whether a curve is modelled in its entirety directly, or whether it is modelled as a sum of a base curve and a basis curve;

(c) require the institution to provide a sensitivity analysis of its portfolio towards each of the yield curves referred to in point (a);

(d) verify, by using the information referred to in points (a), (b) and (c), that the basis risk between any two given yield curves is either implicitly captured by the fact that two yield curves are modelled directly, or by the fact that a basis yield curve representing the difference between those two yield curves is included in the internal-risk measurement model;

(f) perform, in relation to curves that have been modelled by means of function parameters as referred to in Article 6 of Delegated Regulation (EU) 2022/2060, an additional assessment of compliance in accordance with Article 29 of this Regulation;

(g) assess whether vega risk related to interest rate risk is duly captured as required by Article 30 of this Regulation.

Article 25

Assessment of equity risk factors

(a) require the institution to provide a list of all equity names and equity indices towards which the institution’s portfolio is sensitive, and the risk factors used to model the associated risk;

(b) require the institution to provide a sensitivity analysis of its portfolio towards each of the equity names and equity indices referred to in point (a);

(c) verify that, where the risk in an equity name is modelled as a sum of a systematic risk factor as referred to in Article 3(3) of Delegated Regulation (EU) 2022/2060 and idiosyncratic risk factor, the volatility generated by shocking those factors reflects the volatility observed for that equity name;

(d) verify that the basis risk between two different equity names is captured by either modelling the two equity names directly or by means of a basis risk factor;

(e) assess whether the risk in changes in equity curves is duly captured in accordance with Article 29 of this Regulation;

(f) assess whether vega risk related to equity risk is duly captured in accordance with Article 30 of this Regulation.

For the purposes of point (c), the competent authority may, where appropriate, compare the volatility of the shocks applied to the issuer equity name, as resulting from the systematic and idiosyncratic risk factors, with the volatility observed for that equity name.

Article 26

Assessment of credit spread risk factors

(a) require the institution to provide a list of all issuers’ credit spreads curves and credit indices towards which the institution’s portfolio is sensitive, and the risk factors used to model the associated risk;

(b) require the institution to provide a sensitivity analysis of its portfolio towards each of the issuers’ credit spreads curves and credit indices referred to in point (a);

(c) verify whether, where the risk in an issuer credit spread is modelled as a sum of a systematic risk factor as referred to in Article 3(3) of Delegated Regulation (EU) 2022/2060 and an idiosyncratic risk factor, the volatility generated by shocking those factors reflects the volatility observed for that issuer credit spread;

(d) verify whether the basis risk between issuers is captured by either modelling the issuers’ credit spreads directly or by means of a basis risk factor, and whether the basis between different positions referencing to the same issuer is monitored and, when material, included in the internal risk-measurement model;

(e) assess whether the risk in changes in credit spread curves is duly captured as required by Article 29 of this Regulation;

(f) assess whether vega risk related to credit spread risk is duly captured as required by Article 30 of this Regulation.

For the purposes of point (c), competent authorities may, where appropriate, compare the volatility of the shocks applied to the issuer credit spread, as resulting from the systematic and idiosyncratic risk factors, with the volatility observed for that issuer credit spread.

Article 27

Assessment of foreign exchange risk factors

(a) require the institution to provide a list of all the currency pairs towards which the institution’s portfolio is sensitive and, for each of those currency pairs, to clarify whether that currency pair is subject to the spot exchange rate only, or other risk factors, including implied volatilities;

(b) require the institution to provide a sensitivity analysis of its portfolio towards each currency pair referred to in point (a);

(d) assess the extent to which the institution considers the risk linked to unpegging events for non-free floating currency pairs, and where such risk is material, how it is monitored;

(e) assess whether the risk in changes in foreign-exchange curves is duly captured as required by Article 29 of this Regulation;

(f) assess whether vega risk related to foreign-exchange risk is duly captured as required by Article 30 of this Regulation.

Article 28

Assessment of commodity risk factors

(b) verify whether the institution’s internal policies identify metrics that are appropriate to assess the materiality of a commodity market as referred to in Article 325bh(1), point (f), of Regulation (EU) No 575/2013 and whether, for commodity markets identified as material, each different commodity is specifically modelled in the institution’s internal risk-measurement model;

(c) verify whether the basis risk between similar but not identical commodities towards which the institution has material exposure is captured, including the basis risk stemming from a different place of delivery and from maturity mismatches;

(d) assess whether the risk in changes in commodity curves is duly captured as required by Article 29 of this Regulation;

(e) assess whether vega risk related to commodity risk is duly captured as required by Article 30 of this Regulation.

For the purposes of point (c), competent authorities shall verify whether the institution models two different commodities directly or captures the basis by means of a basis risk factor.

Article 29

Assessment of curves

(a) where required to assess curves whose points are risk factors as referred to in Article 4 of Delegated Regulation (EU) 2022/2060, paragraph 2 of this Article;

(b) where required to assess curves that have been modelled by means of function parameters as referred to in Article 6 of Delegated Regulation (EU) 2022/2060, paragraph 4 of this Article.

For the purposes of points (a) and (b), competent authorities shall assess the interpolation and extrapolation techniques used by the institution in accordance with paragraph 6.

(a) the institution’s internal policies have established criteria to decide on the numbers of risk factors to be used to model a curve, and that such criteria are based on the liquidity and materiality of the positions with exposure to that curve;

(b) the criteria referred to in point (a) are accompanied by an analysis showing that the number of risk factors used allows for the volatility across different tenors to be captured.

For the purposes of point (b), where the competent authority considers that the number of risk factors used to model a curve are not appropriate, competent authorities may complement their assessment using the assessment method referred to in paragraph 3.

(a) require the institution to apply scenarios of future shocks to the curve’s risk factors as made in the internal risk-measurement model;

(b) require the institution to derive the volatility of a point in the curve that is not a risk factor;

(c) require the institution to obtain the observed volatility of the point in the curve referred to in point (b);

(d) compare the volatility obtained in accordance with point (b) with the observed volatility obtained in accordance with point (c).

For the assessment referred to in paragraph 2, point (b), competent authorities shall base themselves on both the period referred to in Article 325bc(4), point (c), of Regulation (EU) No 575/2013 and the period of financial stress referred to in Article 325bc(2), point (c), of that Regulation.

(a) require the institution to apply scenarios of future shocks to the function parameters as made in the internal risk-measurement model;

(b) require the institution to derive the volatility of a point in the curve;

(c) require the institution to obtain the volatility of the point in the curve referred to in point (b);

(d) compare the volatility obtained in accordance with point (b) with the observed volatility obtained in accordance with point (c).

For that assessment, competent authorities shall base themselves on both the period referred to in Article 325bc(4), point (c), of Regulation (EU) No 575/2013 and the period of financial stress referred to in Article 325bc(2), point (c), of that Regulation.

Article 30

Assessment of implied volatility surfaces

(a) require the institution to provide a list of all the volatility surfaces towards which the institution’s portfolio is sensitive;

(b) require the institution to provide a sensitivity analysis of its portfolio towards each of the surfaces referred to in point (a);

(c) verify, based on the information referred to in points (a) and (b), whether any material basis risk between any two given surfaces is either implicitly captured by the fact that two surfaces are modelled directly, or by the fact that a basis surface representing the difference between those two curves is modelled;

(e) verify, in relation to surfaces that have been modelled by means of function parameters as referred to in Article 6 of Delegated Regulation (EU) 2022/2060, whether the institution’s internal policies include an analysis showing that shocking functions parameters allow for a comprehensive representation of the risk across the surface;

(f) assess whether interpolation and extrapolation techniques used by the institution to build a surface are sound and where part of the surface is derived by extrapolating its two outer points, verify whether the volatility of the returns observed in the market for the extrapolated part of the surface does not significantly differ from that resulting from the extrapolation.

For the purposes of point (a), the institution shall for each of the surfaces referred in that point specify whether it is modelled in its entirety directly, or whether it is modelled as a sum of a base surface and a basis surface.

For the purposes of point (d)(ii), competent authorities may, where appropriate, complement their assessment by using the assessment method referred to in paragraph 2.

For the purposes of point (e), competent authorities may, where appropriate, complement their assessment by using the assessment method referred to in paragraph 3.

For the purposes of point (f), competent authorities may apply the assessment method referred to in paragraphs 2 and 3 by picking a point in the surface obtained via extrapolation when applying points (b) of those paragraphs.

(a) require the institution to apply scenarios of future shocks to the surface’s risk factors as made in the internal risk-measurement model;

(b) require the institution to derive the volatility of a point of the surface that is not a risk factor;

(c) require the institution to obtain the observed volatility of the point in the surface referred to in point (b);

(d) compare the volatility obtained in accordance with point (b) with the observed volatility obtained in accordance with point (c).

For the assessment referred to in paragraph 1, point (d)(ii), competent authorities shall base themselves on both the period referred to in Article 325bc(4), point (c), of Regulation (EU) No 575/2013 and the period of financial stress referred to in Article 325bc(2), point (c), of that Regulation.

(a) require the institution to apply scenarios of future shocks to the function parameters as made in the internal risk-measurement model;

(b) require the institution to derive the volatility of a point of the surface;

(c) require the institution to obtain the observed volatility of the point in the surface referred to in point (b);

(d) compare the volatility obtained in accordance with point (b) with the observed volatility obtained in accordance with point (c).

For the assessment referred to in paragraph 1, point (e), competent authorities shall base themselves on both the period referred to in Article 325bc(4), point (c), of Regulation (EU) No 575/2013 and the period of financial stress referred to in Article 325bc(2), point (c), of that Regulation.

Article 31

Assessment of correlation risk factors

When assessing whether an institution’s internal risk-measurement model captures correlation risk as required by Article 325bh(1), point (b), of Regulation (EU) No 575/2013, competent authorities shall verify that, for multi-underlying options and any other products whose end-of-day value is determined via an implied correlation parameter, a risk factor capturing the risk of changes in the correlation parameter is included in the internal risk-measurement model.

The competent authority may identify options and products relying on an implied correlation parameter by using the information reported in accordance with Article 23 of this Regulation, and by identifying those factors that are correlation parameters.

Subsection 2

Assessment of the risk factors properties

Article 32

Assessment of the modellability of risk factors

(a) the internal policies cover the aspects referred to in Article 7 of Delegated Regulation (EU) 2022/2060 for all documentation;

(d) the internal policies set out criteria to determine whether the modellability assessment of a curve, surface, or cube is performed by using standard, pre-defined buckets as referred to in Article 5(2) of Delegated Regulation (EU) 2022/2060, or by using the institution’s own establishment of buckets as referred to in Article 5(4) of that Delegated Regulation;

(e) the internal policies set out the rationale of the choice, where the standard pre-defined buckets referred to in Article 5(2) of Delegated Regulation (EU) 2022/2060 are subdivided into smaller buckets in accordance with Article 5(3) of that Regulation.

For the purposes of points (b)(vii) and (viii), where the institution performs the modellability assessment for a risk factor by assessing the modellability of a set of buckets first, competent authorities shall verify whether the number of verifiable and representative prices are specified at the level of each of those buckets.

(c) in relation to the requirements for considering a verifiable price as representative of a risk factor as referred to in Article 3 of Delegated Regulation (EU) 2022/2060, verify whether the mapping process and the criteria used to determine the representativeness of a price for a risk factor as referred to in Article 7(1), point (d), of that Delegated Regulation are sound.

For the purposes of point (a)(ii), competent authorities shall verify whether the criteria referred to in paragraph 1, point (c) to identify whether risk factors are of the same type are sound and, by using the inventory referred to in paragraph 1, point (b), verify whether those criteria are applied correctly.

For the purposes of point (b)(i), competent authorities shall apply the assessment method referred to in paragraph 5.

For the purposes of point (c), competent authorities shall apply the assessment method referred to in paragraph 6.

(c) in relation to the requirements for allocating a verifiable price to a bucket as referred to in Article 4(4) of Delegated Regulation (EU) 2022/2060, verify whether the mapping process and the criteria referred to in Article 7(1), point (d), of that Regulation used to determine that a price is representative for a point in the bucket are sound;

For the purposes of point (b)(i), competent authorities shall apply the assessment method referred to in paragraph 5.

For the purposes of point (c), competent authorities shall apply the assessment method referred to in paragraph 7.

(c) in relation to the requirements for allocating a verifiable price to a bucket as referred to in Article 4(4) of Delegated Regulation (EU) 2022/2060, verify whether the mapping process and the criteria referred to in Article 7(1), point (d), of that Regulation used to determine that a price is representative for a point in the bucket are sound;

For the purposes of point (b)(i), competent authorities shall apply the assessment method referred to in paragraph 5.

For the purposes of point (c), competent authorities shall apply the assessment method referred to in paragraph 7.

For the purposes of this paragraph, competent authorities shall require institutions or third-party vendors as applicable to provide them with all information that they need to perform that assessment comprehensively, in accordance with Article 2(5), point (b), of Delegated Regulation (EU) 2022/2060.