Supervisory review and evaluation

(1) In the course of supervision, the supervisory authority assesses
1. the arrangements, strategies, procedures, and processes that an institution has established to comply with the supervisory requirements, and
2. the risks to which an institution is or may be exposed, in particular also the risks identified in stress tests, having regard to the nature, scale, and complexity of an institution's business activities. The Federal Institute cooperates with the Deutsche Bundesbank in this regard under section 7.
(2) On the basis of the review and evaluation, the supervisory authority assesses, comprehensively and prospectively, whether the arrangements, strategies, procedures, and processes established by an institution, and its liquidity and own funds resources, ensure sound risk management and adequate risk coverage. Besides credit risk, market risk, and operational risk, and the ESG risks affecting these and other types of risk in each case, it in particular has regard to
1. the results of the internal stress tests of an institution that uses an IRB approach or that uses an internal model to calculate the own funds requirements for market risk set out in Articles 362 to 377 of Regulation (EU) No 575/2013, as amended from time to time;
2. an institution's ability, on account of valuation adjustments made under Article 105 of Regulation (EU) No 575/2013, as amended from time to time, to dispose of or hedge its trading book positions in the short term, under normal market conditions, without material losses;
3. the extent to which an institution is exposed to risk concentrations, and their management by the institution, including compliance with the supervisory requirements, in particular with regard to the concentration risk arising from exposures to central counterparties, including the plans drawn up under section 26c(4a), point 7, and progress in adapting institutions' business models to the requirements set out in Article 7a of Regulation (EU) No 648/2012;
4. the impact of diversification effects, and the manner in which they are incorporated into an institution's risk measurement system;
5. the robustness, suitability, and manner of application of the principles and procedures that an institution has introduced for managing the risk that remains with the institution despite the use of recognised credit risk mitigation techniques;
6. the adequacy of the own funds that an institution holds for securitisations for which it is deemed the originator, having regard to the economic substance of the transaction and the degree of risk transfer achieved; in this connection, the supervisory authority monitors whether an institution provides implicit support to a transaction;
7. the liquidity risks to which an institution is exposed, and their assessment and management, including the development of alternative scenario analyses and effective contingency plans and the management of risk-mitigating factors, in particular the level, composition, and quality of liquidity buffers;
8. the results of supervisory stress tests under subsection (3) or under Article 32 of Regulation (EU) No 1093/2010;
9. the geographical distribution of an institution's risk exposures;
10. the business model;
11. an institution's interest rate risk arising from transactions not held in the trading book;
12. the procedures for determining and ensuring an institution's risk-bearing capacity under section 25a;
13. the risk of excessive leverage of an institution, as shown by the indicators of excessive leverage, which also includes the leverage ratio determined under Article 429 of Regulation (EU) No 575/2013, as amended from time to time; in assessing the adequacy of an institution's leverage ratio, and of the arrangements, strategies, procedures, and mechanisms introduced by the institution to manage the risk of excessive leverage, the supervisory authority has regard to the institution's business model;
14. the arrangements for ensuring the proper management of an institution's business, the manner of their implementation and practical application, and the ability of the members of the management body to perform their duties;
15. the ESG risk plan to be drawn up under section 26c(1), point 1, in conjunction with section 26d, and the institution's progress in handling ESG risks in its business organisation, in particular in its business and risk strategy and in risk management, having regard to the business model, any sustainability-related product offering, the institution's strategy for financing the transformation of the economy, related credit-processing guidelines, and targets, indicators, and limits in connection with ESG risks within the meaning of section 26c(4), point 2, and section 26d(1), point 3; the federal authorities and bodies responsible for matters of climate protection, transformation, and environmental, social, and governance factors support the Federal Institute, on request, in this assessment, and
16. an institution's credit spread risk arising from transactions not held in the trading book.
(3) The supervisory authority may subject an institution to supervisory stress tests, or, insofar as the Federal Institute is the supervisory authority, may instruct the Deutsche Bundesbank to do so. For this purpose, the supervisory authority, and, insofar as the Federal Institute is the supervisory authority, also the Deutsche Bundesbank, may
1. require the institution to calculate its risk, own funds, and liquidity positions using the institution's own risk management methods, applying scenarios prescribed by the supervisor, and to transmit the data and the results to the supervisory authority, the Deutsche Bundesbank, and, where the European Central Bank is the supervisory authority, also to the Federal Institute, and
2. determine the effects of shocks on the institution on the basis of supervisory stress-test methods, using the available data. Institutions and third parties that act in an advisory capacity for institutions in connection with stress tests must refrain from activities that could compromise a stress test.
(4) The supervisory authority determines the frequency and intensity of the reviews, evaluations, and any supervisory stress tests, having regard to the size, systemic importance, and the nature, scale, and complexity of an institution's business. The reviews and evaluations are updated at least once a year. In the review and evaluation under subsection (1), the supervisory authority applies the principle of proportionality in accordance with the criteria it has published. Insofar as the Federal Institute is the supervisory authority, it performs the tasks under the first sentence in coordination with the Deutsche Bundesbank.
(5) The supervisory authority may adapt the method of review and evaluation under subsection (1) to take account of institutions with a similar risk profile. The adapted method
1. may include risk-oriented benchmarks and quantitative indicators,
2. must allow appropriate account to be taken of specific risks to which an institution may be exposed, and
3. may not impair the institution-specific nature of orders issued in connection with the supervisory review and evaluation process, the ongoing review of the permission to use internal approaches, or to avert breaches of this Act or of the requirements of Regulation (EU) No 575/2013.